| blob | c599a52271f98b4c5f6c7006a5870641071bad79 |
1 '\" te
2 .\" Copyright (C) 2009, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH SNOOP 1M "Feb 25, 2017"
7 .SH NAME
8 snoop \- capture and inspect network packets
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fBsnoop\fR [\fB-aqrCDINPSvV\fR] [\fB-t\fR [r | a | d]] [\fB-c\fR \fImaxcount\fR]
13 [\fB-d\fR \fIdevice\fR] [\fB-i\fR \fIfilename\fR] [\fB-n\fR \fIfilename\fR] [\fB-o\fR \fIfilename\fR]
14 [\fB-p\fR \fIfirst\fR [, \fIlast\fR]] [\fB-s\fR \fIsnaplen\fR] [\fB-x\fR \fIoffset\fR [, \fIlength\fR]]
15 [\fIexpression\fR]
16 .fi
18 .SH DESCRIPTION
19 .LP
20 From a datalink or IP interface, \fBsnoop\fR captures packets and displays
21 their contents. If the datalink or IP interface is not specified, \fBsnoop\fR
22 will pick a datalink to use, giving priority to datalinks that have been
23 plumbed for IP traffic. \fBsnoop\fR uses the \fBpfmod\fR(7M) and
24 \fBbufmod\fR(7M) STREAMS modules to provide efficient capture of packets from
25 the network. Captured packets can be displayed as they are received or saved to
26 a file (which is \fIRFC 1761\fR-compliant) for later inspection.
27 .sp
28 .LP
29 \fBsnoop\fR can display packets in a single-line summary form or in verbose
30 multi-line forms. In summary form, with the exception of certain VLAN packets,
31 only the data pertaining to the highest level protocol is displayed. If a
32 packet has a VLAN header and its VLAN ID is non-zero, then \fBsnoop\fR will
33 show that the packet is VLAN tagged. For example, an \fBNFS\fR packet will have
34 only \fBNFS\fR information displayed. Except for VLAN information under the
35 condition just described, the underlying \fBRPC\fR, \fBUDP\fR, \fBIP\fR, and
36 Ethernet frame information is suppressed, but can be displayed if either of the
37 verbose options are chosen.
38 .sp
39 .LP
40 In the absence of a name service, such as LDAP or NIS, \fBsnoop\fR displays
41 host names as numeric IP addresses.
42 .sp
43 .LP
44 \fBsnoop\fR requires an interactive interface.
45 .SH OPTIONS
46 .ne 2
47 .na
48 \fB\fB-C\fR\fR
49 .ad
50 .sp .6
51 .RS 4n
52 List the code generated from the filter expression for either the kernel packet
53 filter, or \fBsnoop\fR's own filter.
54 .RE
56 .sp
57 .ne 2
58 .na
59 \fB\fB-D\fR\fR
60 .ad
61 .sp .6
62 .RS 4n
63 Display number of packets dropped during capture on the summary line.
64 .RE
66 .sp
67 .ne 2
68 .na
69 \fB\fB-N\fR\fR
70 .ad
71 .sp .6
72 .RS 4n
73 Create an \fBIP\fR address-to-name file from a capture file. This must be set
74 together with the \fB-i\fR option that names a capture file. The
75 address-to-name file has the same name as the capture file with \fB\&.names\fR
76 appended. This file records the \fBIP\fR address to hostname mapping at the
77 capture site and increases the portability of the capture file. Generate a
78 \fB\&.names\fR file if the capture file is to be analyzed elsewhere. Packets
79 are not displayed when this flag is used.
80 .RE
82 .sp
83 .ne 2
84 .na
85 \fB\fB-I\fR \fIinterface\fR\fR
86 .ad
87 .sp .6
88 .RS 4n
89 Capture IP packets from the network using the IP interface specified by
90 \fIinterface\fR, for example, \fBlo0\fR. The \fBifconfig\fR(1M) command can be
91 used to list available IP interfaces. The \fB-I\fR and \fB-d\fR options are
92 mutually exclusive.
93 .RE
95 .sp
96 .ne 2
97 .na
98 \fB\fB-P\fR\fR
99 .ad
100 .sp .6
101 .RS 4n
102 Capture packets in non-promiscuous mode. Only broadcast, multicast, or packets
103 addressed to the host machine will be seen.
104 .RE
106 .sp
107 .ne 2
108 .na
109 \fB\fB-S\fR\fR
110 .ad
111 .sp .6
112 .RS 4n
113 Display size of the entire link layer frame in bytes on the summary line.
114 .RE
116 .sp
117 .ne 2
118 .na
119 \fB\fB-V\fR\fR
120 .ad
121 .sp .6
122 .RS 4n
123 Verbose summary mode. This is halfway between summary mode and verbose mode in
124 degree of verbosity. Instead of displaying just the summary line for the
125 highest level protocol in a packet, it displays a summary line for each
126 protocol layer in the packet. For instance, for an \fBNFS\fR packet it will
127 display a line each for the \fBETHER\fR, \fBIP\fR, \fBUDP\fR, \fBRPC\fR and
128 \fBNFS\fR layers. Verbose summary mode output may be easily piped through
129 \fBgrep\fR to extract packets of interest. For example, to view only \fBRPC\fR
130 summary lines, enter the following: \fBexample#\fR \fBsnoop -i rpc.cap -V |
131 grep RPC\fR
132 .RE
134 .sp
135 .ne 2
136 .na
137 \fB\fB-a\fR\fR
138 .ad
139 .sp .6
140 .RS 4n
141 Listen to packets on \fB/dev/audio\fR (warning: can be noisy).
142 .RE
144 .sp
145 .ne 2
146 .na
147 \fB\fB-c\fR \fImaxcount\fR\fR
148 .ad
149 .sp .6
150 .RS 4n
151 Quit after capturing \fImaxcount\fR packets. Otherwise keep capturing until
152 there is no disk space left or until interrupted with Control-C.
