home *** CD-ROM | disk | FTP | other *** search
open in: 
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text
This file was processed as: Tape Archive
(archive/tar).
You can browse this item here: tcpdump.tar
| Confidence | Program | Detection | Match Type | Support
|
|---|
| 100%
| dexvert
| Tape Archive (archive/tar)
| magic
| Supported |
| 100%
| file
| tar archive
| default
| |
| 99%
| file
| tar archive (V7), file README, mode 440 , uid 2011 , gid 34 , size 30001 , seconds 4573764747
| default
| |
| 98%
| file
| data
| default
| |
| 100%
| TrID
| Sybase iAnywhere database files
| default (weak)
| |
| 100%
| siegfried
| x-fmt/265 Tape Archive Format
| default
| |
| 100%
| lsar
| Tar
| default
| |
| 100%
| gt2
| TAR Archiv gefunden (Auflistung ist deaktiviert)
| default
| |
| 100%
| disktype
| Pre-POSIX tar archive
| default
|
|
hex view+--------+-------------------------+-------------------------+--------+--------+
|00000000| 52 45 41 44 4d 45 00 00 | 00 00 00 00 00 00 00 00 |README..|........|
|00000010| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000020| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000030| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000040| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000050| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000060| 00 00 00 00 20 20 20 34 | 34 30 20 00 20 20 32 30 |.... 4|40 . 20|
|00000070| 31 31 20 00 20 20 20 20 | 33 34 20 00 20 20 20 20 |11 . |34 . |
|00000080| 20 20 33 30 30 30 31 20 | 20 34 35 37 33 37 36 34 | 30001 | 4573764|
|00000090| 37 34 37 20 20 20 35 30 | 33 33 00 20 00 00 00 00 |747 50|33. ....|
|000000a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000100| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000110| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000120| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000130| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000140| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000150| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000160| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000170| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000180| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000190| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000200| 53 61 74 20 4d 61 72 20 | 20 33 20 30 34 3a 34 35 |Sat Mar | 3 04:45|
|00000210| 3a 33 39 20 50 53 54 20 | 31 39 39 30 0a 0a 54 68 |:39 PST |1990..Th|
|00000220| 69 73 20 64 69 72 65 63 | 74 6f 72 79 20 66 69 6c |is direc|tory fil|
|00000230| 65 20 63 6f 6e 74 61 69 | 6e 73 20 79 65 74 20 61 |e contai|ns yet a|
|00000240| 6e 6f 74 68 65 72 20 62 | 65 74 61 20 72 65 6c 65 |nother b|eta rele|
|00000250| 61 73 65 20 6f 66 20 74 | 68 65 0a 73 6f 75 72 63 |ase of t|he.sourc|
|00000260| 65 20 66 6f 72 20 74 63 | 70 64 75 6d 70 2e 20 20 |e for tc|pdump. |
|00000270| 57 65 20 61 72 65 20 73 | 74 69 6c 6c 20 69 6e 20 |We are s|till in |
|00000280| 74 68 65 20 6d 69 64 64 | 6c 65 20 6f 66 20 72 65 |the midd|le of re|
|00000290| 70 6c 61 63 69 6e 67 20 | 74 68 65 0a 53 75 6e 20 |placing |the.Sun |
|000002a0| 4e 49 54 20 69 6e 74 65 | 72 66 61 63 65 20 77 69 |NIT inte|rface wi|
|000002b0| 74 68 20 61 6e 20 65 6e | 68 61 6e 63 65 64 20 76 |th an en|hanced v|
|000002c0| 65 72 73 69 6f 6e 20 6f | 66 20 74 68 65 20 43 4d |ersion o|f the CM|
|000002d0| 55 2f 53 74 61 6e 66 6f | 72 64 0a 70 61 63 6b 65 |U/Stanfo|rd.packe|
|000002e0| 74 20 66 69 6c 74 65 72 | 20 74 68 61 74 20 77 61 |t filter| that wa|
|000002f0| 73 20 64 69 73 74 72 69 | 62 75 74 65 64 20 77 69 |s distri|buted wi|
|00000300| 74 68 20 34 2e 33 62 73 | 64 2e 20 20 57 65 20 68 |th 4.3bs|d. We h|
|00000310| 6f 70 65 20 74 68 61 74 | 0a 74 68 65 20 6e 65 78 |ope that|.the nex|
|00000320| 74 20 76 65 72 73 69 6f | 6e 20 6f 66 20 74 63 70 |t versio|n of tcp|
|00000330| 64 75 6d 70 20 77 69 6c | 6c 20 72 75 6e 20 61 6e |dump wil|l run an|
|00000340| 20 61 6e 79 20 34 62 73 | 64 20 73 79 73 74 65 6d | any 4bs|d system|
|00000350| 2c 20 6e 6f 74 20 6a 75 | 73 74 0a 53 75 6e 73 2e |, not ju|st.Suns.|
|00000360| 20 20 4f 75 72 20 69 6e | 74 65 6e 74 20 69 73 20 | Our in|tent is |
|00000370| 74 6f 20 69 6e 63 6c 75 | 64 65 20 74 68 65 20 6e |to inclu|de the n|
|00000380| 65 77 20 76 65 72 73 69 | 6f 6e 20 77 69 74 68 20 |ew versi|on with |
|00000390| 74 68 65 20 34 2e 34 62 | 73 64 0a 64 69 73 74 72 |the 4.4b|sd.distr|
|000003a0| 69 62 75 74 69 6f 6e 2e | 0a 0a 4d 61 6a 6f 72 20 |ibution.|..Major |
|000003b0| 63 68 61 6e 67 65 73 20 | 66 72 6f 6d 20 74 68 65 |changes |from the|
|000003c0| 20 4a 75 6e 65 20 27 38 | 39 20 72 65 6c 65 61 73 | June '8|9 releas|
|000003d0| 65 20 74 6f 20 74 68 69 | 73 20 72 65 6c 65 61 73 |e to thi|s releas|
|000003e0| 65 20 61 72 65 3a 0a 0a | 20 2d 20 53 70 61 72 63 |e are:..| - Sparc|
|000003f0| 20 61 72 63 68 69 74 65 | 63 74 75 72 65 73 2c 20 | archite|ctures, |
|00000400| 69 6e 63 6c 75 64 69 6e | 67 20 74 68 65 20 53 70 |includin|g the Sp|
|00000410| 61 72 63 73 74 61 74 69 | 6f 6e 2d 31 2c 20 61 72 |arcstati|on-1, ar|
|00000420| 65 20 6e 6f 77 20 73 75 | 70 70 6f 72 74 65 64 0a |e now su|pported.|
|00000430| 20 20 20 74 68 61 6e 6b | 73 20 74 6f 20 53 74 65 | thank|s to Ste|
|00000440| 76 65 20 4d 63 43 61 6e | 6e 65 20 61 6e 64 20 43 |ve McCan|ne and C|
|00000450| 72 61 69 67 20 4c 65 72 | 65 73 2e 0a 0a 20 2d 20 |raig Ler|es... - |
|00000460| 53 75 6e 4f 53 20 34 2e | 30 20 69 73 20 6e 6f 77 |SunOS 4.|0 is now|
|00000470| 20 73 75 70 70 6f 72 74 | 65 64 20 74 68 61 6e 6b | support|ed thank|
|00000480| 73 20 74 6f 20 4d 69 63 | 6b 79 20 4c 69 75 20 6f |s to Mic|ky Liu o|
|00000490| 66 20 43 6f 6c 75 6d 62 | 69 61 20 55 6e 69 76 65 |f Columb|ia Unive|
|000004a0| 72 73 69 74 79 0a 20 20 | 20 28 6d 69 63 6b 79 40 |rsity. | (micky@|
|000004b0| 63 75 6e 69 78 63 2e 63 | 63 2e 63 6f 6c 75 6d 62 |cunixc.c|c.columb|
|000004c0| 69 61 2e 65 64 75 29 2e | 20 54 6f 20 63 6f 6d 70 |ia.edu).| To comp|
|000004d0| 69 6c 65 2c 20 79 6f 75 | 20 6e 65 65 64 20 74 6f |ile, you| need to|
|000004e0| 20 64 65 66 69 6e 65 20 | 53 55 4e 4f 53 34 2e 0a | define |SUNOS4..|
|000004f0| 20 20 20 59 6f 75 20 77 | 69 6c 6c 20 61 6c 73 6f | You w|ill also|
|00000500| 20 6e 65 65 64 20 74 6f | 20 72 65 70 6c 61 63 65 | need to| replace|
|00000510| 20 74 68 65 20 53 75 6e | 20 73 75 70 70 6c 69 65 | the Sun| supplie|
|00000520| 64 20 2f 73 79 73 2f 4f | 42 4a 2f 6e 69 74 5f 69 |d /sys/O|BJ/nit_i|
|00000530| 66 2e 6f 0a 20 20 20 77 | 69 74 68 20 74 68 65 20 |f.o. w|ith the |
|00000540| 61 70 70 72 6f 70 72 69 | 61 74 65 20 76 65 72 73 |appropri|ate vers|
|00000550| 69 6f 6e 20 66 72 6f 6d | 20 74 68 69 73 20 64 69 |ion from| this di|
|00000560| 73 74 72 69 62 75 74 69 | 6f 6e 27 73 20 53 55 4e |stributi|on's SUN|
|00000570| 4f 53 34 20 73 75 62 64 | 69 72 65 63 74 6f 72 79 |OS4 subd|irectory|
|00000580| 3a 0a 09 20 20 20 6e 69 | 74 5f 69 66 2e 6f 2e 73 |:.. ni|t_if.o.s|
|00000590| 75 6e 33 09 28 61 6e 79 | 20 66 6c 61 76 6f 72 20 |un3.(any| flavor |
|000005a0| 6f 66 20 73 75 6e 33 29 | 0a 09 20 20 20 6e 69 74 |of sun3)|.. nit|
|000005b0| 5f 69 66 2e 6f 2e 73 70 | 61 72 63 09 28 61 6c 6c |_if.o.sp|arc.(all|
|000005c0| 20 53 75 6e 34 27 73 20 | 65 78 63 65 70 74 20 66 | Sun4's |except f|
|000005d0| 6f 72 20 74 68 65 20 53 | 70 61 72 63 73 74 61 74 |or the S|parcstat|
|000005e0| 69 6f 6e 2d 31 29 0a 09 | 20 20 20 6e 69 74 5f 69 |ion-1)..| nit_i|
|000005f0| 66 2e 6f 2e 73 75 6e 34 | 63 09 28 53 70 61 72 63 |f.o.sun4|c.(Sparc|
|00000600| 73 74 61 74 69 6f 6e 2d | 31 29 0a 20 20 20 54 68 |station-|1). Th|
|00000610| 65 73 65 20 6e 69 74 20 | 72 65 70 6c 61 63 65 6d |ese nit |replacem|
|00000620| 65 6e 74 73 20 66 69 78 | 20 61 20 62 75 67 20 74 |ents fix| a bug t|
|00000630| 68 61 74 20 6d 61 6b 65 | 73 20 6e 69 74 20 65 73 |hat make|s nit es|
|00000640| 73 65 6e 74 69 61 6c 6c | 79 0a 20 20 20 75 6e 75 |sentiall|y. unu|
|00000650| 73 61 62 6c 65 20 69 6e | 20 53 75 6e 20 4f 53 20 |sable in| Sun OS |
|00000660| 34 2e 20 20 49 6e 20 61 | 64 64 69 74 69 6f 6e 2c |4. In a|ddition,|
|00000670| 20 6f 75 72 20 73 75 6e | 34 63 20 6e 69 74 20 67 | our sun|4c nit g|
|00000680| 69 76 65 73 20 79 6f 75 | 0a 20 20 20 74 69 6d 65 |ives you|. time|
|00000690| 73 74 61 6d 70 73 20 74 | 6f 20 74 68 65 20 72 65 |stamps t|o the re|
|000006a0| 73 6f 6c 75 74 69 6f 6e | 20 6f 66 20 74 68 65 20 |solution| of the |
|000006b0| 53 53 2d 31 20 63 6c 6f | 63 6b 20 28 31 20 75 73 |SS-1 clo|ck (1 us|
|000006c0| 29 20 72 61 74 68 65 72 | 0a 20 20 20 74 68 61 6e |) rather|. than|
|000006d0| 20 74 68 65 20 6c 6f 75 | 73 79 20 32 30 6d 73 20 | the lou|sy 20ms |
|000006e0| 74 69 6d 65 73 74 61 6d | 70 73 20 53 75 6e 20 67 |timestam|ps Sun g|
|000006f0| 69 76 65 73 20 79 6f 75 | 20 20 28 74 63 70 64 75 |ives you| (tcpdu|
|00000700| 6d 70 20 77 69 6c 6c 0a | 20 20 20 70 72 69 6e 74 |mp will.| print|
|00000710| 20 6f 75 74 20 74 68 65 | 20 66 75 6c 6c 20 74 69 | out the| full ti|
|00000720| 6d 65 73 74 61 6d 70 20 | 72 65 73 6f 6c 75 74 69 |mestamp |resoluti|
|00000730| 6f 6e 20 69 66 20 69 74 | 20 66 69 6e 64 73 20 69 |on if it| finds i|
|00000740| 74 27 73 20 72 75 6e 6e | 69 6e 67 0a 20 20 20 6f |t's runn|ing. o|
|00000750| 6e 20 61 20 53 53 2d 31 | 29 2e 0a 0a 20 2d 20 49 |n a SS-1|)... - I|
|00000760| 50 20 6f 70 74 69 6f 6e | 73 20 61 72 65 20 6e 6f |P option|s are no|
|00000770| 77 20 70 72 69 6e 74 65 | 64 2e 0a 0a 20 2d 20 52 |w printe|d... - R|
|00000780| 49 50 20 70 61 63 6b 65 | 74 73 20 61 72 65 20 6e |IP packe|ts are n|
|00000790| 6f 77 20 70 72 69 6e 74 | 65 64 2e 0a 0a 20 2d 20 |ow print|ed... - |
|000007a0| 54 68 65 72 65 27 73 20 | 61 20 2d 76 20 66 6c 61 |There's |a -v fla|
|000007b0| 67 20 74 68 61 74 20 70 | 72 69 6e 74 73 20 6f 75 |g that p|rints ou|
|000007c0| 74 20 6d 6f 72 65 20 69 | 6e 66 6f 72 6d 61 74 69 |t more i|nformati|
|000007d0| 6f 6e 20 74 68 61 6e 20 | 74 68 65 0a 20 20 20 64 |on than |the. d|
|000007e0| 65 66 61 75 6c 74 20 28 | 65 2e 67 2e 2c 20 69 74 |efault (|e.g., it|
|000007f0| 20 77 69 6c 6c 20 65 6e | 61 62 6c 65 20 70 72 69 | will en|able pri|
|00000800| 6e 74 69 6e 67 20 6f 66 | 20 49 50 20 74 74 6c 2c |nting of| IP ttl,|
|00000810| 20 74 6f 73 20 61 6e 64 | 20 69 64 29 0a 20 20 20 | tos and| id). |
|00000820| 61 6e 64 20 2d 71 20 66 | 6c 61 67 20 74 68 61 74 |and -q f|lag that|
|00000830| 20 70 72 69 6e 74 73 20 | 6f 75 74 20 6c 65 73 73 | prints |out less|
|00000840| 20 28 65 2e 67 2e 2c 20 | 69 74 20 77 69 6c 6c 20 | (e.g., |it will |
|00000850| 64 69 73 61 62 6c 65 0a | 20 20 20 69 6e 74 65 72 |disable.| inter|
|00000860| 70 72 65 74 61 74 69 6f | 6e 20 6f 66 20 41 70 70 |pretatio|n of App|
|00000870| 6c 65 74 61 6c 6b 2d 69 | 6e 2d 55 44 50 29 2e 0a |letalk-i|n-UDP)..|
|00000880| 0a 20 2d 20 54 68 65 20 | 67 72 61 6d 6d 61 72 20 |. - The |grammar |
|00000890| 68 61 73 20 75 6e 64 65 | 72 67 6f 6e 65 20 73 75 |has unde|rgone su|
|000008a0| 62 73 74 61 6e 74 69 61 | 6c 20 63 68 61 6e 67 65 |bstantia|l change|
|000008b0| 73 20 28 69 66 20 79 6f | 75 20 68 61 76 65 20 61 |s (if yo|u have a|
|000008c0| 6e 0a 20 20 20 65 61 72 | 6c 69 65 72 20 76 65 72 |n. ear|lier ver|
|000008d0| 73 69 6f 6e 20 6f 66 20 | 74 63 70 64 75 6d 70 2c |sion of |tcpdump,|
|000008e0| 20 79 6f 75 20 73 68 6f | 75 6c 64 20 72 65 2d 72 | you sho|uld re-r|
|000008f0| 65 61 64 20 74 68 65 20 | 6d 61 6e 75 61 6c 0a 20 |ead the |manual. |
|00000900| 20 20 65 6e 74 72 79 29 | 2e 0a 0a 20 20 20 54 68 | entry)|... Th|
|00000910| 65 20 6d 6f 73 74 20 75 | 73 65 66 75 6c 20 63 68 |e most u|seful ch|
|00000920| 61 6e 67 65 20 69 73 20 | 74 68 65 20 61 64 64 69 |ange is |the addi|
|00000930| 74 69 6f 6e 20 6f 66 20 | 61 6e 20 65 78 70 72 65 |tion of |an expre|
|00000940| 73 73 69 6f 6e 0a 20 20 | 20 73 79 6e 74 61 78 20 |ssion. | syntax |
|00000950| 74 68 61 74 20 6c 65 74 | 73 20 79 6f 75 20 66 69 |that let|s you fi|
|00000960| 6c 74 65 72 20 6f 6e 20 | 61 72 62 69 74 72 61 72 |lter on |arbitrar|
|00000970| 79 20 66 69 65 6c 64 73 | 20 6f 72 20 76 61 6c 75 |y fields| or valu|
|00000980| 65 73 20 69 6e 20 74 68 | 65 0a 20 20 20 70 61 63 |es in th|e. pac|
|00000990| 6b 65 74 2e 20 20 45 2e | 67 2e 2c 20 22 69 70 5b |ket. E.|g., "ip[|
|000009a0| 30 5d 20 3e 20 30 78 34 | 35 22 20 77 6f 75 6c 64 |0] > 0x4|5" would|
|000009b0| 20 70 72 69 6e 74 20 6f | 6e 6c 79 20 70 61 63 6b | print o|nly pack|
|000009c0| 65 74 73 20 77 69 74 68 | 20 49 50 0a 20 20 20 6f |ets with| IP. o|
|000009d0| 70 74 69 6f 6e 73 2c 20 | 22 74 63 70 5b 31 33 5d |ptions, |"tcp[13]|
|000009e0| 20 26 20 33 20 21 3d 20 | 30 22 20 77 6f 75 6c 64 | & 3 != |0" would|
|000009f0| 20 70 72 69 6e 74 20 6f | 6e 6c 79 20 54 43 50 20 | print o|nly TCP |
|00000a00| 53 59 4e 20 61 6e 64 20 | 46 49 4e 0a 20 20 20 70 |SYN and |FIN. p|
|00000a10| 61 63 6b 65 74 73 2e 0a | 0a 20 20 20 54 68 65 20 |ackets..|. The |
|00000a20| 6d 6f 73 74 20 70 61 69 | 6e 66 75 6c 20 63 68 61 |most pai|nful cha|
|00000a30| 6e 67 65 20 69 73 20 74 | 68 61 74 20 63 6f 6e 63 |nge is t|hat conc|
|00000a40| 61 74 65 6e 61 74 69 6f | 6e 20 6e 6f 20 6c 6f 6e |atenatio|n no lon|
|00000a50| 67 65 72 20 6d 65 61 6e | 73 0a 20 20 20 22 61 6e |ger mean|s. "an|
|00000a60| 64 22 20 2d 2d 20 65 2e | 67 2e 2c 20 79 6f 75 20 |d" -- e.|g., you |
|00000a70| 68 61 76 65 20 74 6f 20 | 73 61 79 20 22 68 6f 73 |have to |say "hos|
|00000a80| 74 20 66 6f 6f 20 61 6e | 64 20 70 6f 72 74 20 62 |t foo an|d port b|
