read ajp13 packet contents on terminal using tshark 1.4.15

tshark -r *.eth -S -R "ajp13" -d tcp.port==9009,ajp13 -s 0 -l -V | awk '/Apache JServ/ {p=1} /^ *$/ {p=0;printf "\n"} (p){printf "%s\n", $0} /^(Frame|Internet Pro|Transmission Control)/ {print $0}'
if you have a capture file *.eth, and ajp protocol is in use on port 9009, you can paste the above command. You can change the fiile and port name
Sample Output
Frame 9: 928 bytes on wire (7424 bits), 928 bytes captured (7424 bits)
Internet Protocol, Src: 127.0.0.1 (127.0.0.1), Dst: 127.0.0.1 (127.0.0.1)
Transmission Control Protocol, Src Port: 39823 (39823), Dst Port: pichat (9009), Seq: 1, Ack: 1, Len: 860
Apache JServ Protocol v1.3
    Magic: 1234
    Length: 856
    Code: (2) FORWARD REQUEST
    Method: (2) GET
    Version: HTTP/1.1
    URI: /abcd
    RADDR: 10.50.12.3
    RHOST: 
    SRV: s.com
    PORT: 443
    SSLP: 1
    NHDR: 10
    user-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CL
R 3.5.21022)
    accept-encoding: gzip, deflate
    accept-language: en-us
    accept: */*
    connection: Keep-Alive
    host: s.com:8235
    cookie: JSESSIONID=D7FD2C7E64995549ABE05776BE01E2EF

0
2013-01-10 21:12:51

These Might Interest You

  • Very useful for interactive scripts where you would like to return the terminal contents to its original state before the script was run. This would be similar to how vi exits and returns you to your original terminal screen. Save and clear the terminal contents with: tput smcup Execute some commands, then restore the saved terminal contents with: tput rmcup


    8
    tput smcup; echo "Doing some things..."; sleep 2; tput rmcup
    jgc · 2009-10-08 16:48:04 2
  • This captures traffic on a remote machine with tshark, sends the raw pcap data over the ssh link, and displays it in wireshark. Hitting ctrl+C will stop the capture and unfortunately close your wireshark window. This can be worked-around by passing -c # to tshark to only capture a certain # of packets, or redirecting the data through a named pipe rather than piping directly from ssh to wireshark. I recommend filtering as much as you can in the tshark command to conserve bandwidth. tshark can be replaced with tcpdump thusly: ssh root@example.com tcpdump -w - 'port !22' | wireshark -k -i -


    30
    ssh root@server.com 'tshark -f "port !22" -w -' | wireshark -k -i -
    markdrago · 2009-12-17 23:03:24 2
  • trace http requests on the specified interface. uses the amazing tshark tool (http://www.wireshark.org/docs/man-pages/tshark.html) Show Sample Output


    0
    tshark -i en1 -z proto,colinfo,http.request.uri,http.request.uri -R http.request.uri
    lele · 2011-04-05 14:18:35 0
  • Read all contents from current directory and display to stdout.


    -6
    while read f;do echo "$f";done < <(find .)
    unixmonkey8504 · 2010-03-02 14:22:22 0

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands



Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: