How to monitor incoming http requests

Question

How can I monitor incoming HTTP requests to port 80? I have set up web hosting on my local machine using DynDNS and Nginx. I wanted to know how many request are made on my server every day.

Currently I'm using this command:

netstat -an | grep 80

score 48 · Answer 1 · edited Apr 13 '17 at 12:13

48

You may use tcpdump.

# tcpdump filter for HTTP GET 
sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

# tcpdump filter for HTTP POST 
sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

For a solution using tshark see:

https://serverfault.com/questions/84750/monitoring-http-traffic-using-tcpdump

edited Apr 13 '17 at 12:13

Community

1

answered Aug 26 '11 at 13:14

nad

481
3
2

That's so helpful. Is there something similar for thrift messages? – Darth Egregious Jul 27 '15 at 20:44
4

What about https? – FooBar Mar 02 '18 at 14:22

score 7 · Answer 2 · edited Jun 11 '20 at 12:04

7

I've been using tcpflow to check incoming requests at aws instances, maybe there's a way to aggregate requests daywise.

STEP 1 - installation

# yum install --nogpgcheck http://pkgs.repoforge.org/tcpflow/tcpflow-0.21-1.2.el6.rf.x86_64.rpm

STEP 2 - track GET/POST requests at port 80

# tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*'

Reference

https://github.com/simsong/tcpflow

edited Jun 11 '20 at 12:04

Community

1

answered Jul 25 '14 at 14:29

prayagupa

4,797
12
32
38

For Ubuntu it's: sudo apt install tcpflow Also on Ubuntu the "eth0" is named something like "ens33". You can use ifconfig command to see the name of your ethernet adaptor. – nivs1978 Apr 24 '19 at 10:01

score 6 · Answer 3 · answered Aug 26 '11 at 13:10

6

Do you have log files turned on for your server? If you do, I'd recommend installing AwStats and running your log files with it to get accurate reporting.

If you want to just monitor all incoming/outgoing traffic, you can use WireShark.

answered Aug 26 '11 at 13:10

djsumdog

820
2
9
16

score 4 · Answer 4 · answered Aug 26 '11 at 14:39

4

You can also tail the log file:

tail -f /path/to/access_log

The -f parameter will cause tail to continually update the screen as new entries are written to the log.

answered Aug 26 '11 at 14:39

Dave

230
1
4

score 1 · Answer 5 · answered May 26 '16 at 19:40

Run this

while true
do
echo -----`date '+%r'` -----:
netstat -ant | grep :8080 | awk '{print $6}' | sort | uniq -c | sort -n
echo httpd processes: [`ps aux | grep httpd | wc -l`]
echo .
sleep 2
done

It will monitor traffic on 8080 port every 2 seconds

How to monitor incoming http requests

5 Answers5

Reference