IRIX Base Documentation 2001 May

home *** CD-ROM | disk | FTP | other *** search

/ IRIX Base Documentation 2001 May / SGI IRIX Base Documentation 2001 May.iso / usr / share / catman / a_man / cat1 / snoop.z / snoop

Wrap

Text File | 1998-10-20 | 45.6 KB | 619 lines

ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) NNNNAAAAMMMMEEEE snoop - capture and inspect network packets SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS ssssnnnnoooooooopppp [ ----aaaaPPPPDDDDSSSSvvvvVVVVNNNNCCCC ] [ ----dddd _d_e_v_i_c_e ] [ ----ssss _s_n_a_p_l_e_n ] [ ----cccc _m_a_x_c_o_u_n_t ] [ ----iiii _f_i_l_e_n_a_m_e ] [ ----oooo _f_i_l_e_n_a_m_e ] [ ----nnnn _f_i_l_e_n_a_m_e ] [ ----tttt [ rrrr | aaaa | dddd ] ] [ ----pppp _f_i_r_s_t [ , _l_a_s_t ] ] [ ----xxxx _o_f_f_s_e_t [ , _l_e_n_g_t_h ] ] [ _e_x_p_r_e_s_s_i_o_n ] DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN ssssnnnnoooooooopppp captures packets from the network and displays their contents. ssssnnnnoooooooopppp uses both the network packet filter and streams buffer modules to provide efficient capture of packets from the network. Captured packets can be displayed as they are received, or saved to a file for later inspection. ssssnnnnoooooooopppp can display packets in a single-line summary form or in verbose multi-line forms. In summary form, only the data pertaining to the highest level protocol is displayed. For example, an NFS packet will have only NFS information displayed. The underlying RPC, UDP, IP, and ethernet frame information is suppressed but can be displayed if either of the verbose options are chosen. OOOOPPPPTTTTIIIIOOOONNNNSSSS ----aaaa Listen to packets on ////ddddeeeevvvv////aaaauuuuddddiiiioooo (warning: can be noisy). ----PPPP Capture packets in non-promiscuous mode. Only broadcast, multicast, or packets addressed to the host machine will be seen. ----dddd _d_e_v_i_c_e Receive packets from the network using the interface specified by _d_e_v_i_c_e. Usually eeeecccc0000. The program nnnneeeettttssssttttaaaatttt(1M), when invoked with the ----iiii flag, lists all the interfaces that a machine has. Normally, ssssnnnnoooooooopppp will automatically choose the first non-loopback interface it finds. ----ssss _s_n_a_p_l_e_n Truncate each packet after _s_n_a_p_l_e_n bytes. Usually the whole packet is captured. This option is useful if only certain packet header information is required. The packet truncation is done within the kernel giving better utilization of the streams packet buffer. This means less chance of dropped packets due to buffer overflow during periods of high traffic. It also saves disk space when capturing large traces to a capture file. To capture only IP headers (no options) use a _s_n_a_p_l_e_n of 34. For UDP use 42, and for TCP use 54. You can capture RPC headers with a _s_n_a_p_l_e_n of 80 bytes. NFS headers can be captured in 120 bytes. PPPPaaaaggggeeee 1111 ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) ----cccc _m_a_x_c_o_u_n_t Quit after capturing _m_a_x_c_o_u_n_t packets. Otherwise keep capturing until there is no disk left or until interrupted with CTRL-C. ----iiii _f_i_l_e_n_a_m_e Display packets previously captured in _f_i_l_e_n_a_m_e. Without this option, ssssnnnnoooooooopppp reads packets from the network interface. If a _f_i_l_e_n_a_m_e....nnnnaaaammmmeeeessss file is present, it is automatically loaded into ssssnnnnoooooooopppp's IP address-to-name mapping table (See ----NNNN flag below). ----oooo _f_i_l_e_n_a_m_e