Using Tcpdump to count HTTP data features

Background: The network structure is a fixed IP as a gateway, the internal use of NAT, from the external data collection, storage as a CAP packet, hoping to get the internal network structure and related host information.

Technical route: Extract the host and cookie values from the HTTP header information to investigate its relevance.

What to do: Extract HTTP headers using tcpdump-> Each HTTP header information into one line-> filter the specified host Value-> Filter cookie Value-> Statistics

Tcpdump-a-VVV ' TCP ports and Ip[2:2]>40 and Tcp[tcpflags] & Tcp-push!=0 and DST Port-R ****.cap >htt P-head-1.txt

Dos2unix Http-head-1.txt

Cat http-head-1.txt|awk-v rs= "" ' Gsub ("\ n", "@");p rint} >http-head-2.txt

Replace the carriage return with @, combining each HTTP header message into a single line

Cat Http-head-2.txt|grep "Www.xxx.com" >http-head-3.txt

Awk-v rs= "" ' {gsub ("@", "\ n");p rint} ' Http-head-3.txt|grep "Cookie" |sort|uniq-c|sort-rn

Test down, may be due to limited data volume, the results are not ideal, I hope the generous comment of prawns.