153 .RE
155 .sp
156 .ne 2
157 .na
158 \fB\fB-d\fR \fIdatalink\fR\fR
159 .ad
160 .sp .6
161 .RS 4n
162 Capture link-layer packets from the network using the DLPI datalink specified
163 by \fIdatalink\fR, for example, \fBbge0\fR or \fBnet0\fR. The \fBdladm\fR(1M)
164 \fBshow-link\fR subcommand can be used to list available datalinks. The
165 \fB-d\fR and \fB-I\fR options are mutually exclusive.
166 .RE
168 .sp
169 .ne 2
170 .na
171 \fB\fB-i\fR \fIfilename\fR\fR
172 .ad
173 .sp .6
174 .RS 4n
175 Display packets previously captured in \fIfilename\fR. Without this option,
176 \fBsnoop\fR reads packets from the network interface. If a
177 \fIfilename\fR\fB\&.names\fR file is present, it is automatically loaded into
178 the \fBsnoop\fR \fBIP\fR address-to-name mapping table (See \fB-N\fR flag).
179 .RE
181 .sp
182 .ne 2
183 .na
184 \fB\fB-n\fR \fIfilename\fR\fR
185 .ad
186 .sp .6
187 .RS 4n
188 Use \fIfilename\fR as an \fBIP\fR address-to-name mapping table. This file must
189 have the same format as the \fB/etc/hosts\fR file (IP address followed by the
190 hostname).
191 .RE
193 .sp
194 .ne 2
195 .na
196 \fB\fB-o\fR \fIfilename\fR\fR
197 .ad
198 .sp .6
199 .RS 4n
200 Save captured packets in \fIfilename\fR as they are captured. (This
201 \fIfilename\fR is referred to as the "capture file".) The format of the capture
202 file is RFC 1761-compliant. During packet capture, a count of the number of
203 packets saved in the file is displayed. If you wish just to count packets
204 without saving to a file, name the file \fB/dev/null\fR.
205 .RE
207 .sp
208 .ne 2
209 .na
210 \fB\fB-p\fR \fIfirst\fR [ , \fBlast\fR ]\fR
211 .ad
212 .sp .6
213 .RS 4n
214 Select one or more packets to be displayed from a capture file. The \fIfirst\fR
215 packet in the file is packet number 1.
216 .RE
218 .sp
219 .ne 2
220 .na
221 \fB\fB-q\fR\fR
222 .ad
223 .sp .6
224 .RS 4n
225 When capturing network packets into a file, do not display the packet count.
226 This can improve packet capturing performance.
227 .RE
229 .sp
230 .ne 2
231 .na
232 \fB\fB-r\fR\fR
233 .ad
234 .sp .6
235 .RS 4n
236 Do not resolve the \fBIP\fR address to the symbolic name. This prevents
237 \fBsnoop\fR from generating network traffic while capturing and displaying
238 packets. However, if the \fB-n\fR option is used, and an address is found in
239 the mapping file, its corresponding name will be used.
240 .RE
242 .sp
243 .ne 2
244 .na
245 \fB\fB-s\fR \fIsnaplen\fR\fR
246 .ad
247 .sp .6
248 .RS 4n
249 Truncate each packet after \fIsnaplen\fR bytes. Usually the whole packet is
250 captured. This option is useful if only certain packet header information is
251 required. The packet truncation is done within the kernel giving better
252 utilization of the streams packet buffer. This means less chance of dropped
253 packets due to buffer overflow during periods of high traffic. It also saves
254 disk space when capturing large traces to a capture file. To capture only
255 \fBIP\fR headers (no options) use a \fIsnaplen\fR of 34. For \fBUDP\fR use 42,
256 and for \fBTCP\fR use 54. You can capture \fBRPC\fR headers with a
257 \fIsnaplen\fR of 80 bytes. \fBNFS\fR headers can be captured in 120 bytes.
258 .RE
260 .sp
261 .ne 2
262 .na
263 \fB\fB-t\fR [ \fBr\fR | \fBa\fR | \fBd\fR ]\fR
264 .ad
265 .sp .6
266 .RS 4n
267 Time-stamp presentation. Time-stamps are accurate to within 4 microseconds. The
268 default is for times to be presented in \fBd\fR (delta) format (the time since
269 receiving the previous packet). Option \fBa\fR (absolute) gives wall-clock
270 time. Option \fBr\fR (relative) gives time relative to the first packet
271 displayed. This can be used with the \fB-p\fR option to display time relative
272 to any selected packet.
273 .RE
275 .sp
276 .ne 2
277 .na
278 \fB\fB-v\fR\fR
279 .ad
280 .sp .6
281 .RS 4n
282 Verbose mode. Print packet headers in lots of detail. This display consumes
283 many lines per packet and should be used only on selected packets.