Save captured packets in _f_i_l_e_n_a_m_e as they are captured. During packet capture, a count of the number of packets saved in the file is displayed. If you wish just to count packets without saving to a file, name the file ////ddddeeeevvvv////nnnnuuuullllllll. ----nnnn _f_i_l_e_n_a_m_e Use _f_i_l_e_n_a_m_e as an IP address-to-name mapping table. This file must have the same format as the ////eeeettttcccc////hhhhoooossssttttssss file (IP address followed by the hostname). ----DDDD Display number of packets dropped during capture on the summary line. ----SSSS Display size of the entire ethernet frame in bytes on the summary line. ----tttt [[[[ r |||| a |||| d ] Time-stamp presentation. Time-stamps are accurate to within a few microseconds. The default is for times to be presented in dddd (delta) format (the time since receiving the previous packet). Option aaaa (absolute) gives wall-clock time. Option rrrr (relative) gives time relative to the first packet displayed. This can be used with the ----pppp option to display time relative to any selected packet. ----vvvv Verbose mode. Print packet headers in lots of detail. This display consumes many lines per packet and should be used only on selected packets. ----VVVV Verbose summary mode. This is halfway between summary mode and verbose mode in degree of verbosity. Instead of displaying just the summary line for the highest level protocol in a packet, it displays a summary line for each protocol layer in the packet. For instance, for an NFS packet it will display a line each for the ETHER, IP, UDP, RPC and NFS layers. Verbose summary mode output may be easily piped through ggggrrrreeeepppp to extract packets of interest. For example to view only RPC summary lines: eeeexxxxaaaammmmpppplllleeee#### ssssnnnnoooooooopppp ----iiii rrrrppppcccc....ccccaaaapppp ----VVVV |||| ggggrrrreeeepppp RRRRPPPPCCCC PPPPaaaaggggeeee 2222 ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) ----pppp _f_i_r_s_t [ , _l_a_s_t ] Select one or more packets to be displayed from a capture file. The _f_i_r_s_t packet in the file is packet #1. ----xxxx _o_f_f_s_e_t [ , _l_e_n_g_t_h ] Display packet data in hexadecimal and ASCII format. The _o_f_f_s_e_t and _l_e_n_g_t_h values select a portion of the packet to be displayed. To display the whole packet, use an _o_f_f_s_e_t of 0. If a _l_e_n_g_t_h value is not provided, the rest of the packet is displayed. ----NNNN Create an IP address-to-name file from a capture file. This must be set together with the ----iiii option that names a capture file. The address-to-name file has the same name as the capture file with ....nnnnaaaammmmeeeessss appended. This file records the IP address to hostname mapping at the capture site and increases the portability of the capture file. Generate a ....nnnnaaaammmmeeeessss file if the capture file is to be analyzed elsewhere. Packets are not displayed when this flag is used. ----CCCC List the code generated from the filter expression for either the kernel packet filter, or ssssnnnnoooooooopppp's own filter. _e_x_p_r_e_s_s_i_o_n Select packets either from the network or from a capture file. Only packets for which the expression is true will be selected. If no expression is provided it is assumed to be true. Given a filter expression, ssssnnnnoooooooopppp generates code for either the kernel packet filter or for its own internal filter. If capturing packets with the network interface, code for the kernel packet filter is generated. This