tcpdump
alone is not a great way to do this, technically you can determine the answer by inspecting packets, but it's not the best network layer to look at. The first problem is that you will need to deal with variable HTTP headers, the second problem is that with HTTP/1.1 and persistent connections you have to inspect every reply packet, or reassemble every request/response.
HTTP requests are very rarely compressed. It might be useful to inspect requests for the presence or absence of "gzip" or "deflate" in the Accept-Encoding:
header though.
HTTP replies should have a Content-Encoding:
header containing gzip
or deflate
when compression is used.
Things to note:
- due to a large number of browser bugs, many web servers will have a default User-Agent list that they will not enable compression for
- there is very likely a default set of file/URL patterns or MIME content types too, compressing PDFs and images is often not done
- small files may not be compressed
In Apache, one way to record use of compression is to use mod_deflate
's DeflateFilterNote and then amend your logging directives, I usually use at least the following in a custom LogFormat
:
%>s %B %I %O %D %{instream}n/%{outstream}n/%{ratio}n%% %{Content-Type}o
which logs the total size in and out, compression details, and MIME type.
I've used httpry
to watch HTTP requests, but it won't quite work here because it sadly lacks the feature to inspect and record response headers (it also doesn't reassemble packets or HTTP streams).
Two programs that should provide the required details are justsniffer
and xplico
(note though I've never used either as they're a little tricky to compile due to their dependencies, if you can get binary packages for your OS then you should be ok).