|00000a90| 61 72 22 20 69 6e 73 74 | 65 61 64 0a 20 20 20 6f |ar" inst|ead. o|
|00000aa0| 66 20 22 68 6f 73 74 20 | 66 6f 6f 20 70 6f 72 74 |f "host |foo port|
|00000ab0| 20 62 61 72 22 2e 20 20 | 54 68 65 20 75 70 20 73 | bar". |The up s|
|00000ac0| 69 64 65 20 74 6f 20 74 | 68 69 73 20 64 6f 77 6e |ide to t|his down|
|00000ad0| 20 69 73 20 74 68 61 74 | 0a 20 20 20 72 65 70 65 | is that|. repe|
|00000ae0| 61 74 65 64 20 71 75 61 | 6c 69 66 69 65 72 73 20 |ated qua|lifiers |
|00000af0| 63 61 6e 20 62 65 20 6f | 6d 69 74 74 65 64 2c 20 |can be o|mitted, |
|00000b00| 6d 61 6b 69 6e 67 20 6d | 6f 73 74 20 66 69 6c 74 |making m|ost filt|
|00000b10| 65 72 0a 20 20 20 65 78 | 70 72 65 73 73 69 6f 6e |er. ex|pression|
|00000b20| 73 20 73 68 6f 72 74 65 | 72 2e 20 20 45 2e 67 2e |s shorte|r. E.g.|
|00000b30| 2c 20 79 6f 75 20 63 61 | 6e 20 6e 6f 77 20 73 61 |, you ca|n now sa|
|00000b40| 79 20 22 69 70 20 68 6f | 73 74 20 66 6f 6f 20 61 |y "ip ho|st foo a|
|00000b50| 6e 64 0a 20 20 20 28 62 | 61 72 20 6f 72 20 62 61 |nd. (b|ar or ba|
|00000b60| 7a 29 22 20 74 6f 20 6c | 6f 6f 6b 20 61 74 20 69 |z)" to l|ook at i|
|00000b70| 70 20 74 72 61 66 66 69 | 63 20 62 65 74 77 65 65 |p traffi|c betwee|
|00000b80| 6e 20 68 6f 73 74 73 20 | 66 6f 6f 20 61 6e 64 20 |n hosts |foo and |
|00000b90| 62 61 72 20 6f 72 0a 20 | 20 20 62 65 74 77 65 65 |bar or. | betwee|
|00000ba0| 6e 20 68 6f 73 74 73 20 | 66 6f 6f 20 61 6e 64 20 |n hosts |foo and |
|00000bb0| 62 61 7a 2e 20 20 5b 54 | 68 65 20 6f 6c 64 20 77 |baz. [T|he old w|
|00000bc0| 61 79 20 6f 66 20 73 61 | 79 69 6e 67 20 74 68 69 |ay of sa|ying thi|
|00000bd0| 73 20 77 61 73 20 22 69 | 70 0a 20 20 20 68 6f 73 |s was "i|p. hos|
|00000be0| 74 20 66 6f 6f 20 61 6e | 64 20 28 69 70 20 68 6f |t foo an|d (ip ho|
|00000bf0| 73 74 20 62 61 72 20 6f | 72 20 69 70 20 68 6f 73 |st bar o|r ip hos|
|00000c00| 74 20 62 61 7a 29 22 2e | 5d 0a 0a 0a 0a 54 6f 20 |t baz)".|]....To |
|00000c10| 62 75 69 6c 74 20 74 63 | 70 64 75 6d 70 2c 20 65 |built tc|pdump, e|
|00000c20| 64 69 74 20 74 68 65 20 | 4d 61 6b 65 66 69 6c 65 |dit the |Makefile|
|00000c30| 20 74 6f 20 6d 61 6b 65 | 20 61 70 70 72 6f 70 72 | to make| appropr|
|00000c40| 69 61 74 65 20 63 68 61 | 6e 67 65 73 20 66 6f 72 |iate cha|nges for|
|00000c50| 0a 79 6f 75 72 20 73 69 | 74 65 2e 20 20 54 68 69 |.your si|te. Thi|
|00000c60| 6e 67 73 20 79 6f 75 20 | 6d 61 79 20 68 61 76 65 |ngs you |may have|
|00000c70| 20 74 6f 20 63 68 61 6e | 67 65 20 61 72 65 3a 0a | to chan|ge are:.|
|00000c80| 20 2d 20 64 65 66 69 6e | 65 20 22 43 43 20 3d 20 | - defin|e "CC = |
|00000c90| 63 63 22 20 69 66 20 79 | 6f 75 20 64 6f 6e 27 74 |cc" if y|ou don't|
|00000ca0| 20 68 61 76 65 20 67 63 | 63 2e 0a 20 2d 20 64 65 | have gc|c.. - de|
|00000cb0| 66 69 6e 65 20 22 59 41 | 43 43 20 3d 20 79 61 63 |fine "YA|CC = yac|
|00000cc0| 63 22 20 69 66 20 79 6f | 75 20 64 6f 6e 27 74 20 |c" if yo|u don't |
|00000cd0| 68 61 76 65 20 62 69 73 | 6f 6e 2e 0a 20 2d 20 64 |have bis|on.. - d|
|00000ce0| 65 66 69 6e 65 20 22 4c | 45 58 20 3d 20 6c 65 78 |efine "L|EX = lex|
|00000cf0| 22 20 61 6e 64 20 72 65 | 6d 6f 76 65 20 2d 44 46 |" and re|move -DF|
|00000d00| 4c 45 58 20 66 72 6f 6d | 20 44 45 46 49 4e 45 53 |LEX from| DEFINES|
|00000d10| 20 69 66 20 79 6f 75 20 | 64 6f 6e 27 74 20 68 61 | if you |don't ha|
|00000d20| 76 65 20 66 6c 65 78 2e | 0a 20 2d 20 64 65 66 69 |ve flex.|. - defi|
|00000d30| 6e 65 20 22 43 46 4c 41 | 47 53 5f 53 55 4e 33 20 |ne "CFLA|GS_SUN3 |
|00000d40| 3d 20 24 28 43 46 4c 41 | 47 53 5f 53 55 4e 4f 53 |= $(CFLA|GS_SUNOS|
|00000d50| 34 29 22 20 69 66 20 79 | 6f 75 20 72 75 6e 20 53 |4)" if y|ou run S|
|00000d60| 75 6e 20 4f 53 20 34 2e | 78 20 6f 6e 0a 20 20 20 |un OS 4.|x on. |
|00000d70| 79 6f 75 72 20 53 75 6e | 2d 33 27 73 20 28 77 65 |your Sun|-3's (we|
|00000d80| 20 72 75 6e 20 53 75 6e | 20 4f 53 20 33 2e 35 20 | run Sun| OS 3.5 |
|00000d90| 6f 6e 20 6f 75 72 20 53 | 75 6e 2d 33 27 73 29 2e |on our S|un-3's).|
|00000da0| 0a 20 2d 20 72 65 64 65 | 66 69 6e 65 20 42 49 4e |. - rede|fine BIN|
|00000db0| 44 45 53 54 20 61 6e 64 | 2f 6f 72 20 4d 41 4e 44 |DEST and|/or MAND|
|00000dc0| 45 53 54 20 69 66 20 79 | 6f 75 20 77 61 6e 74 20 |EST if y|ou want |
|00000dd0| 74 68 65 20 62 69 6e 61 | 72 79 20 6f 72 20 6d 61 |the bina|ry or ma|
|00000de0| 6e 75 61 6c 0a 20 20 20 | 65 6e 74 72 79 20 69 6e |nual. |entry in|
|00000df0| 73 74 61 6c 6c 65 64 20 | 73 6f 6d 65 77 68 65 72 |stalled |somewher|
|00000e00| 65 20 65 6c 73 65 2e 0a | 20 2d 20 63 6f 6d 6d 65 |e else..| - comme|
|00000e10| 6e 74 20 6f 75 74 20 74 | 68 65 20 6c 69 6e 65 20 |nt out t|he line |
|00000e20| 22 6d 6b 64 65 70 20 24 | 28 43 46 4c 41 47 53 29 |"mkdep $|(CFLAGS)|
|00000e30| 20 24 28 43 53 52 43 29 | 22 20 69 66 20 79 6f 75 | $(CSRC)|" if you|
|00000e40| 72 20 73 79 73 74 65 6d | 0a 20 20 20 69 73 20 6d |r system|. is m|
|00000e50| 69 73 73 69 6e 67 20 22 | 6d 6b 64 65 70 22 2e 0a |issing "|mkdep"..|
|00000e60| 20 2d 20 52 65 6d 6f 76 | 65 20 61 6c 6c 20 69 6e | - Remov|e all in|
|00000e70| 73 74 61 6e 63 65 73 20 | 6f 66 20 2d 44 43 53 4c |stances |of -DCSL|
|00000e80| 49 50 20 75 6e 6c 65 73 | 73 20 79 6f 75 72 20 72 |IP unles|s your r|
|00000e90| 75 6e 6e 69 6e 67 20 53 | 75 6e 20 4f 53 20 33 2c |unning S|un OS 3,|
|00000ea0| 20 79 6f 75 72 0a 20 20 | 20 68 61 76 65 20 69 6e | your. | have in|
|00000eb0| 73 74 61 6c 6c 65 64 20 | 6f 75 72 20 63 6f 6d 70 |stalled |our comp|
|00000ec0| 72 65 73 73 65 64 20 53 | 4c 49 50 20 73 6f 66 74 |ressed S|LIP soft|
|00000ed0| 77 61 72 65 20 69 6e 20 | 2f 73 79 73 2f 6e 65 74 |ware in |/sys/net|
|00000ee0| 20 61 6e 64 20 68 61 76 | 65 0a 20 20 20 63 6f 6e | and hav|e. con|
|00000ef0| 66 69 67 75 72 65 64 20 | 79 6f 75 72 20 6b 65 72 |figured |your ker|
|00000f00| 6e 65 6c 20 77 69 74 68 | 20 6f 70 74 69 6f 6e 20 |nel with| option |
|00000f10| 53 4c 5f 4e 49 54 2e 0a | 0a 4f 6e 63 65 20 74 68 |SL_NIT..|.Once th|
|00000f20| 65 20 4d 61 6b 65 66 69 | 6c 65 20 69 73 20 72 69 |e Makefi|le is ri|
|00000f30| 67 68 74 2c 20 6a 75 73 | 74 20 74 79 70 65 20 22 |ght, jus|t type "|
|00000f40| 6d 61 6b 65 22 2e 20 20 | 54 68 69 73 20 77 69 6c |make". |This wil|
|00000f50| 6c 20 63 72 65 61 74 65 | 0a 61 20 73 75 62 64 69 |l create|.a subdi|
|00000f60| 72 65 63 74 6f 72 79 20 | 61 70 70 72 6f 70 72 69 |rectory |appropri|
|00000f70| 61 74 65 20 66 6f 72 20 | 74 68 65 20 61 72 63 68 |ate for |the arch|
|00000f80| 69 74 65 63 74 75 72 65 | 20 79 6f 75 27 72 65 20 |itecture| you're |
|00000f90| 62 75 69 6c 64 69 6e 67 | 0a 6f 6e 20 28 69 2e 65 |building|.on (i.e|
|00000fa0| 2e 2c 20 65 69 74 68 65 | 72 20 22 73 75 6e 33 22 |., eithe|r "sun3"|
|00000fb0| 20 6f 72 20 22 73 75 6e | 34 22 29 20 61 6e 64 20 | or "sun|4") and |
|00000fc0| 63 6f 6d 70 69 6c 65 20 | 65 76 65 72 79 74 68 69 |compile |everythi|
|00000fd0| 6e 67 20 69 6e 0a 74 68 | 61 74 20 73 75 62 64 69 |ng in.th|at subdi|
|00000fe0| 72 65 63 74 6f 72 79 20 | 28 74 68 65 20 73 75 62 |rectory |(the sub|
|00000ff0| 64 69 72 65 63 74 6f 72 | 69 65 73 20 65 78 69 73 |director|ies exis|
|00001000| 74 20 73 6f 20 77 65 20 | 63 61 6e 20 73 75 70 70 |t so we |can supp|
|00001010| 6f 72 74 0a 62 6f 74 68 | 20 53 75 6e 2d 33 27 73 |ort.both| Sun-3's|
|00001020| 20 61 6e 64 20 53 75 6e | 2d 34 27 73 20 66 72 6f | and Sun|-4's fro|
|00001030| 6d 20 6f 6e 65 20 63 6f | 70 79 20 6f 66 20 74 68 |m one co|py of th|
|00001040| 65 20 73 6f 75 72 63 65 | 29 2e 20 20 44 4f 4e 27 |e source|). DON'|
|00001050| 54 0a 73 61 79 20 22 6d | 61 6b 65 20 74 63 70 64 |T.say "m|ake tcpd|
|00001060| 75 6d 70 22 20 69 6e 20 | 74 68 65 20 74 6f 70 20 |ump" in |the top |
|00001070| 6c 65 76 65 6c 20 64 69 | 72 65 63 74 6f 72 79 20 |level di|rectory |
|00001080| 2d 2d 20 69 74 20 77 6f | 6e 27 74 20 77 6f 72 6b |-- it wo|n't work|
|00001090| 0a 61 6e 64 20 69 74 20 | 77 69 6c 6c 20 6c 65 61 |.and it |will lea|
|000010a0| 76 65 20 61 20 6c 6f 74 | 20 6f 66 20 75 73 65 6c |ve a lot| of usel|
|000010b0| 65 73 73 20 2e 6f 27 73 | 20 61 72 6f 75 6e 64 2e |ess .o's| around.|
|000010c0| 0a 0a 49 66 20 65 76 65 | 72 79 74 68 69 6e 67 20 |..If eve|rything |
|000010d0| 62 75 69 6c 64 73 20 6f | 6b 2c 20 73 75 20 61 6e |builds o|k, su an|
|000010e0| 64 20 74 79 70 65 20 22 | 6d 61 6b 65 20 69 6e 73 |d type "|make ins|
|000010f0| 74 61 6c 6c 22 2e 20 20 | 54 68 69 73 20 77 69 6c |tall". |This wil|
|00001100| 6c 0a 69 6e 73 74 61 6c | 6c 20 74 68 65 20 74 63 |l.instal|l the tc|
|00001110| 70 64 75 6d 70 20 61 6e | 64 20 69 74 73 20 6d 61 |pdump an|d its ma|
|00001120| 6e 75 61 6c 20 65 6e 74 | 72 79 2e 20 20 4e 6f 74 |nual ent|ry. Not|
|00001130| 65 20 74 68 61 74 20 73 | 69 6e 63 65 20 4e 49 54 |e that s|ince NIT|
|00001140| 0a 63 61 6e 20 6f 6e 6c | 79 20 62 65 20 75 73 65 |.can onl|y be use|
|00001150| 64 20 62 79 20 72 6f 6f | 74 2c 20 74 63 70 64 75 |d by roo|t, tcpdu|
|00001160| 6d 70 20 69 73 20 69 6e | 73 74 61 6c 6c 65 64 20 |mp is in|stalled |
|00001170| 73 65 74 75 69 64 20 74 | 6f 20 72 6f 6f 74 2e 0a |setuid t|o root..|
|00001180| 0a 50 72 6f 62 6c 65 6d | 73 2c 20 62 75 67 73 2c |.Problem|s, bugs,|
|00001190| 20 71 75 65 73 74 69 6f | 6e 73 2c 20 64 65 73 69 | questio|ns, desi|
|000011a0| 72 61 62 6c 65 20 65 6e | 68 61 6e 63 65 6d 65 6e |rable en|hancemen|
|000011b0| 74 73 2c 20 65 74 63 2e | 2c 20 73 68 6f 75 6c 64 |ts, etc.|, should|
|000011c0| 20 62 65 0a 73 65 6e 74 | 20 74 6f 20 74 68 65 20 | be.sent| to the |
|000011d0| 65 6d 61 69 6c 20 61 64 | 64 72 65 73 73 20 22 74 |email ad|dress "t|
|000011e0| 63 70 64 75 6d 70 40 68 | 65 6c 69 6f 73 2e 65 65 |cpdump@h|elios.ee|
|000011f0| 2e 6c 62 6c 2e 67 6f 76 | 22 2e 20 20 54 68 65 20 |.lbl.gov|". The |
|00001200| 61 75 74 68 6f 72 73 0a | 77 65 6c 63 6f 6d 65 20 |authors.|welcome |
|00001210| 63 6f 6d 6d 65 6e 74 73 | 2e 0a 0a 20 2d 20 53 74 |comments|... - St|
|00001220| 65 76 65 20 4d 63 43 61 | 6e 6e 65 20 28 6d 63 63 |eve McCa|nne (mcc|
|00001230| 61 6e 6e 65 40 68 65 6c | 69 6f 73 2e 65 65 2e 6c |anne@hel|ios.ee.l|
|00001240| 62 6c 2e 67 6f 76 29 0a | 20 20 20 43 72 61 69 67 |bl.gov).| Craig|
|00001250| 20 4c 65 72 65 73 20 28 | 6c 65 72 65 73 40 68 65 | Leres (|leres@he|
|00001260| 6c 69 6f 73 2e 65 65 2e | 6c 62 6c 2e 67 6f 76 29 |lios.ee.|lbl.gov)|
|00001270| 0a 20 20 20 56 61 6e 20 | 4a 61 63 6f 62 73 6f 6e |. Van |Jacobson|
|00001280| 20 28 76 61 6e 40 68 65 | 6c 69 6f 73 2e 65 65 2e | (van@he|lios.ee.|
|00001290| 6c 62 6c 2e 67 6f 76 29 | 0a 0a 2d 2d 2d 2d 2d 2d |lbl.gov)|..------|
|000012a0| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |--------|--------|
|000012b0| 2d 2d 2d 2d 2d 2d 2d 2d | 0a 0a 54 68 65 20 70 72 |--------|..The pr|
|000012c0| 6f 67 72 61 6d 20 69 73 | 20 6c 6f 6f 73 65 6c 79 |ogram is| loosely|
|000012d0| 20 62 61 73 65 64 20 6f | 6e 20 53 4d 49 27 73 20 | based o|n SMI's |
|000012e0| 22 65 74 68 65 72 66 69 | 6e 64 22 20 61 6c 74 68 |"etherfi|nd" alth|
|000012f0| 6f 75 67 68 20 6e 6f 6e | 65 0a 6f 66 20 74 68 65 |ough non|e.of the|
|00001300| 20 65 74 68 65 72 66 69 | 6e 64 20 63 6f 64 65 20 | etherfi|nd code |
|00001310| 72 65 6d 61 69 6e 73 2e | 20 20 49 74 20 77 61 73 |remains.| It was|
|00001320| 20 6f 72 69 67 69 6e 61 | 6c 6c 79 20 77 72 69 74 | origina|lly writ|
|00001330| 74 65 6e 20 62 79 20 56 | 61 6e 0a 4a 61 63 6f 62 |ten by V|an.Jacob|
|00001340| 73 6f 6e 2c 20 4c 61 77 | 72 65 6e 63 65 20 42 65 |son, Law|rence Be|
|00001350| 72 6b 65 6c 65 79 20 4c | 61 62 6f 72 61 74 6f 72 |rkeley L|aborator|
|00001360| 79 2c 20 61 73 20 70 61 | 72 74 20 6f 66 20 61 6e |y, as pa|rt of an|
|00001370| 20 6f 6e 67 6f 69 6e 67 | 0a 72 65 73 65 61 72 63 | ongoing|.researc|
|00001380| 68 20 70 72 6f 6a 65 63 | 74 20 74 6f 20 69 6e 76 |h projec|t to inv|
|00001390| 65 73 74 69 67 61 74 65 | 20 61 6e 64 20 69 6d 70 |estigate| and imp|
|000013a0| 72 6f 76 65 20 74 63 70 | 20 61 6e 64 20 69 6e 74 |rove tcp| and int|
|000013b0| 65 72 6e 65 74 0a 67 61 | 74 65 77 61 79 20 70 65 |ernet.ga|teway pe|
|000013c0| 72 66 6f 72 6d 61 6e 63 | 65 2e 20 20 54 68 65 20 |rformanc|e. The |
|000013d0| 70 61 72 74 73 20 6f 66 | 20 74 68 65 20 70 72 6f |parts of| the pro|
|000013e0| 67 72 61 6d 20 6f 72 69 | 67 69 6e 61 6c 6c 79 20 |gram ori|ginally |
|000013f0| 74 61 6b 65 6e 0a 66 72 | 6f 6d 20 53 75 6e 27 73 |taken.fr|om Sun's|
|00001400| 20 65 74 68 65 72 66 69 | 6e 64 20 77 65 72 65 20 | etherfi|nd were |
|00001410| 6c 61 74 65 72 20 72 65 | 2d 77 72 69 74 74 65 6e |later re|-written|
|00001420| 20 62 79 20 53 74 65 76 | 65 20 4d 63 43 61 6e 6e | by Stev|e McCann|
|00001430| 65 20 6f 66 0a 4c 42 4c | 2e 20 20 54 6f 20 69 6e |e of.LBL|. To in|
|00001440| 73 75 72 65 20 74 68 61 | 74 20 77 6f 75 6c 64 20 |sure tha|t would |
|00001450| 62 65 20 6e 6f 20 76 65 | 73 74 69 67 65 20 6f 66 |be no ve|stige of|
|00001460| 20 70 72 6f 70 72 69 65 | 74 61 72 79 20 63 6f 64 | proprie|tary cod|
|00001470| 65 20 69 6e 0a 74 63 70 | 64 75 6d 70 2c 20 53 74 |e in.tcp|dump, St|
|00001480| 65 76 65 20 77 72 6f 74 | 65 20 74 68 65 73 65 20 |eve wrot|e these |
|00001490| 70 69 65 63 65 73 20 66 | 72 6f 6d 20 74 68 65 20 |pieces f|rom the |
|000014a0| 73 70 65 63 69 66 69 63 | 61 74 69 6f 6e 20 67 69 |specific|ation gi|
|000014b0| 76 65 6e 0a 62 79 20 74 | 68 65 20 6d 61 6e 75 61 |ven.by t|he manua|
|000014c0| 6c 20 65 6e 74 72 79 2c | 20 77 69 74 68 20 6e 6f |l entry,| with no|
|000014d0| 20 61 63 63 65 73 73 20 | 74 6f 20 74 68 65 20 73 | access |to the s|