filter is implemented as a streams module, upstream of the buffer module. The buffer module accumulates packets until it becomes full and passes the packets on to ssssnnnnoooooooopppp. The kernel packet filter is very efficient, since it rejects unwanted packets in the kernel before they reach the packet buffer or ssssnnnnoooooooopppp. The kernel packet filter has some limitations in its implementation - it is possible to construct filter expressions that it cannot handle. In this event, ssssnnnnoooooooopppp generates code for its own filter. The ----CCCC flag can be used to view generated code for either the kernel's or ssssnnnnoooooooopppp's own packet filter. If packets are read from a capture file using the ----iiii option, only ssssnnnnoooooooopppp's packet filter is used. A filter _e_x_p_r_e_s_s_i_o_n consists of a series of one or more boolean primitives that may be combined with boolean operators ( AND , OR , and NOT ). Normal precedence rules for boolean operators apply. Order of evaluation of these operators may be controlled with parentheses. Since parentheses and other filter expression characters are known to the shell, it is often necessary to enclose the PPPPaaaaggggeeee 3333 ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) the filter expression in quotes. The primitives are: hhhhoooosssstttt _h_o_s_t_n_a_m_e True if the source or destination address is that of _h_o_s_t_n_a_m_e. The keyword hhhhoooosssstttt may be omitted if the name does not conflict with the name of another expression primitive e.g. "ppppiiiinnnnkkkkyyyy" selects packets transmitted to or received from the host ppppiiiinnnnkkkkyyyy whereas "ppppiiiinnnnkkkkyyyy aaaannnndddd ddddiiiinnnnkkkkyyyy" selects packets exchanged between hosts ppppiiiinnnnkkkkyyyy AND ddddiiiinnnnkkkkyyyy. Normally the IP address is used. With the eeeetttthhhheeeerrrr qualifier the ethernet address is used, for instance, "eeeetttthhhheeeerrrr ppppiiiinnnnkkkkyyyy". _i_p_a_d_d_r or _e_t_h_e_r_a_d_d_r Literal addresses, both IP dotted and ethernet colon are recognized. For example, "111122229999....111144444444....44440000....11113333" matches all packets with that IP address as source or destination, and similarly, "8888::::0000::::22220000::::ffff::::bbbb1111::::55551111" matches all packets with the ethernet address as source or destination. An ethernet address beginning with a letter is interpreted as a hostname. To avoid this, prepend a zero when specifying the address. For example, if the ethernet address is "aa:0:45:23:52:44", then specify it by add a leading zero to make it "0aa:0:45:23:52:44". ffffrrrroooommmm or ssssrrrrcccc A qualifier that modifies the following hhhhoooosssstttt, nnnneeeetttt, _i_p_a_d_d_r, _e_t_h_e_r_a_d_d_r, ppppoooorrrrtttt or rrrrppppcccc primitive to match just the source address, port, or RPC reply. ttttoooo or ddddsssstttt A qualifier that modifies the following hhhhoooosssstttt, nnnneeeetttt, _i_p_a_d_d_r, _e_t_h_e_r_a_d_d_r, ppppoooorrrrtttt or rrrrppppcccc primitive to match just the destination address, port, or RPC call. eeeetttthhhheeeerrrr A qualifier that modifies the following hhhhoooosssstttt primitive to resolve a name to an ethernet address. Normally, IP address matching is performed. eeeetttthhhheeeerrrrttttyyyyppppeeee _n_u_m_b_e_r True if the ethernet type field has value _n_u_m_b_e_r. Equivalent to "eeeetttthhhheeeerrrr[[[[11112222::::2222]]]] ==== _n_u_m_b_e_r". iiiipppp, aaaarrrrpppp, rrrraaaarrrrpppp