Running a network trace on the command line using tcpflow

Detailed intructions on how to run a network trace on the Linux command line using the tcpflow tool.

Network trace tools like Wireshark are amazing for debugging request/response cycles between your clients and your web servers, allowinh you to inspect each request and response in detail. However, usually in a production environment you will not have a window envrionment to run Wireshark, instead you will just have a command line interface. You can use tcpdump (which comes with most versions of Linux by default) to generate a .pcap file that you can then inspect offline with Wireshark on a machine that does have a window environment installed on, however this process is not realtime and is a little cumbersome.

The tcpflow tool is usally not installed by default, however it should be available in most Linux repositories for easy install. For example on CentOS/RHEL/Fedora, the following command will install it for you:

root$ yum install tcpflow

If it is not available in a repository you have configured, you can download an .rpn file from here:

http://pkgs.repoforge.org/tcpflow/

For example to install it on 64bit CentOS 6:

root$ yum install --nogpgcheck http://pkgs.repoforge.org/tcpflow/tcpflow-0.21-1.2.el6.rf.x86_64.rpm

Once installed, you can then run the following command to get a live trace tailed to your command line, replacing the list of HTTP verns to suit your needs:

root$ tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*'

You will also need to ensure that if your network card is not named eth0, then place the correct name after the -i flag instead.

Sample output:

root$ tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*'
tcpflow[31437]: listening on eth0
GET / HTTP/1.1
Host: www.alphadevx.com
GET //alpha/css/alpha.css HTTP/1.1
Host: www.alphadevx.com
GET //config/css/overrides.css HTTP/1.1
Host: www.alphadevx.com
GET /lib/luminous/style/luminous.css HTTP/1.1
Host: www.alphadevx.com
GET /lib/luminous/style/luminous_light.css HTTP/1.1
Host: www.alphadevx.com
GET //alpha/lib/jquery/jquery-1.5.1.min.js HTTP/1.1
Host: www.alphadevx.com
GET /images/bookshelf.png HTTP/1.1
Host: www.alphadevx.com
GET /alpha/images/icons/feed.png HTTP/1.1
Host: www.alphadevx.com
GET /alpha/images/icons/twitter.png HTTP/1.1
Host: www.alphadevx.com
GET /alpha/images/icons/page_go.png HTTP/1.1
Host: www.alphadevx.com
GET /favicon.ico HTTP/1.1
Host: www.alphadevx.com
GET /search/q/digest HTTP/1.1
Host: www.alphadevx.com
GET /search/q/test HTTP/1.1
Host: www.alphadevx.com
...

Once you are finished with the trace, press ctrl-c to exit.

John Collins

I have been writing about web technology and software development since 2001. I am the developer of the Alpha Framework for PHP, and the five.today personal productivity app. I love open source, technology, and economics.