|000014e0| 6f 75 72 63 65 20 6f 66 | 20 74 63 70 64 75 6d 70 |ource of| tcpdump|
|000014f0| 20 6f 72 0a 65 74 68 65 | 72 66 69 6e 64 2e 0a 0a | or.ethe|rfind...|
|00001500| 54 68 65 20 63 75 72 72 | 65 6e 74 20 76 65 72 73 |The curr|ent vers|
|00001510| 69 6f 6e 73 20 6f 66 20 | 74 68 65 73 65 20 66 69 |ions of |these fi|
|00001520| 6c 65 73 20 61 72 65 20 | 61 76 61 69 6c 61 62 6c |les are |availabl|
|00001530| 65 20 76 69 61 20 61 6e | 6f 6e 79 6d 6f 75 73 0a |e via an|onymous.|
|00001540| 66 74 70 20 66 72 6f 6d | 20 68 6f 73 74 20 66 74 |ftp from| host ft|
|00001550| 70 2e 65 65 2e 6c 62 6c | 2e 67 6f 76 20 28 63 75 |p.ee.lbl|.gov (cu|
|00001560| 72 72 65 6e 74 6c 79 20 | 61 74 20 61 64 64 72 65 |rrently |at addre|
|00001570| 73 73 20 31 32 38 2e 33 | 2e 32 35 34 2e 36 38 29 |ss 128.3|.254.68)|
|00001580| 0a 66 69 6c 65 20 74 63 | 70 64 75 6d 70 2e 74 61 |.file tc|pdump.ta|
|00001590| 72 2e 5a 20 28 61 20 63 | 6f 6d 70 72 65 73 73 65 |r.Z (a c|ompresse|
|000015a0| 64 20 55 6e 69 78 20 74 | 61 72 20 66 69 6c 65 29 |d Unix t|ar file)|
|000015b0| 2e 0a 0a 54 68 69 73 20 | 70 72 6f 67 72 61 6d 20 |...This |program |
|000015c0| 69 73 20 73 75 62 6a 65 | 63 74 20 74 6f 20 74 68 |is subje|ct to th|
|000015d0| 65 20 27 73 74 61 6e 64 | 61 72 64 27 20 42 65 72 |e 'stand|ard' Ber|
|000015e0| 6b 65 6c 65 79 20 6e 65 | 74 77 6f 72 6b 20 73 6f |keley ne|twork so|
|000015f0| 66 74 77 61 72 65 0a 63 | 6f 70 79 72 69 67 68 74 |ftware.c|opyright|
|00001600| 3a 0a 20 20 0a 20 20 20 | 43 6f 70 79 72 69 67 68 |:. . |Copyrigh|
|00001610| 74 20 28 63 29 20 31 39 | 38 38 20 52 65 67 65 6e |t (c) 19|88 Regen|
|00001620| 74 73 20 6f 66 20 74 68 | 65 20 55 6e 69 76 65 72 |ts of th|e Univer|
|00001630| 73 69 74 79 20 6f 66 20 | 43 61 6c 69 66 6f 72 6e |sity of |Californ|
|00001640| 69 61 2e 0a 20 20 20 41 | 6c 6c 20 72 69 67 68 74 |ia.. A|ll right|
|00001650| 73 20 72 65 73 65 72 76 | 65 64 2e 0a 20 20 0a 20 |s reserv|ed.. . |
|00001660| 20 20 52 65 64 69 73 74 | 72 69 62 75 74 69 6f 6e | Redist|ribution|
|00001670| 20 61 6e 64 20 75 73 65 | 20 69 6e 20 73 6f 75 72 | and use| in sour|
|00001680| 63 65 20 61 6e 64 20 62 | 69 6e 61 72 79 20 66 6f |ce and b|inary fo|
|00001690| 72 6d 73 20 61 72 65 20 | 70 65 72 6d 69 74 74 65 |rms are |permitte|
|000016a0| 64 0a 20 20 20 70 72 6f | 76 69 64 65 64 20 74 68 |d. pro|vided th|
|000016b0| 61 74 20 74 68 65 20 61 | 62 6f 76 65 20 63 6f 70 |at the a|bove cop|
|000016c0| 79 72 69 67 68 74 20 6e | 6f 74 69 63 65 20 61 6e |yright n|otice an|
|000016d0| 64 20 74 68 69 73 20 70 | 61 72 61 67 72 61 70 68 |d this p|aragraph|
|000016e0| 20 61 72 65 0a 20 20 20 | 64 75 70 6c 69 63 61 74 | are. |duplicat|
|000016f0| 65 64 20 69 6e 20 61 6c | 6c 20 73 75 63 68 20 66 |ed in al|l such f|
|00001700| 6f 72 6d 73 20 61 6e 64 | 20 74 68 61 74 20 61 6e |orms and| that an|
|00001710| 79 20 64 6f 63 75 6d 65 | 6e 74 61 74 69 6f 6e 2c |y docume|ntation,|
|00001720| 0a 20 20 20 61 64 76 65 | 72 74 69 73 69 6e 67 20 |. adve|rtising |
|00001730| 6d 61 74 65 72 69 61 6c | 73 2c 20 61 6e 64 20 6f |material|s, and o|
|00001740| 74 68 65 72 20 6d 61 74 | 65 72 69 61 6c 73 20 72 |ther mat|erials r|
|00001750| 65 6c 61 74 65 64 20 74 | 6f 20 73 75 63 68 0a 20 |elated t|o such. |
|00001760| 20 20 64 69 73 74 72 69 | 62 75 74 69 6f 6e 20 61 | distri|bution a|
|00001770| 6e 64 20 75 73 65 20 61 | 63 6b 6e 6f 77 6c 65 64 |nd use a|cknowled|
|00001780| 67 65 20 74 68 61 74 20 | 74 68 65 20 73 6f 66 74 |ge that |the soft|
|00001790| 77 61 72 65 20 77 61 73 | 20 64 65 76 65 6c 6f 70 |ware was| develop|
|000017a0| 65 64 0a 20 20 20 62 79 | 20 74 68 65 20 55 6e 69 |ed. by| the Uni|
|000017b0| 76 65 72 73 69 74 79 20 | 6f 66 20 43 61 6c 69 66 |versity |of Calif|
|000017c0| 6f 72 6e 69 61 2c 20 4c | 61 77 72 65 6e 63 65 20 |ornia, L|awrence |
|000017d0| 42 65 72 6b 65 6c 65 79 | 20 4c 61 62 6f 72 61 74 |Berkeley| Laborat|
|000017e0| 6f 72 79 2c 0a 20 20 20 | 42 65 72 6b 65 6c 65 79 |ory,. |Berkeley|
|000017f0| 2c 20 43 41 2e 20 20 54 | 68 65 20 6e 61 6d 65 20 |, CA. T|he name |
|00001800| 6f 66 20 74 68 65 20 55 | 6e 69 76 65 72 73 69 74 |of the U|niversit|
|00001810| 79 20 6d 61 79 20 6e 6f | 74 20 62 65 20 75 73 65 |y may no|t be use|
|00001820| 64 20 74 6f 0a 20 20 20 | 65 6e 64 6f 72 73 65 20 |d to. |endorse |
|00001830| 6f 72 20 70 72 6f 6d 6f | 74 65 20 70 72 6f 64 75 |or promo|te produ|
|00001840| 63 74 73 20 64 65 72 69 | 76 65 64 20 66 72 6f 6d |cts deri|ved from|
|00001850| 20 74 68 69 73 20 73 6f | 66 74 77 61 72 65 20 77 | this so|ftware w|
|00001860| 69 74 68 6f 75 74 0a 20 | 20 20 73 70 65 63 69 66 |ithout. | specif|
|00001870| 69 63 20 70 72 69 6f 72 | 20 77 72 69 74 74 65 6e |ic prior| written|
|00001880| 20 70 65 72 6d 69 73 73 | 69 6f 6e 2e 0a 20 20 20 | permiss|ion.. |
|00001890| 54 48 49 53 20 53 4f 46 | 54 57 41 52 45 20 49 53 |THIS SOF|TWARE IS|
|000018a0| 20 50 52 4f 56 49 44 45 | 44 20 60 60 41 53 20 49 | PROVIDE|D ``AS I|
|000018b0| 53 27 27 20 41 4e 44 20 | 57 49 54 48 4f 55 54 20 |S'' AND |WITHOUT |
|000018c0| 41 4e 59 20 45 58 50 52 | 45 53 53 20 4f 52 0a 20 |ANY EXPR|ESS OR. |
|000018d0| 20 20 49 4d 50 4c 49 45 | 44 20 57 41 52 52 41 4e | IMPLIE|D WARRAN|
|000018e0| 54 49 45 53 2c 20 49 4e | 43 4c 55 44 49 4e 47 2c |TIES, IN|CLUDING,|
|000018f0| 20 57 49 54 48 4f 55 54 | 20 4c 49 4d 49 54 41 54 | WITHOUT| LIMITAT|
|00001900| 49 4f 4e 2c 20 54 48 45 | 20 49 4d 50 4c 49 45 44 |ION, THE| IMPLIED|
|00001910| 0a 20 20 20 57 41 52 52 | 41 4e 54 49 45 53 20 4f |. WARR|ANTIES O|
|00001920| 46 20 4d 45 52 43 48 41 | 4e 54 49 42 49 4c 49 54 |F MERCHA|NTIBILIT|
|00001930| 59 20 41 4e 44 20 46 49 | 54 4e 45 53 53 20 46 4f |Y AND FI|TNESS FO|
|00001940| 52 20 41 20 50 41 52 54 | 49 43 55 4c 41 52 20 50 |R A PART|ICULAR P|
|00001950| 55 52 50 4f 53 45 2e 0a | 0a 45 6e 6a 6f 79 2e 0a |URPOSE..|.Enjoy..|
|00001960| 0a 20 20 2d 20 56 61 6e | 20 4a 61 63 6f 62 73 6f |. - Van| Jacobso|
|00001970| 6e 2c 20 53 74 65 76 65 | 20 4d 63 43 61 6e 6e 65 |n, Steve| McCanne|
|00001980| 2c 20 43 72 61 69 67 20 | 4c 65 72 65 73 0a 2d 2d |, Craig |Leres.--|
|00001990| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 2d 2d 2d 2d 2d 2d |--------|--------|
|000019a0| 2d 2d 2d 2d 2d 2d 2d 2d | 2d 2d 0a 0a 54 68 69 73 |--------|--..This|
|000019b0| 20 64 69 72 65 63 74 6f | 72 79 20 61 6c 73 6f 20 | directo|ry also |
|000019c0| 63 6f 6e 74 61 69 6e 73 | 20 73 6f 6d 65 20 73 68 |contains| some sh|
|000019d0| 6f 72 74 20 61 77 6b 20 | 70 72 6f 67 72 61 6d 73 |ort awk |programs|
|000019e0| 20 69 6e 74 65 6e 64 65 | 64 20 61 73 0a 65 78 61 | intende|d as.exa|
|000019f0| 6d 70 6c 65 73 20 6f 66 | 20 77 61 79 73 20 74 6f |mples of| ways to|
|00001a00| 20 72 65 64 75 63 65 20 | 74 63 70 64 75 6d 70 20 | reduce |tcpdump |
|00001a10| 64 61 74 61 20 77 68 65 | 6e 20 79 6f 75 27 72 65 |data whe|n you're|
|00001a20| 20 74 72 61 63 6b 69 6e | 67 0a 70 61 72 74 69 63 | trackin|g.partic|
|00001a30| 75 6c 61 72 20 6e 65 74 | 77 6f 72 6b 20 70 72 6f |ular net|work pro|
|00001a40| 62 6c 65 6d 73 3a 0a 0a | 73 65 6e 64 2d 61 63 6b |blems:..|send-ack|
|00001a50| 2e 61 77 6b 0a 09 53 69 | 6d 70 6c 69 66 69 65 73 |.awk..Si|mplifies|
|00001a60| 20 74 68 65 20 74 63 70 | 64 75 6d 70 20 74 72 61 | the tcp|dump tra|
|00001a70| 63 65 20 66 6f 72 20 61 | 6e 20 66 74 70 20 28 6f |ce for a|n ftp (o|
|00001a80| 72 20 6f 74 68 65 72 20 | 75 6e 69 64 69 72 65 63 |r other |unidirec|
|00001a90| 74 69 6f 6e 61 6c 0a 09 | 74 63 70 20 74 72 61 6e |tional..|tcp tran|
|00001aa0| 73 66 65 72 29 2e 20 20 | 53 69 6e 63 65 20 77 65 |sfer). |Since we|
|00001ab0| 20 61 73 73 75 6d 65 20 | 74 68 61 74 20 6f 6e 65 | assume |that one|
|00001ac0| 20 68 6f 73 74 20 6f 6e | 6c 79 20 73 65 6e 64 73 | host on|ly sends|
|00001ad0| 20 61 6e 64 0a 09 74 68 | 65 20 6f 74 68 65 72 20 | and..th|e other |
|00001ae0| 6f 6e 6c 79 20 61 63 6b | 73 2c 20 61 6c 6c 20 61 |only ack|s, all a|
|00001af0| 64 64 72 65 73 73 20 69 | 6e 66 6f 72 6d 61 74 69 |ddress i|nformati|
|00001b00| 6f 6e 20 69 73 20 6c 65 | 66 74 20 6f 66 66 20 61 |on is le|ft off a|
|00001b10| 6e 64 0a 09 77 65 20 6a | 75 73 74 20 6e 6f 74 65 |nd..we j|ust note|
|00001b20| 20 69 66 20 74 68 65 20 | 70 61 63 6b 65 74 20 69 | if the |packet i|
|00001b30| 73 20 61 20 22 73 65 6e | 64 22 20 6f 72 20 61 6e |s a "sen|d" or an|
|00001b40| 20 22 61 63 6b 22 2e 0a | 0a 09 54 68 65 72 65 20 | "ack"..|..There |
|00001b50| 69 73 20 6f 6e 65 20 6f | 75 74 70 75 74 20 6c 69 |is one o|utput li|
|00001b60| 6e 65 20 70 65 72 20 6c | 69 6e 65 20 6f 66 20 74 |ne per l|ine of t|
|00001b70| 68 65 20 6f 72 69 67 69 | 6e 61 6c 20 74 72 61 63 |he origi|nal trac|
|00001b80| 65 2e 20 0a 09 46 69 65 | 6c 64 20 31 20 69 73 20 |e. ..Fie|ld 1 is |
|00001b90| 74 68 65 20 70 61 63 6b | 65 74 20 74 69 6d 65 20 |the pack|et time |
|00001ba0| 69 6e 20 64 65 63 69 6d | 61 6c 20 73 65 63 6f 6e |in decim|al secon|
|00001bb0| 64 73 2c 20 72 65 6c 61 | 74 69 76 65 0a 09 74 6f |ds, rela|tive..to|
|00001bc0| 20 74 68 65 20 73 74 61 | 72 74 20 6f 66 20 74 68 | the sta|rt of th|
|00001bd0| 65 20 63 6f 6e 76 65 72 | 73 61 74 69 6f 6e 2e 20 |e conver|sation. |
|00001be0| 20 46 69 65 6c 64 20 32 | 20 69 73 20 64 65 6c 74 | Field 2| is delt|
|00001bf0| 61 2d 74 69 6d 65 0a 09 | 66 72 6f 6d 20 6c 61 73 |a-time..|from las|
|00001c00| 74 20 70 61 63 6b 65 74 | 2e 20 20 46 69 65 6c 64 |t packet|. Field|
|00001c10| 20 33 20 69 73 20 70 61 | 63 6b 65 74 20 74 79 70 | 3 is pa|cket typ|
|00001c20| 65 2f 64 69 72 65 63 74 | 69 6f 6e 2e 20 0a 09 22 |e/direct|ion. .."|
|00001c30| 53 65 6e 64 22 20 6d 65 | 61 6e 73 20 64 61 74 61 |Send" me|ans data|
|00001c40| 20 67 6f 69 6e 67 20 66 | 72 6f 6d 20 73 65 6e 64 | going f|rom send|
|00001c50| 65 72 20 74 6f 20 72 65 | 63 65 69 76 65 72 2c 20 |er to re|ceiver, |
|00001c60| 22 61 63 6b 22 0a 09 6d | 65 61 6e 73 20 61 6e 20 |"ack"..m|eans an |
|00001c70| 61 63 6b 20 67 6f 69 6e | 67 20 66 72 6f 6d 20 74 |ack goin|g from t|
|00001c80| 68 65 20 72 65 63 65 69 | 76 65 72 20 74 6f 20 74 |he recei|ver to t|
|00001c90| 68 65 20 73 65 6e 64 65 | 72 2e 20 20 41 0a 09 70 |he sende|r. A..p|
|00001ca0| 72 65 63 65 64 69 6e 67 | 20 22 2a 22 20 69 6e 64 |receding| "*" ind|
|00001cb0| 69 63 61 74 65 73 20 74 | 68 61 74 20 74 68 65 20 |icates t|hat the |
|00001cc0| 64 61 74 61 20 69 73 20 | 61 20 72 65 74 72 61 6e |data is |a retran|
|00001cd0| 73 6d 69 73 73 69 6f 6e | 2e 0a 09 41 20 70 72 65 |smission|...A pre|
|00001ce0| 63 65 64 69 6e 67 20 22 | 2d 22 20 69 6e 64 69 63 |ceding "|-" indic|
|00001cf0| 61 74 65 73 20 61 20 68 | 6f 6c 65 20 69 6e 20 74 |ates a h|ole in t|
|00001d00| 68 65 20 73 65 71 75 65 | 6e 63 65 20 73 70 61 63 |he seque|nce spac|
|00001d10| 65 0a 09 28 69 2e 65 2e | 2c 20 6d 69 73 73 69 6e |e..(i.e.|, missin|
|00001d20| 67 20 70 61 63 6b 65 74 | 28 73 29 29 2c 20 61 20 |g packet|(s)), a |
|00001d30| 22 23 22 20 6d 65 61 6e | 73 20 61 6e 20 6f 64 64 |"#" mean|s an odd|
|00001d40| 2d 73 69 7a 65 20 28 6e | 6f 74 20 6d 61 78 0a 09 |-size (n|ot max..|
|00001d50| 73 65 67 20 73 69 7a 65 | 29 20 70 61 63 6b 65 74 |seg size|) packet|
|00001d60| 2e 20 20 46 69 65 6c 64 | 20 34 20 68 61 73 20 74 |. Field| 4 has t|
|00001d70| 68 65 20 70 61 63 6b 65 | 74 20 66 6c 61 67 73 0a |he packe|t flags.|
|00001d80| 09 28 73 61 6d 65 20 66 | 6f 72 6d 61 74 20 61 73 |.(same f|ormat as|
|00001d90| 20 72 61 77 20 74 72 61 | 63 65 29 2e 20 20 46 69 | raw tra|ce). Fi|
|00001da0| 65 6c 64 20 35 20 69 73 | 20 74 68 65 20 73 65 71 |eld 5 is| the seq|
|00001db0| 75 65 6e 63 65 0a 09 6e | 75 6d 62 65 72 20 28 73 |uence..n|umber (s|
|00001dc0| 74 61 72 74 20 73 65 71 | 2e 20 6e 75 6d 20 66 6f |tart seq|. num fo|
|00001dd0| 72 20 73 65 6e 64 65 72 | 2c 20 6e 65 78 74 20 65 |r sender|, next e|
|00001de0| 78 70 65 63 74 65 64 20 | 73 65 71 20 6e 75 6d 62 |xpected |seq numb|
|00001df0| 65 72 0a 09 66 6f 72 20 | 61 63 6b 73 29 2e 20 20 |er..for |acks). |
|00001e00| 54 68 65 20 6e 75 6d 62 | 65 72 20 69 6e 20 70 61 |The numb|er in pa|
|00001e10| 72 65 6e 73 20 66 6f 6c | 6c 6f 77 69 6e 67 20 61 |rens fol|lowing a|
|00001e20| 6e 20 61 63 6b 20 69 73 | 0a 09 74 68 65 20 64 65 |n ack is|..the de|
|00001e30| 6c 74 61 2d 74 69 6d 65 | 20 66 72 6f 6d 20 74 68 |lta-time| from th|
|00001e40| 65 20 66 69 72 73 74 20 | 73 65 6e 64 20 6f 66 20 |e first |send of |
|00001e50| 74 68 65 20 70 61 63 6b | 65 74 20 74 6f 20 74 68 |the pack|et to th|
|00001e60| 65 0a 09 61 63 6b 2e 20 | 20 41 20 6e 75 6d 62 65 |e..ack. | A numbe|
|00001e70| 72 20 69 6e 20 70 61 72 | 65 6e 73 20 66 6f 6c 6c |r in par|ens foll|
|00001e80| 6f 77 69 6e 67 20 61 20 | 73 65 6e 64 20 69 73 20 |owing a |send is |
|00001e90| 74 68 65 0a 09 64 65 6c | 74 61 2d 74 69 6d 65 20 |the..del|ta-time |
|00001ea0| 66 72 6f 6d 20 74 68 65 | 20 66 69 72 73 74 20 73 |from the| first s|
|00001eb0| 65 6e 64 20 6f 66 20 74 | 68 65 20 70 61 63 6b 65 |end of t|he packe|
|00001ec0| 74 20 74 6f 20 74 68 65 | 0a 09 63 75 72 72 65 6e |t to the|..curren|
|00001ed0| 74 20 73 65 6e 64 20 28 | 6f 6e 20 64 75 70 6c 69 |t send (|on dupli|
|00001ee0| 63 61 74 65 20 70 61 63 | 6b 65 74 73 20 6f 6e 6c |cate pac|kets onl|
|00001ef0| 79 29 2e 20 20 44 75 70 | 6c 69 63 61 74 65 0a 09 |y). Dup|licate..|
|00001f00| 73 65 6e 64 73 20 6f 72 | 20 61 63 6b 73 20 68 61 |sends or| acks ha|
|00001f10| 76 65 20 61 20 6e 75 6d | 62 65 72 20 69 6e 20 73 |ve a num|ber in s|
|00001f20| 71 75 61 72 65 20 62 72 | 61 63 6b 65 74 73 20 73 |quare br|ackets s|