284 .RE
286 .sp
287 .ne 2
288 .na
289 \fB\fB\fR\fB-x\fR\fIoffset\fR [ , \fIlength\fR]\fR
290 .ad
291 .sp .6
292 .RS 4n
293 Display packet data in hexadecimal and \fBASCII\fR format. The \fIoffset\fR and
294 \fIlength\fR values select a portion of the packet to be displayed. To display
295 the whole packet, use an \fIoffset\fR of 0. If a \fIlength\fR value is not
296 provided, the rest of the packet is displayed.
297 .RE
299 .SH OPERANDS
300 .ne 2
301 .na
302 \fB\fIexpression\fR\fR
303 .ad
304 .sp .6
305 .RS 4n
306 Select packets either from the network or from a capture file. Only packets for
307 which the expression is true will be selected. If no expression is provided it
308 is assumed to be true.
309 .sp
310 Given a filter expression, \fBsnoop\fR generates code for either the kernel
311 packet filter or for its own internal filter. If capturing packets with the
312 network interface, code for the kernel packet filter is generated. This filter
313 is implemented as a streams module, upstream of the buffer module. The buffer
314 module accumulates packets until it becomes full and passes the packets on to
315 \fBsnoop\fR. The kernel packet filter is very efficient, since it rejects
316 unwanted packets in the kernel before they reach the packet buffer or
317 \fBsnoop\fR. The kernel packet filter has some limitations in its
318 implementation; it is possible to construct filter expressions that it cannot
319 handle. In this event, \fBsnoop\fR tries to split the filter and do as much
320 filtering in the kernel as possible. The remaining filtering is done by the
321 packet filter for \fBsnoop\fR. The \fB-C\fR flag can be used to view generated
322 code for either the packet filter for the kernel or the packet filter for
323 \fBsnoop\fR. If packets are read from a capture file using the \fB-i\fR option,
324 only the packet filter for \fBsnoop\fR is used.
325 .sp
326 A filter \fIexpression\fR consists of a series of one or more boolean
327 primitives that may be combined with boolean operators (\fBAND\fR, \fBOR\fR,
328 and \fBNOT\fR). Normal precedence rules for boolean operators apply. Order of
329 evaluation of these operators may be controlled with parentheses. Since
330 parentheses and other filter expression characters are known to the shell, it
331 is often necessary to enclose the filter expression in quotes. Refer to for
332 information about setting up more efficient filters.
333 .sp
334 The primitives are:
335 .sp
336 .ne 2
337 .na
338 \fB\fBhost\fR \fIhostname\fR\fR
339 .ad
340 .sp .6
341 .RS 4n
342 True if the source or destination address is that of \fBhostname\fR. The
343 \fIhostname\fR argument may be a literal address. The keyword \fBhost\fR may be
344 omitted if the name does not conflict with the name of another expression
345 primitive. For example, \fBpinky\fR selects packets transmitted to or received
346 from the host \fBpinky\fR, whereas \fBpinky and dinky\fR selects packets
347 exchanged between hosts \fBpinky AND dinky\fR.
348 .sp
349 The type of address used depends on the primitive which precedes the \fBhost\fR
350 primitive. The possible qualifiers are \fBinet\fR, \fBinet6\fR, \fBether\fR, or
351 none. These three primitives are discussed below. Having none of the primitives
352 present is equivalent to "inet host hostname or inet6 host hostname". In other
353 words, snoop tries to filter on all IP addresses associated with hostname.
354 .RE
356 .sp
357 .ne 2
358 .na
359 \fB\fIinet\fR or \fIinet6\fR\fR
360 .ad
361 .sp .6
362 .RS 4n
363 A qualifier that modifies the \fBhost\fR primitive that follows. If it is
364 \fIinet\fR, then \fBsnoop\fR tries to filter on all IPv4 addresses returned
365 from a name lookup. If it is \fIinet6\fR, \fBsnoop\fR tries to filter on all
366 IPv6 addresses returned from a name lookup.
367 .RE
369 .sp
370 .ne 2
371 .na
372 \fB\fIipaddr\fR, \fIatalkaddr\fR, or \fIetheraddr\fR\fR
373 .ad
374 .sp .6
375 .RS 4n
376 Literal addresses, \fBIP\fR dotted, AppleTalk dotted, and Ethernet colon are
377 recognized. For example,
378 .RS +4
379 .TP
380 .ie t \(bu
381 .el o
382 "\fB172.16.40.13\fR" matches all packets with that \fBIP\fR
383 .RE
384 .RS +4
385 .TP
386 .ie t \(bu
387 .el o
388 "\fB2::9255:a00:20ff:fe73:6e35\fR" matches all packets with that IPv6 address
389 as source or destination;
390 .RE
391 .RS +4
392 .TP
393 .ie t \(bu
394 .el o
395 "\fB65281.13\fR" matches all packets with that AppleTalk address;
396 .RE
397 .RS +4
398 .TP
399 .ie t \(bu
400 .el o
401 "\fB8:0:20:f:b1:51\fR" matches all packets with the Ethernet address as source
402 or destination.
