Page 1 of 1

packet sniffer?

PostPosted: 28. March 2013 15:01
by AndyS01
I have xampp installed on my laptop to do development that will eventually be released to our company server. On the company server, I can run Ethereal to monitor the GET requests and view detailed packet info. Is there a similar utility that allows me to see the xampp-apache GET requests and detailed packet info that I can run on my laptop? I have Ethereal installed on my laptop, but cannot configure it to do what I want.

Andy

Re: packet sniffer?

PostPosted: 28. March 2013 18:52
by JonB
uhh wireshark?

Re: packet sniffer?

PostPosted: 29. March 2013 15:56
by AndyS01
Wireshark asks me to choose an interface. There are 4 listed and I don't know which to use. I tried each one, but when I to a Refresh on my browser, nothing gets captured. I might not have setup the filtering correctly. I'm sure others have done this, but I can't get it working.

Re: packet sniffer?

PostPosted: 29. March 2013 21:57
by AndyS01
I fired off a message to the Wireshark forum and this is the answer they gave me:
Wireshark can't capture requests made to the local machine, that is if you run the browser on the same machine as the web server. This is because the MS network stack recognises that the packet is local so "short-circuits" the packet and the WinPCap driver that Wireshark uses to capture doesn't see the packet.

Re: packet sniffer?

PostPosted: 29. March 2013 21:59
by AndyS01
Perhaps I could modify one of the Apache php/perl files to intercept GET requests related to MiMe multipart handling and log the details to a log file.

Re: packet sniffer?

PostPosted: 29. March 2013 22:21
by JonB
Well - phpBB seems to have blown away my post -

I have a suggestion - try using the LAN IP of your XAMPP machine in both the Apache config and in your URL.

:)

Re: packet sniffer?

PostPosted: 30. March 2013 13:00
by AndyS01
I'm sorry to be obtuse but I need an explanation of your suggestion.
o By "LAN IP" do you mean "http://127.0.0.1"?
o And what files do I change to make sure it's in the Apache config?
o Also, by "in your URL", do you mean addressing my web stuff using "http://127.0.0.1/something.html" vs "http://localhost/something.html"?

Re: packet sniffer?

PostPosted: 30. March 2013 14:06
by AndyS01
Please let me explain exactly what I'm trying to do.

I'm trying to determine if the 'formenctype="multipart/form-data"' attribute is actually returning all of the requested data (usually, a file) in multiple packets (true multipart) or in one big packet (not multipart).

So looking at the browser GET requests only confirms that the browser is actually requesting multipart packets, but I want to see what the SERVER sends out.

Andy

Re: packet sniffer?

PostPosted: 30. March 2013 14:13
by Altrea
Hi AndyS01,

AndyS01 wrote:o By "LAN IP" do you mean "http://127.0.0.1"?

No. 127.0.0.1 is your loopback network interface.
Your LAN IP is the IP your computer uses to communicate with your network. Very common this is an private IP address.

AndyS01 wrote:o And what files do I change to make sure it's in the Apache config?

\xampp\apache\conf\httpd.conf

AndyS01 wrote:o Also, by "in your URL", do you mean addressing my web stuff using "http://127.0.0.1/something.html" vs "http://localhost/something.html"?

not 127.0.0.1, but your LAN IP address, yes.

best wishes,
Altrea

Re: packet sniffer?

PostPosted: 01. April 2013 00:39
by AndyS01
Thank you. I did as you suggested and I changed my web page
from http://localhost/mdg/home.xhtml
to http://<my ip address>/mdg/home.xhtml
Now I can go to all of my web content using the new addressing. However, I could not configure Wireshark to capture the server side GET requests. One problem was deciding which of the 4 interfaces to choose. I clicked on all 4 and got lots of messages logged, but none of the HTTP GET requests were there. Can you help me to the next step?

Andy