|00001f30| 68 6f 77 69 6e 67 0a 09 | 74 68 65 20 6e 75 6d 62 |howing..|the numb|
|00001f40| 65 72 20 6f 66 20 64 75 | 70 6c 69 63 61 74 65 73 |er of du|plicates|
|00001f50| 20 73 6f 20 66 61 72 2e | 20 0a 0a 09 48 65 72 65 | so far.| ...Here|
|00001f60| 20 69 73 20 61 20 73 68 | 6f 72 74 20 73 61 6d 70 | is a sh|ort samp|
|00001f70| 6c 65 20 66 72 6f 6d 20 | 6e 65 61 72 20 74 68 65 |le from |near the|
|00001f80| 20 73 74 61 72 74 20 6f | 66 20 61 6e 20 66 74 70 | start o|f an ftp|
|00001f90| 3a 0a 09 09 33 2e 30 30 | 20 20 20 20 30 2e 32 30 |:...3.00| 0.20|
|00001fa0| 20 20 20 73 65 6e 64 20 | 2e 20 35 31 32 0a 09 09 | send |. 512...|
|00001fb0| 33 2e 32 30 20 20 20 20 | 30 2e 32 30 20 20 20 20 |3.20 |0.20 |
|00001fc0| 61 63 6b 20 2e 20 31 30 | 32 34 20 20 28 30 2e 32 |ack . 10|24 (0.2|
|00001fd0| 30 29 0a 09 09 33 2e 32 | 30 20 20 20 20 30 2e 30 |0)...3.2|0 0.0|
|00001fe0| 30 20 20 20 73 65 6e 64 | 20 50 20 31 30 32 34 0a |0 send| P 1024.|
|00001ff0| 09 09 33 2e 34 30 20 20 | 20 20 30 2e 32 30 20 20 |..3.40 | 0.20 |
|00002000| 20 20 61 63 6b 20 2e 20 | 31 35 33 36 20 20 28 30 | ack . |1536 (0|
|00002010| 2e 32 30 29 0a 09 09 33 | 2e 38 30 20 20 20 20 30 |.20)...3|.80 0|
|00002020| 2e 34 30 20 2a 20 73 65 | 6e 64 20 2e 20 30 20 20 |.40 * se|nd . 0 |
|00002030| 28 33 2e 38 30 29 20 5b | 32 5d 0a 09 09 33 2e 38 |(3.80) [|2]...3.8|
|00002040| 32 20 20 20 20 30 2e 30 | 32 20 2a 20 20 61 63 6b |2 0.0|2 * ack|
|00002050| 20 2e 20 31 35 33 36 20 | 20 28 30 2e 36 32 29 20 | . 1536 | (0.62) |
|00002060| 5b 32 5d 0a 09 54 68 72 | 65 65 20 73 65 63 6f 6e |[2]..Thr|ee secon|
|00002070| 64 73 20 69 6e 74 6f 20 | 74 68 65 20 63 6f 6e 76 |ds into |the conv|
|00002080| 65 72 73 61 74 69 6f 6e | 2c 20 62 79 74 65 73 20 |ersation|, bytes |
|00002090| 35 31 32 20 74 68 72 6f | 75 67 68 20 31 30 32 33 |512 thro|ugh 1023|
|000020a0| 0a 09 77 65 72 65 20 73 | 65 6e 74 2e 20 20 32 30 |..were s|ent. 20|
|000020b0| 30 6d 73 20 6c 61 74 65 | 72 20 74 68 65 79 20 77 |0ms late|r they w|
|000020c0| 65 72 65 20 61 63 6b 65 | 64 2e 20 20 53 68 6f 72 |ere acke|d. Shor|
|000020d0| 74 6c 79 20 74 68 65 72 | 65 61 66 74 65 72 0a 09 |tly ther|eafter..|
|000020e0| 62 79 74 65 73 20 31 30 | 32 34 2d 31 35 33 35 20 |bytes 10|24-1535 |
|000020f0| 77 65 72 65 20 73 65 6e | 74 20 61 6e 64 20 61 67 |were sen|t and ag|
|00002100| 61 69 6e 20 61 63 6b 65 | 64 20 61 66 74 65 72 20 |ain acke|d after |
|00002110| 32 30 30 6d 73 2e 20 0a | 09 54 68 65 6e 2c 20 66 |200ms. .|.Then, f|
|00002120| 6f 72 20 6e 6f 20 61 70 | 70 61 72 65 6e 74 20 72 |or no ap|parent r|
|00002130| 65 61 73 6f 6e 2c 20 30 | 2d 35 31 31 20 69 73 20 |eason, 0|-511 is |
|00002140| 72 65 74 72 61 6e 73 6d | 69 74 74 65 64 2c 20 33 |retransm|itted, 3|
|00002150| 2e 38 0a 09 73 65 63 6f | 6e 64 73 20 61 66 74 65 |.8..seco|nds afte|
|00002160| 72 20 69 74 73 20 69 6e | 69 74 69 61 6c 20 73 65 |r its in|itial se|
|00002170| 6e 64 20 28 74 68 65 20 | 72 6f 75 6e 64 20 74 72 |nd (the |round tr|
|00002180| 69 70 20 74 69 6d 65 20 | 66 6f 72 20 74 68 69 73 |ip time |for this|
|00002190| 0a 09 66 74 70 20 77 61 | 73 20 31 73 65 63 2c 20 |..ftp wa|s 1sec, |
|000021a0| 2b 2d 35 30 30 6d 73 29 | 2e 20 20 53 69 6e 63 65 |+-500ms)|. Since|
|000021b0| 20 74 68 65 20 72 65 63 | 65 69 76 65 72 20 69 73 | the rec|eiver is|
|000021c0| 20 65 78 70 65 63 74 69 | 6e 67 0a 09 31 35 33 36 | expecti|ng..1536|
|000021d0| 2c 20 31 35 33 36 20 69 | 73 20 72 65 2d 61 63 6b |, 1536 i|s re-ack|
|000021e0| 65 64 20 77 68 65 6e 20 | 30 20 61 72 72 69 76 65 |ed when |0 arrive|
|000021f0| 73 2e 20 0a 0a 70 61 63 | 6b 65 74 64 61 74 2e 61 |s. ..pac|ketdat.a|
|00002200| 77 6b 0a 09 43 6f 6d 70 | 75 74 65 73 20 63 68 75 |wk..Comp|utes chu|
|00002210| 6e 6b 20 73 75 6d 6d 61 | 72 79 20 64 61 74 61 20 |nk summa|ry data |
|00002220| 66 6f 72 20 61 6e 20 66 | 74 70 20 28 6f 72 20 73 |for an f|tp (or s|
|00002230| 69 6d 69 6c 61 72 0a 09 | 75 6e 69 64 69 72 65 63 |imilar..|unidirec|
|00002240| 74 69 6f 6e 61 6c 20 74 | 63 70 20 74 72 61 6e 73 |tional t|cp trans|
|00002250| 66 65 72 29 2e 20 5b 41 | 20 22 63 68 75 6e 6b 22 |fer). [A| "chunk"|
|00002260| 20 72 65 66 65 72 73 20 | 74 6f 0a 09 61 20 63 68 | refers |to..a ch|
|00002270| 75 6e 6b 20 6f 66 20 74 | 68 65 20 73 65 71 75 65 |unk of t|he seque|
|00002280| 6e 63 65 20 73 70 61 63 | 65 20 2d 2d 20 65 73 73 |nce spac|e -- ess|
|00002290| 65 6e 74 69 61 6c 6c 79 | 20 74 68 65 20 70 61 63 |entially| the pac|
|000022a0| 6b 65 74 0a 09 73 65 71 | 75 65 6e 63 65 20 6e 75 |ket..seq|uence nu|
|000022b0| 6d 62 65 72 20 64 69 76 | 69 64 65 64 20 62 79 20 |mber div|ided by |
|000022c0| 74 68 65 20 6d 61 78 20 | 73 65 67 6d 65 6e 74 20 |the max |segment |
|000022d0| 73 69 7a 65 2e 5d 0a 0a | 09 41 20 73 75 6d 6d 61 |size.]..|.A summa|
|000022e0| 72 79 20 6c 69 6e 65 20 | 69 73 20 70 72 69 6e 74 |ry line |is print|
|000022f0| 65 64 20 73 68 6f 77 69 | 6e 67 20 74 68 65 20 6e |ed showi|ng the n|
|00002300| 75 6d 62 65 72 20 6f 66 | 20 63 68 75 6e 6b 73 2c |umber of| chunks,|
|00002310| 0a 09 74 68 65 20 6e 75 | 6d 62 65 72 20 6f 66 20 |..the nu|mber of |
|00002320| 70 61 63 6b 65 74 73 20 | 69 74 20 74 6f 6f 6b 20 |packets |it took |
|00002330| 74 6f 20 73 65 6e 64 20 | 74 68 61 74 20 6d 61 6e |to send |that man|
|00002340| 79 20 63 68 75 6e 6b 73 | 0a 09 28 69 66 20 74 68 |y chunks|..(if th|
|00002350| 65 72 65 20 61 72 65 20 | 6e 6f 20 6c 6f 73 74 20 |ere are |no lost |
|00002360| 6f 72 20 64 75 70 6c 69 | 63 61 74 65 64 20 70 61 |or dupli|cated pa|
|00002370| 63 6b 65 74 73 2c 20 74 | 68 65 20 6e 75 6d 62 65 |ckets, t|he numbe|
|00002380| 72 0a 09 6f 66 20 70 61 | 63 6b 65 74 73 20 73 68 |r..of pa|ckets sh|
|00002390| 6f 75 6c 64 20 65 71 75 | 61 6c 20 74 68 65 20 6e |ould equ|al the n|
|000023a0| 75 6d 62 65 72 20 6f 66 | 20 63 68 75 6e 6b 73 29 |umber of| chunks)|
|000023b0| 20 61 6e 64 20 74 68 65 | 0a 09 6e 75 6d 62 65 72 | and the|..number|
|000023c0| 20 6f 66 20 61 63 6b 73 | 2e 0a 0a 09 46 6f 6c 6c | of acks|....Foll|
|000023d0| 6f 77 69 6e 67 20 74 68 | 65 20 73 75 6d 6d 61 72 |owing th|e summar|
|000023e0| 79 20 6c 69 6e 65 20 69 | 73 20 6f 6e 65 20 6c 69 |y line i|s one li|
|000023f0| 6e 65 20 6f 66 20 69 6e | 66 6f 72 6d 61 74 69 6f |ne of in|formatio|
|00002400| 6e 0a 09 70 65 72 20 63 | 68 75 6e 6b 2e 20 20 54 |n..per c|hunk. T|
|00002410| 68 65 20 6c 69 6e 65 20 | 63 6f 6e 74 61 69 6e 73 |he line |contains|
|00002420| 20 65 69 67 68 74 20 66 | 69 65 6c 64 73 3a 0a 09 | eight f|ields:..|
|00002430| 20 20 20 31 20 2d 20 74 | 68 65 20 63 68 75 6e 6b | 1 - t|he chunk|
|00002440| 20 6e 75 6d 62 65 72 0a | 09 20 20 20 32 20 2d 20 | number.|. 2 - |
|00002450| 74 68 65 20 73 74 61 72 | 74 20 73 65 71 75 65 6e |the star|t sequen|
|00002460| 63 65 20 6e 75 6d 62 65 | 72 20 66 6f 72 20 74 68 |ce numbe|r for th|
|00002470| 69 73 20 63 68 75 6e 6b | 0a 09 20 20 20 33 20 2d |is chunk|.. 3 -|
|00002480| 20 74 69 6d 65 20 6f 66 | 20 66 69 72 73 74 20 73 | time of| first s|
|00002490| 65 6e 64 0a 09 20 20 20 | 34 20 2d 20 74 69 6d 65 |end.. |4 - time|
|000024a0| 20 6f 66 20 6c 61 73 74 | 20 73 65 6e 64 0a 09 20 | of last| send.. |
|000024b0| 20 20 35 20 2d 20 74 69 | 6d 65 20 6f 66 20 66 69 | 5 - ti|me of fi|
|000024c0| 72 73 74 20 61 63 6b 0a | 09 20 20 20 36 20 2d 20 |rst ack.|. 6 - |
|000024d0| 74 69 6d 65 20 6f 66 20 | 6c 61 73 74 20 61 63 6b |time of |last ack|
|000024e0| 0a 09 20 20 20 37 20 2d | 20 6e 75 6d 62 65 72 20 |.. 7 -| number |
|000024f0| 6f 66 20 74 69 6d 65 73 | 20 63 68 75 6e 6b 20 77 |of times| chunk w|
|00002500| 61 73 20 73 65 6e 74 20 | 0a 09 20 20 20 38 20 2d |as sent |.. 8 -|
|00002510| 20 6e 75 6d 62 65 72 20 | 6f 66 20 74 69 6d 65 73 | number |of times|
|00002520| 20 63 68 75 6e 6b 20 77 | 61 73 20 61 63 6b 65 64 | chunk w|as acked|
|00002530| 0a 09 28 61 6c 6c 20 74 | 69 6d 65 73 20 61 72 65 |..(all t|imes are|
|00002540| 20 69 6e 20 64 65 63 69 | 6d 61 6c 20 73 65 63 6f | in deci|mal seco|
|00002550| 6e 64 73 2c 20 72 65 6c | 61 74 69 76 65 20 74 6f |nds, rel|ative to|
|00002560| 20 74 68 65 20 73 74 61 | 72 74 0a 09 6f 66 20 74 | the sta|rt..of t|
|00002570| 68 65 20 63 6f 6e 76 65 | 72 73 61 74 69 6f 6e 2e |he conve|rsation.|
|00002580| 29 0a 0a 09 41 73 20 61 | 6e 20 65 78 61 6d 70 6c |)...As a|n exampl|
|00002590| 65 2c 20 68 65 72 65 20 | 69 73 20 74 68 65 20 66 |e, here |is the f|
|000025a0| 69 72 73 74 20 70 61 72 | 74 20 6f 66 20 74 68 65 |irst par|t of the|
|000025b0| 20 6f 75 74 70 75 74 20 | 66 6f 72 0a 09 61 6e 20 | output |for..an |
|000025c0| 66 74 70 20 74 72 61 63 | 65 3a 0a 0a 09 23 20 31 |ftp trac|e:...# 1|
|000025d0| 33 34 20 63 68 75 6e 6b | 73 2e 20 20 35 33 36 20 |34 chunk|s. 536 |
|000025e0| 70 61 63 6b 65 74 73 20 | 73 65 6e 74 2e 20 20 35 |packets |sent. 5|
|000025f0| 30 38 20 61 63 6b 73 2e | 0a 09 31 20 20 20 20 20 |08 acks.|..1 |
|00002600| 20 20 31 20 20 20 20 20 | 20 20 30 2e 30 30 20 20 | 1 | 0.00 |
|00002610| 20 20 35 2e 38 30 20 20 | 20 20 30 2e 32 30 20 20 | 5.80 | 0.20 |
|00002620| 20 20 30 2e 32 30 20 20 | 20 20 34 20 20 20 20 20 | 0.20 | 4 |
|00002630| 20 20 31 0a 09 32 20 20 | 20 20 20 20 20 35 31 33 | 1..2 | 513|
|00002640| 20 20 20 20 20 30 2e 32 | 38 20 20 20 20 36 2e 32 | 0.2|8 6.2|
|00002650| 30 20 20 20 20 30 2e 34 | 30 20 20 20 20 30 2e 34 |0 0.4|0 0.4|
|00002660| 30 20 20 20 20 34 20 20 | 20 20 20 20 20 31 0a 09 |0 4 | 1..|
|00002670| 33 20 20 20 20 20 20 20 | 31 30 32 35 20 20 20 20 |3 |1025 |
|00002680| 31 2e 31 36 20 20 20 20 | 36 2e 33 32 20 20 20 20 |1.16 |6.32 |
|00002690| 31 2e 32 30 20 20 20 20 | 31 2e 32 30 20 20 20 20 |1.20 |1.20 |
|000026a0| 34 20 20 20 20 20 20 20 | 31 0a 09 34 20 20 20 20 |4 |1..4 |
|000026b0| 20 20 20 31 35 36 31 20 | 20 20 20 31 2e 38 36 20 | 1561 | 1.86 |
|000026c0| 20 20 20 31 35 2e 30 30 | 20 20 20 32 2e 30 30 20 | 15.00| 2.00 |
|000026d0| 20 20 20 32 2e 30 30 20 | 20 20 20 36 20 20 20 20 | 2.00 | 6 |
|000026e0| 20 20 20 31 0a 09 35 20 | 20 20 20 20 20 20 32 30 | 1..5 | 20|
|000026f0| 34 39 20 20 20 20 32 2e | 31 36 20 20 20 20 31 35 |49 2.|16 15|
|00002700| 2e 34 34 20 20 20 32 2e | 32 30 20 20 20 20 32 2e |.44 2.|20 2.|
|00002710| 32 30 20 20 20 20 35 20 | 20 20 20 20 20 20 31 0a |20 5 | 1.|
|00002720| 09 36 20 20 20 20 20 20 | 20 32 35 38 35 20 20 20 |.6 | 2585 |
|00002730| 20 32 2e 36 34 20 20 20 | 20 31 36 2e 34 34 20 20 | 2.64 | 16.44 |
|00002740| 20 32 2e 38 30 20 20 20 | 20 32 2e 38 30 20 20 20 | 2.80 | 2.80 |
|00002750| 20 35 20 20 20 20 20 20 | 20 31 0a 09 37 20 20 20 | 5 | 1..7 |
|00002760| 20 20 20 20 33 30 37 33 | 20 20 20 20 33 2e 30 30 | 3073| 3.00|
|00002770| 20 20 20 20 31 36 2e 36 | 36 20 20 20 33 2e 32 30 | 16.6|6 3.20|
|00002780| 20 20 20 20 33 2e 32 30 | 20 20 20 20 34 20 20 20 | 3.20| 4 |
|00002790| 20 20 20 20 31 0a 09 38 | 20 20 20 20 20 20 20 33 | 1..8| 3|
|000027a0| 36 30 39 20 20 20 20 33 | 2e 32 30 20 20 20 20 31 |609 3|.20 1|
|000027b0| 37 2e 32 34 20 20 20 33 | 2e 34 30 20 20 20 20 35 |7.24 3|.40 5|
|000027c0| 2e 38 32 20 20 20 20 34 | 20 20 20 20 20 20 20 31 |.82 4| 1|
|000027d0| 31 0a 09 39 20 20 20 20 | 20 20 20 34 30 39 37 20 |1..9 | 4097 |
|000027e0| 20 20 20 36 2e 30 32 20 | 20 20 20 36 2e 35 38 20 | 6.02 | 6.58 |
|000027f0| 20 20 20 36 2e 32 30 20 | 20 20 20 36 2e 38 30 20 | 6.20 | 6.80 |
|00002800| 20 20 20 32 20 20 20 20 | 20 20 20 35 0a 0a 09 54 | 2 | 5...T|
|00002810| 68 69 73 20 73 61 79 73 | 20 74 68 61 74 20 31 33 |his says| that 13|
|00002820| 34 20 63 68 75 6e 6b 73 | 20 77 65 72 65 20 74 72 |4 chunks| were tr|
|00002830| 61 6e 73 66 65 72 65 64 | 20 28 61 62 6f 75 74 20 |ansfered| (about |
|00002840| 37 30 4b 0a 09 73 69 6e | 63 65 20 74 68 65 20 61 |70K..sin|ce the a|
|00002850| 76 65 72 61 67 65 20 70 | 61 63 6b 65 74 20 73 69 |verage p|acket si|
|00002860| 7a 65 20 77 61 73 20 35 | 31 32 20 62 79 74 65 73 |ze was 5|12 bytes|
|00002870| 29 2e 20 20 49 74 20 74 | 6f 6f 6b 0a 09 35 33 36 |). It t|ook..536|
|00002880| 20 70 61 63 6b 65 74 73 | 20 74 6f 20 74 72 61 6e | packets| to tran|
|00002890| 73 66 65 72 20 74 68 65 | 20 64 61 74 61 20 28 69 |sfer the| data (i|
|000028a0| 2e 65 2e 2c 20 6f 6e 20 | 74 68 65 20 61 76 65 72 |.e., on |the aver|
|000028b0| 61 67 65 0a 09 65 61 63 | 68 20 63 68 75 6e 6b 20 |age..eac|h chunk |
|000028c0| 77 61 73 20 74 72 61 6e | 73 6d 69 74 74 65 64 20 |was tran|smitted |
|000028d0| 66 6f 75 72 20 74 69 6d | 65 73 29 2e 20 20 4c 6f |four tim|es). Lo|
|000028e0| 6f 6b 69 6e 67 20 61 74 | 2c 0a 09 73 61 79 2c 20 |oking at|,..say, |
|000028f0| 63 68 75 6e 6b 20 34 2c | 20 77 65 20 73 65 65 20 |chunk 4,| we see |
|00002900| 69 74 20 72 65 70 72 65 | 73 65 6e 74 73 20 74 68 |it repre|sents th|
|00002910| 65 20 35 31 32 20 62 79 | 74 65 73 20 6f 66 0a 09 |e 512 by|tes of..|
|00002920| 73 65 71 75 65 6e 63 65 | 20 73 70 61 63 65 20 66 |sequence| space f|
|00002930| 72 6f 6d 20 31 35 36 31 | 20 74 6f 20 32 30 34 38 |rom 1561| to 2048|
|00002940| 2e 20 20 49 74 20 77 61 | 73 20 66 69 72 73 74 20 |. It wa|s first |
|00002950| 73 65 6e 74 0a 09 31 2e | 38 36 20 73 65 63 6f 6e |sent..1.|86 secon|
|00002960| 64 73 20 69 6e 74 6f 20 | 74 68 65 20 63 6f 6e 76 |ds into |the conv|
|00002970| 65 72 73 61 74 69 6f 6e | 2e 20 20 49 74 20 77 61 |ersation|. It wa|
|00002980| 73 20 6c 61 73 74 0a 09 | 73 65 6e 74 20 31 35 20 |s last..|sent 15 |
|00002990| 73 65 63 6f 6e 64 73 20 | 69 6e 74 6f 20 74 68 65 |seconds |into the|
|000029a0| 20 63 6f 6e 76 65 72 73 | 61 74 69 6f 6e 20 61 6e | convers|ation an|
