I need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body.I have found that tcpdump captures all the requests, but big ones end up being split into multiple frames and is not easy to patch them together with a script that uses libpcap.tcpflow almost does what I need, but it puts the whole flow between the host/client in the same file, without a good token to separate them making it impossible to know when a request ended and other started automatically.Wireshark has the follow http option, but I couldn't find a way to use tshark to export one file for each flow.Any suggestions?
How to capture http requests headers and body
http;tcpdump;wireshark