testing/watch-port-80.sh

   1 #!/bin/sh
   2
   3 PORT=${1:-"80"}
   4 IFACE=${2:-"any"}
   5 IP=${3:-""}
   6
   7 # Only include packets that contain data
   8 NOTSYNFIN=" and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)"
   9 DUMP="tcp port ${PORT}"
  10
  11 IPCLAUSE=""
  12 if [ "${IFACE}" != "any" ]; then
  13   if [ -z "${IP}" ]; then
  14     IP="`ip addr show dev ${IFACE} | grep ' inet ' | tr -s ' ' | cut -f3 -d' ' | cut -f1 -d'/'`"
  15   fi
  16   IPCLAUSE=" and ((src host ${IP} and src port ${PORT}) or (dst host ${IP} and dst port ${PORT}))"
  17 fi
  18
  19 DUMPFILE="dumps/`date '+%FT%T'`.dump"
  20
  21 # touch "${DUMPFILE}"
  22 sudo tcpdump -i $IFACE -s0 -l -n -q -A "${DUMP}${NOTSYNFIN}${IPCLAUSE}" >"${DUMPFILE}" 2>&1 &
  23 DUMPPID="$!"
  24
  25 less "${DUMPFILE}"
  26
  27 sudo kill "${DUMPPID}"
  28
  29 if [ "`stat --format='%s' \"${DUMPFILE}\"`" -le 230 ] ; then
  30   rm "${DUMPFILE}"
  31 fi