|000029b0| 64 20 77 61 73 20 73 65 | 6e 74 0a 09 61 20 74 6f |d was se|nt..a to|
|000029c0| 74 61 6c 20 6f 66 20 36 | 20 74 69 6d 65 73 20 28 |tal of 6| times (|
|000029d0| 69 2e 65 2e 2c 20 69 74 | 20 77 61 73 20 72 65 74 |i.e., it| was ret|
|000029e0| 72 61 6e 73 6d 69 74 74 | 65 64 20 65 76 65 72 79 |ransmitt|ed every|
|000029f0| 0a 09 32 20 73 65 63 6f | 6e 64 73 20 6f 6e 20 74 |..2 seco|nds on t|
|00002a00| 68 65 20 61 76 65 72 61 | 67 65 29 2e 20 20 49 74 |he avera|ge). It|
|00002a10| 20 77 61 73 20 61 63 6b | 65 64 20 6f 6e 63 65 2c | was ack|ed once,|
|00002a20| 20 31 34 30 6d 73 0a 09 | 61 66 74 65 72 20 69 74 | 140ms..|after it|
|00002a30| 20 66 69 72 73 74 20 61 | 72 72 69 76 65 64 2e 0a | first a|rrived..|
|00002a40| 0a 73 74 69 6d 65 2e 61 | 77 6b 0a 61 74 69 6d 65 |.stime.a|wk.atime|
|00002a50| 2e 61 77 6b 0a 09 4f 75 | 74 70 75 74 20 6f 6e 65 |.awk..Ou|tput one|
|00002a60| 20 6c 69 6e 65 20 70 65 | 72 20 73 65 6e 64 20 6f | line pe|r send o|
|00002a70| 72 20 61 63 6b 2c 20 72 | 65 73 70 65 63 74 69 76 |r ack, r|espectiv|
|00002a80| 65 6c 79 2c 20 69 6e 20 | 74 68 65 20 66 6f 72 6d |ely, in |the form|
|00002a90| 0a 09 09 3c 74 69 6d 65 | 3e 20 3c 73 65 71 2e 20 |...<time|> <seq. |
|00002aa0| 6e 75 6d 62 65 72 3e 0a | 09 77 68 65 72 65 20 3c |number>.|.where <|
|00002ab0| 74 69 6d 65 3e 20 69 73 | 20 74 68 65 20 74 69 6d |time> is| the tim|
|00002ac0| 65 20 69 6e 20 73 65 63 | 6f 6e 64 73 20 73 69 6e |e in sec|onds sin|
|00002ad0| 63 65 20 74 68 65 20 73 | 74 61 72 74 20 6f 66 20 |ce the s|tart of |
|00002ae0| 74 68 65 0a 09 74 72 61 | 6e 73 66 65 72 20 61 6e |the..tra|nsfer an|
|00002af0| 64 20 3c 73 65 71 2e 20 | 6e 75 6d 62 65 72 3e 20 |d <seq. |number> |
|00002b00| 69 73 20 74 68 65 20 73 | 65 71 75 65 6e 63 65 20 |is the s|equence |
|00002b10| 6e 75 6d 62 65 72 20 62 | 65 69 6e 67 20 73 65 6e |number b|eing sen|
|00002b20| 74 0a 09 6f 72 20 61 63 | 6b 65 64 2e 20 20 49 20 |t..or ac|ked. I |
|00002b30| 74 79 70 69 63 61 6c 6c | 79 20 70 6c 6f 74 20 74 |typicall|y plot t|
|00002b40| 68 69 73 20 64 61 74 61 | 20 6c 6f 6f 6b 69 6e 67 |his data| looking|
|00002b50| 20 66 6f 72 20 73 75 73 | 70 69 63 69 6f 75 73 0a | for sus|picious.|
|00002b60| 09 70 61 74 74 65 72 6e | 73 2e 0a 0a 0a 54 68 65 |.pattern|s....The|
|00002b70| 20 70 72 6f 62 6c 65 6d | 20 49 20 77 61 73 20 6c | problem| I was l|
|00002b80| 6f 6f 6b 69 6e 67 20 61 | 74 20 77 61 73 20 74 68 |ooking a|t was th|
|00002b90| 65 20 62 75 6c 6b 2d 64 | 61 74 61 2d 74 72 61 6e |e bulk-d|ata-tran|
|00002ba0| 73 66 65 72 0a 74 68 72 | 6f 75 67 68 70 75 74 20 |sfer.thr|oughput |
|00002bb0| 6f 66 20 6d 65 64 69 75 | 6d 20 64 65 6c 61 79 20 |of mediu|m delay |
|00002bc0| 6e 65 74 77 6f 72 6b 20 | 70 61 74 68 73 20 28 31 |network |paths (1|
|00002bd0| 2d 36 20 73 65 63 2e 20 | 20 72 6f 75 6e 64 20 74 |-6 sec. | round t|
|00002be0| 72 69 70 0a 74 69 6d 65 | 29 20 75 6e 64 65 72 20 |rip.time|) under |
|00002bf0| 74 79 70 69 63 61 6c 20 | 44 41 52 50 41 20 49 6e |typical |DARPA In|
|00002c00| 74 65 72 6e 65 74 20 63 | 6f 6e 64 69 74 69 6f 6e |ternet c|ondition|
|00002c10| 73 2e 20 20 54 68 65 20 | 74 72 61 63 65 20 6f 66 |s. The |trace of|
|00002c20| 20 74 68 65 0a 66 74 70 | 20 74 72 61 6e 73 66 65 | the.ftp| transfe|
|00002c30| 72 20 6f 66 20 61 20 6c | 61 72 67 65 20 66 69 6c |r of a l|arge fil|
|00002c40| 65 20 77 61 73 20 75 73 | 65 64 20 61 73 20 74 68 |e was us|ed as th|
|00002c50| 65 20 72 61 77 20 64 61 | 74 61 20 73 6f 75 72 63 |e raw da|ta sourc|
|00002c60| 65 2e 20 0a 54 68 65 20 | 6d 65 74 68 6f 64 20 77 |e. .The |method w|
|00002c70| 61 73 3a 0a 0a 20 20 2d | 20 4f 6e 20 61 20 6c 6f |as:.. -| On a lo|
|00002c80| 63 61 6c 20 68 6f 73 74 | 20 28 62 75 74 20 6e 6f |cal host| (but no|
|00002c90| 74 20 74 68 65 20 53 75 | 6e 20 72 75 6e 6e 69 6e |t the Su|n runnin|
|00002ca0| 67 20 74 63 70 64 75 6d | 70 29 2c 20 63 6f 6e 6e |g tcpdum|p), conn|
|00002cb0| 65 63 74 20 74 6f 0a 20 | 20 20 20 74 68 65 20 72 |ect to. | the r|
|00002cc0| 65 6d 6f 74 65 20 66 74 | 70 2e 0a 0a 20 20 2d 20 |emote ft|p... - |
|00002cd0| 4f 6e 20 74 68 65 20 6d | 6f 6e 69 74 6f 72 20 53 |On the m|onitor S|
|00002ce0| 75 6e 2c 20 73 74 61 72 | 74 20 74 68 65 20 74 72 |un, star|t the tr|
|00002cf0| 61 63 65 20 67 6f 69 6e | 67 2e 20 20 45 2e 67 2e |ace goin|g. E.g.|
|00002d00| 2c 0a 09 74 63 70 64 75 | 6d 70 20 62 65 74 77 65 |,..tcpdu|mp betwe|
|00002d10| 65 6e 20 6c 6f 63 61 6c | 20 72 65 6d 6f 74 65 20 |en local| remote |
|00002d20| 61 6e 64 20 70 6f 72 74 | 20 66 74 70 2d 64 61 74 |and port| ftp-dat|
|00002d30| 61 20 3e 74 72 61 63 65 | 66 69 6c 65 0a 0a 20 20 |a >trace|file.. |
|00002d40| 2d 20 4f 6e 20 6c 6f 63 | 61 6c 2c 20 64 6f 20 65 |- On loc|al, do e|
|00002d50| 69 74 68 65 72 20 61 20 | 67 65 74 20 6f 72 20 70 |ither a |get or p|
|00002d60| 75 74 20 6f 66 20 61 20 | 6c 61 72 67 65 20 66 69 |ut of a |large fi|
|00002d70| 6c 65 20 28 7e 35 30 30 | 4b 42 29 2c 0a 20 20 20 |le (~500|KB),. |
|00002d80| 20 70 72 65 66 65 72 61 | 62 6c 79 20 74 6f 20 74 | prefera|bly to t|
|00002d90| 68 65 20 6e 75 6c 6c 20 | 64 65 76 69 63 65 20 28 |he null |device (|
|00002da0| 74 6f 20 6d 69 6e 69 6d | 69 7a 65 20 65 66 66 65 |to minim|ize effe|
|00002db0| 63 74 73 20 6c 69 6b 65 | 0a 20 20 20 20 63 6c 6f |cts like|. clo|
|00002dc0| 73 69 6e 67 20 74 68 65 | 20 72 65 63 65 69 76 65 |sing the| receive|
|00002dd0| 20 77 69 6e 64 6f 77 20 | 77 68 69 6c 65 20 77 61 | window |while wa|
|00002de0| 69 74 69 6e 67 20 66 6f | 72 20 61 20 64 69 73 6b |iting fo|r a disk|
|00002df0| 20 77 72 69 74 65 29 2e | 0a 0a 20 20 2d 20 57 68 | write).|.. - Wh|
|00002e00| 65 6e 20 74 72 61 6e 66 | 65 72 20 69 73 20 66 69 |en tranf|er is fi|
|00002e10| 6e 69 73 68 65 64 2c 20 | 73 74 6f 70 20 74 63 70 |nished, |stop tcp|
|00002e20| 64 75 6d 70 2e 20 20 55 | 73 65 20 61 77 6b 20 74 |dump. U|se awk t|
|00002e30| 6f 20 6d 61 6b 65 20 75 | 70 0a 20 20 20 20 74 77 |o make u|p. tw|
|00002e40| 6f 20 66 69 6c 65 73 20 | 6f 66 20 73 75 6d 6d 61 |o files |of summa|
|00002e50| 72 79 20 64 61 74 61 20 | 28 6d 61 78 73 69 7a 65 |ry data |(maxsize|
|00002e60| 20 69 73 20 74 68 65 20 | 6d 61 78 69 6d 75 6d 20 | is the |maximum |
|00002e70| 70 61 63 6b 65 74 20 73 | 69 7a 65 2c 0a 20 20 20 |packet s|ize,. |
|00002e80| 20 74 72 61 63 65 64 61 | 74 61 20 69 73 20 74 68 | traceda|ta is th|
|00002e90| 65 20 66 69 6c 65 20 6f | 66 20 74 63 70 64 75 6d |e file o|f tcpdum|
|00002ea0| 70 20 74 72 61 63 65 64 | 61 74 61 29 3a 0a 20 20 |p traced|ata):. |
|00002eb0| 20 20 20 20 61 77 6b 20 | 2d 66 20 73 65 6e 64 2d | awk |-f send-|
|00002ec0| 61 63 6b 2e 61 77 6b 20 | 70 61 63 6b 65 74 73 69 |ack.awk |packetsi|
|00002ed0| 7a 65 3d 61 76 67 73 69 | 7a 65 20 74 72 61 63 65 |ze=avgsi|ze trace|
|00002ee0| 64 61 74 61 20 3e 73 61 | 0a 20 20 20 20 20 20 61 |data >sa|. a|
|00002ef0| 77 6b 20 2d 66 20 70 61 | 63 6b 65 74 64 61 74 2e |wk -f pa|cketdat.|
|00002f00| 61 77 6b 20 70 61 63 6b | 65 74 73 69 7a 65 3d 61 |awk pack|etsize=a|
|00002f10| 76 67 73 69 7a 65 20 74 | 72 61 63 65 64 61 74 61 |vgsize t|racedata|
|00002f20| 20 3e 70 64 0a 0a 20 20 | 2d 20 57 68 69 6c 65 20 | >pd.. |- While |
|00002f30| 74 68 65 20 73 75 6d 6d | 61 72 79 20 64 61 74 61 |the summ|ary data|
|00002f40| 20 66 69 6c 65 73 20 61 | 72 65 20 70 72 69 6e 74 | files a|re print|
|00002f50| 69 6e 67 2c 20 74 61 6b | 65 20 61 20 6c 6f 6f 6b |ing, tak|e a look|
|00002f60| 20 61 74 0a 20 20 20 20 | 68 6f 77 20 74 68 65 20 | at. |how the |
|00002f70| 74 72 61 6e 73 66 65 72 | 20 62 65 68 61 76 65 64 |transfer| behaved|
|00002f80| 3a 0a 20 20 20 20 20 20 | 61 77 6b 20 2d 66 20 73 |:. |awk -f s|
|00002f90| 74 69 6d 65 2e 61 77 6b | 20 74 72 61 63 65 64 61 |time.awk| traceda|
|00002fa0| 74 61 20 7c 20 78 67 72 | 61 70 68 0a 20 20 20 20 |ta | xgr|aph. |
|00002fb0| 28 39 30 25 20 6f 66 20 | 77 68 61 74 20 79 6f 75 |(90% of |what you|
|00002fc0| 20 6c 65 61 72 6e 20 73 | 65 65 6d 73 20 74 6f 20 | learn s|eems to |
|00002fd0| 68 61 70 70 65 6e 20 69 | 6e 20 74 68 69 73 20 73 |happen i|n this s|
|00002fe0| 74 65 70 29 2e 0a 0a 20 | 20 2d 20 44 6f 20 61 6c |tep)... | - Do al|
|00002ff0| 6c 20 6f 66 20 74 68 65 | 20 61 62 6f 76 65 20 73 |l of the| above s|
|00003000| 74 65 70 73 20 73 65 76 | 65 72 61 6c 20 74 69 6d |teps sev|eral tim|
|00003010| 65 73 2c 20 62 6f 74 68 | 20 64 69 72 65 63 74 69 |es, both| directi|
|00003020| 6f 6e 73 2c 0a 20 20 20 | 20 61 74 20 64 69 66 66 |ons,. | at diff|
|00003030| 65 72 65 6e 74 20 74 69 | 6d 65 73 20 6f 66 20 64 |erent ti|mes of d|
|00003040| 61 79 2c 20 77 69 74 68 | 20 64 69 66 66 65 72 65 |ay, with| differe|
|00003050| 6e 74 20 70 72 6f 74 6f | 63 6f 6c 0a 20 20 20 20 |nt proto|col. |
|00003060| 69 6d 70 6c 65 6d 65 6e | 74 61 74 69 6f 6e 73 20 |implemen|tations |
|00003070| 6f 6e 20 74 68 65 20 6f | 74 68 65 72 20 65 6e 64 |on the o|ther end|
|00003080| 2e 0a 0a 20 20 2d 20 55 | 73 69 6e 67 20 6f 6e 65 |... - U|sing one|
|00003090| 20 6f 66 20 74 68 65 20 | 55 6e 69 78 20 64 61 74 | of the |Unix dat|
|000030a0| 61 20 61 6e 61 6c 79 73 | 69 73 20 70 61 63 6b 61 |a analys|is packa|
|000030b0| 67 65 73 20 28 69 6e 20 | 6d 79 20 63 61 73 65 2c |ges (in |my case,|
|000030c0| 0a 20 20 20 20 53 20 61 | 6e 64 20 47 61 72 79 20 |. S a|nd Gary |
|000030d0| 50 65 72 6c 6d 61 6e 27 | 73 20 55 6e 69 78 7c 53 |Perlman'|s Unix|S|
|000030e0| 74 61 74 29 2c 20 73 70 | 65 6e 64 20 61 20 66 65 |tat), sp|end a fe|
|000030f0| 77 20 6d 6f 6e 74 68 73 | 20 73 74 61 72 69 6e 67 |w months| staring|
|00003100| 0a 20 20 20 20 61 74 20 | 74 68 65 20 64 61 74 61 |. at |the data|
|00003110| 2e 0a 0a 20 20 2d 20 43 | 68 61 6e 67 65 20 73 6f |... - C|hange so|
|00003120| 6d 65 74 68 69 6e 67 20 | 69 6e 20 74 68 65 20 6c |mething |in the l|
|00003130| 6f 63 61 6c 20 70 72 6f | 74 6f 63 6f 6c 20 69 6d |ocal pro|tocol im|
|00003140| 70 6c 65 6d 65 6e 74 61 | 74 69 6f 6e 20 61 6e 64 |plementa|tion and|
|00003150| 0a 20 20 20 20 72 65 64 | 6f 20 74 68 65 20 73 74 |. red|o the st|
|00003160| 65 70 73 20 61 62 6f 76 | 65 2e 0a 0a 20 20 2d 20 |eps abov|e... - |
|00003170| 4f 6e 63 65 20 61 20 77 | 65 65 6b 2c 20 74 65 6c |Once a w|eek, tel|
|00003180| 6c 20 79 6f 75 72 20 66 | 75 6e 64 69 6e 67 20 61 |l your f|unding a|
|00003190| 67 65 6e 74 20 74 68 61 | 74 20 79 6f 75 27 72 65 |gent tha|t you're|
|000031a0| 20 64 69 73 63 6f 76 65 | 72 69 6e 67 0a 20 20 20 | discove|ring. |
|000031b0| 20 77 6f 6e 64 65 72 66 | 75 6c 20 74 68 69 6e 67 | wonderf|ul thing|
|000031c0| 73 20 61 6e 64 20 79 6f | 75 27 6c 6c 20 77 72 69 |s and yo|u'll wri|
|000031d0| 74 65 20 75 70 20 74 68 | 61 74 20 72 65 73 65 61 |te up th|at resea|
|000031e0| 72 63 68 20 72 65 70 6f | 72 74 0a 20 20 20 20 22 |rch repo|rt. "|
|000031f0| 72 65 61 6c 20 73 6f 6f | 6e 20 6e 6f 77 22 2e 0a |real soo|n now"..|
|00003200| 0a 65 74 68 65 72 66 69 | 6e 64 20 77 65 72 65 20 |.etherfi|nd were |
|00003210| 6c 61 74 65 72 20 72 65 | 2d 77 72 69 74 74 65 6e |later re|-written|
|00003220| 20 62 79 20 53 74 65 76 | 65 20 4d 63 43 61 6e 6e | by Stev|e McCann|
|00003230| 65 20 6f 66 0a 4c 42 4c | 2e 20 20 54 6f 20 69 6e |e of.LBL|. To in|
|00003240| 73 75 72 65 20 74 68 61 | 74 20 77 6f 75 6c 64 20 |sure tha|t would |
|00003250| 62 65 20 6e 6f 20 76 65 | 73 74 69 67 65 20 6f 66 |be no ve|stige of|
|00003260| 20 70 72 6f 70 72 69 65 | 74 61 72 79 20 63 6f 64 | proprie|tary cod|
|00003270| 65 20 69 6e 0a 74 63 70 | 64 75 6d 70 2c 20 53 74 |e in.tcp|dump, St|
|00003280| 65 76 65 20 77 72 6f 74 | 65 20 74 68 65 73 65 20 |eve wrot|e these |
|00003290| 70 69 65 63 65 73 20 66 | 72 6f 6d 20 74 68 65 20 |pieces f|rom the |
|000032a0| 73 70 65 63 69 66 69 63 | 61 74 69 6f 6e 20 67 69 |specific|ation gi|
|000032b0| 76 65 6e 0a 62 79 20 74 | 68 65 20 6d 61 6e 75 61 |ven.by t|he manua|
|000032c0| 6c 20 65 6e 74 72 79 2c | 20 77 69 74 68 20 6e 6f |l entry,| with no|
|000032d0| 20 61 63 63 65 73 73 20 | 74 6f 20 74 68 65 20 73 | access |to the s|
|000032e0| 6f 75 72 63 65 20 6f 66 | 20 74 63 70 64 75 6d 70 |ource of| tcpdump|
|000032f0| 20 6f 72 0a 65 74 68 65 | 72 66 69 6e 64 2e 0a 0a | or.ethe|rfind...|
|00003300| 54 68 65 20 63 75 72 72 | 65 6e 74 20 76 65 72 73 |The curr|ent vers|
|00003310| 69 6f 6e 73 20 6f 66 20 | 74 68 65 73 65 20 66 69 |ions of |these fi|
|00003320| 6c 65 73 20 61 72 65 20 | 61 76 61 69 6c 61 62 6c |les are |availabl|
|00003330| 65 20 76 69 61 20 61 6e | 6f 6e 79 6d 6f 75 73 0a |e via an|onymous.|
|00003340| 66 74 70 20 66 72 6f 6d | 20 68 6f 73 74 20 66 74 |ftp from| host ft|
|00003350| 70 2e 65 65 2e 6c 62 6c | 2e 67 6f 76 20 28 63 75 |p.ee.lbl|.gov (cu|
|00003360| 72 72 65 6e 74 6c 79 20 | 61 74 20 61 64 64 72 65 |rrently |at addre|
|00003370| 73 73 20 31 32 38 2e 33 | 2e 32 35 34 2e 36 38 29 |ss 128.3|.254.68)|
|00003380| 0a 66 69 6c 65 20 74 63 | 70 64 75 6d 70 2e 74 61 |.file tc|pdump.ta|
|00003390| 72 2e 5a 20 28 61 20 63 | 6f 6d 70 72 65 73 73 65 |r.Z (a c|ompresse|
|000033a0| 64 20 55 6e 69 78 20 74 | 61 72 20 66 69 6c 65 29 |d Unix t|ar file)|
|000033b0| 2e 0a 0a 54 68 69 73 20 | 70 72 6f 67 72 61 6d 20 |...This |program |
|000033c0| 69 73 20 73 75 62 6a 65 | 63 74 20 74 6f 20 74 68 |is subje|ct to th|
|000033d0| 65 20 27 73 74 61 6e 64 | 61 72 64 27 20 42 65 72 |e 'stand|ard' Ber|
|000033e0| 6b 65 6c 65 79 20 6e 65 | 74 77 6f 72 6b 20 73 6f |keley ne|twork so|
|000033f0| 66 74 77 61 72 65 0a 63 | 6f 70 79 72 69 67 68 74 |ftware.c|opyright|
