参考： https://linuxwiki.github.io/NetTools/tcpdump.html
1.参考如下：
2.10、抓HTTP GET数据
tcpdump -i eth1 'tcp[(tcp[12]>>2):4] = 0x47455420'
结果如下：
[mextest@gdswarm3 ~]$ sudo tcpdump 'tcp[(tcp[12]>>2):4] = 0x47455420'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
11:59:52.818166 IP 172.21.14.11.45322 > 172.21.64.3.sds: Flags [P.], seq 1972651900:1972652447, ack 2495722689, win 229, options [nop,nop,TS val 1671880463 ecr 2818731487], length 547
11:59:52.818852 IP gdswarm3.48120 > ec2-52-80-47-238.cn-north-1.compute.amazonaws.com.cn.http: Flags [P.], seq 3346597785:3346598220, ack 2860074991, win 1418, options [nop,nop,TS val 2818731490 ecr 170996910], length 435: HTTP: GET /tkio/uqEBf2a?clickid=154769759281845261636r1547697592818452616rd585e4c22&idfa=B89C42A7-B7A4-49A6-92E7-F914FF36B2D7&ip=220.202.134.160&subchannel=3&callback=http%3A%2F%2Fcallback.gdtrafficad.com%2Fe%3Fclickid%3D154769759281845261636r1547697592818452616rd585e4c22%26idfa%3DB89C42A7-B7A4-49A6-92E7-F914FF36B2D7%26ip%3D220.202.134.160%26ename%3Dfopen HTTP/1.1
11:59:54.053315 IP 100.116.223.139.26303 > gdswarm3.glrpc: Flags [P.], seq 3403863266:3403863774, ack 2470168070, win 57, options [nop,nop,TS val 1183745830 ecr 2818732724], length 508
11:59:55.762365 IP 100.116.223.240.27715 > gdswarm3.glrpc: Flags [P.], seq 4240517049:4240517562, ack 1147427769, win 57, options [nop,nop,TS val 4264356563 ecr 2818734434], length 513
11:59:55.763176 IP gdswarm3.48120 > ec2-52-80-47-238.cn-north-1.compute.amazonaws.com.cn.http: Flags [P.], seq 435:868, ack 433, win 1418, options [nop,nop,TS val 2818734434 ecr 170998885], length 433: HTTP: GET /tkio/uqEBf2a?clickid=154769759576274979136r1547697595762749791rd585e4c22&idfa=0290E3F3-B2BA-47BC-B3E8-5019334ED35A&ip=202.204.188.87&subchannel=3&callback=http%3A%2F%2Fcallback.gdtrafficad.com%2Fe%3Fclickid%3D154769759576274979136r1547697595762749791rd585e4c22%26idfa%3D0290E3F3-B2BA-47BC-B3E8-5019334ED35A%26ip%3D202.204.188.87%26ename%3Dfopen HTTP/1.1
2. 改进，使用-n 显示 ip和端口，而不是域名和应用协议：
[mextest@gdswarm3 ~]$ sudo tcpdump -n 'tcp[(tcp[12]>>2):4] = 0x47455420'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:00:24.145337 IP 172.21.4.3.57562 > 172.21.64.3.sds: Flags [P.], seq 2139347705:2139348902, ack 2780941484, win 229, options [nop,nop,TS val 1671904886 ecr 2818762816], length 1197
12:00:26.702886 IP 172.21.14.11.51324 > 172.21.64.3.sds: Flags [P.], seq 4214548473:4214549019, ack 390493388, win 229, options [nop,nop,TS val 1671914348 ecr 2818765373], length 546
12:00:27.373326 IP 172.21.4.3.57152 > 172.21.64.2.sds: Flags [P.], seq 1693393385:1693393932, ack 2791190339, win 229, options [nop,nop,TS val 1671908114 ecr 2818766044], length 547
12:00:27.373906 IP 172.17.0.195.49422 > 54.222.129.161.http: Flags [P.], seq 1824846028:1824846461, ack 2805218235, win 1376, options [nop,nop,TS val 2818766045 ecr 152155086], length 433: HTTP: GET /tkio/uqEBf2a?clickid=154769762737355609836r1547697627373556098rd585e4c22&idfa=144A32D6-7BD8-4CA1-8C9F-8A66AAF8442A&ip=115.196.194.47&subchannel=3&callback=http%3A%2F%2Fcallback.gdtrafficad.com%2Fe%3Fclickid%3D154769762737355609836r1547697627373556098rd585e4c22%26idfa%3D144A32D6-7BD8-4CA1-8C9F-8A66AAF8442A%26ip%3D115.196.194.47%26ename%3Dfopen HTTP/1.1
12:00:27.673767 IP 100.116.223.171.9474 > 172.17.0.195.glrpc: Flags [P.], seq 1041274690:1041275412, ack 52583168, win 57, options [nop,nop,TS val 145857207 ecr 2818766345], length 722
12:00:27.674152 IP 172.21.64.5.56838 > 172.21.4.2.monkeycom: Flags [P.], seq 500122362:500123118, ack 1636957615, win 229, options [nop,nop,TS val 2818766345 ecr 1671908415], length 756
3. use tcp to filter only get request and show HEX data
[mextest@gdswarm3 ~]$ sudo tcpdump 'tcp[(tcp[12]>>2):4] = 0x47455420' -n -s 0 -X -l |grep -A 10 "price"
result
0x0330: 2670 7269 6365 3d4d 5445 314e 4463 324f &price=MTE1NDc2O
0x0340: 5459 334d 7a45 304d 5452 784d 5463 7959 TY3MzE0MTRxMTcyY
0x0350: 5449 7959 5455 3159 546b 7963 5459 794e TIyYTU1YTkycTYyN
0x0360: 4842 7743 465a 5643 5649 4841 6755 334e HBwCFZVCVIHAgU3N
0x0370: 544d 315a 5468 6c4e 7725 3344 2533 4420 TM1ZThlNw%3D%3D.
0x0380: 4854 5450 2f31 2e31 0d0a 5265 6d6f 7465 HTTP/1.1..Remote
0x0390: 4970 3a20 3232 302e 3131 322e 3132 312e Ip:.220.112.121.
0x03a0: 3237 0d0a 486f 7374 3a20 6d6f 6e69 746f 27..Host:.monito
0x03b0: 722e 6764 7472 6166 6669 6361 642e 636f r.gdtrafficad.co
0x03c0: 6d0d 0a58 2d46 6f72 7761 7264 6564 2d46 m..X-Forwarded-F
0x03d0: 6f72 3a20 3232 302e 3131 322e 3132 312e or:.220.112.121.
--
0x0330: 7461 6749 643d 3139 3833 2670 7269 6365 tagId=1983&price
0x0340: 3d4d 5445 314e 4463 324f 5459 334e 7a4d =MTE1NDc2OTY3NzM
0x0350: 334f 444a 784d 5463 7959 5449 7959 5455 3ODJxMTcyYTIyYTU
0x0360: 3159 5445 7a4e 4845 314e 7a52 7755 6763 1YTEzNHE1NzRwUgc
0x0370: 4643 5168 5843 564d 774d 6a6c 6d4d 6a41 FCQhXCVMwMjlmMjA
0x0380: 335a 6725 3344 2533 4420 4854 5450 2f31 3Zg%3D%3D.HTTP/1
0x0390: 2e31 0d0a 5265 6d6f 7465 4970 3a20 3232 .1..RemoteIp:.22
0x03a0: 332e 3734 2e32 3335 2e37 0d0a 486f 7374 3.74.235.7..Host
0x03b0: 3a20 6d6f 6e69 746f 722e 6764 7472 6166 :.monitor.gdtraf
0x03c0: 6669 6361 642e 636f 6d0d 0a58 2d46 6f72 ficad.com..X-For
0x03d0: 7761 7264 6564 2d46 6f72 3a20 3232 332e warded-For:.223.
--
0x02e0: 643d 3132 2d33 2670 7269 6365 3d36 5366 d=12-3&price=6Sf
0x02f0: 7363 7353 5a4a 644a 626c 6874 314b 3144 scsSZJdJblht1K1D
0x0300: 4d35 6963 4730 416d 4f30 5953 3563 4677 M5icG0AmO0YS5cFw
0x0310: 726d 4652 6275 6651 3d20 4854 5450 2f31 rmFRbufQ=.HTTP/1
0x0320: 2e31 0d0a 5265 6d6f 7465 4970 3a20 3131 .1..RemoteIp:.11
0x0330: 312e 3530 2e31 3034 2e39 330d 0a48 6f73 1.50.104.93..Hos
0x0340: 743a 206d 6f6e 6974 6f72 2e67 6474 7261 t:.monitor.gdtra
0x0350: 6666 6963 6164 2e63 6f6d 0d0a 582d 466f fficad.com..X-Fo
0x0360: 7277 6172 6465 642d 466f 723a 2031 3131 rwarded-For:.111
0x0370: 2e35 302e 3130 342e 3933 0d0a 436f 6e6e .50.104.93..Conn
0x0380: 6563 7469 6f6e 3a20 636c 6f73 650d 0a61 ection:.close..a
--
0x0330: 2670 7269 6365 3d4d 5445 314e 4463 324f &price=MTE1NDc2O
0x0340: 5459 344d 6a55 794d 7a52 784d 5463 7959 TY4MjUyMzRxMTcyY
0x0350: 5449 7a59 5455 3059 5445 334d 3345 784e TIzYTU0YTE3M3ExN
0x0360: 6a5a 7741 565a 5341 5651 4256 564d 305a jZwAVZSAVQBVVM0Z
0x0370: 446c 684e 5459 324e 6725 3344 2533 4420 DlhNTY2Ng%3D%3D.
0x0380: 4854 5450 2f31 2e31 0d0a 5265 6d6f 7465 HTTP/1.1..Remote
0x0390: 4970 3a20 3131 352e 3536 2e31 3736 2e31 Ip:.115.56.176.1
0x03a0: 3933 0d0a 486f 7374 3a20 6d6f 6e69 746f 93..Host:.monito
0x03b0: 722e 6764 7472 6166 6669 6361 642e 636f r.gdtrafficad.co
0x03c0: 6d0d 0a58 2d46 6f72 7761 7264 6564 2d46 m..X-Forwarded-F
0x03d0: 6f72 3a20 3131 352e 3536 2e31 3736 2e31 or:.115.56.176.1
0x0340: 7072 6963 653d 4d54 4531 4e44 6332 4f54 price=MTE1NDc2OT
0x0350: 5934 4e6a 6733 4d54 5678 4d54 6379 5954 Y4Njg3MTVxMTcyYT
0x0360: 4979 5954 5531 5954 4577 4e6e 4531 4e7a IyYTU1YTEwNnE1Nz
0x0370: 4a77 4267 6b43 5577 5a52 4277 5977 5a6d JwBgkCUwZRBwYwZm
0x0380: 4934 4e7a 6c69 4e41 2533 4425 3344 2048 I4NzliNA%3D%3D.H
0x0390: 5454 502f 312e 310d 0a52 656d 6f74 6549 TTP/1.1..RemoteI
0x03a0: 703a 2031 3137 2e31 3831 2e32 302e 3134 p:.117.181.20.14
0x03b0: 370d 0a48 6f73 743a 206d 6f6e 6974 6f72 7..Host:.monitor
0x03c0: 2e67 6474 7261 6666 6963 6164 2e63 6f6d .gdtrafficad.com
0x03d0: 0d0a 582d 466f 7277 6172 6465 642d 466f ..X-Forwarded-Fo
0x03e0: 723a 2031 3137 2e31 3831 2e32 302e 3134 r:.117.181.20.14
--
0x0340: 7072 6963 653d 4d54 4531 4e44 6332 4f54 price=MTE1NDc2OT
0x0350: 5934 4e7a 4530 4f44 5678 4d54 6379 5954 Y4NzE0ODVxMTcyYT
0x0360: 497a 5954 5977 5954 6b7a 6354 4d7a 4f44 IzYTYwYTkzcTMzOD
0x0370: 4677 4151 4542 5567 5258 4346 4533 4e44 FwAQEBUgRXCFE3ND
0x0380: 5130 5954 6b31 4e41 2533 4425 3344 2048 Q0YTk1NA%3D%3D.H
0x0390: 5454 502f 312e 310d 0a52 656d 6f74 6549 TTP/1.1..RemoteI
0x03a0: 703a 2031 3134 2e32 3431 2e33 302e 3134 p:.114.241.30.14
0x03b0: 380d 0a48 6f73 743a 206d 6f6e 6974 6f72 8..Host:.monitor
0x03c0: 2e67 6474 7261 6666 6963 6164 2e63 6f6d .gdtrafficad.com
0x03d0: 0d0a 582d 466f 7277 6172 6465 642d 466f ..X-Forwarded-Fo
0x03e0: 723a 2031 3134 2e32 3431 2e33 302e 3134 r:.114.241.30.14