403 .RE
404 An Ethernet address beginning with a letter is interpreted as a hostname. To
405 avoid this, prepend a zero when specifying the address. For example, if the
406 Ethernet address is \fBaa:0:45:23:52:44\fR, then specify it by add a leading
407 zero to make it \fB0aa:0:45:23:52:44\fR.
408 .RE
410 .sp
411 .ne 2
412 .na
413 \fB\fBfrom\fR or \fBsrc\fR\fR
414 .ad
415 .sp .6
416 .RS 4n
417 A qualifier that modifies the following \fBhost\fR, \fBnet\fR, \fIipaddr\fR,
418 \fIatalkaddr\fR, \fIetheraddr\fR, \fBport\fR or \fBrpc\fR primitive to match
419 just the source address, port, or \fBRPC\fR reply.
420 .RE
422 .sp
423 .ne 2
424 .na
425 \fB\fBto\fR or \fBdst\fR\fR
426 .ad
427 .sp .6
428 .RS 4n
429 A qualifier that modifies the following \fBhost\fR, \fBnet\fR, \fIipaddr\fR,
430 \fIatalkaddr\fR, \fIetheraddr\fR, \fBport\fR or \fBrpc\fR primitive to match
431 just the destination address, port, or \fBRPC\fR call.
432 .RE
434 .sp
435 .ne 2
436 .na
437 \fB\fBether\fR\fR
438 .ad
439 .sp .6
440 .RS 4n
441 A qualifier that modifies the following \fBhost\fR primitive to resolve a name
442 to an Ethernet address. Normally, \fBIP\fR address matching is performed. This
443 option is not supported on media such as IPoIB (IP over InfiniBand).
444 .RE
446 .sp
447 .ne 2
448 .na
449 \fB\fBethertype\fR \fInumber\fR\fR
450 .ad
451 .sp .6
452 .RS 4n
453 True if the Ethernet type field has value \fInumber\fR. If \fInumber\fR is not
454 0x8100 (VLAN) and the packet is VLAN tagged, then the expression will match the
455 encapsulated Ethernet type.
456 .RE
458 .sp
459 .ne 2
460 .na
461 \fB\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBpppoed\fR, \fBpppoes\fR\fR
462 .ad
463 .sp .6
464 .RS 4n
465 True if the packet is of the appropriate ethertype.
466 .RE
468 .sp
469 .ne 2
470 .na
471 \fB\fBvlan\fR\fR
472 .ad
473 .sp .6
474 .RS 4n
475 True if the packet has \fBethertype\fR VLAN and the VLAN ID is not zero.
476 .RE
478 .sp
479 .ne 2
480 .na
481 \fB\fBvlan-id\fR \fIid\fR\fR
482 .ad
483 .sp .6
484 .RS 4n
485 True for packets of ethertype VLAN with the id \fIid\fR.
486 .RE
488 .sp
489 .ne 2
490 .na
491 \fB\fBpppoe\fR\fR
492 .ad
493 .sp .6
494 .RS 4n
495 True if the ethertype of the packet is either \fBpppoed\fR or \fBpppoes\fR.
496 .RE
498 .sp
499 .ne 2
500 .na
501 \fB\fBbroadcast\fR\fR
502 .ad
503 .sp .6
504 .RS 4n
505 True if the packet is a broadcast packet. Equivalent to \fBether[2:4] =
506 0xffffffff\fR for Ethernet. This option is not supported on media such as IPoIB
507 (IP over InfiniBand).
508 .RE
510 .sp
511 .ne 2
512 .na
513 \fB\fBmulticast\fR\fR
514 .ad
515 .sp .6
516 .RS 4n
517 True if the packet is a multicast packet. Equivalent to "\fBether[0] & 1 =
518 1\fR" on Ethernet. This option is not supported on media such as IPoIB (IP over
519 InfiniBand).
520 .RE
522 .sp
523 .ne 2
524 .na
525 \fB\fBbootp\fR, \fBdhcp\fR\fR
526 .ad
527 .sp .6
528 .RS 4n
529 True if the packet is an unfragmented IPv4 UDP packet with either a source port
530 of \fBBOOTPS (67)\fR and a destination port of \fBBOOTPC (68)\fR, or a source
531 port of \fBBOOTPC (68)\fR and a destination of \fBBOOTPS (67)\fR.
532 .RE
534 .sp
535 .ne 2
536 .na
537 \fB\fBdhcp6\fR\fR
538 .ad
539 .sp .6
540 .RS 4n
541 True if the packet is an unfragmented IPv6 UDP packet with either a source port
542 of \fBDHCPV6-SERVER\fR (547) and a destination port of \fBDHCPV6-CLIENT\fR
543 (546), or a source port of \fBDHCPV6-CLIENT\fR (546) and a destination of
544 \fBDHCPV6-SERVER\fR (547).
545 .RE
547 .sp
548 .ne 2
549 .na
550 \fB\fBapple\fR\fR
551 .ad
552 .sp .6
553 .RS 4n
554 True if the packet is an Apple Ethertalk packet. Equivalent to "\fBethertype
555 0x809b or ethertype 0x80f3\fR".