True if the packet is of the appropriate ethertype. bbbbrrrrooooaaaaddddccccaaaasssstttt True if the packet is a broadcast packet. Equivalent to "eeeetttthhhheeeerrrr[[[[2222::::4444]]]] ==== 0000xxxxffffffffffffffffffffffffffffffff". PPPPaaaaggggeeee 4444 ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) mmmmuuuullllttttiiiiccccaaaasssstttt True if the packet is a multicast packet. Equivalent to "eeeetttthhhheeeerrrr[[[[0000]]]] &&&& 1111 ==== 1111". aaaapppppppplllleeee True if the packet is an Apple Ethertalk packet. Equivalent to "eeeetttthhhheeeerrrrttttyyyyppppeeee 0000xxxx888800009999bbbb oooorrrr eeeetttthhhheeeerrrrttttyyyyppppeeee 0000xxxx888800003333ffff". ddddeeeeccccnnnneeeetttt True if the packet is a DECNET packet. ggggrrrreeeeaaaatttteeeerrrr _l_e_n_g_t_h True if the packet is longer than _l_e_n_g_t_h. lllleeeessssssss _l_e_n_g_t_h True if the packet is shorter than _l_e_n_g_t_h. uuuuddddpppp, ttttccccpppp, iiiiccccmmmmpppp True if the IP protocol is of the appropriate type. nnnneeeetttt _n_e_t True if either the IP source or destination address has a network number of _n_e_t. The ffffrrrroooommmm or ttttoooo qualifier may be used to select packets for which the network number occurs only in the source or destination address. ppppoooorrrrtttt _p_o_r_t True if either the source or destination port is _p_o_r_t. The _p_o_r_t may be either a port number or name from ////eeeettttcccc////sssseeeerrrrvvvviiiicccceeeessss. The ttttccccpppp or uuuuddddpppp primitives may be used to select TCP or UDP ports only. The ffffrrrroooommmm or ttttoooo qualifier may be used to select packets for which the _p_o_r_t occurs only as the source or destination. rrrrppppcccc _p_r_o_g [ , _v_e_r_s [ , _p_r_o_c ] ] True if the packet is an RPC call or reply packet for the protocol identified by _p_r_o_g. The _p_r_o_g may be either the name of an RPC protocol from ////eeeettttcccc////rrrrppppcccc or a program number. The _v_e_r_s and _p_r_o_c may be used to further qualify the program _v_e_r_s_i_o_n and _p_r_o_c_e_d_u_r_e number, for example, "rrrrppppcccc nnnnffffssss,,,,2222,,,,0000" selects all calls and replies for the NFS null procedure. The ttttoooo or ffffrrrroooommmm qualifier may be used to select either call or reply packets only. ggggaaaatttteeeewwwwaaaayyyy _h_o_s_t True if the packet used _h_o_s_t as a gateway, that is, the ethernet source or destination address was for _h_o_s_t but not the IP address. Equivalent to "eeeetttthhhheeeerrrr hhhhoooosssstttt _h_o_s_t and not host _h_o_s_t". PPPPaaaaggggeeee 5555 ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) nnnnooooffffrrrraaaagggg True if the packet is unfragmented or is the first in a series of IP fragments. Equivalent to "iiiipppp[[[[6666::::2222]]]] &&&& 0000xxxx1111ffffffffffff ==== 0000". _e_x_p_r _r_e_l_o_p _e_x_p_r True if the relation holds, where _r_e_l_o_p is one of >>>>, <<<<, >>>>====, <<<<====, ====, !!!!====, and _e_x_p_r is an arithmetic expression composed of numbers, packet field selectors, the lllleeeennnnggggtttthhhh primitive, and arithmetic operators ++++, ----, ****, &&&&, ||||, ^^^^, and%%%%. The arithmetic operators within _e_x_p_r are evaluated before the relational operator and normal precedence rules apply between the arithmetic operators, such as multiplication before addition. Parentheses may be used to control the order of evaluation. To use the value of a field in the packet use the following syntax: _b_a_s_e[_e_x_p_r [:::: _s_i_z_e ] ] where _e_x_p_r evaluates the value of an offset into the packet from a _b_a_s_e offset which may be eeeetttthhhheeeerrrr, iiiipppp, uuuuddddpppp, ttttccccpppp, or iiiiccccmmmmpppp. The _s_i_z_e value specifies the size of the field. If not given, 1 is assumed. Other legal values are 2 and 4. Examples: "eeeetttthhhheeeerrrr[[[[0000]]]] &&&& 1111 ==== 1111" is equivalent to mmmmuuuullllttttiiiiccccaaaasssstttt. "eeeetttthhhheeeerrrr[[[[2222::::4444]]]] ==== 0000xxxxffffffffffffffffffffffffffffffff" is equivalent to bbbbrrrrooooaaaaddddccccaaaasssstttt. "iiiipppp[[[[iiiipppp[[[[0000]]]] &&&& 0000xxxxffff **** 4444 :::: 2222]]]] ==== 2222000044449999" is equivalent to "uuuuddddpppp[[[[0000::::2222]]]] ==== 2222000044449999". "iiiipppp[[[[0000]]]] &&&& 0000xxxxffff >>>> 5555" selects IP packets with options. "iiiipppp[[[[6666::::2222]]]] &&&& 0000xxxx1111ffffffffffff ==== 0000" eliminates IP fragments. "uuuuddddpppp aaaannnndddd iiiipppp[[[[6666::::2222]]]]&&&&0000xxxx1111ffffffffffff ==== 0000 aaaannnndddd uuuuddddpppp[[[[6666::::2222]]]] !!!!==== 0000" finds all packets with UDP checksums. The lllleeeennnnggggtttthhhh primitive may be used to obtain the length of the packet. For instance "lllleeeennnnggggtttthhhh >>>> 66660000" is equivalent to "ggggrrrreeeeaaaatttteeeerrrr 66660000", and "eeeetttthhhheeeerrrr[[[[lllleeeennnnggggtttthhhh ---- 1111]]]]" obtains the value of the last byte in a packet. aaaannnndddd Perform a logical AND operation between two boolean values. The AND operation is implied by the juxtaposition of two boolean expressions, for example "ddddiiiinnnnkkkkyyyy ppppiiiinnnnkkkkyyyy" is the same as "ddddiiiinnnnkkkkyyyy AAAANNNNDDDD ppppiiiinnnnkkkkyyyy". PPPPaaaaggggeeee 6666 ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) oooorrrr or ,,,, Perform a logical OR operation between two boolean values. A comma may be used instead, for example, "ddddiiiinnnnkkkkyyyy,,,,ppppiiiinnnnkkkkyyyy" is the same as "ddddiiiinnnnkkkkyyyy OOOORRRR ppppiiiinnnnkkkkyyyy". nnnnooootttt or !!!! Perform a logical NOT operation on the following boolean value. This operator is evaluated before AND or OR . EEEEXXXXAAAAMMMMPPPPLLLLEEEESSSS Capture all packets and display them as they are received: eeeexxxxaaaammmmpppplllleeee####snoop Capture packets with host ffffuuuunnnnkkkkyyyy as either the source or destination and display them as they are received: eeeexxxxaaaammmmpppplllleeee####snoopffffuuuunnnnkkkkyyyy Capture packets between ffffuuuunnnnkkkkyyyy and ppppiiiinnnnkkkkyyyy and save them to a file. Then inspect the packets using times (in seconds) relative to the first captured packet: eeeexxxxaaaammmmpppplllleeee#### ssssnnnnoooooooopppp ----oooo ccccaaaapppp ffffuuuunnnnkkkkyyyy ppppiiiinnnnkkkkyyyy eeeexxxxaaaammmmpppplllleeee$$$$ ssssnnnnoooooooopppp ----iiii ccccaaaapppp ----tttt rrrr |||| mmmmoooorrrreeee Look at selected packets in another capture file: eeeexxxxaaaammmmpppplllleeee$$$$ ssssnnnnoooooooopppp ----iiii ppppkkkkttttssss ----pppp99999999,,,,111100008888 99999999 0000....0000000022227777 bbbboooouuuuttttiiiiqqqquuuueeee ---->>>> ssssuuuunnnnrrrrooooooooffff NNNNFFFFSSSS CCCC GGGGEEEETTTTAAAATTTTTTTTRRRR FFFFHHHH====8888EEEE6666CCCC 111100000000 0000....0000000044446666 ssssuuuunnnnrrrrooooooooffff ---->>>> bbbboooouuuuttttiiiiqqqquuuueeee NNNNFFFFSSSS RRRR GGGGEEEETTTTAAAATTTTTTTTRRRR OOOOKKKK 111100001111 0000....0000000088880000 bbbboooouuuuttttiiiiqqqquuuueeee ---->>>> ssssuuuunnnnrrrrooooooooffff