<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">If you didn't know, there is also a
      text based version of wireshark called tshark. So if you're
      familiar with any of the filters of wireshark you can use those on
      the command line. <br>
      <br>
      Very useful!<br>
    </div>
    <blockquote
cite="mid:CAPwZOK7-fUqriAuMx2m0JpkdjkVGrz2P4a_dAePm_m-0m9EsZA@mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div>Of course wireshark has a great UI and is probably the
          recommended tool for much of this kind of work.<br>
          I find the technique used to define filters a bit obscure but
          that's probably a familiarity issue as much as anything else.<br>
          <br>
          I tend to use tcpdump for this kind if thing.<br>
          <br>
          sudo tcpdump  -s1564 -w - port 80 | strings<br>
        </div>
        <div>sudo tcpdmup -s1500 -X -vv port 80<br>
          <br>
          <br>
          <br>
        </div>
      </div>
      <div class="gmail_extra"><br>
        <br>
        <div class="gmail_quote">On Thu, May 1, 2014 at 10:35 PM, David
          L. Anselmi <span dir="ltr">&lt;<a moz-do-not-send="true"
              href="mailto:anselmi@anselmi.us" target="_blank">anselmi@anselmi.us</a>&gt;</span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0
            .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div class="">Christopher Cross wrote:<br>
              &gt; I have the same script on two different machines.<br>
              <br>
            </div>
            There's a .curlrc that might give different options.<br>
            <br>
            I would look at wireshark to see what's different.<br>
            <br>
            Dave<br>
            <div class="HOEnZb">
              <div class="h5">_______________________________________________<br>
                clue mailing list: <a moz-do-not-send="true"
                  href="mailto:clue@cluedenver.org">clue@cluedenver.org</a><br>
                For information, account preferences, or to unsubscribe
                see:<br>
                <a moz-do-not-send="true"
                  href="http://cluedenver.org/mailman/listinfo/clue"
                  target="_blank">http://cluedenver.org/mailman/listinfo/clue</a><br>
              </div>
            </div>
          </blockquote>
        </div>
        <br>
      </div>
      <br>
      <fieldset class="mimeAttachmentHeader"></fieldset>
      <br>
      <pre wrap="">_______________________________________________
clue mailing list: <a class="moz-txt-link-abbreviated" href="mailto:clue@cluedenver.org">clue@cluedenver.org</a>
For information, account preferences, or to unsubscribe see:
<a class="moz-txt-link-freetext" href="http://cluedenver.org/mailman/listinfo/clue">http://cluedenver.org/mailman/listinfo/clue</a></pre>
    </blockquote>
    <br>
  </body>
</html>