556 .RE
558 .sp
559 .ne 2
560 .na
561 \fB\fBdecnet\fR\fR
562 .ad
563 .sp .6
564 .RS 4n
565 True if the packet is a \fBDECNET\fR packet.
566 .RE
568 .sp
569 .ne 2
570 .na
571 \fB\fBgreater\fR \fIlength\fR\fR
572 .ad
573 .sp .6
574 .RS 4n
575 True if the packet is longer than \fIlength\fR.
576 .RE
578 .sp
579 .ne 2
580 .na
581 \fB\fBless\fR \fIlength\fR\fR
582 .ad
583 .sp .6
584 .RS 4n
585 True if the packet is shorter than \fIlength\fR.
586 .RE
588 .sp
589 .ne 2
590 .na
591 \fB\fBudp\fR, \fBtcp\fR, \fBicmp\fR, \fBicmp6\fR, \fBah\fR, \fBesp\fR\fR
592 .ad
593 .sp .6
594 .RS 4n
595 True if the \fBIP\fR or IPv6 protocol is of the appropriate type.
596 .RE
598 .sp
599 .ne 2
600 .na
601 \fB\fBnet\fR \fInet\fR\fR
602 .ad
603 .sp .6
604 .RS 4n
605 True if either the \fBIP\fR source or destination address has a network number
606 of \fInet\fR. The \fBfrom\fR or \fBto\fR qualifier may be used to select
607 packets for which the network number occurs only in the source or destination
608 address.
609 .RE
611 .sp
612 .ne 2
613 .na
614 \fB\fBport\fR \fIport\fR\fR
615 .ad
616 .sp .6
617 .RS 4n
618 True if either the source or destination port is \fIport\fR. The \fIport\fR may
619 be either a port number or name from \fB/etc/services\fR. The \fBtcp\fR or
620 \fBudp\fR primitives may be used to select \fBTCP\fR or \fBUDP\fR ports only.
621 The \fBfrom\fR or \fBto\fR qualifier may be used to select packets for which
622 the \fIport\fR occurs only as the source or destination.
623 .RE
625 .sp
626 .ne 2
627 .na
628 \fB\fBrpc\fR \fIprog\fR [ , \fIvers\fR [ , \fBproc\fR ] ]\fR
629 .ad
630 .sp .6
631 .RS 4n
632 True if the packet is an \fBRPC\fR call or reply packet for the protocol
633 identified by \fIprog\fR. The \fIprog\fR may be either the name of an \fBRPC\fR
634 protocol from \fB/etc/rpc\fR or a program number. The \fIvers\fR and \fBproc\fR
635 may be used to further qualify the program \fIversion\fR and \fIprocedure\fR
636 number, for example, \fBrpc nfs,2,0\fR selects all calls and replies for the
637 \fBNFS\fR null procedure. The \fBto\fR or \fBfrom\fR qualifier may be used to
638 select either call or reply packets only.
639 .RE
641 .sp
642 .ne 2
643 .na
644 \fB\fBzone\fR \fIzoneid\fR\fR
645 .ad
646 .sp .6
647 .RS 4n
648 True if \fIzoneid\fR matches either the source or destination \fIzoneid\fR of a
649 packet received on an \fBipnet\fR device.
650 .RE
652 .sp
653 .ne 2
654 .na
655 \fB\fBldap\fR\fR
656 .ad
657 .sp .6
658 .RS 4n
659 True if the packet is an \fBLDAP\fR packet on port 389.
660 .RE
662 .sp
663 .ne 2
664 .na
665 \fB\fBgateway\fR \fIhost\fR\fR
666 .ad
667 .sp .6
668 .RS 4n
669 True if the packet used \fIhost\fR as a gateway, that is, the Ethernet source
670 or destination address was for \fIhost\fR but not the \fBIP\fR address.
671 Equivalent to "\fBether host\fR \fIhost\fR and not host \fIhost\fR".
672 .RE
674 .sp
675 .ne 2
676 .na
677 \fB\fBnofrag\fR\fR
678 .ad
679 .sp .6
680 .RS 4n
681 True if the packet is unfragmented or is the first in a series of \fBIP\fR
682 fragments. Equivalent to \fBip[6:2] & 0x1fff = 0\fR.
683 .RE
685 .sp
686 .ne 2
687 .na
688 \fB\fIexpr\fR \fIrelop\fR \fIexpr\fR\fR
689 .ad
690 .sp .6
691 .RS 4n
692 True if the relation holds, where \fIrelop\fR is one of \fB>\fR, \fB<\fR,
693 \fB>=\fR, \fB<=\fR, \fB=\fR, \fB!=\fR, and \fBexpr\fR is an arithmetic
694 expression composed of numbers, packet field selectors, the \fBlength\fR
695 primitive, and arithmetic operators \fB+\fR, \fB\(mi\fR, \fB*\fR, \fB&\fR,
696 \fB|\fR, \fB^\fR, and \fB%\fR. The arithmetic operators within \fBexpr\fR are
697 evaluated before the relational operator and normal precedence rules apply
698 between the arithmetic operators, such as multiplication before addition.
699 Parentheses may be used to control the order of evaluation. To use the value of
700 a field in the packet use the following syntax:
701 .sp
702 .in +2
703 .nf
704 \fIbase\fR[\fBexpr\fR [\fB:\fR \fBsize\fR ] ]
705 .fi
706 .in -2
707 .sp
709 where \fBexpr\fR evaluates the value of an offset into the packet from a
710 \fIbase\fR offset which may be \fBether\fR, \fBip\fR, \fBip6\fR, \fBudp\fR,
711 \fBtcp\fR, or \fBicmp\fR. The \fBsize\fR value specifies the size of the field.