NNNNFFFFSSSS CCCC RRRREEEENNNNAAAAMMMMEEEE FFFFHHHH====8888EEEE6666CCCC MMMMTTTTrrrraaaa00000000111199992222 ttttoooo ....nnnnffffssss00008888 111100002222 0000....0000111100002222 mmmmaaaarrrrmmmmooootttt ---->>>> vvvviiiippppeeeerrrr NNNNFFFFSSSS CCCC LLLLOOOOOOOOKKKKUUUUPPPP FFFFHHHH====555566661111EEEE ssssccccrrrreeeeeeeennnn....rrrr....11113333....iiii333388886666 111100003333 0000....0000000077772222 vvvviiiippppeeeerrrr ---->>>> mmmmaaaarrrrmmmmooootttt NNNNFFFFSSSS RRRR LLLLOOOOOOOOKKKKUUUUPPPP NNNNoooo ssssuuuucccchhhh ffffiiiilllleeee oooorrrr ddddiiiirrrreeeeccccttttoooorrrryyyy 111100004444 0000....0000000088885555 bbbbuuuuggggbbbboooommmmbbbb ---->>>> ssssuuuunnnnrrrrooooooooffff RRRRLLLLOOOOGGGGIIIINNNN CCCC PPPPOOOORRRRTTTT====1111000022223333 hhhh 111100005555 0000....0000000000005555 kkkkaaaannnnddddiiiinnnnsssskkkkyyyy ---->>>> ssssppppaaaarrrrkkkkyyyy RRRRSSSSTTTTAAAATTTT CCCC GGGGeeeetttt SSSSttttaaaattttiiiissssttttiiiiccccssss 111100006666 0000....0000000000004444 bbbbeeeeeeeebbbblllleeeebbbbrrrrooooxxxx ---->>>> ssssuuuunnnnrrrrooooooooffff NNNNFFFFSSSS CCCC GGGGEEEETTTTAAAATTTTTTTTRRRR FFFFHHHH====0000333300007777 111100007777 0000....0000000022221111 ssssppppaaaarrrrkkkkyyyy ---->>>> kkkkaaaannnnddddiiiinnnnsssskkkkyyyy RRRRSSSSTTTTAAAATTTT RRRR 111100008888 0000....0000000077773333 ooooffffffffiiiicccceeee ---->>>> jjjjeeeerrrreeeemmmmiiiiaaaahhhh NNNNFFFFSSSS CCCC RRRREEEEAAAADDDD FFFFHHHH====2222555588884444 aaaatttt 44440000999966660000 ffffoooorrrr 8888111199992222 Packet 101 Looks interesting. Take a look in more detail: eeeexxxxaaaammmmpppplllleeee$$$$ ssssnnnnoooooooopppp ----iiii ppppkkkkttttssss ----vvvv ----pppp111100001111 EEEETTTTHHHHEEEERRRR:::: -------------------- EEEEtttthhhheeeerrrr HHHHeeeeaaaaddddeeeerrrr -------------------- EEEETTTTHHHHEEEERRRR:::: EEEETTTTHHHHEEEERRRR:::: PPPPaaaacccckkkkeeeetttt 111100001111 aaaarrrrrrrriiiivvvveeeedddd aaaatttt 11116666::::00009999::::55553333....55559999 EEEETTTTHHHHEEEERRRR:::: PPPPaaaacccckkkkeeeetttt ssssiiiizzzzeeee ==== 222211110000 bbbbyyyytttteeeessss EEEETTTTHHHHEEEERRRR:::: DDDDeeeessssttttiiiinnnnaaaattttiiiioooonnnn ==== 8888::::0000::::22220000::::1111::::3333dddd::::99994444,,,, SSSSuuuunnnn EEEETTTTHHHHEEEERRRR:::: SSSSoooouuuurrrrcccceeee ==== 8888::::0000::::66669999::::1111::::5555ffff::::eeee,,,, SSSSiiiilllliiiiccccoooonnnn GGGGrrrraaaapppphhhhiiiiccccssss EEEETTTTHHHHEEEERRRR:::: EEEEtttthhhheeeerrrrttttyyyyppppeeee ==== 0000888800000000 ((((IIIIPPPP)))) EEEETTTTHHHHEEEERRRR:::: IIIIPPPP:::: -------------------- IIIIPPPP HHHHeeeeaaaaddddeeeerrrr -------------------- IIIIPPPP:::: IIIIPPPP:::: VVVVeeeerrrrssssiiiioooonnnn ==== 4444,,,, hhhheeeeaaaaddddeeeerrrr lllleeeennnnggggtttthhhh ==== 22220000 bbbbyyyytttteeeessss IIIIPPPP:::: TTTTyyyyppppeeee ooooffff sssseeeerrrrvvvviiiicccceeee ==== 00000000 IIIIPPPP:::: ........0000.... ................ ==== rrrroooouuuuttttiiiinnnneeee IIIIPPPP:::: ............0000 ................ ==== nnnnoooorrrrmmmmaaaallll ddddeeeellllaaaayyyy IIIIPPPP:::: ................ 0000............ ==== nnnnoooorrrrmmmmaaaallll tttthhhhrrrroooouuuugggghhhhppppuuuutttt IIIIPPPP:::: ................ ....0000........ ==== nnnnoooorrrrmmmmaaaallll rrrreeeelllliiiiaaaabbbbiiiilllliiiittttyyyy IIIIPPPP:::: TTTToooottttaaaallll lllleeeennnnggggtttthhhh ==== 111199996666 bbbbyyyytttteeeessss IIIIPPPP:::: IIIIddddeeeennnnttttiiiiffffiiiiccccaaaattttiiiioooonnnn 11119999888844446666 IIIIPPPP:::: FFFFllllaaaaggggssss ==== 0000XXXX IIIIPPPP:::: ....0000........ ................ ==== mmmmaaaayyyy ffffrrrraaaaggggmmmmeeeennnntttt IIIIPPPP:::: ........0000.... ................ ==== mmmmoooorrrreeee ffffrrrraaaaggggmmmmeeeennnnttttssss IIIIPPPP:::: FFFFrrrraaaaggggmmmmeeeennnntttt ooooffffffffsssseeeetttt ==== 0000 bbbbyyyytttteeeessss IIIIPPPP:::: TTTTiiiimmmmeeee ttttoooo lllliiiivvvveeee ==== 222255555555 sssseeeeccccoooonnnnddddssss////hhhhooooppppssss IIIIPPPP:::: PPPPrrrroooottttooooccccoooollll ==== 11117777 ((((UUUUDDDDPPPP)))) IIIIPPPP:::: HHHHeeeeaaaaddddeeeerrrr cccchhhheeeecccckkkkssssuuuummmm ==== 11118888DDDDCCCC IIIIPPPP:::: SSSSoooouuuurrrrcccceeee aaaaddddddddrrrreeeessssssss ==== 111122229999....111144444444....44440000....222222222222,,,, bbbboooouuuuttttiiiiqqqquuuueeee IIIIPPPP:::: DDDDeeeessssttttiiiinnnnaaaattttiiiioooonnnn aaaaddddddddrrrreeeessssssss ==== 111122229999....111144444444....44440000....222200000000,,,, ssssuuuunnnnrrrrooooooooffff IIIIPPPP:::: UUUUDDDDPPPP:::: -------------------- UUUUDDDDPPPP HHHHeeeeaaaaddddeeeerrrr -------------------- PPPPaaaaggggeeee 7777 ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) UUUUDDDDPPPP:::: UUUUDDDDPPPP:::: SSSSoooouuuurrrrcccceeee ppppoooorrrrtttt ==== 1111000022223333 UUUUDDDDPPPP:::: DDDDeeeessssttttiiiinnnnaaaattttiiiioooonnnn ppppoooorrrrtttt ==== 2222000044449999 ((((SSSSuuuunnnn RRRRPPPPCCCC)))) UUUUDDDDPPPP:::: LLLLeeeennnnggggtttthhhh ==== 111177776666 UUUUDDDDPPPP:::: CCCChhhheeeecccckkkkssssuuuummmm ==== 0000 UUUUDDDDPPPP:::: RRRRPPPPCCCC:::: -------------------- SSSSUUUUNNNN RRRRPPPPCCCC HHHHeeeeaaaaddddeeeerrrr -------------------- RRRRPPPPCCCC:::: RRRRPPPPCCCC:::: TTTTrrrraaaannnnssssaaaaccccttttiiiioooonnnn iiiidddd ==== 666666665555999900005555 RRRRPPPPCCCC:::: TTTTyyyyppppeeee ==== 0000 ((((CCCCaaaallllllll)))) RRRRPPPPCCCC:::: RRRRPPPPCCCC vvvveeeerrrrssssiiiioooonnnn ==== 2222 RRRRPPPPCCCC:::: PPPPrrrrooooggggrrrraaaammmm ==== 111100000000000000003333 ((((NNNNFFFFSSSS)))),,,, vvvveeeerrrrssssiiiioooonnnn ==== 2222,,,, pppprrrroooocccceeeedddduuuurrrreeee ==== 1111 RRRRPPPPCCCC:::: CCCCrrrreeeeddddeeeennnnttttiiiiaaaallllssss:::: FFFFllllaaaavvvvoooorrrr ==== 1111 ((((UUUUnnnniiiixxxx)))),,,, lllleeeennnn ==== 33332222 bbbbyyyytttteeeessss RRRRPPPPCCCC:::: TTTTiiiimmmmeeee ==== 00006666----MMMMaaaarrrr----99990000 00007777::::22226666::::55558888 RRRRPPPPCCCC:::: HHHHoooossssttttnnnnaaaammmmeeee ==== bbbboooouuuuttttiiiiqqqquuuueeee RRRRPPPPCCCC:::: UUUUiiiidddd ==== 0000,,,, GGGGiiiidddd ==== 1111 RRRRPPPPCCCC:::: GGGGrrrroooouuuuppppssss ==== 1111 RRRRPPPPCCCC:::: VVVVeeeerrrriiiiffffiiiieeeerrrr :::: FFFFllllaaaavvvvoooorrrr ==== 0000 ((((NNNNoooonnnneeee)))),,,, lllleeeennnn ==== 0000 bbbbyyyytttteeeessss RRRRPPPPCCCC:::: NNNNFFFFSSSS:::: -------------------- SSSSUUUUNNNN NNNNFFFFSSSS -------------------- NNNNFFFFSSSS:::: NNNNFFFFSSSS:::: PPPPrrrroooocccc ==== 11111111 ((((RRRReeeennnnaaaammmmeeee)))) NNNNFFFFSSSS:::: FFFFiiiilllleeee hhhhaaaannnnddddlllleeee ==== 000000000000000011116666444433330000000000000000000000000000111100000000000088880000000000000000333300005555AAAA1111CCCC44447777 NNNNFFFFSSSS:::: 555599997777AAAA0000000000000000000000000000888800000000000000002222000044446666333311114444AAAAFFFFCCCC444455550000000000000000 NNNNFFFFSSSS:::: FFFFiiiilllleeee nnnnaaaammmmeeee ==== MMMMTTTTrrrraaaa00000000111199992222 NNNNFFFFSSSS:::: FFFFiiiilllleeee hhhhaaaannnnddddlllleeee ==== 