Sorry for the belated reply but I’m sure this will be useful at some point! Here’s a couple of examples. This first one is tcpdump slurping packets on the lo1 interface, as the actual traffic is behind haproxy, which handles the TLS termination, and filtering only on traffic going to, or coming from, port 4003:
# tcpdump -i lo1 -vvv 'port 4003' -ttt -w /tmp/plug.pcap
tcpdump: listening on lo1, link-type EN10MB (Ethernet), capture size 262144 bytes
^C12 packets captured
582 packets received by filter
0 packets dropped by kernel
root@i09 /u/h/dch# l /tmp/plug.pcap
-rw-r--r-- 1 root wheel 1.3K Mar 1 13:21 /tmp/plug.pcap
You can then just copy that locally, open that in wireshark. wireshark and tcpdump have powerful filtering capabilities, CaptureFilters - Wireshark Wiki so you can do a lot more than just port 4003, you could filter only on traffic coming from a particular IP, or a datagram containing a specific word (like a Host: http header).
This example is using ngrep, acquiring traffic that only contains a particular regex of text, and using the same tcpdump filter as above. ngrep also allows nicely displaying things textually which, if you’re stripping TLS upstream, makes reading http for debugging purposes almost pleasant. The packets are also output to a file which is the same tcpdump format that wireshark also reads.
# ngrep -W byline -O /tmp/plug.pcap -qid lo1 '(health|http)' port 4003
interface: lo1
filter: ( port 4003 ) and ((ip || ip6) || (vlan && (ip || ip6)))
match: (health|http)
output: /tmp/plug.pcap
T fc36:c375:a2e3:b0e3:e4ee::1:61304 -> fc36:c375:a250:715c:f0b4::8:4003 [AP] #22
GET /healthz HTTP/1.0.
.
T fc36:c375:a250:715c:f0b4::8:4003 -> fc36:c375:a2e3:b0e3:e4ee::1:61304 [AP] #23
HTTP/1.1 200 OK.
cache-control: max-age=0, private, must-revalidate.
connection: close.
content-length: 0.
date: Fri, 01 Mar 2019 13:35:48 GMT.
server: Cowboy.
.
Its’ worth restating that if you are using OTP to handle TLS connections then none of the above is at all useful, and that HTTP2 doesn’t use the same readable text. I’m a huge fan of haproxy for doing TLS termination, and switching external HTTP2 to HTTP1.1 and load balancing in general, and handling TLS outside the BEAM lets it do what it does best as well.