|00003400| 4d 61 6b 65 66 69 6c 65 | 00 00 00 00 00 00 00 00 |Makefile|........|
|00003410| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003420| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003430| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003440| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003450| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003460| 00 00 00 00 20 20 20 34 | 34 34 20 00 20 20 33 30 |.... 4|44 . 30|
|00003470| 36 30 20 00 20 20 20 20 | 33 34 20 00 20 20 20 20 |60 . |34 . |
|00003480| 20 20 31 31 30 34 35 20 | 20 34 35 37 34 32 37 32 | 11045 | 4574272|
|00003490| 32 33 32 20 20 20 35 36 | 31 33 00 20 00 00 00 00 |232 56|13. ....|
|000034a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000034b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000034c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000034d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000034e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000034f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003500| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003510| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003520| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003530| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003540| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003550| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003560| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003570| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003580| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003590| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035a0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035b0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035c0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000035f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00003600| 23 20 20 43 6f 70 79 72 | 69 67 68 74 20 28 63 29 |# Copyr|ight (c)|
|00003610| 20 31 39 38 38 20 52 65 | 67 65 6e 74 73 20 6f 66 | 1988 Re|gents of|
|00003620| 20 74 68 65 20 55 6e 69 | 76 65 72 73 69 74 79 20 | the Uni|versity |
|00003630| 6f 66 20 43 61 6c 69 66 | 6f 72 6e 69 61 2e 0a 23 |of Calif|ornia..#|
|00003640| 20 20 41 6c 6c 20 72 69 | 67 68 74 73 20 72 65 73 | All ri|ghts res|
|00003650| 65 72 76 65 64 2e 0a 23 | 20 0a 23 20 20 52 65 64 |erved..#| .# Red|
|00003660| 69 73 74 72 69 62 75 74 | 69 6f 6e 20 61 6e 64 20 |istribut|ion and |
|00003670| 75 73 65 20 69 6e 20 73 | 6f 75 72 63 65 20 61 6e |use in s|ource an|
|00003680| 64 20 62 69 6e 61 72 79 | 20 66 6f 72 6d 73 20 61 |d binary| forms a|
|00003690| 72 65 20 70 65 72 6d 69 | 74 74 65 64 0a 23 20 20 |re permi|tted.# |
|000036a0| 70 72 6f 76 69 64 65 64 | 20 74 68 61 74 20 74 68 |provided| that th|
|000036b0| 65 20 61 62 6f 76 65 20 | 63 6f 70 79 72 69 67 68 |e above |copyrigh|
|000036c0| 74 20 6e 6f 74 69 63 65 | 20 61 6e 64 20 74 68 69 |t notice| and thi|
|000036d0| 73 20 70 61 72 61 67 72 | 61 70 68 20 61 72 65 0a |s paragr|aph are.|
|000036e0| 23 20 20 64 75 70 6c 69 | 63 61 74 65 64 20 69 6e |# dupli|cated in|
|000036f0| 20 61 6c 6c 20 73 75 63 | 68 20 66 6f 72 6d 73 20 | all suc|h forms |
|00003700| 61 6e 64 20 74 68 61 74 | 20 61 6e 79 20 64 6f 63 |and that| any doc|
|00003710| 75 6d 65 6e 74 61 74 69 | 6f 6e 2c 0a 23 20 20 61 |umentati|on,.# a|
|00003720| 64 76 65 72 74 69 73 69 | 6e 67 20 6d 61 74 65 72 |dvertisi|ng mater|
|00003730| 69 61 6c 73 2c 20 61 6e | 64 20 6f 74 68 65 72 20 |ials, an|d other |
|00003740| 6d 61 74 65 72 69 61 6c | 73 20 72 65 6c 61 74 65 |material|s relate|
|00003750| 64 20 74 6f 20 73 75 63 | 68 0a 23 20 20 64 69 73 |d to suc|h.# dis|
|00003760| 74 72 69 62 75 74 69 6f | 6e 20 61 6e 64 20 75 73 |tributio|n and us|
|00003770| 65 20 61 63 6b 6e 6f 77 | 6c 65 64 67 65 20 74 68 |e acknow|ledge th|
|00003780| 61 74 20 74 68 65 20 73 | 6f 66 74 77 61 72 65 20 |at the s|oftware |
|00003790| 77 61 73 20 64 65 76 65 | 6c 6f 70 65 64 0a 23 20 |was deve|loped.# |
|000037a0| 20 62 79 20 74 68 65 20 | 55 6e 69 76 65 72 73 69 | by the |Universi|
|000037b0| 74 79 20 6f 66 20 43 61 | 6c 69 66 6f 72 6e 69 61 |ty of Ca|lifornia|
|000037c0| 2c 20 4c 61 77 72 65 6e | 63 65 20 42 65 72 6b 65 |, Lawren|ce Berke|
|000037d0| 6c 65 79 20 4c 61 62 6f | 72 61 74 6f 72 79 2c 0a |ley Labo|ratory,.|
|000037e0| 23 20 20 42 65 72 6b 65 | 6c 65 79 2c 20 43 41 2e |# Berke|ley, CA.|
|000037f0| 20 20 54 68 65 20 6e 61 | 6d 65 20 6f 66 20 74 68 | The na|me of th|
|00003800| 65 20 55 6e 69 76 65 72 | 73 69 74 79 20 6d 61 79 |e Univer|sity may|
|00003810| 20 6e 6f 74 20 62 65 20 | 75 73 65 64 20 74 6f 0a | not be |used to.|
|00003820| 23 20 20 65 6e 64 6f 72 | 73 65 20 6f 72 20 70 72 |# endor|se or pr|
|00003830| 6f 6d 6f 74 65 20 70 72 | 6f 64 75 63 74 73 20 64 |omote pr|oducts d|
|00003840| 65 72 69 76 65 64 20 66 | 72 6f 6d 20 74 68 69 73 |erived f|rom this|
|00003850| 20 73 6f 66 74 77 61 72 | 65 20 77 69 74 68 6f 75 | softwar|e withou|
|00003860| 74 0a 23 20 20 73 70 65 | 63 69 66 69 63 20 70 72 |t.# spe|cific pr|
|00003870| 69 6f 72 20 77 72 69 74 | 74 65 6e 20 70 65 72 6d |ior writ|ten perm|
|00003880| 69 73 73 69 6f 6e 2e 0a | 23 20 20 54 48 49 53 20 |ission..|# THIS |
|00003890| 53 4f 46 54 57 41 52 45 | 20 49 53 20 50 52 4f 56 |SOFTWARE| IS PROV|
|000038a0| 49 44 45 44 20 60 60 41 | 53 20 49 53 27 27 20 41 |IDED ``A|S IS'' A|
|000038b0| 4e 44 20 57 49 54 48 4f | 55 54 20 41 4e 59 20 45 |ND WITHO|UT ANY E|
|000038c0| 58 50 52 45 53 53 20 4f | 52 0a 23 20 20 49 4d 50 |XPRESS O|R.# IMP|
|000038d0| 4c 49 45 44 20 57 41 52 | 52 41 4e 54 49 45 53 2c |LIED WAR|RANTIES,|
|000038e0| 20 49 4e 43 4c 55 44 49 | 4e 47 2c 20 57 49 54 48 | INCLUDI|NG, WITH|
|000038f0| 4f 55 54 20 4c 49 4d 49 | 54 41 54 49 4f 4e 2c 20 |OUT LIMI|TATION, |
|00003900| 54 48 45 20 49 4d 50 4c | 49 45 44 0a 23 20 20 57 |THE IMPL|IED.# W|
|00003910| 41 52 52 41 4e 54 49 45 | 53 20 4f 46 20 4d 45 52 |ARRANTIE|S OF MER|
|00003920| 43 48 41 4e 54 49 42 49 | 4c 49 54 59 20 41 4e 44 |CHANTIBI|LITY AND|
|00003930| 20 46 49 54 4e 45 53 53 | 20 46 4f 52 20 41 20 50 | FITNESS| FOR A P|
|00003940| 41 52 54 49 43 55 4c 41 | 52 20 50 55 52 50 4f 53 |ARTICULA|R PURPOS|
|00003950| 45 2e 0a 23 20 0a 23 20 | 40 28 23 29 20 24 48 65 |E..# .# |@(#) $He|
|00003960| 61 64 65 72 3a 20 4d 61 | 6b 65 66 69 6c 65 2c 76 |ader: Ma|kefile,v|
|00003970| 20 31 2e 33 31 20 39 30 | 2f 30 33 2f 30 34 20 31 | 1.31 90|/03/04 1|
|00003980| 30 3a 32 31 3a 35 36 20 | 6d 63 63 61 6e 6e 65 20 |0:21:56 |mccanne |
|00003990| 45 78 70 20 24 20 28 4c | 42 4c 29 0a 0a 23 20 50 |Exp $ (L|BL)..# P|
|000039a0| 6f 73 73 69 62 6c 65 20 | 4f 70 74 69 6f 6e 73 3a |ossible |Options:|
|000039b0| 0a 23 20 20 20 20 2d 44 | 43 53 4c 49 50 09 69 6e |.# -D|CSLIP.in|
|000039c0| 63 6c 75 64 65 20 73 75 | 70 70 6f 72 74 20 66 6f |clude su|pport fo|
|000039d0| 72 20 6b 65 72 6e 65 6c | 20 73 6c 69 70 20 6e 69 |r kernel| slip ni|
|000039e0| 74 20 69 6e 74 65 72 66 | 61 63 65 20 28 6e 65 65 |t interf|ace (nee|
|000039f0| 64 20 4c 42 4c 0a 23 09 | 09 69 66 5f 73 6c 20 64 |d LBL.#.|.if_sl d|
|00003a00| 72 69 76 65 72 20 61 6e | 64 20 6f 6e 6c 79 20 77 |river an|d only w|
|00003a10| 6f 72 6b 73 20 75 6e 64 | 65 72 20 53 75 6e 20 4f |orks und|er Sun O|
|00003a20| 53 20 33 2e 35 29 2e 0a | 23 20 20 20 20 2d 44 46 |S 3.5)..|# -DF|
|00003a30| 4c 45 58 09 73 63 61 6e | 6e 65 72 20 62 75 69 6c |LEX.scan|ner buil|
|00003a40| 74 20 77 69 74 68 20 66 | 6c 65 78 20 69 6e 73 74 |t with f|lex inst|
|00003a50| 65 61 64 20 6f 66 20 6c | 65 78 0a 23 20 20 20 20 |ead of l|ex.# |
|00003a60| 2d 44 44 45 42 55 47 09 | 69 6e 63 6c 75 64 65 20 |-DDEBUG.|include |
|00003a70| 73 6f 6d 65 20 64 65 62 | 75 67 67 69 6e 67 20 63 |some deb|ugging c|
|00003a80| 6f 64 65 20 28 75 6e 6c | 65 73 73 20 79 6f 75 27 |ode (unl|ess you'|
|00003a90| 72 65 20 6d 61 6b 69 6e | 67 20 6d 61 6a 6f 72 0a |re makin|g major.|
|00003aa0| 23 09 09 61 64 64 69 74 | 69 6f 6e 73 20 74 6f 20 |#..addit|ions to |
|00003ab0| 74 68 69 73 20 70 72 6f | 67 72 61 6d 2c 20 79 6f |this pro|gram, yo|
|00003ac0| 75 20 64 6f 6e 27 74 20 | 6e 65 65 64 20 74 6f 20 |u don't |need to |
|00003ad0| 73 65 74 20 74 68 69 73 | 29 0a 44 45 46 49 4e 45 |set this|).DEFINE|
|00003ae0| 53 20 3d 20 2d 44 46 4c | 45 58 20 2d 44 44 45 42 |S = -DFL|EX -DDEB|
|00003af0| 55 47 0a 43 43 4f 50 54 | 20 3d 20 2d 4f 0a 49 4e |UG.CCOPT| = -O.IN|
|00003b00| 43 4c 55 44 45 53 20 3d | 0a 0a 23 20 46 75 6c 6c |CLUDES =|..# Full|
|00003b10| 20 70 61 74 68 6e 61 6d | 65 20 6f 66 20 77 68 65 | pathnam|e of whe|
|00003b20| 72 65 20 74 6f 20 69 6e | 73 74 61 6c 6c 20 74 68 |re to in|stall th|
|00003b30| 65 20 62 69 6e 61 72 79 | 0a 42 49 4e 44 45 53 54 |e binary|.BINDEST|
|00003b40| 20 3d 20 2f 75 73 72 2f | 65 74 63 2f 74 63 70 64 | = /usr/|etc/tcpd|
|00003b50| 75 6d 70 0a 23 20 46 75 | 6c 6c 20 70 61 74 68 6e |ump.# Fu|ll pathn|
|00003b60| 61 6d 65 20 6f 66 20 77 | 68 65 72 65 20 74 6f 20 |ame of w|here to |
|00003b70| 69 6e 73 74 61 6c 6c 20 | 74 68 65 20 6d 61 6e 75 |install |the manu|
|00003b80| 61 6c 20 65 6e 74 72 79 | 0a 4d 41 4e 44 45 53 54 |al entry|.MANDEST|
|00003b90| 20 3d 20 2f 75 73 72 2f | 6d 61 6e 2f 6d 61 6e 6c | = /usr/|man/manl|
|00003ba0| 2f 74 63 70 64 75 6d 70 | 2e 6c 0a 0a 23 20 54 68 |/tcpdump|.l..# Th|
|00003bb0| 65 73 65 20 61 72 65 20 | 74 68 65 20 66 6c 61 67 |ese are |the flag|
|00003bc0| 73 20 74 6f 20 75 73 65 | 20 66 6f 72 20 53 75 6e |s to use| for Sun|
|00003bd0| 20 4f 53 20 33 2e 78 0a | 43 46 4c 41 47 53 5f 53 | OS 3.x.|CFLAGS_S|
|00003be0| 55 4e 4f 53 33 20 3d 20 | 24 28 43 43 4f 50 54 29 |UNOS3 = |$(CCOPT)|
|00003bf0| 20 24 28 44 45 46 49 4e | 45 53 29 20 24 28 49 4e | $(DEFIN|ES) $(IN|
|00003c00| 43 4c 55 44 45 53 29 0a | 23 20 54 68 65 73 65 20 |CLUDES).|# These |
|00003c10| 61 72 65 20 74 68 65 20 | 66 6c 61 67 73 20 74 6f |are the |flags to|
|00003c20| 20 75 73 65 20 66 6f 72 | 20 53 75 6e 20 4f 53 20 | use for| Sun OS |
|00003c30| 34 2e 30 2e 78 0a 43 46 | 4c 41 47 53 5f 53 55 4e |4.0.x.CF|LAGS_SUN|
|00003c40| 4f 53 34 20 3d 20 24 28 | 43 43 4f 50 54 29 20 24 |OS4 = $(|CCOPT) $|
|00003c50| 28 44 45 46 49 4e 45 53 | 29 20 24 28 49 4e 43 4c |(DEFINES|) $(INCL|
|00003c60| 55 44 45 53 29 20 2d 44 | 53 55 4e 4f 53 34 20 2d |UDES) -D|SUNOS4 -|
|00003c70| 42 73 74 61 74 69 63 0a | 0a 23 20 43 68 61 6e 67 |Bstatic.|.# Chang|
|00003c80| 65 20 74 68 65 73 65 20 | 74 6f 20 63 63 2f 6c 65 |e these |to cc/le|
|00003c90| 78 2f 79 61 63 63 20 69 | 66 20 79 6f 75 20 64 6f |x/yacc i|f you do|
|00003ca0| 6e 27 74 20 68 61 76 65 | 20 67 63 63 2c 20 66 6c |n't have| gcc, fl|
|00003cb0| 65 78 20 61 6e 64 2f 6f | 72 20 62 69 73 6f 6e 2e |ex and/o|r bison.|
|00003cc0| 0a 23 20 49 66 20 75 73 | 69 6e 67 20 6c 65 78 2c |.# If us|ing lex,|
|00003cd0| 20 61 6c 73 6f 20 72 65 | 6d 6f 76 65 20 74 68 65 | also re|move the|
|00003ce0| 20 2d 44 46 4c 45 58 20 | 66 72 6f 6d 20 44 45 46 | -DFLEX |from DEF|
|00003cf0| 49 4e 45 53 2e 0a 23 0a | 43 43 20 3d 20 67 63 63 |INES..#.|CC = gcc|
|00003d00| 20 2d 67 0a 4c 45 58 3d | 09 66 6c 65 78 0a 59 41 | -g.LEX=|.flex.YA|
|00003d10| 43 43 3d 09 62 69 73 6f | 6e 20 2d 79 0a 0a 23 20 |CC=.biso|n -y..# |
|00003d20| 53 65 74 20 74 68 65 20 | 66 6f 6c 6c 6f 77 69 6e |Set the |followin|
|00003d30| 67 20 74 6f 20 74 68 65 | 20 43 46 4c 41 47 53 20 |g to the| CFLAGS |
|00003d40| 79 6f 75 20 77 61 6e 74 | 20 74 6f 20 75 73 65 20 |you want| to use |
|00003d50| 74 6f 20 63 6f 6d 70 69 | 6c 65 20 6f 6e 20 61 20 |to compi|le on a |
|00003d60| 53 75 6e 20 33 2e 0a 23 | 0a 43 46 4c 41 47 53 5f |Sun 3..#|.CFLAGS_|
|00003d70| 53 55 4e 33 20 3d 20 24 | 28 43 46 4c 41 47 53 5f |SUN3 = $|(CFLAGS_|
|00003d80| 53 55 4e 4f 53 33 29 20 | 2d 44 43 53 4c 49 50 0a |SUNOS3) |-DCSLIP.|
|00003d90| 20 0a 23 20 53 65 74 20 | 74 68 65 20 66 6f 6c 6c | .# Set |the foll|
|00003da0| 6f 77 69 6e 67 20 74 6f | 20 74 68 65 20 43 46 4c |owing to| the CFL|
|00003db0| 41 47 53 20 79 6f 75 20 | 77 61 6e 74 20 74 6f 20 |AGS you |want to |
|00003dc0| 75 73 65 20 74 6f 20 63 | 6f 6d 70 69 6c 65 20 6f |use to c|ompile o|
|00003dd0| 6e 20 61 20 73 70 61 72 | 63 2e 0a 23 0a 43 46 4c |n a spar|c..#.CFL|
|00003de0| 41 47 53 5f 53 55 4e 34 | 20 3d 20 24 28 43 46 4c |AGS_SUN4| = $(CFL|
|00003df0| 41 47 53 5f 53 55 4e 4f | 53 34 29 0a 0a 43 53 52 |AGS_SUNO|S4)..CSR|
|00003e00| 43 20 3d 09 74 63 70 64 | 75 6d 70 2e 63 20 66 69 |C =.tcpd|ump.c fi|
|00003e10| 6c 74 65 72 2e 63 20 6e | 65 74 73 74 72 69 6e 67 |lter.c n|etstring|
|00003e20| 73 2e 63 20 64 65 62 75 | 67 2e 63 20 5c 0a 09 65 |s.c debu|g.c \..e|
|00003e30| 74 68 65 72 5f 70 72 69 | 6e 74 2e 63 20 69 70 5f |ther_pri|nt.c ip_|
|00003e40| 70 72 69 6e 74 2e 63 20 | 61 72 70 5f 70 72 69 6e |print.c |arp_prin|
|00003e50| 74 2e 63 20 74 63 70 5f | 70 72 69 6e 74 2e 63 20 |t.c tcp_|print.c |
|00003e60| 75 64 70 5f 70 72 69 6e | 74 2e 63 20 5c 0a 09 61 |udp_prin|t.c \..a|
|00003e70| 74 61 6c 6b 5f 70 72 69 | 6e 74 2e 63 20 6e 73 5f |talk_pri|nt.c ns_|
|00003e80| 70 72 69 6e 74 2e 63 20 | 6e 66 73 5f 70 72 69 6e |print.c |nfs_prin|
|00003e90| 74 2e 63 20 69 63 6d 70 | 5f 70 72 69 6e 74 2e 63 |t.c icmp|_print.c|
|00003ea0| 20 6f 70 74 69 6d 69 7a | 65 2e 63 20 5c 0a 09 70 | optimiz|e.c \..p|
|00003eb0| 73 74 72 2e 63 20 69 6e | 69 74 64 65 76 69 63 65 |str.c in|itdevice|
|00003ec0| 2e 63 20 73 6c 5f 70 72 | 69 6e 74 2e 63 20 72 69 |.c sl_pr|int.c ri|
|00003ed0| 70 5f 70 72 69 6e 74 2e | 63 20 6f 70 73 74 72 69 |p_print.|c opstri|
