HTTP(1) Manual Page

Input

Packets containing HTTP traffic (typically TCP port 80)

Output

One record for each request-response pair between a client and a web server.

This tool parses HTTP traffic into records, which describe each individual web request.

HTTP Port

Controls the port on which HTTP traffic is detected. The most common value (and the default) is 80, but in some scenarios, HTTP traffic can be found on non-standard ports.

Include POST blob

Controls whether the actual content of posted data (e.g. submitted forms and uploaded files) are passed along as part of the output stream. Enabling this option has a small but noticeable effect on the tool cpu and memory usage.

Include content blob

Controls whether the actual content of downloaded files, such as html pages, images and similar is passed along as part of the output stream. This has a significant affect on the resource usage of the tool. Use with care!

Handle requests only

If this option is chosen, only the HTTP requests are parsed not their responses.