Now I see and yes, it's a tcpdump-related issue. I run an older tcpdump (package for Slack 9.0), and it basically misses all beautifying around the raw data: the address-indicator at the beginning and the plain dump at the end of each line.
A quick hack could be the following. Please note that I'm currently not in the condition of testing it (momentarily in a Win32 environment):
#!/usr/bin/perl
$LIMIT = shift || 5000;
$|=1;
open (STDIN,"/usr/sbin/tcpdump -lnx -s 1024 dst port 80 |");
while (<>) {
if (/^\S/) {
last unless $LIMIT--;
while ($packet=~/(GET|POST|WWW-Authenticate|Authorization).+/g) {
print "$client -> $host\t$&\n";
}
undef $client; undef $host; undef $packet;
($client,$host) = /(\d+\.\d+\.\d+\.\d+).+ > (\d+\.\d+\.\d+\.\d+)/
if /P \d+:\d+\((\d+)\)/ && $1 > 0;
}
next unless $client && $host;
s/^\s+\S+\s+//; # remove initial address ind.
s/\s{2}.*//; # remove trailing dump
s/\s+//;
s/([0-9a-f]{2})\s?/chr(hex($1))/eg;
tr/\x1F-\x7E\r\n//cd;
$packet .= $_;
}
Flavio (perl -e 'print(scalar(reverse("\nti.xittelop\@oivalf")))')
Don't fool yourself.