How to monitor incoming http requests

monitoringweb

How can I monitor incoming HTTP requests to port 80? I have set up web hosting on my local machine using DynDNS and Nginx. I wanted to know how many request are made on my server every day.

Currently I'm using this command:

netstat -an | grep 80

Best Answer

You may use tcpdump.

# tcpdump filter for HTTP GET 
sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

# tcpdump filter for HTTP POST 
sudo tcpdump -s 0 -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

For a solution using tshark see:

https://serverfault.com/questions/84750/monitoring-http-traffic-using-tcpdump

Related Solutions

On-the-fly monitoring HTTP requests on a network interface

Try tcpflow:

tcpflow -p -c -i eth0 port 80 | grep -oE '(GET|POST|HEAD) .* HTTP/1.[01]|Host: .*'

Output is like this:

GET /search?q=stack+exchange&btnI=I%27m+Feeling+Lucky HTTP/1.1
Host: www.google.com

You can obviously add additional HTTP methods to the grep statement, and use sed to combine the two lines into a full URL.

Debian – Monitor and Log Network Traffic

ntop is probably your best solution for doing this. It is designed to run long term and capture exactly what youre looking for.
It can show you what remote destinations are being used the most, how much traffic sent to/from, what protocols and ports were being used etc. It can do the same for the source hosts if you run it on a router so you can see the same stats on local clients as well.
It then uses a web GUI to navigate and display this information.

ntop

Best Answer

Related Solutions

On-the-fly monitoring HTTP requests on a network interface

Debian – Monitor and Log Network Traffic

Related Question