the-tcpdump-group/tcpdump — pull request #348 by adarquix (2013-12-02 15:17:14+00:00)
Title: a tcp parser for redis - shows redis commands if port 6379 or -T redis are specified

Hey, quick example output:

16:40:59.458165 IP 10.111.159.114.41009 > 10.73.5.172.6379: Flags [P.], seq 682:731, ack 61, win 296, options [nop,nop,TS val 422117144 ecr 419391549], length 49
LPOP,resque:queue:indexer,

16:40:59.458536 IP 10.111.159.114.41009 > 10.73.5.172.6379: Flags [P.], seq 731:789, ack 66, win 296, options [nop,nop,TS val 422117144 ecr 419391549], length 58
LPOP,resque:queue:existing_filesize,

16:40:59.458547 IP 10.111.159.114.40999 > 10.73.5.172.6379: Flags [P.], seq 731:789, ack 66, win 318, options [nop,nop,TS val 422117144 ecr 419391549], length 58
LPOP,resque:queue:existing_filesize,

16:40:59.458916 IP 10.111.159.114.41009 > 10.73.5.172.6379: Flags [P.], seq 789:831, ack 71, win 296, options [nop,nop,TS val 422117144 ecr 419391549], length 42
LPOP,resque:queue:metadata,

16:40:59.458927 IP 10.111.159.114.40999 > 10.73.5.172.6379: Flags [P.], seq 789:831, ack 71, win 318, options [nop,nop,TS val 422117144 ecr 419391549], length 42
LPOP,resque:queue:metadata,

I put the protocol output on the next line, because it can get quite large. A simple way to parse all of the commands becomes (This gives you protocol header on one line and the redis commands on the next):

# tcpdump -nni any port 6379 | grep -2

Just thought this might be useful for somebody. Redis comes with a "MONITOR" command, but that can kill a production server. So, when I need to monitor redis in production, I use these tcpdump mods.

Bye!