As far as I know a HTTP request and response constructs one TCP connection. To debug a web application on a GUI-less server, I'd like to be able to capture these TCP streams in a single distinguishable entity (same color, file, db record, anything).tcpdump can only save IP packets as they arrive or leave, with no ordering or reassembling. tcpflow goes one step further to reassemble TCP connections in separate files, but puts send and receive streams in separate files, which makes quick debugging annoying. I'm sure I can write a script or even one-liner to merge related files, but I'm guessing a wrapper around tcpflow for this job could introduce complexities which wouldn't exist inside tcpflow. Also I'm lazy and looking for a cleaner solution.Any suggestions would be appreciated.
Capture web traffic grouped by individual TCP streams
networking;http;tcpdump
You could copy (or stream) the pcap file to your desktop and use the Wireshark GUI for packet analysis. Besides the GUI, there is also the tshark command (included with Wireshark). Given a stream number, you can get its requests and responses combined in a single output with:$ tshark -q -r http.pcapng -z follow,tcp,ascii,1===================================================================Follow: tcp,asciiFilter: tcp.stream eq 1Node 0: 10.44.1.8:47833Node 1: 178.21.112.251:8077GET / HTTP/1.1User-Agent: curl/7.37.0Host: lekensteyn.nlAccept: */*        356HTTP/1.1 302 Moved TemporarilyServer: nginx/1.4.7Date: Sun, 29 Jun 2014 10:24:34 GMTContent-Type: text/htmlContent-Length: 160Connection: keep-aliveLocation: https://lekensteyn.nl/<html><head><title>302 Found</title></head><body bgcolor=white><center><h1>302 Found</h1></center><hr><center>nginx/1.4.7</center></body></html>===================================================================Refer to the manual page of tshark for more details. Basically, -q suppresses the normal packet display, -r http.pcapng selects the capture file and -z follow,... is the equivalent of the Follow TCP Stream in the GUI. Unfortunately, you must repeat this command for every stream, not really ideal.As for streaming a connection to the Wireshark GUI, you could use this command:ssh you@server 'tcpdump -w - tcp port 80' | wireshark -i - -kIf this is still not what you are looking for, then you could consider setting up a proxy and then logging everything through that proxy.