linux - 从 tcpdump 输出中删除不必要的字符

Question

我使用此命令来监视本地 (macOS) HTTP 流量:

sudo tcpdump -A -s 0 'tcp port 4444 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -i lo0

我发挥了魔法，但也输出了不必要的字符:

{"message":"body"}
14:29:07.725362 IP localhost.64258 > localhost.krb524: Flags [P.],seq 1004:1579, ack 469, win 11768, options [nop,nop,TS val 1448865401 ecr 1448865398], length 575 E..s..@.@..............\...^Z.>...-..h.....
V[.yV[.vPOST /v2/8387efc52b0b6b14e83bcd1d1951bdb2 HTTP/1.1
Content-Type: application/json; charset=utf-8

应该是:

{"message":"body"}

POST /v2/8387efc52b0b6b14e83bcd1d1951bdb2 HTTP/1.1
Content-Type: application/json; charset=utf-8

Answer 1

假设您显示的输入:

{"message":"body"}
14:29:07.725362 IP localhost.64258 > localhost.krb524: Flags [P.],seq 1004:1579, ack 469, win 11768, options [nop,nop,TS val 1448865401 ecr 1448865398], length 575 E..s..@.@..............\...^Z.>...-..h.....
V[.yV[.vPOST /v2/8387efc52b0b6b14e83bcd1d1951bdb2 HTTP/1.1
Content-Type: application/json; charset=utf-8

这行 sed :

sed -e 's#^\(.*\)\(\(\(GET\|POST\|PUT\|DELETE\|OPTIONS\)\) /.*$\)#\2#g' input.txt | grep -E '({|Content-Type|GET|POST|PUT|DELETE|OPTIONS)'

将输出:

{"message":"body"}
POST /v2/8387efc52b0b6b14e83bcd1d1951bdb2 HTTP/1.1
Content-Type: application/json; charset=utf-8

这是您需要的吗？