Monitor All HTTP Requests (like TCPdump) On a Linux Server with httpry

Wouldn't it be really cool if you could run a tool like tcpdump and see all HTTP requests flowing over the network, in a readable form?

Because let's be honest, something like this is far from readable.

$ tcpdump -i eth0 port 80 -A
20:56:08.793822 IP 172.28.128.1.49781 > 172.28.128.3.http: Flags [S], seq 1641176060, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 1225415667 ecr 0,sackOK,eol], length 0
E..@V.@.@............u.Pa.[..........-.............
...

It tells you that something is flowing over the wire, but you sure as hell can't read what is going over it. You recognise keywords, but that's it.

There are tools out there that do a better job, like httpry.

It's been around long enough to be present in most repositories on Linux servers by now. Install it via your package manager of choice.

$ yum install httpry
$ apt-get install httpry

After you have it installed, you can run it on your server and sniff for HTTP calls.

$ httpry -i eth0
172.28.128.1  172.28.128.3  >  HEAD  ma.ttias.be  /  HTTP/1.1  -    -
172.28.128.3  172.28.128.1  <  -     -            -  HTTP/1.1  301  Moved Permanently

To output above is the result of the following HTTP call.

$ curl -I 172.28.128.3 -H "Host: ma.ttias.be"

It did a HEAD request (-I) and got a 301 HTTP redirect back.

Want to see how many HTTP requests are flowing through per second and which vhost is the most active? Start httpry with the -s parameter.

$ httpry -i eth0 -s
...
2015-08-06 21:06:56	infinite-download.ma.ttias.be	19 rps
2015-08-06 21:06:56	enginehack.ma.ttias.be	61 rps
2015-08-06 21:06:56	totals	30.69 rps
2015-08-06 21:07:01	infinite-download.ma.ttias.be	21 rps
2015-08-06 21:07:01	enginehack.ma.ttias.be	56 rps
2015-08-06 21:07:01	totals	32.41 rps

Every 5 seconds, the output shows the requests made in that last interval. It shows the Host: headers used in that request and the amount of requests that were received.

While it doesn't work on HTTPS requests, it is a useful tool to have in your arsenal.