|00003ee0| 6e 67 73 2e 63 0a 0a 53 | 52 43 20 3d 09 24 28 43 |ngs.c..S|RC =.$(C|
|00003ef0| 53 52 43 29 20 74 63 70 | 67 72 61 6d 2e 79 20 74 |SRC) tcp|gram.y t|
|00003f00| 63 70 6c 65 78 2e 6c 0a | 0a 4f 42 4a 20 3d 09 74 |cplex.l.|.OBJ =.t|
|00003f10| 63 70 64 75 6d 70 2e 6f | 20 66 69 6c 74 65 72 2e |cpdump.o| filter.|
|00003f20| 6f 20 74 63 70 67 72 61 | 6d 2e 6f 20 74 63 70 6c |o tcpgra|m.o tcpl|
|00003f30| 65 78 2e 6f 20 6e 65 74 | 73 74 72 69 6e 67 73 2e |ex.o net|strings.|
|00003f40| 6f 20 64 65 62 75 67 2e | 6f 20 5c 0a 09 65 74 68 |o debug.|o \..eth|
|00003f50| 65 72 5f 70 72 69 6e 74 | 2e 6f 20 69 70 5f 70 72 |er_print|.o ip_pr|
|00003f60| 69 6e 74 2e 6f 20 61 72 | 70 5f 70 72 69 6e 74 2e |int.o ar|p_print.|
|00003f70| 6f 20 74 63 70 5f 70 72 | 69 6e 74 2e 6f 20 75 64 |o tcp_pr|int.o ud|
|00003f80| 70 5f 70 72 69 6e 74 2e | 6f 20 5c 0a 09 61 74 61 |p_print.|o \..ata|
|00003f90| 6c 6b 5f 70 72 69 6e 74 | 2e 6f 20 6e 73 5f 70 72 |lk_print|.o ns_pr|
|00003fa0| 69 6e 74 2e 6f 20 6e 66 | 73 5f 70 72 69 6e 74 2e |int.o nf|s_print.|
|00003fb0| 6f 20 69 63 6d 70 5f 70 | 72 69 6e 74 2e 6f 20 6f |o icmp_p|rint.o o|
|00003fc0| 70 74 69 6d 69 7a 65 2e | 6f 20 5c 0a 09 70 73 74 |ptimize.|o \..pst|
|00003fd0| 72 2e 6f 20 69 6e 69 74 | 64 65 76 69 63 65 2e 6f |r.o init|device.o|
|00003fe0| 20 73 6c 5f 70 72 69 6e | 74 2e 6f 20 72 69 70 5f | sl_prin|t.o rip_|
|00003ff0| 70 72 69 6e 74 2e 6f 20 | 6f 70 73 74 72 69 6e 67 |print.o |opstring|
|00004000| 73 2e 6f 0a 0a 48 44 52 | 20 3d 20 09 66 69 6c 74 |s.o..HDR| = .filt|
|00004010| 65 72 2e 68 20 69 6e 74 | 65 72 66 61 63 65 2e 68 |er.h int|erface.h|
|00004020| 20 73 61 6d 70 6c 65 2e | 68 20 73 75 6e 6f 73 34 | sample.|h sunos4|
|00004030| 2e 6d 61 70 2e 68 20 61 | 70 70 6c 65 74 61 6c 6b |.map.h a|ppletalk|
|00004040| 2e 68 20 5c 0a 09 6e 65 | 74 73 74 72 69 6e 67 73 |.h \..ne|tstrings|
|00004050| 2e 68 20 74 63 70 67 72 | 61 6d 2e 68 20 70 73 74 |.h tcpgr|am.h pst|
|00004060| 72 2e 68 0a 0a 41 57 4b | 53 20 3d 09 61 74 69 6d |r.h..AWK|S =.atim|
|00004070| 65 2e 61 77 6b 20 70 61 | 63 6b 65 74 64 61 74 2e |e.awk pa|cketdat.|
|00004080| 61 77 6b 20 73 65 6e 64 | 2d 61 63 6b 2e 61 77 6b |awk send|-ack.awk|
|00004090| 20 73 74 69 6d 65 2e 61 | 77 6b 0a 0a 61 6c 6c 3a | stime.a|wk..all:|
|000040a0| 09 66 6f 72 63 65 0a 09 | 24 28 4d 41 4b 45 29 20 |.force..|$(MAKE) |
|000040b0| 60 61 72 63 68 60 0a 0a | 73 75 6e 33 3a 09 73 75 |`arch`..|sun3:.su|
|000040c0| 6e 33 2f 4d 61 6b 65 66 | 69 6c 65 0a 09 63 64 20 |n3/Makef|ile..cd |
|000040d0| 73 75 6e 33 3b 20 24 28 | 4d 41 4b 45 29 20 43 46 |sun3; $(|MAKE) CF|
|000040e0| 4c 41 47 53 3d 22 2d 49 | 2e 2e 20 24 28 43 46 4c |LAGS="-I|.. $(CFL|
|000040f0| 41 47 53 5f 53 55 4e 33 | 29 22 20 74 63 70 64 75 |AGS_SUN3|)" tcpdu|
|00004100| 6d 70 0a 0a 73 75 6e 33 | 2f 4d 61 6b 65 66 69 6c |mp..sun3|/Makefil|
|00004110| 65 3a 20 4d 61 6b 65 66 | 69 6c 65 0a 09 69 66 20 |e: Makef|ile..if |
|00004120| 5b 20 21 20 2d 64 20 73 | 75 6e 33 20 5d 20 3b 20 |[ ! -d s|un3 ] ; |
|00004130| 74 68 65 6e 20 5c 0a 09 | 09 6d 6b 64 69 72 20 73 |then \..|.mkdir s|
|00004140| 75 6e 33 3b 20 5c 0a 09 | 09 66 6f 72 20 69 20 69 |un3; \..|.for i i|
|00004150| 6e 20 24 28 53 52 43 29 | 20 3b 20 64 6f 20 6c 6e |n $(SRC)| ; do ln|
|00004160| 20 2d 73 20 2e 2e 2f 24 | 24 69 20 73 75 6e 33 3b | -s ../$|$i sun3;|
|00004170| 20 64 6f 6e 65 3b 20 5c | 0a 09 66 69 0a 09 63 70 | done; \|..fi..cp|
|00004180| 20 4d 61 6b 65 66 69 6c | 65 20 73 75 6e 33 2f 4d | Makefil|e sun3/M|
|00004190| 61 6b 65 66 69 6c 65 0a | 09 63 64 20 73 75 6e 33 |akefile.|.cd sun3|
|000041a0| 3b 20 24 28 4d 41 4b 45 | 29 20 43 46 4c 41 47 53 |; $(MAKE|) CFLAGS|
|000041b0| 3d 22 2d 49 2e 2e 20 24 | 28 43 46 4c 41 47 53 5f |="-I.. $|(CFLAGS_|
|000041c0| 53 55 4e 33 29 22 20 64 | 65 70 65 6e 64 0a 0a 23 |SUN3)" d|epend..#|
|000041d0| 20 4e 2e 42 2e 2d 20 73 | 79 6d 62 6f 6c 69 63 20 | N.B.- s|ymbolic |
|000041e0| 6c 69 6e 6b 73 20 61 72 | 65 20 75 73 65 64 20 69 |links ar|e used i|
|000041f0| 6e 20 74 68 65 20 73 75 | 62 64 69 72 65 63 74 6f |n the su|bdirecto|
|00004200| 72 79 20 72 61 74 68 65 | 72 20 74 68 61 6e 20 56 |ry rathe|r than V|
|00004210| 50 41 54 48 0a 23 20 62 | 65 63 61 75 73 65 20 61 |PATH.# b|ecause a|
|00004220| 74 20 6c 65 61 73 74 20 | 6f 6e 65 20 53 75 6e 20 |t least |one Sun |
|00004230| 63 63 20 63 6f 6d 70 69 | 6c 65 72 20 70 75 74 73 |cc compi|ler puts|
|00004240| 20 74 68 65 20 2e 6f 20 | 69 6e 20 74 68 65 20 77 | the .o |in the w|
|00004250| 72 6f 6e 67 20 70 6c 61 | 63 65 0a 23 20 77 68 65 |rong pla|ce.# whe|
|00004260| 6e 20 75 73 69 6e 67 20 | 56 50 41 54 48 20 61 6e |n using |VPATH an|
|00004270| 64 20 69 74 27 73 20 61 | 6c 6d 6f 73 74 20 69 6d |d it's a|lmost im|
|00004280| 70 6f 73 73 69 62 6c 65 | 20 74 6f 20 67 65 74 20 |possible| to get |
|00004290| 22 6d 61 6b 65 20 64 65 | 70 65 6e 64 22 20 74 6f |"make de|pend" to|
|000042a0| 0a 23 20 64 6f 20 74 68 | 65 20 72 69 67 68 74 20 |.# do th|e right |
|000042b0| 74 68 69 6e 67 2e 0a 0a | 73 75 6e 34 3a 09 73 75 |thing...|sun4:.su|
|000042c0| 6e 34 2f 4d 61 6b 65 66 | 69 6c 65 0a 09 63 64 20 |n4/Makef|ile..cd |
|000042d0| 73 75 6e 34 3b 20 24 28 | 4d 41 4b 45 29 20 43 46 |sun4; $(|MAKE) CF|
|000042e0| 4c 41 47 53 3d 22 2d 49 | 2e 2e 20 24 28 43 46 4c |LAGS="-I|.. $(CFL|
|000042f0| 41 47 53 5f 53 55 4e 34 | 29 22 20 74 63 70 64 75 |AGS_SUN4|)" tcpdu|
|00004300| 6d 70 0a 0a 73 75 6e 34 | 2f 4d 61 6b 65 66 69 6c |mp..sun4|/Makefil|
|00004310| 65 3a 20 4d 61 6b 65 66 | 69 6c 65 0a 09 69 66 20 |e: Makef|ile..if |
|00004320| 5b 20 21 20 2d 64 20 73 | 75 6e 34 20 5d 20 3b 20 |[ ! -d s|un4 ] ; |
|00004330| 74 68 65 6e 20 5c 0a 09 | 09 6d 6b 64 69 72 20 73 |then \..|.mkdir s|
|00004340| 75 6e 34 3b 20 5c 0a 09 | 09 66 6f 72 20 69 20 69 |un4; \..|.for i i|
|00004350| 6e 20 24 28 53 52 43 29 | 20 3b 20 64 6f 20 6c 6e |n $(SRC)| ; do ln|
|00004360| 20 2d 73 20 2e 2e 2f 24 | 24 69 20 73 75 6e 34 3b | -s ../$|$i sun4;|
|00004370| 20 64 6f 6e 65 3b 20 5c | 0a 09 66 69 0a 09 63 70 | done; \|..fi..cp|
|00004380| 20 4d 61 6b 65 66 69 6c | 65 20 73 75 6e 34 2f 4d | Makefil|e sun4/M|
|00004390| 61 6b 65 66 69 6c 65 0a | 09 63 64 20 73 75 6e 34 |akefile.|.cd sun4|
|000043a0| 3b 20 24 28 4d 41 4b 45 | 29 20 43 46 4c 41 47 53 |; $(MAKE|) CFLAGS|
|000043b0| 3d 22 2d 49 2e 2e 20 24 | 28 43 46 4c 41 47 53 5f |="-I.. $|(CFLAGS_|
|000043c0| 53 55 4e 34 29 22 20 64 | 65 70 65 6e 64 0a 0a 74 |SUN4)" d|epend..t|
|000043d0| 63 70 64 75 6d 70 3a 20 | 24 28 4f 42 4a 29 0a 09 |cpdump: |$(OBJ)..|
|000043e0| 24 28 43 43 29 20 24 28 | 43 46 4c 41 47 53 29 20 |$(CC) $(|CFLAGS) |
|000043f0| 2d 6f 20 24 40 20 24 28 | 4f 42 4a 29 0a 0a 74 63 |-o $@ $(|OBJ)..tc|
|00004400| 70 6c 65 78 2e 6f 3a 20 | 74 63 70 6c 65 78 2e 63 |plex.o: |tcplex.c|
|00004410| 20 74 6f 6b 64 65 66 73 | 2e 68 0a 74 63 70 6c 65 | tokdefs|.h.tcple|
|00004420| 78 2e 63 3a 20 74 63 70 | 6c 65 78 2e 6c 0a 09 72 |x.c: tcp|lex.l..r|
|00004430| 6d 20 2d 66 20 24 40 0a | 09 24 28 4c 45 58 29 20 |m -f $@.|.$(LEX) |
|00004440| 24 3c 0a 09 6d 76 20 2d | 66 20 6c 65 78 2e 79 79 |$<..mv -|f lex.yy|
|00004450| 2e 63 20 74 63 70 6c 65 | 78 2e 63 0a 0a 74 6f 6b |.c tcple|x.c..tok|
|00004460| 64 65 66 73 2e 68 3a 20 | 74 63 70 67 72 61 6d 2e |defs.h: |tcpgram.|
|00004470| 63 0a 74 63 70 67 72 61 | 6d 2e 63 3a 20 74 63 70 |c.tcpgra|m.c: tcp|
|00004480| 67 72 61 6d 2e 79 0a 09 | 72 6d 20 2d 66 20 74 63 |gram.y..|rm -f tc|
|00004490| 70 67 72 61 6d 2e 63 20 | 74 6f 6b 64 65 66 73 2e |pgram.c |tokdefs.|
|000044a0| 68 0a 09 24 28 59 41 43 | 43 29 20 2d 64 20 24 3c |h..$(YAC|C) -d $<|
|000044b0| 0a 09 6d 76 20 79 2e 74 | 61 62 2e 63 20 74 63 70 |..mv y.t|ab.c tcp|
|000044c0| 67 72 61 6d 2e 63 0a 09 | 6d 76 20 79 2e 74 61 62 |gram.c..|mv y.tab|
|000044d0| 2e 68 20 74 6f 6b 64 65 | 66 73 2e 68 0a 0a 6f 70 |.h tokde|fs.h..op|
|000044e0| 73 74 72 69 6e 67 73 2e | 63 3a 20 2e 2e 2f 66 69 |strings.|c: ../fi|
|000044f0| 6c 74 65 72 2e 68 0a 09 | 2e 2e 2f 6d 61 6b 65 6f |lter.h..|../makeo|
|00004500| 70 73 74 72 69 6e 67 73 | 20 2e 2e 2f 66 69 6c 74 |pstrings| ../filt|
|00004510| 65 72 2e 68 20 3e 20 6f | 70 73 74 72 69 6e 67 73 |er.h > o|pstrings|
|00004520| 2e 63 0a 0a 69 6e 73 74 | 61 6c 6c 3a 20 66 6f 72 |.c..inst|all: for|
|00004530| 63 65 0a 09 24 28 4d 41 | 4b 45 29 20 69 6e 73 74 |ce..$(MA|KE) inst|
|00004540| 61 6c 6c 2e 60 61 72 63 | 68 60 0a 0a 69 6e 73 74 |all.`arc|h`..inst|
|00004550| 61 6c 6c 2e 73 75 6e 33 | 3a 20 73 75 6e 33 2f 74 |all.sun3|: sun3/t|
|00004560| 63 70 64 75 6d 70 0a 09 | 69 6e 73 74 61 6c 6c 20 |cpdump..|install |
|00004570| 2d 6d 20 34 35 35 35 20 | 73 75 6e 33 2f 74 63 70 |-m 4555 |sun3/tcp|
|00004580| 64 75 6d 70 20 24 28 44 | 45 53 54 44 49 52 29 24 |dump $(D|ESTDIR)$|
|00004590| 28 42 49 4e 44 45 53 54 | 29 0a 09 69 6e 73 74 61 |(BINDEST|)..insta|
|000045a0| 6c 6c 20 2d 63 20 74 63 | 70 64 75 6d 70 2e 31 20 |ll -c tc|pdump.1 |
|000045b0| 24 28 44 45 53 54 44 49 | 52 29 24 28 4d 41 4e 44 |$(DESTDI|R)$(MAND|
|000045c0| 45 53 54 29 0a 0a 69 6e | 73 74 61 6c 6c 2e 73 75 |EST)..in|stall.su|
|000045d0| 6e 34 3a 20 73 75 6e 34 | 2f 74 63 70 64 75 6d 70 |n4: sun4|/tcpdump|
|000045e0| 0a 09 69 6e 73 74 61 6c | 6c 20 2d 6d 20 34 35 35 |..instal|l -m 455|
|000045f0| 35 20 73 75 6e 34 2f 74 | 63 70 64 75 6d 70 20 24 |5 sun4/t|cpdump $|
|00004600| 28 44 45 53 54 44 49 52 | 29 24 28 42 49 4e 44 45 |(DESTDIR|)$(BINDE|
|00004610| 53 54 29 0a 09 69 6e 73 | 74 61 6c 6c 20 2d 63 20 |ST)..ins|tall -c |
|00004620| 74 63 70 64 75 6d 70 2e | 31 20 24 28 44 45 53 54 |tcpdump.|1 $(DEST|
|00004630| 44 49 52 29 24 28 4d 41 | 4e 44 45 53 54 29 0a 0a |DIR)$(MA|NDEST)..|
|00004640| 6c 69 6e 74 3a 09 66 6f | 72 63 65 0a 09 6c 69 6e |lint:.fo|rce..lin|
|00004650| 74 20 24 28 43 53 52 43 | 29 20 74 63 70 6c 65 78 |t $(CSRC|) tcplex|
|00004660| 2e 63 20 74 63 70 67 72 | 61 6d 2e 63 0a 0a 63 6c |.c tcpgr|am.c..cl|
|00004670| 65 61 6e 3a 0a 09 72 6d | 20 2d 66 20 2a 2e 6f 20 |ean:..rm| -f *.o |
|00004680| 74 63 70 64 75 6d 70 20 | 74 63 70 64 75 6d 70 2e |tcpdump |tcpdump.|
|00004690| 73 68 61 72 0a 09 72 6d | 20 2d 72 66 20 73 75 6e |shar..rm| -rf sun|
|000046a0| 33 20 73 70 61 72 63 0a | 0a 54 41 47 53 3a 09 24 |3 sparc.|.TAGS:.$|
|000046b0| 28 53 52 43 29 20 24 28 | 48 44 52 29 0a 09 65 74 |(SRC) $(|HDR)..et|
|000046c0| 61 67 73 20 2d 74 20 24 | 28 53 52 43 29 20 24 28 |ags -t $|(SRC) $(|
|000046d0| 48 44 52 29 0a 0a 74 61 | 67 73 3a 09 24 28 53 52 |HDR)..ta|gs:.$(SR|
|000046e0| 43 29 20 24 28 48 44 52 | 29 0a 09 63 74 61 67 73 |C) $(HDR|)..ctags|
|000046f0| 20 2d 74 20 24 28 53 52 | 43 29 20 24 28 48 44 52 | -t $(SR|C) $(HDR|
|00004700| 29 0a 0a 74 61 72 3a 09 | 66 6f 72 63 65 0a 09 74 |)..tar:.|force..t|
|00004710| 61 72 20 63 66 20 2f 74 | 6d 70 2f 74 63 70 64 75 |ar cf /t|mp/tcpdu|
|00004720| 6d 70 2e 74 61 72 20 52 | 45 41 44 4d 45 20 4d 61 |mp.tar R|EADME Ma|
|00004730| 6b 65 66 69 6c 65 20 74 | 63 70 64 75 6d 70 2e 31 |kefile t|cpdump.1|
|00004740| 20 5c 0a 09 09 24 28 53 | 52 43 29 20 24 28 48 44 | \...$(S|RC) $(HD|
|00004750| 52 29 20 24 28 41 57 4b | 53 29 20 6d 61 6b 65 6f |R) $(AWK|S) makeo|
|00004760| 70 73 74 72 69 6e 67 73 | 20 5c 0a 09 09 53 55 4e |pstrings| \...SUN|
|00004770| 4f 53 34 0a 09 63 6f 6d | 70 72 65 73 73 20 2f 74 |OS4..com|press /t|
|00004780| 6d 70 2f 74 63 70 64 75 | 6d 70 2e 74 61 72 0a 0a |mp/tcpdu|mp.tar..|
|00004790| 73 68 61 72 3a 09 66 6f | 72 63 65 0a 09 73 68 61 |shar:.fo|rce..sha|
|000047a0| 72 20 2d 76 20 2d 63 20 | 2d 70 20 58 20 52 45 41 |r -v -c |-p X REA|
|000047b0| 44 4d 45 20 4d 61 6b 65 | 66 69 6c 65 20 74 63 70 |DME Make|file tcp|
|000047c0| 64 75 6d 70 2e 31 20 5c | 0a 09 09 24 28 53 52 43 |dump.1 \|...$(SRC|
|000047d0| 29 20 24 28 48 44 52 29 | 20 24 28 41 57 4b 53 29 |) $(HDR)| $(AWKS)|
|000047e0| 20 3e 74 63 70 64 75 6d | 70 2e 73 68 61 72 0a 0a | >tcpdum|p.shar..|
|000047f0| 66 6f 72 63 65 3a 09 2f | 74 6d 70 0a 0a 64 65 70 |force:./|tmp..dep|
|00004800| 65 6e 64 3a 09 66 6f 72 | 63 65 0a 09 6d 6b 64 65 |end:.for|ce..mkde|
|00004810| 70 20 24 28 43 46 4c 41 | 47 53 29 20 24 28 43 53 |p $(CFLA|GS) $(CS|
|00004820| 52 43 29 0a 0a 65 62 75 | 67 2e 63 20 5c 0a 09 65 |RC)..ebu|g.c \..e|
|00004830| 74 68 65 72 5f 70 72 69 | 6e 74 2e 63 20 69 70 5f |ther_pri|nt.c ip_|
|00004840| 70 72 69 6e 74 2e 63 20 | 61 72 70 5f 70 72 69 6e |print.c |arp_prin|
|00004850| 74 2e 63 20 74 63 70 5f | 70 72 69 6e 74 2e 63 20 |t.c tcp_|print.c |
|00004860| 75 64 70 5f 70 72 69 6e | 74 2e 63 20 5c 0a 09 61 |udp_prin|t.c \..a|
|00004870| 74 61 6c 6b 5f 70 72 69 | 6e 74 2e 63 20 6e 73 5f |talk_pri|nt.c ns_|
|00004880| 70 72 69 6e 74 2e 63 20 | 6e 66 73 5f 70 72 69 6e |print.c |nfs_prin|
|00004890| 74 2e 63 20 69 63 6d 70 | 5f 70 72 69 6e 74 2e 63 |t.c icmp|_print.c|
|000048a0| 20 6f 70 74 69 6d 69 7a | 65 2e 63 20 5c 0a 09 70 | optimiz|e.c \..p|
|000048b0| 73 74 72 2e 63 20 69 6e | 69 74 64 65 76 69 63 65 |str.c in|itdevice|
|000048c0| 2e 63 20 73 6c 5f 70 72 | 69 6e 74 2e 63 20 72 69 |.c sl_pr|int.c ri|
|000048d0| 70 5f 70 72 69 6e 74 2e | 63 20 6f 70 73 74 72 69 |p_print.|c opstri|
|000048e0| 6e 67 73 2e 63 0a 0a 53 | 52 43 20 3d 09 24 28 43 |ngs.c..S|RC =.$(C|
|000048f0| 53 52 43 29 20 74 63 70 | 67 72 61 6d 2e 79 20 74 |SRC) tcp|gram.y t|
|00004900| 63 70 6c 65 78 2e 6c 0a | 0a 4f 42 4a 20 3d 09 74 |cplex.l.|.OBJ =.t|
|00004910| 63 70 64 75 6d 70 2e 6f | 20 66 69 6c 74 65 72 2e |cpdump.o| filter.|
