httpry 截取 HTTP 封包，類似 tcpdump 、ngrep 工具

httpry 是直接截取過濾 80 port HTTP 的封包，不用像 tcpdump 、ngrep 還要額外處理

httpry 需要 libpcap，我在 CentOS6 上測試，安裝 libpcap-devel

yum install libpcap-devel.x86_64

下載、編譯 httpry

cd /root/
wget https://github.com/jbittel/httpry/archive/master.zip
unzip master.zip
cd httpry-master
make

我直接在該目錄執行，暫不安裝

-i 選擇要被截取的網卡

./httpry -i eth0

httpry version 0.1.8 -- HTTP logging and information retrieval tool
Copyright (c) 2005-2014 Jason Bittel <[email protected]>
Starting capture on eth0 interface
2014-09-04 09:46:03     1.1.1.1			1.1.1.1		    >       GET     www.xxxxxx.com /photos/798227086537500_L.jpg        HTTP/1.1        -       -
2014-09-04 09:46:03     1.1.1.1			1.1.1.1		    < - - - HTTP/1.1 200 OK 2014-09-04 09:46:03 1.1.1.1 1.1.1.1 >       GET     www.xxxxxx.com /photos/953637441213800_L.png        HTTP/1.1        -       -
^CCaught SIGINT, shutting down...
858 packets received, 0 packets dropped, 14 http packets parsed
51480.0 packets/min, 840.0 http packets/min

或者選擇要看 GET 或 POST

./httpry -i eth0 -m POST

在 script 目錄裡有支 parse_log.pl 可以計算 httpry 截取封包後的記錄把它 summary 一下

# 因為會產生很多檔案，所以額外目錄存放
mkdir /root/test
cd /root/test
# -o 輸出截取資料
/root/httpry-master/httpry -i eth0 -o wow.txt
# 指定檔案
perl /root/httpry-master/scripts/parse_log.pl /root/httpry-master/scripts/plugins/ wow.txt

產生很多檔案，但對我有用的只有 log_summary.txt

LOG SUMMARY

Generated:      Thu Sep  4 09:48:56 2014
Total lines:    36
Total run time: 0.0 secs


REQUESTS BY HOUR

  0%   0%   0%   0%   0%   0%   0%   0%   0% 100%   0%   0%
  |----|----|----|----|----|----|----|----|----|----|----|
 00   01   02   03   04   05   06   07   08   09   10   11

  0%   0%   0%   0%   0%   0%   0%   0%   0%   0%   0%   0%
  |----|----|----|----|----|----|----|----|----|----|----|
 12   13   14   15   16   17   18   19   20   21   22   23


15/6 VISITED HOSTS

12      70.6%   www.xxxxx.com
1       5.9%    www.11111.org.tw
1       5.9%    18.13.22.1
1       5.9%    webmail.fffffffffffff.com
1       5.9%    wwwwwwwwwwwww.tw
1       5.9%    fffffffff.com


15/10 TOP TALKERS

6       35.3%   1.1.1.1
3       17.6%   2.2.2.2
1       5.9%    3.3.3.3
1       5.9%    4.4.4.4
1       5.9%    5.5.5.5
1       5.9%    6.6.6.6
1       5.9%    7.7.7.7
1       5.9%    8.8.8.8
1       5.9%    9.9.9.9
1       5.9%    11.11.11.11


15/4 RESPONSE CODES

13      68.4%   200
4       21.1%   304
1       5.3%    302
1       5.3%    404


15/5 FILE EXTENSIONS

7       50.0%   js
4       28.6%   php
1       7.1%    css
1       7.1%    xsql
1       7.1%    png