000000000000000011116666444433330000000000000000000000000000111100000000000088880000000000000000333300005555AAAA1111CCCC44447777 NNNNFFFFSSSS:::: 555599997777AAAA0000000000000000000000000000888800000000000000002222000044446666333311114444AAAAFFFFCCCC444455550000000000000000 NNNNFFFFSSSS:::: FFFFiiiilllleeee nnnnaaaammmmeeee ==== ....nnnnffffssss00008888 NNNNFFFFSSSS:::: View just the NFS packets between ssssuuuunnnnrrrrooooooooffff and bbbboooouuuuttttiiiiqqqquuuueeee: eeeexxxxaaaammmmpppplllleeee$$$$ ssssnnnnoooooooopppp ----iiii ppppkkkkttttssss rrrrppppcccc nnnnffffssss aaaannnndddd ssssuuuunnnnrrrrooooooooffff aaaannnndddd bbbboooouuuuttttiiiiqqqquuuueeee 1111 0000....0000000000000000 bbbboooouuuuttttiiiiqqqquuuueeee ---->>>> ssssuuuunnnnrrrrooooooooffff NNNNFFFFSSSS CCCC GGGGEEEETTTTAAAATTTTTTTTRRRR FFFFHHHH====8888EEEE6666CCCC 2222 0000....0000000044446666 ssssuuuunnnnrrrrooooooooffff ---->>>> bbbboooouuuuttttiiiiqqqquuuueeee NNNNFFFFSSSS RRRR GGGGEEEETTTTAAAATTTTTTTTRRRR OOOOKKKK 3333 0000....0000000088880000 bbbboooouuuuttttiiiiqqqquuuueeee ---->>>> ssssuuuunnnnrrrrooooooooffff NNNNFFFFSSSS CCCC RRRREEEENNNNAAAAMMMMEEEE FFFFHHHH====8888EEEE6666CCCC MMMMTTTTrrrraaaa00000000111199992222 ttttoooo ....nnnnffffssss00008888 Save these packets to a new capture file: $$$$ ssssnnnnoooooooopppp ----iiii ppppkkkkttttssss ----oooo ppppkkkkttttssss....nnnnffffssss rrrrppppcccc nnnnffffssss ssssuuuunnnnrrrrooooooooffff bbbboooouuuuttttiiiiqqqquuuueeee EEEEXXXXIIIITTTT SSSSTTTTAAAATTTTUUUUSSSS Unless ssssnnnnoooooooopppp receives an error signal, its Exit Status is zero. All abnormal exits return 1111. WWWWAAAARRRRNNNNIIIINNNNGGGGSSSS The processing overhead is much higher for realtime packet interpretation. Consequently, the packet drop count may be higher. For more reliable capture, output raw packets to a file using the ----oooo option and analyze the packets off-line. Unfiltered packet capture imposes a heavy processing load on the host computer-particularly if the captured packets are interpreted realtime. This processing load further increases if verbose options are used. Since heavy use of ssssnnnnoooooooopppp may deny computing resources to other processes, it should not be used on production servers. Heavy use of ssssnnnnoooooooopppp should be restricted to a dedicated computer. ssssnnnnoooooooopppp does not reassemble IP fragments. Interpretation of higher level protocol halts at the end of the first IP fragment. ssssnnnnoooooooopppp may generate extra packets as a side-effect of its use. For example it may use a network name service (NIS or NIS+) to convert IP addresses to host names for display. Capturing into a file for later display can be used to postpone the address-to-name mapping until after the capture session is complete. Capturing into an NFS-mounted file may also generate extra packets. PPPPaaaaggggeeee 8888 ssssnnnnoooooooopppp((((1111MMMM)))) ssssnnnnoooooooopppp((((1111MMMM)))) Setting the ssssnnnnaaaapppplllleeeennnn( ----ssss option) to small values may remove header information required for packet interpretation for higher level protocols. For complete NFS interpretation do not set ssssnnnnaaaapppplllleeeennnn less than 120 bytes. ssssnnnnoooooooopppp requires information from an RPC request to fully interpret an RPC reply. If an RPC reply in a capture file or packet range does not have a request preceding it, then only the RPC reply header will be displayed. NNNNOOOOTTTTEEEESSSS ssssnnnnoooooooopppp requires an interactive interface. PPPPaaaaggggeeee 9999