[lug] Mailman question

[Hugh Brown]

karl horlen wrote:
>> I used tcpdump to see what happened when he attempts
>> to log in and I do
>> log in.  The one thing that I have that he doesn't
>> is this:
> 
> Can you show / explain more about how you used tcpdump
> to come up with this info.? 
> 
>> Set-Cookie:
>> tesla+admin=280200c7148300<bunch-o-numbers
>> deleted>3633643134;
>> Path=/mailman/; Version=1;
> 


Run tcpdump on the web server or on the client:

tcpdump -i eth0 -w httpsniff.tcpdump -s 0 -vv port 80

will start a sniff on interface eth0, write the results to the file 
httpsniff.tcpdump, capture the full package, extra verbosely, all 
packets that have a source or destination of port 80.

After the dump is written out, I load it into wireshark and use 
Analyze-TCP Stream which will usually print out everything in a nice 
human readable format.

Hugh