Tools for Tracking Server-to-Server Calls in SOA Architectures
Table of Contents
1. Summary
Provides general use notes for tracking down server-to-server calls when debugging SOA architectures.
2. Tools
2.1. tcpdump
The foundational packet capture tool available on virtually all Unix-like systems. Best for low-level network analysis and capturing raw traffic.
2.1.1. Basic Usage for HTTP Traffic
# Capture HTTP traffic on port 80
tcpdump -i any -A -s 0 'tcp port 80'
# Monitor specific host communication
tcpdump -i any -A -s 0 'host api.example.com and port 443'
# Save capture for later analysis
tcpdump -i any -w capture.pcap 'tcp port 8080'
# Read from saved capture
tcpdump -r capture.pcap -A
2.1.2. Filtering by Port and Host
# Multiple ports
tcpdump -i any 'port 80 or port 443 or port 8080'
# Specific source and destination
tcpdump -i any 'src 10.0.1.5 and dst port 9000'
# Exclude SSH traffic to reduce noise
tcpdump -i any 'port 80 and not port 22'
# Filter by network segment
tcpdump -i any 'net 192.168.1.0/24 and port 80'
2.1.3. When to Use
- Need complete packet capture for deep inspection
- Troubleshooting connection-level issues (TCP handshakes, retransmissions)
- Creating captures for offline analysis with Wireshark
- Working on systems without specialized HTTP tools
2.2. ngrep
Network grep - pattern matching for packet payloads. Ideal for real-time monitoring of HTTP requests with familiar grep-like syntax.
2.2.1. Pattern Matching HTTP Requests
# Match specific API endpoint
ngrep -q -W byline 'GET /api/users' port 80
# Case-insensitive search for POST requests
ngrep -q -i 'POST' port 8080
# Match JSON payloads containing specific keys
ngrep -q '"user_id"' port 3000
# Monitor authentication headers
ngrep -q 'Authorization:' port 443
2.2.2. Real-Time Monitoring
# Monitor all HTTP traffic with clean output
ngrep -d any -q -W byline port 80
# Track requests to specific service
ngrep -d any -q 'Host: auth-service' port 80
# Watch for error responses
ngrep -q '500 Internal Server Error' port 80
# Monitor API calls with timestamps
ngrep -qt -W byline 'api' port 8080
2.2.3. When to Use
- Quick inspection of HTTP request/response content
- Searching for specific patterns in API calls
- Debugging authentication or header issues
- Real-time monitoring during load tests
2.3. httpry
HTTP-specific packet sniffer designed for logging and analyzing HTTP traffic. Provides structured output optimized for HTTP protocol.
2.3.1. HTTP-Specific Analysis
# Basic HTTP traffic logging
httpry -i any
# Monitor specific interface with formatted output
httpry -i eth0 -o http.log
# Filter by HTTP method
httpry -m get,post -i any
# Parse specific fields
httpry -i any -f source-ip,dest-ip,request-uri,status-code
2.3.2. Request/Response Logging
# Log all requests with timestamps
httpry -i any -t -o requests.log
# Monitor POST requests only
httpry -i any -m post -o post-traffic.log
# Track API responses by status code
httpry -i any -f timestamp,host,request-uri,status-code -o api-status.log
# Follow specific host
httpry -i any 'host api.internal.com'
2.3.3. When to Use
- Need HTTP-specific metrics and logging
- Analyzing API usage patterns
- Debugging REST API calls between services
- Creating structured logs for analysis
3. Modern Alternatives
3.1. Wireshark / tshark
GUI and CLI versions of the most powerful packet analyzer. Excellent for deep protocol analysis.
# Command-line equivalent
tshark -i any -f "tcp port 80" -Y "http.request"
3.2. mitmproxy
Interactive HTTPS proxy with powerful inspection and modification capabilities.
# Transparent proxy mode
mitmproxy --mode transparent --showhost
3.3. httpie + logging
For controlled API testing with human-readable output.
3.4. Docker container inspection
When debugging containerized SOA:
# Monitor container network traffic
docker exec <container> tcpdump -i any -A port 80
4. Debugging Workflow
4.1. 1. Identify the Problem Scope
- Which services are involved?
- What protocol (HTTP, HTTPS, gRPC)?
- Is this intermittent or consistent?
4.2. 2. Choose Your Tool
- tcpdump: Connection issues, need raw packets, creating captures
- ngrep: Quick content inspection, pattern matching
- httpry: HTTP-specific analysis, structured logging
- mitmproxy: HTTPS inspection, request modification
- Wireshark: Complex protocol analysis, GUI needed
4.3. 3. Capture Strategy
# Start broad, then narrow
tcpdump -i any -w full-capture.pcap 'port 8080'
# Filter to specific conversation
tcpdump -i any 'host 10.0.1.5 and host 10.0.1.8'
# Real-time monitoring with ngrep
ngrep -q -W byline 'api' port 8080
4.4. 4. Analysis Techniques
- Look for missing requests (expected calls not happening)
- Check response codes and timings
- Verify request headers (Authorization, Content-Type)
- Examine payload structure
- Identify network-level issues (retransmissions, resets)
4.5. 5. Common SOA Issues
- Service discovery failures (wrong host/port)
- Authentication token expiry
- Timeout misconfigurations
- Load balancer routing problems
- API version mismatches