Return-Path: <new-httpd-owner-new-httpd-archive=hyperreal.org@apache.org>
Delivered-To: new-httpd-archive@hyperreal.org
Received: (qmail 9109 invoked by uid 6000); 23 Nov 1997 03:45:46 -0000
Received: (qmail 8995 invoked from network); 23 Nov 1997 03:45:43 -0000
Received: from scanner.worldgate.com (198.161.84.3)
  by taz.hyperreal.org with SMTP; 23 Nov 1997 03:45:43 -0000
Received: from znep.com (uucp@localhost)
	by scanner.worldgate.com (8.8.7/8.8.7) with UUCP id UAA22033
	for new-httpd@apache.org; Sat, 22 Nov 1997 20:45:42 -0700 (MST)
Received: from localhost (marcs@localhost) by alive.znep.com (8.7.5/8.7.3)
 with SMTP id UAA19492 for <new-httpd@apache.org>;
 Sat, 22 Nov 1997 20:44:10 -0700 (MST)
Date: Sat, 22 Nov 1997 20:44:10 -0700 (MST)
From: Marc Slemko <marcs@znep.com>
To: TLOSAP <new-httpd@apache.org>
Subject: Re: Getting ethernet packets content under FreeBSD?  (fwd)
Message-ID: <Pine.BSF.3.95.971122204309.18200N-100000@alive.znep.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: new-httpd-owner@apache.org
Precedence: bulk
Reply-To: new-httpd@apache.org

Anyone too lazy to hack tcpdump (eg. my tcpdump has a -X option to display
the data in ASCII) can use something like the below to grab HTTP headers
when debugging broken clients.

Nothing complicated, but handy.

---------- Forwarded message ----------
Date: Sat, 22 Nov 1997 14:35:23 PST
From: Bill Fenner <fenner@parc.xerox.com>
To: Nate Williams <nate@mt.sri.com>
Cc: bmah@ca.sandia.gov, hackers@FreeBSD.ORG
Subject: Re: Getting ethernet packets content under FreeBSD? 

I usually just use this perl script, which I call "tcpdumpscii".
Then run "tcpdumpscii -s 1500 -x [other tcpdump args]".

  Bill

#!/import/misc/bin/perl
#
#
open(TCPDUMP,"tcpdump -l @ARGV|");
while (<TCPDUMP>) {
	if (/^\s+(\S\S)+/) {
		$sav = $_;
		$asc = "";
		while (s/\s*(\S\S)\s*//) {
			$i = hex($1);
			if ($i < 32 || $i > 126) {
				$asc .= ".";
			} else {
				$asc .= pack(C,hex($1));
			}
		}
		$foo = "." x length($asc);
		$_ = $sav;
		s/\t/        /g;
		s/^$foo/$asc/;
	}
	print;
}