712 If not given, 1 is assumed. Other legal values are 2 and 4. For example,
713 .sp
714 .in +2
715 .nf
716 ether[0] & 1 = 1
717 .fi
718 .in -2
720 is equivalent to \fBmulticast\fR
721 .sp
722 .in +2
723 .nf
724 ether[2:4] = 0xffffffff
725 .fi
726 .in -2
728 is equivalent to \fBbroadcast\fR.
729 .sp
730 .in +2
731 .nf
732 ip[ip[0] & 0xf * 4 : 2] = 2049
733 .fi
734 .in -2
736 is equivalent to \fBudp[0:2] = 2049\fR
737 .sp
738 .in +2
739 .nf
740 ip[0] & 0xf > 5
741 .fi
742 .in -2
744 selects \fBIP\fR packets with options.
745 .sp
746 .in +2
747 .nf
748 ip[6:2] & 0x1fff = 0
749 .fi
750 .in -2
752 eliminates \fBIP\fR fragments.
753 .sp
754 .in +2
755 .nf
756 udp and ip[6:2]&0x1fff = 0 and udp[6:2] != 0
757 .fi
758 .in -2
760 finds all packets with \fBUDP\fR checksums.
761 .sp
762 The \fBlength\fR primitive may be used to obtain the length of the packet. For
763 instance "\fBlength > 60\fR" is equivalent to "\fBgreater 60\fR", and
764 "\fBether[length \(mi 1]\fR" obtains the value of the last byte in a packet.
765 .RE
767 .sp
768 .ne 2
769 .na
770 \fB\fBand\fR\fR
771 .ad
772 .sp .6
773 .RS 4n
774 Perform a logical \fBAND\fR operation between two boolean values. The \fBAND\fR
775 operation is implied by the juxtaposition of two boolean expressions, for
776 example "\fBdinky pinky\fR" is the same as "\fBdinky AND pinky\fR".
777 .RE
779 .sp
780 .ne 2
781 .na
782 \fB\fBor\fR or \fB,\fR\fR
783 .ad
784 .sp .6
785 .RS 4n
786 Perform a logical \fBOR\fR operation between two boolean values. A comma may be
787 used instead, for example, "\fBdinky,pinky\fR" is the same as "\fBdinky OR
788 pinky\fR".
789 .RE
791 .sp
792 .ne 2
793 .na
794 \fB\fBnot\fR or \fB!\fR\fR
795 .ad
796 .sp .6
797 .RS 4n
798 Perform a logical \fBNOT\fR operation on the following boolean value. This
799 operator is evaluated before \fBAND\fR or OR.
800 .RE
802 .sp
803 .ne 2
804 .na
805 \fB\fBslp\fR\fR
806 .ad
807 .sp .6
808 .RS 4n
809 True if the packet is an \fBSLP\fR packet.
810 .RE
812 .sp
813 .ne 2
814 .na
815 \fB\fBsctp\fR\fR
816 .ad
817 .sp .6
818 .RS 4n
819 True if the packet is an \fBSCTP\fR packet.
820 .RE
822 .sp
823 .ne 2
824 .na
825 \fB\fBospf\fR\fR
826 .ad
827 .sp .6
828 .RS 4n
829 True if the packet is an \fBOSPF\fR packet.
830 .RE
832 .RE
834 .SH EXAMPLES
835 .LP
836 \fBExample 1 \fRUsing the \fBsnoop\fR Command
837 .sp
838 .LP
839 Capture all packets and display them as they are received:
841 .sp
842 .in +2
843 .nf
844 example# \fBsnoop\fR
845 .fi
846 .in -2
847 .sp
849 .sp
850 .LP
851 Capture packets with host \fBfunky\fR as either the source or destination and
852 display them as they are received:
854 .sp
855 .in +2
856 .nf
857 example# \fBsnoop funky\fR
858 .fi
859 .in -2
860 .sp
862 .sp
863 .LP
864 Capture packets between \fBfunky\fR and \fBpinky\fR and save them to a file.
865 Then inspect the packets using times (in seconds) relative to the first
866 captured packet:
868 .sp
869 .in +2
870 .nf
871 example# \fBsnoop -o cap funky pinky\fR
872 example# \fBsnoop -i cap -t r | more\fR
873 .fi
874 .in -2
875 .sp
877 .sp
878 .LP
879 To look at selected packets in another capture file:
881 .sp
882 .in +2
883 .nf
884 example# \fBsnoop -i pkts -p 99,108\fR
885 99 0.0027 boutique -> sunroof NFS C GETATTR FH=8E6
886 100 0.0046 sunroof -> boutique NFS R GETATTR OK
887 101 0.0080 boutique -> sunroof NFS C RENAME FH=8E6C MTra00192 to .nfs08
888 102 0.0102 marmot -> viper NFS C LOOKUP FH=561E screen.r.13.i386
889 103 0.0072 viper -> marmot NFS R LOOKUP No such file or directory
890 104 0.0085 bugbomb -> sunroof RLOGIN C PORT=1023 h
891 105 0.0005 kandinsky -> sparky RSTAT C Get Statistics
892 106 0.0004 beeblebrox -> sunroof NFS C GETATTR FH=0307
893 107 0.0021 sparky -> kandinsky RSTAT R
894 108 0.0073 office -> jeremiah NFS C READ FH=2584 at 40960 for 8192
895 .fi
896 .in -2
897 .sp
899 .sp
900 .LP
901 To look at packet 101 in more detail:
903 .sp
904 .in +2
905 .nf
906 example# \fBsnoop -i pkts -v -p101\fR
907 ETHER: ----- Ether Header -----
908 ETHER:
909 ETHER: Packet 101 arrived at 16:09:53.59
910 ETHER: Packet size = 210 bytes
911 ETHER: Destination = 8:0:20:1:3d:94, Sun
912 ETHER: Source = 8:0:69:1:5f:e, Silicon Graphics
913 ETHER: Ethertype = 0800 (IP)
914 ETHER:
915 IP: ----- IP Header -----
916 IP:
917 IP: Version = 4, header length = 20 bytes
918 IP: Type of service = 00
919 IP: ..0. .... = routine
920 IP: ...0 .... = normal delay
921 IP: .... 0... = normal throughput
922 IP: .... .0.. = normal reliability
923 IP: Total length = 196 bytes
924 IP: Identification 19846
925 IP: Flags = 0X
926 IP: .0.. .... = may fragment
927 IP: ..0. .... = more fragments
928 IP: Fragment offset = 0 bytes
929 IP: Time to live = 255 seconds/hops
930 IP: Protocol = 17 (UDP)
931 IP: Header checksum = 18DC
932 IP: Source address = 172.16.40.222, boutique
933 IP: Destination address = 172.16.40.200, sunroof
934 IP:
935 UDP: ----- UDP Header -----
936 UDP:
937 UDP: Source port = 1023
938 UDP: Destination port = 2049 (Sun RPC)
939 UDP: Length = 176
940 UDP: Checksum = 0
941 UDP:
942 RPC: ----- SUN RPC Header -----
943 RPC:
944 RPC: Transaction id = 665905
945 RPC: Type = 0 (Call)
946 RPC: RPC version = 2
947 RPC: Program = 100003 (NFS), version = 2, procedure = 1
948 RPC: Credentials: Flavor = 1 (Unix), len = 32 bytes
949 RPC: Time = 06-Mar-90 07:26:58
950 RPC: Hostname = boutique
951 RPC: Uid = 0, Gid = 1
952 RPC: Groups = 1
953 RPC: Verifier : Flavor = 0 (None), len = 0 bytes
954 RPC:
955 NFS: ----- SUN NFS -----
956 NFS:
957 NFS: Proc = 11 (Rename)
958 NFS: File handle = 000016430000000100080000305A1C47
959 NFS: 597A0000000800002046314AFC450000
960 NFS: File name = MTra00192
961 NFS: File handle = 000016430000000100080000305A1C47
962 NFS: 597A0000000800002046314AFC450000
963 NFS: File name = .nfs08
964 NFS:
965 .fi
966 .in -2
967 .sp
969 .sp
970 .LP
971 To view just the \fBNFS\fR packets between \fBsunroof\fR and \fBboutique\fR:
973 .sp
974 .in +2
975 .nf
976 example# \fBsnoop -i pkts rpc nfs and sunroof and boutique\fR
977 1 0.0000 boutique -> sunroof NFS C GETATTR FH=8E6C
978 2 0.0046 sunroof -> boutique NFS R GETATTR OK
979 3 0.0080 boutique -> sunroof NFS C RENAME FH=8E6C MTra00192 to .nfs08
980 .fi
981 .in -2
982 .sp
984 .sp
985 .LP
986 To save these packets to a new capture file:
988 .sp
989 .in +2
990 .nf
991 example# \fBsnoop -i pkts -o pkts.nfs rpc nfs sunroof boutique\fR
992 .fi
993 .in -2
994 .sp
996 .sp
997 .LP
998 To view encapsulated packets, there will be an indicator of encapsulation:
1000 .sp
1001 .in +2
1002 .nf
1003 example# \fBsnoop ip-in-ip\fR
1004 sunroof -> boutique ICMP Echo request (1 encap)
1005 .fi
1006 .in -2
1007 .sp
1009 .sp
1010 .LP
1011 If -V is used on an encapsulated packet:
1013 .sp
1014 .in +2
1015 .nf
1016 example# \fBsnoop -V ip-in-ip\fR
1017 sunroof -> boutique ETHER Type=0800 (IP), size = 118 bytes
1018 sunroof -> boutique IP D=172.16.40.222 S=172.16.40.200 LEN=104, ID=27497
1019 sunroof -> boutique IP D=10.1.1.2 S=10.1.1.1 LEN=84, ID=27497
1020 sunroof -> boutique ICMP Echo request
1021 .fi
1022 .in -2
1023 .sp
1025 .LP
1026 \fBExample 2 \fRSetting Up A More Efficient Filter
1027 .sp
1028 .LP
1029 To set up a more efficient filter, the following filters should be used toward
1030 the end of the expression, so that the first part of the expression can be set
1031 up in the kernel: \fBgreater\fR, \fBless\fR, \fBport\fR, \fBrpc\fR,
1032 \fBnofrag\fR, and \fBrelop\fR. The presence of \fBOR\fR makes it difficult to
1033 split the filtering when using these primitives that cannot be set in the
1034 kernel. Instead, use parentheses to enforce the primitives that should be
1035 \fBOR\fR'd.
