Debugging web apps using tcpdump and Wireshark

Debugging AJAX calls can be a pain, especially when they use POSTs that hide the variable values from view. Normally, I’d just use Firebug, the best web development tool since the browser itself. Unfortunately, calls to my Facebook application are all routed through Facebook’s servers, rendering Firebug useless.

Now, when I run into a sticky AJAX problem, I rely on tcpdump and Wireshark.

To capture the traffic:

  1. On the web server, run: /usr/sbin/tcpdump -A -s 0 port 80 -w capture.dump This command will capture all traffic on port 80 and output it to capture.dump in a format that Wireshark will be able to analyse.
  2. Access the web page of interest or click the button/link to run the AJAX call.
  3. Stop capturing on the web server by hitting Ctrl-C.

To analyse the traffic:

  1. Download the capture.dump file to the machine that runs Wireshark.
  2. Open capture.dump in Wireshark.
  3. Right click on any packet and select “Follow TCP Stream”.

To inspect another stream, you will have to clear the filter (in the toolbar).

Leave your thoughts
  • You can use some HTML in your comment.
  • Your comment may not display immediately due to spam filtering. Please wait for moderation.