GoReplay Logo
Operator docs for capture and replay. Product pages: PRO.

Capture live HTTP with --input-raw

Job: sit on the same machine as the service (or on a mirror/VXLAN target) and copy HTTP from a port. The app is unchanged.

sudo gor --input-raw :8080 --output-stdout

You should see request lines on stdout. Then shadow:

sudo gor --input-raw :8080 --output-http="http://staging.example.com"

Permissions

pcap / raw sockets need root or capabilities. Typical failure is an empty capture, not a loud error. Grant caps instead of sudo:

sudo setcap "cap_net_raw,cap_net_admin+eip" /usr/local/bin/gor

More: FAQ and Windows.

What you capture

By default only requests. To also record origin responses (for middleware, files, reports):

sudo gor --input-raw :8080 --input-raw-track-response --output-file requests.gor

Engine

--input-raw-engine is libpcap (default), raw_socket, pcap_file, or vxlan.

sudo gor --input-raw :80 --input-raw-engine raw_socket --output-http "http://staging.example.com"

# VXLAN / traffic mirror (UDP 4789 by default)
gor --input-raw :80 --input-raw-engine vxlan --output-stdout

VXLAN extras: --input-raw-vxlan-port (default 4789), --input-raw-vxlan-vni. VLAN: --input-raw-vlan and --input-raw-vlan-vid.

Interface, BPF, buffers

  • --input-raw-ignore-interface — skip listed interfaces (repeatable; useful in k8s).
  • --input-raw-bpf-filter — extra BPF, e.g. 'dst port 80'.
  • --input-raw-buffer-size — OS capture buffer (Linux default is about 2MB). Increase if packets drop.
  • --input-raw-override-snaplen — force 64k snaplen (some VMs).
  • --input-raw-promisc, --input-raw-monitor, --input-raw-stats.
  • --input-raw-allow-incomplete — keep HTTP messages with missing packets.
  • --input-raw-expire — wait for the last TCP packet before treating a message complete (default 2s).
  • --input-raw-realip-header X-Real-IP — inject the peer IP as a header.
  • --input-raw-protocol — http (default) or binary (PRO replay uses --output-binary).

HTTPS

pcap sees TLS as binary. Capture on the upstream HTTP port behind nginx, Envoy, or an ELB. See HTTPS.

If nothing shows up

Wrong port, TLS, loopback vs the real NIC, missing root, or a full pcap buffer. See troubleshooting.

Save the stream: files. Or replay immediately: replaying.