1037 .sp
1038 .LP
1039 To capture packets between \fBfunky\fR and \fBpinky\fR of type \fBtcp\fR or
1040 \fBudp\fR on \fBport\fR 80:
1042 .sp
1043 .in +2
1044 .nf
1045 example# \fBsnoop funky and pinky and port 80 and tcp or udp\fR
1046 .fi
1047 .in -2
1048 .sp
1050 .sp
1051 .LP
1052 Since the primitive \fBport\fR cannot be handled by the kernel filter, and
1053 there is also an \fBOR\fR in the expression, a more efficient way to filter is
1054 to move the \fBOR\fR to the end of the expression and to use parentheses to
1055 enforce the \fBOR\fR between \fBtcp\fR and \fBudp\fR:
1057 .sp
1058 .in +2
1059 .nf
1060 example# \fBsnoop funky and pinky and (tcp or udp) and port 80\fR
1061 .fi
1062 .in -2
1063 .sp
1065 .SH EXIT STATUS
1066 .ne 2
1067 .na
1068 \fB\fB0\fR\fR
1069 .ad
1070 .RS 5n
1071 Successful completion.
1072 .RE
1074 .sp
1075 .ne 2
1076 .na
1077 \fB\fB1\fR\fR
1078 .ad
1079 .RS 5n
1080 An error occurred.
1081 .RE
1083 .SH FILES
1084 .ne 2
1085 .na
1086 \fB\fB/dev/audio\fR\fR
1087 .ad
1088 .RS 17n
1089 Symbolic link to the system's primary audio device.
1090 .RE
1092 .sp
1093 .ne 2
1094 .na
1095 \fB\fB/dev/null\fR\fR
1096 .ad
1097 .RS 17n
1098 The null file.
1099 .RE
1101 .sp
1102 .ne 2
1103 .na
1104 \fB\fB/etc/hosts\fR\fR
1105 .ad
1106 .RS 17n
1107 Host name database.
1108 .RE
1110 .sp
1111 .ne 2
1112 .na
1113 \fB\fB/etc/rpc\fR\fR
1114 .ad
1115 .RS 17n
1116 RPC program number data base.
1117 .RE
1119 .sp
1120 .ne 2
1121 .na
1122 \fB\fB/etc/services\fR\fR
1123 .ad
1124 .RS 17n
1125 Internet services and aliases.
1126 .RE
1128 .SH SEE ALSO
1129 .LP
1130 \fBdladm\fR(1M), \fBifconfig\fR(1M), \fBnetstat\fR(1M), \fBhosts\fR(4),
1131 \fBrpc\fR(4), \fBservices\fR(4), \fBattributes\fR(5), \fBaudio\fR(7I),
1132 \fBipnet\fR(7D), \fBbufmod\fR(7M), \fBdlpi\fR(7P), \fBpfmod\fR(7M)
1133 .sp
1134 .LP
1135 Callaghan, B. and Gilligan, R. \fIRFC 1761, Snoop Version 2 Packet Capture File
1136 Format\fR. Network Working Group. February 1995.
1137 .SH WARNINGS
1138 .LP
1139 The processing overhead is much higher for real-time packet interpretation.
1140 Consequently, the packet drop count may be higher. For more reliable capture,
1141 output raw packets to a file using the \fB-o\fR option and analyze the packets
1142 offline.
1143 .sp
1144 .LP
1145 Unfiltered packet capture imposes a heavy processing load on the host computer,
1146 particularly if the captured packets are interpreted real-time. This processing
1147 load further increases if verbose options are used. Since heavy use of
1148 \fBsnoop\fR may deny computing resources to other processes, it should not be
1149 used on production servers. Heavy use of \fBsnoop\fR should be restricted to a
1150 dedicated computer.
1151 .sp
1152 .LP
1153 \fBsnoop\fR does not reassemble \fBIP\fR fragments. Interpretation of higher
1154 level protocol halts at the end of the first \fBIP\fR fragment.
1155 .sp
1156 .LP
1157 \fBsnoop\fR may generate extra packets as a side-effect of its use. For example
1158 it may use a network name service to convert \fBIP\fR addresses
1159 to host names for display. Capturing into a file for later display can be used
1160 to postpone the address-to-name mapping until after the capture session is
1161 complete. Capturing into an NFS-mounted file may also generate extra packets.
1162 .sp
1163 .LP
1164 Setting the \fBsnaplen\fR (\fB-s\fR option) to small values may remove header
1165 information that is needed to interpret higher level protocols. The exact
1166 cutoff value depends on the network and protocols being used. For \fBNFS\fR
1167 Version 2 traffic using \fBUDP\fR on 10 Mb/s Ethernet, do not set \fBsnaplen\fR
1168 less than 150 bytes. For \fBNFS\fR Version 3 traffic using \fBTCP\fR on 100
1169 Mb/s Ethernet, \fBsnaplen\fR should be 250 bytes or more.
1170 .sp
1171 .LP
1172 \fBsnoop\fR requires information from an \fBRPC\fR request to fully interpret
1173 an \fBRPC\fR reply. If an \fBRPC\fR reply in a capture file or packet range
1174 does not have a request preceding it, then only the \fBRPC\fR reply header will
1175 be displayed.