read ajp13 packet contents on terminal using tshark 1.4.15

tshark -r *.eth -S -R "ajp13" -d tcp.port==9009,ajp13 -s 0 -l -V | awk '/Apache JServ/ {p=1} /^ *$/ {p=0;printf "\n"} (p){printf "%s\n", $0} /^(Frame|Internet Pro|Transmission Control)/ {print $0}'
if you have a capture file *.eth, and ajp protocol is in use on port 9009, you can paste the above command. You can change the fiile and port name
Sample Output 
Frame 9: 928 bytes on wire (7424 bits), 928 bytes captured (7424 bits)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 39823 (39823), Dst Port: pichat (9009), Seq: 1, Ack: 1, Len: 860
Apache JServ Protocol v1.3
    Magic: 1234
    Length: 856
    Code: (2) FORWARD REQUEST
    Method: (2) GET
    Version: HTTP/1.1
    URI: /abcd
    RADDR: 10.50.12.3
    RHOST: 
    SRV: s.com
    PORT: 443
    SSLP: 1
    NHDR: 10
    user-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CL
R 3.5.21022)
    accept-encoding: gzip, deflate
    accept-language: en-us
    accept: */*
    connection: Keep-Alive
    host: s.com:8235
    cookie: JSESSIONID=D7FD2C7E64995549ABE05776BE01E2EF

0
By: tsureshkumar
2013-01-10 21:12:51
awk printf tshark
0
Submit An Alternative

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands

Similar Commands

Using tput to save, clear and restore the terminal contents

analyze traffic remotely over ssh w/ wireshark

trace http requests with tshark

Send packet by ping

Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: