whats the total number of ws in:
q: how to safely capture or duplicate incoming requests to a web server we have taken over a legacy web application that we cannot modify (the source code is broken and deployment fails) and we will eventually rewrite. ideally we would migrate it one step at a time but this is not possible since we cannot effectively modify the application. 
i am in charge of rewriting the application and there are some complex synchronization algorithms that id like to test against the data postd to the current api.
whats the easiest and safest way to capture incoming http requests with all associated data? the solution must be transparent to api users. the server is running on ubuntu linux and we have ssh access to it. the web app is running on apache 2 on ruby.


*

*use some sort of packet sniffer to capture incoming traffic. id have to figure out a way to replay these requests against a server of my own.

*change the dns to point to another ip that would capture and log the request data, then redirect the request to the production server. i dont think we have access to network infrastructure so i assume this must be executed as a web service that returns a request with a redirect header to the real server. seems fragile and could pose security concerns for browsers?

*use some sort of apache module to do this.


how do the above solutions compare in terms of:


*

*the risk imposed on bringing the server and/or website down

*the ease of implementation


please feel free to suggest any further/better alternatives.

a: i would use tcpdump or ngrep, it would be nice to have the port on the switch connected to the web server mirrored, but in absence of that, you can run ngrep or tcpdump on the server itself.
you will need superuser access to run either of those programs. 
youre going to want to read a bit, as you obviously know what you are looking for in the traffic, ngrep does allow you to select traffic by regex, which might allow you to pick out packets with better accuracy. 
ngrep -l -q -d eth0 ^post  tcp and port 80 -o dump.file 
this would get you any http data posted to port 80 on eth0. you might be able to pick out something much more specific. if you are going to be reading the traffic directly from the file, you might want to add -w byline as it makes the packets much more readable as it respects the line breaks, so you can see the packet written out more logically (for humans). -o dump.file will write the output of your packet capture to a file. the output can be as detailed as youd like, to replay the packets, have a look at tcpreplay

a: the easiest and safest way to capture it would be to simply run a packet sniffer, as you suggested. if you simply do a web search for replay http requests, youll get any number of programs that can capture and then replay your requests. there are also professional tools for this, e.g. loadrunner which is used at my job.
if you dont want to install any extra software, you could use tcpdump -s0 -w /path/to/output.file  to capture the traffic. that will give you a file from which you can read, using tcpdump -a -r /path/to/output.file, presumably using filters such as dst=ip.to.webserver. but then youd need something to replay it.
heres an example of me using tcpdump on localhost:
$ tcpdump -i lo0 -s0 -w /tmp/tcpdump.out

meanwhile i access a web site on localhost from another window; once thats finished, ill press ctrl-c to stop the tcpdump
$ sudo tcpdump -r /tmp/tcpdump.out  -t -q -n -a tcp dst port 80 and  (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)
reading from file /tmp/tcpdump.out, link-type en10mb (ethernet)
ip 127.0.0.1.57499 > 127.0.0.1.http: tcp 122
e.....@.@.p............p.ze................
.9...9..get /~dyho01/ http/1.0
user-agent: wget/1.11.4 red hat modified
accept: */*
host: localhost
connection: keep-alive

you could probably get the same information by opening the raw tcpdump file in a windows program such as wireshark.

a: the packet sniffer option is a good one so long as the connection does not have encryption in play, then you will be sol.   in that case you will need a proxy model for the capture, where the users connect to the proxy using ssl, accepts the proxy certificate and then the connection to the proxy is again under ssl to the destination host.    testing tools like loadrunner, jmeter or the like would be good for capturing a proxy conversation for a single user to allow you to examine the structure of information being passed, but would be impractical for production use for multiple users.
i would look for a proxy server package where you could configure the proxy to dump the requests to a log for analysis purposes.   this way you would have a raw view of the request outside of ssl and having to reassemble packets from a packet level trace.

user
In the text, there are 78 "w"s.
assistant