httpflow

brew update
brew install httpflow

## On CentOS
yum update
yum install libpcap-devel zlib-devel pcre-devel

## On Ubuntu / Debian
apt-get update
apt-get install libpcap-dev zlib1g-dev libpcre3 libpcre3-dev

> git clone https://github.com/six-ddc/httpflow
> cd httpflow &&  make && make install

libpcap version libpcap version 1.9.1
httpflow version 0.0.9

Usage: httpflow [-i interface | -r pcap-file] [-u url-filter] [-w output-path] [expression]

  -i interface      Listen on interface, This is same as tcpdump 'interface'
  -r pcap-file      Read packets from file (which was created by tcpdump with the -w option)
                    Standard input is used if file is '-'
  -u url-filter     Matches which urls will be dumped
  -w output-path    Write the http request and response to a specific directory

  expression        Selects which packets will be dumped, The format is the same as tcpdump's 'expression' argument
                    If filter expression is given, only packets for which expression is 'true' will be dumped
                    For the expression syntax, see pcap-filter(7)

  For more information, see https://github.com/six-ddc/httpflow

> httpflow

> httpflow -i any

# If no expression is given, all packets on the net will be dumped.
# For the expression syntax, see pcap-filter(7).
> httpflow host httpbin.org or host baidu.com

> httpflow -u '/user/[0-9]+'

# tcpdump -w a.cap
> httpflow -r a.cap

> tcpdump -w - | httpflow -r -

> httpflow -w /tmp/http