I was wondering if its possible to capture all network traffic coming from a single website using tcpdump. I am interested in capturing the sizes of all incoming and outgoing packets from and to a certain website. However, something like tcpdump -n host washingtonpost.com will only (I tried this on the terminal) give the traffic coming from washingtonpost's directly resolved servers and not for example all the external CDNs, or the Advertising Servers et cetera. Since I do not know the IP addresses or hostnames of these servers beforehand, I cannot create a filter of somekind. Does anyone know of a way I could do this or whether this is indeed possible?Thanks.
How to capture traffic from an entire website (including external servers) using tcpdump
networking;tcpdump;packet
This is not possible. Why ? Communication-Protocol http/https is the key here. tcpdump is only designated to capture lower level protocol. There is no filter on tcpdump to analyze traffic in-flight and do a expansion on the filter. But this would be necessary to meat your requirements.You could use a Web-Proxy Cache or some other in the middle software. Also it is easy to impediment using Perl or Python scripts if HTTP would be the target. A little more work and in special with certificates in case of HTTPS. +-------------+     +------------+     +------------+| web-Browser |-----| HTTP/HTTPS |-----| HTTP/HTTPS |+-------------+     | Proxy      |     | Server     |                    +------------+     +------------+You can use iptables on Linux do redirect all traffice to target port 80/443 to the web-proxy/man in the middle-program/script or use the proxy-parameter on you web-browser.