httpry

httpry [options] [filter]

httpry is a specialized HTTP packet sniffer. It captures live traffic or reads a pcap file and logs HTTP request and response metadata - method, host, URI, headers - in a compact, customizable line-oriented format instead of full packet dumps.The tool focuses purely on HTTP header parsing rather than general-purpose packet capture, making it lightweight for continuous logging and analysis of web traffic. Output fields are selected with -f, and it can run as a background daemon writing to syslog.

FILTER

BPF-style capture filter expression, same syntax as tcpdump.

Ethernet interface to listen on. If omitted, httpry polls the system and picks the first interface found.

Read packets from an existing pcap capture file instead of doing a live capture. Does not require root.

Output file for writing parsed packet data.

Comma-delimited list of HTTP fields to output (e.g. `method,host,request-uri`).

Comma-delimited list of request methods to parse (e.g. `GET,POST`).

Parse this many HTTP packets, then exit. Default is 0 (run forever).

Run as a daemon process; status output goes to syslog. Requires -o.

Write all processed HTTP packets to a binary pcap dump file.

Do not put the interface into promiscuous mode.

Suppress non-critical output (startup banner, statistics, etc).

Drop privileges to the given user after opening the capture device.

Display help information.

Live capture requires root (or appropriate capabilities) to open the network interface; reading from a pcap file with -r does not. Only plaintext HTTP is parsed - encrypted HTTPS traffic is invisible to it. Built on libpcap. The project has seen no releases since 2018 and is effectively unmaintained.

httpry was created by Jason Bittel around 2005 as a lightweight, purpose-built alternative to general packet sniffers for logging HTTP traffic. It later moved to GitHub under jbittel/httpry.

tcpdump(1), httpflow(1), ngrep(1)

Source code