On Wed, Nov 19, 2008 at 08:18:00PM -0800, Jeff Simmons wrote: > I need, at a minimum, which virtual server at a particular IP address is > being > accessed, and the contents of any GET commands (methods). If there's a way to > get this via tcpdump I haven't found it yet.
Just increase the snaplen. tcpdump -s 65000 -w dump port 80 ^C when you're done and vim the dump. Raw packets but you'll see the GET in there.