|00004920| 6f 20 74 63 70 67 72 61 | 6d 2e 6f 20 74 63 70 6c |o tcpgra|m.o tcpl|
|00004930| 65 78 2e 6f 20 6e 65 74 | 73 74 72 69 6e 67 73 2e |ex.o net|strings.|
|00004940| 6f 20 64 65 62 75 67 2e | 6f 20 5c 0a 09 65 74 68 |o debug.|o \..eth|
|00004950| 65 72 5f 70 72 69 6e 74 | 2e 6f 20 69 70 5f 70 72 |er_print|.o ip_pr|
|00004960| 69 6e 74 2e 6f 20 61 72 | 70 5f 70 72 69 6e 74 2e |int.o ar|p_print.|
|00004970| 6f 20 74 63 70 5f 70 72 | 69 6e 74 2e 6f 20 75 64 |o tcp_pr|int.o ud|
|00004980| 70 5f 70 72 69 6e 74 2e | 6f 20 5c 0a 09 61 74 61 |p_print.|o \..ata|
|00004990| 6c 6b 5f 70 72 69 6e 74 | 2e 6f 20 6e 73 5f 70 72 |lk_print|.o ns_pr|
|000049a0| 69 6e 74 2e 6f 20 6e 66 | 73 5f 70 72 69 6e 74 2e |int.o nf|s_print.|
|000049b0| 6f 20 69 63 6d 70 5f 70 | 72 69 6e 74 2e 6f 20 6f |o icmp_p|rint.o o|
|000049c0| 70 74 69 6d 69 7a 65 2e | 6f 20 5c 0a 09 70 73 74 |ptimize.|o \..pst|
|000049d0| 72 2e 6f 20 69 6e 69 74 | 64 65 76 69 63 65 2e 6f |r.o init|device.o|
|000049e0| 20 73 6c 5f 70 72 69 6e | 74 2e 6f 20 72 69 70 5f | sl_prin|t.o rip_|
|000049f0| 70 72 69 6e 74 2e 6f 20 | 6f 70 73 74 72 69 6e 67 |print.o |opstring|
|00004a00| 74 63 70 64 75 6d 70 2e | 31 00 00 00 00 00 00 00 |tcpdump.|1.......|
|00004a10| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004a20| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004a30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004a40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004a50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004a60| 00 00 00 00 20 20 20 34 | 34 30 20 00 20 20 32 30 |.... 4|40 . 20|
|00004a70| 31 31 20 00 20 20 20 20 | 33 34 20 00 20 20 20 20 |11 . |34 . |
|00004a80| 20 20 37 35 34 37 33 20 | 20 34 35 37 33 37 36 37 | 75473 | 4573767|
|00004a90| 32 32 35 20 20 20 35 37 | 33 31 00 20 00 00 00 00 |225 57|31. ....|
|00004aa0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004ab0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004ac0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004ad0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004ae0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004af0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b00| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b10| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b20| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004b90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004ba0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004bb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004bc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004bd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004be0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004bf0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00004c00| 2e 5c 22 20 40 28 23 29 | 20 24 48 65 61 64 65 72 |.\" @(#)| $Header|
|00004c10| 3a 20 74 63 70 64 75 6d | 70 2e 31 2c 76 20 31 2e |: tcpdum|p.1,v 1.|
|00004c20| 31 36 20 39 30 2f 30 33 | 2f 30 33 20 30 38 3a 32 |16 90/03|/03 08:2|
|00004c30| 32 3a 31 38 20 76 61 6e | 20 45 78 70 20 24 20 28 |2:18 van| Exp $ (|
|00004c40| 4c 42 4c 29 0a 2e 5c 22 | 0a 2e 5c 22 0a 2e 5c 22 |LBL)..\"|..\"..\"|
|00004c50| 20 43 6f 70 79 72 69 67 | 68 74 20 28 63 29 20 31 | Copyrig|ht (c) 1|
|00004c60| 39 38 38 20 52 65 67 65 | 6e 74 73 20 6f 66 20 74 |988 Rege|nts of t|
|00004c70| 68 65 20 55 6e 69 76 65 | 72 73 69 74 79 20 6f 66 |he Unive|rsity of|
|00004c80| 20 43 61 6c 69 66 6f 72 | 6e 69 61 2e 0a 2e 5c 22 | Califor|nia...\"|
|00004c90| 20 41 6c 6c 20 72 69 67 | 68 74 73 20 72 65 73 65 | All rig|hts rese|
|00004ca0| 72 76 65 64 2e 0a 2e 5c | 22 0a 2e 5c 22 20 52 65 |rved...\|"..\" Re|
|00004cb0| 64 69 73 74 72 69 62 75 | 74 69 6f 6e 20 61 6e 64 |distribu|tion and|
|00004cc0| 20 75 73 65 20 69 6e 20 | 73 6f 75 72 63 65 20 61 | use in |source a|
|00004cd0| 6e 64 20 62 69 6e 61 72 | 79 20 66 6f 72 6d 73 20 |nd binar|y forms |
|00004ce0| 61 72 65 20 70 65 72 6d | 69 74 74 65 64 0a 2e 5c |are perm|itted..\|
|00004cf0| 22 20 70 72 6f 76 69 64 | 65 64 20 74 68 61 74 20 |" provid|ed that |
|00004d00| 74 68 65 20 61 62 6f 76 | 65 20 63 6f 70 79 72 69 |the abov|e copyri|
|00004d10| 67 68 74 20 6e 6f 74 69 | 63 65 20 61 6e 64 20 74 |ght noti|ce and t|
|00004d20| 68 69 73 20 70 61 72 61 | 67 72 61 70 68 20 61 72 |his para|graph ar|
|00004d30| 65 0a 2e 5c 22 20 64 75 | 70 6c 69 63 61 74 65 64 |e..\" du|plicated|
|00004d40| 20 69 6e 20 61 6c 6c 20 | 73 75 63 68 20 66 6f 72 | in all |such for|
|00004d50| 6d 73 20 61 6e 64 20 74 | 68 61 74 20 61 6e 79 20 |ms and t|hat any |
|00004d60| 64 6f 63 75 6d 65 6e 74 | 61 74 69 6f 6e 2c 0a 2e |document|ation,..|
|00004d70| 5c 22 20 61 64 76 65 72 | 74 69 73 69 6e 67 20 6d |\" adver|tising m|
|00004d80| 61 74 65 72 69 61 6c 73 | 2c 20 61 6e 64 20 6f 74 |aterials|, and ot|
|00004d90| 68 65 72 20 6d 61 74 65 | 72 69 61 6c 73 20 72 65 |her mate|rials re|
|00004da0| 6c 61 74 65 64 20 74 6f | 20 73 75 63 68 0a 2e 5c |lated to| such..\|
|00004db0| 22 20 64 69 73 74 72 69 | 62 75 74 69 6f 6e 20 61 |" distri|bution a|
|00004dc0| 6e 64 20 75 73 65 20 61 | 63 6b 6e 6f 77 6c 65 64 |nd use a|cknowled|
|00004dd0| 67 65 20 74 68 61 74 20 | 74 68 65 20 73 6f 66 74 |ge that |the soft|
|00004de0| 77 61 72 65 20 77 61 73 | 20 64 65 76 65 6c 6f 70 |ware was| develop|
|00004df0| 65 64 0a 2e 5c 22 20 62 | 79 20 74 68 65 20 55 6e |ed..\" b|y the Un|
|00004e00| 69 76 65 72 73 69 74 79 | 20 6f 66 20 43 61 6c 69 |iversity| of Cali|
|00004e10| 66 6f 72 6e 69 61 2c 20 | 4c 61 77 72 65 6e 63 65 |fornia, |Lawrence|
|00004e20| 20 42 65 72 6b 65 6c 65 | 79 20 4c 61 62 6f 72 61 | Berkele|y Labora|
|00004e30| 74 6f 72 79 2c 0a 2e 5c | 22 20 42 65 72 6b 65 6c |tory,..\|" Berkel|
|00004e40| 65 79 2c 20 43 41 2e 20 | 20 54 68 65 20 6e 61 6d |ey, CA. | The nam|
|00004e50| 65 20 6f 66 20 74 68 65 | 20 55 6e 69 76 65 72 73 |e of the| Univers|
|00004e60| 69 74 79 20 6d 61 79 20 | 6e 6f 74 20 62 65 20 75 |ity may |not be u|
|00004e70| 73 65 64 20 74 6f 0a 2e | 5c 22 20 65 6e 64 6f 72 |sed to..|\" endor|
|00004e80| 73 65 20 6f 72 20 70 72 | 6f 6d 6f 74 65 20 70 72 |se or pr|omote pr|
|00004e90| 6f 64 75 63 74 73 20 64 | 65 72 69 76 65 64 20 66 |oducts d|erived f|
|00004ea0| 72 6f 6d 20 74 68 69 73 | 20 73 6f 66 74 77 61 72 |rom this| softwar|
|00004eb0| 65 20 77 69 74 68 6f 75 | 74 0a 2e 5c 22 20 73 70 |e withou|t..\" sp|
|00004ec0| 65 63 69 66 69 63 20 70 | 72 69 6f 72 20 77 72 69 |ecific p|rior wri|
|00004ed0| 74 74 65 6e 20 70 65 72 | 6d 69 73 73 69 6f 6e 2e |tten per|mission.|
|00004ee0| 0a 2e 5c 22 20 54 48 49 | 53 20 53 4f 46 54 57 41 |..\" THI|S SOFTWA|
|00004ef0| 52 45 20 49 53 20 50 52 | 4f 56 49 44 45 44 20 60 |RE IS PR|OVIDED `|
|00004f00| 60 41 53 20 49 53 27 27 | 20 41 4e 44 20 57 49 54 |`AS IS''| AND WIT|
|00004f10| 48 4f 55 54 20 41 4e 59 | 20 45 58 50 52 45 53 53 |HOUT ANY| EXPRESS|
|00004f20| 20 4f 52 0a 2e 5c 22 20 | 49 4d 50 4c 49 45 44 20 | OR..\" |IMPLIED |
|00004f30| 57 41 52 52 41 4e 54 49 | 45 53 2c 20 49 4e 43 4c |WARRANTI|ES, INCL|
|00004f40| 55 44 49 4e 47 2c 20 57 | 49 54 48 4f 55 54 20 4c |UDING, W|ITHOUT L|
|00004f50| 49 4d 49 54 41 54 49 4f | 4e 2c 20 54 48 45 20 49 |IMITATIO|N, THE I|
|00004f60| 4d 50 4c 49 45 44 0a 2e | 5c 22 20 57 41 52 52 41 |MPLIED..|\" WARRA|
|00004f70| 4e 54 49 45 53 20 4f 46 | 20 4d 45 52 43 48 41 4e |NTIES OF| MERCHAN|
|00004f80| 54 49 42 49 4c 49 54 59 | 20 41 4e 44 20 46 49 54 |TIBILITY| AND FIT|
|00004f90| 4e 45 53 53 20 46 4f 52 | 20 41 20 50 41 52 54 49 |NESS FOR| A PARTI|
|00004fa0| 43 55 4c 41 52 20 50 55 | 52 50 4f 53 45 2e 0a 2e |CULAR PU|RPOSE...|
|00004fb0| 5c 22 0a 2e 54 48 20 54 | 43 50 44 55 4d 50 20 31 |\"..TH T|CPDUMP 1|
|00004fc0| 20 20 22 32 35 20 4a 75 | 6e 20 31 39 38 39 22 0a | "25 Ju|n 1989".|
|00004fd0| 2e 53 48 20 4e 41 4d 45 | 0a 74 63 70 64 75 6d 70 |.SH NAME|.tcpdump|
|00004fe0| 20 5c 2d 20 64 75 6d 70 | 20 74 72 61 66 66 69 63 | \- dump| traffic|
|00004ff0| 20 6f 6e 20 61 6e 20 65 | 74 68 65 72 6e 65 74 0a | on an e|thernet.|
|00005000| 2e 53 48 20 53 59 4e 4f | 50 53 49 53 0a 2e 42 20 |.SH SYNO|PSIS..B |
|00005010| 74 63 70 64 75 6d 70 0a | 5b 0a 2e 42 20 5c 2d 63 |tcpdump.|[..B \-c|
|00005020| 20 20 0a 2e 49 20 63 6f | 75 6e 74 0a 5d 20 5b 0a | ..I co|unt.] [.|
|00005030| 2e 42 20 5c 2d 64 0a 5d | 20 5b 0a 2e 42 20 5c 2d |.B \-d.]| [..B \-|
|00005040| 65 0a 5d 20 5b 0a 2e 42 | 20 5c 2d 66 0a 5d 20 5b |e.] [..B| \-f.] [|
|00005050| 0a 2e 42 20 5c 2d 69 20 | 20 0a 2e 49 20 69 6e 74 |..B \-i | ..I int|
|00005060| 65 72 66 61 63 65 0a 5d | 20 5b 0a 2e 42 20 5c 2d |erface.]| [..B \-|
|00005070| 6c 0a 5d 20 5b 0a 2e 42 | 20 5c 2d 6e 0a 5d 20 5b |l.] [..B| \-n.] [|
|00005080| 0a 2e 42 20 5c 2d 4f 0a | 5d 20 5b 0a 2e 42 20 5c |..B \-O.|] [..B \|
|00005090| 2d 70 0a 5d 20 5b 0a 2e | 42 20 5c 2d 71 0a 5d 20 |-p.] [..|B \-q.] |
|000050a0| 5b 0a 2e 42 20 5c 2d 73 | 20 20 0a 2e 49 20 73 6e |[..B \-s| ..I sn|
|000050b0| 61 70 6c 65 6e 0a 5d 20 | 5b 0a 2e 42 20 5c 2d 74 |aplen.] |[..B \-t|
|000050c0| 0a 5d 20 5b 0a 2e 42 20 | 5c 2d 76 0a 5d 20 5b 0a |.] [..B |\-v.] [.|
|000050d0| 2e 42 20 5c 2d 78 0a 5d | 20 5b 0a 2e 49 52 20 65 |.B \-x.]| [..IR e|
|000050e0| 78 70 72 65 73 73 69 6f | 6e 0a 5d 0a 2e 62 72 0a |xpressio|n.]..br.|
|000050f0| 2e 53 48 20 44 45 53 43 | 52 49 50 54 49 4f 4e 0a |.SH DESC|RIPTION.|
|00005100| 2e 4c 50 0a 5c 66 49 54 | 63 70 64 75 6d 70 5c 66 |.LP.\fIT|cpdump\f|
|00005110| 50 20 70 72 69 6e 74 73 | 20 6f 75 74 20 74 68 65 |P prints| out the|
|00005120| 20 68 65 61 64 65 72 73 | 20 6f 66 20 70 61 63 6b | headers| of pack|
|00005130| 65 74 73 20 6f 6e 20 74 | 68 65 20 65 74 68 65 72 |ets on t|he ether|
|00005140| 6e 65 74 20 74 68 61 74 | 20 6d 61 74 63 68 0a 74 |net that| match.t|
|00005150| 68 65 20 62 6f 6f 6c 65 | 61 6e 20 5c 66 49 65 78 |he boole|an \fIex|
|00005160| 70 72 65 73 73 69 6f 6e | 5c 66 50 2e 20 0a 59 6f |pression|\fP. .Yo|
|00005170| 75 20 6d 75 73 74 20 62 | 65 20 72 6f 6f 74 20 74 |u must b|e root t|
|00005180| 6f 20 69 6e 76 6f 6b 65 | 20 5c 66 49 74 63 70 64 |o invoke| \fItcpd|
|00005190| 75 6d 70 5c 66 50 20 6f | 72 20 69 74 20 6d 75 73 |ump\fP o|r it mus|
|000051a0| 74 20 62 65 20 69 6e 73 | 74 61 6c 6c 65 64 0a 73 |t be ins|talled.s|
|000051b0| 65 74 75 69 64 20 74 6f | 20 72 6f 6f 74 2e 0a 2e |etuid to| root...|
|000051c0| 53 48 20 4f 50 54 49 4f | 4e 53 0a 2e 54 50 0a 2e |SH OPTIO|NS..TP..|
|000051d0| 42 20 5c 2d 63 0a 45 78 | 69 74 20 61 66 74 65 72 |B \-c.Ex|it after|
|000051e0| 20 72 65 63 65 69 76 69 | 6e 67 20 5c 66 49 63 6f | receivi|ng \fIco|
|000051f0| 75 6e 74 5c 66 50 20 70 | 61 63 6b 65 74 73 2e 0a |unt\fP p|ackets..|
|00005200| 2e 54 50 0a 2e 42 20 5c | 2d 64 0a 44 75 6d 70 20 |.TP..B \|-d.Dump |
|00005210| 74 68 65 20 63 6f 6d 70 | 69 6c 65 64 20 70 61 63 |the comp|iled pac|
|00005220| 6b 65 74 2d 6d 61 74 68 | 69 6e 67 20 63 6f 64 65 |ket-math|ing code|
|00005230| 20 74 6f 20 73 74 61 6e | 64 61 72 64 20 6f 75 74 | to stan|dard out|
|00005240| 70 75 74 20 61 6e 64 20 | 73 74 6f 70 2e 20 20 0a |put and |stop. .|
|00005250| 2e 54 50 0a 2e 42 20 5c | 2d 65 0a 50 72 69 6e 74 |.TP..B \|-e.Print|
|00005260| 20 74 68 65 20 65 74 68 | 65 72 6e 65 74 20 68 65 | the eth|ernet he|
|00005270| 61 64 65 72 20 28 73 6f | 75 72 63 65 2c 20 64 65 |ader (so|urce, de|
|00005280| 73 74 69 6e 61 74 69 6f | 6e 2c 20 70 72 6f 74 6f |stinatio|n, proto|
|00005290| 63 6f 6c 20 61 6e 64 20 | 6c 65 6e 67 74 68 29 0a |col and |length).|
|000052a0| 6f 6e 20 65 61 63 68 20 | 64 75 6d 70 20 6c 69 6e |on each |dump lin|
|000052b0| 65 2e 0a 2e 54 50 0a 2e | 42 20 5c 2d 66 0a 50 72 |e...TP..|B \-f.Pr|
|000052c0| 69 6e 74 20 60 66 6f 72 | 65 69 67 6e 27 20 69 6e |int `for|eign' in|
|000052d0| 74 65 72 6e 65 74 20 61 | 64 64 72 65 73 73 65 73 |ternet a|ddresses|
|000052e0| 20 6e 75 6d 65 72 69 63 | 61 6c 6c 79 20 72 61 74 | numeric|ally rat|
|000052f0| 68 65 72 20 74 68 61 6e | 20 73 79 6d 62 6f 6c 69 |her than| symboli|
|00005300| 63 61 6c 6c 79 0a 28 74 | 68 69 73 20 6f 70 74 69 |cally.(t|his opti|
|00005310| 6f 6e 20 69 73 20 69 6e | 74 65 6e 64 65 64 20 74 |on is in|tended t|
|00005320| 6f 20 67 65 74 20 61 72 | 6f 75 6e 64 20 73 65 72 |o get ar|ound ser|
|00005330| 69 6f 75 73 20 62 72 61 | 69 6e 20 64 61 6d 61 67 |ious bra|in damag|
|00005340| 65 20 69 6e 0a 53 75 6e | 27 73 20 79 70 20 73 65 |e in.Sun|'s yp se|
|00005350| 72 76 65 72 20 5c 28 65 | 6d 20 75 73 75 61 6c 6c |rver \(e|m usuall|
|00005360| 79 20 69 74 20 68 61 6e | 67 73 20 66 6f 72 65 76 |y it han|gs forev|
|00005370| 65 72 20 74 72 61 6e 73 | 6c 61 74 69 6e 67 20 6e |er trans|lating n|
|00005380| 6f 6e 2d 6c 6f 63 61 6c | 0a 69 6e 74 65 72 6e 65 |on-local|.interne|
|00005390| 74 20 6e 75 6d 62 65 72 | 73 29 2e 0a 2e 54 50 0a |t number|s)...TP.|
|000053a0| 2e 42 20 5c 2d 69 0a 4c | 69 73 74 65 6e 20 6f 6e |.B \-i.L|isten on|
|000053b0| 20 5c 66 49 69 6e 74 65 | 72 66 61 63 65 5c 66 50 | \fIinte|rface\fP|
|000053c0| 2e 0a 49 66 20 6e 6f 0a | 2e 42 20 5c 2d 69 0a 66 |..If no.|.B \-i.f|
|000053d0| 6c 61 67 20 69 73 20 67 | 69 76 65 6e 2c 20 74 68 |lag is g|iven, th|
|000053e0| 65 20 5c 66 49 74 63 70 | 64 75 6d 70 5c 66 50 20 |e \fItcp|dump\fP |
|000053f0| 74 72 69 65 73 20 74 6f | 20 6c 69 73 74 65 6e 20 |tries to| listen |
|00005400| 6f 6e 20 5c 66 49 6c 65 | 30 5c 66 50 0a 74 68 65 |on \fIle|0\fP.the|
|00005410| 6e 20 5c 66 49 69 65 30 | 5c 66 50 20 69 66 20 74 |n \fIie0|\fP if t|
|00005420| 68 65 72 65 20 69 73 20 | 6e 6f 20 5c 66 49 6c 65 |here is |no \fIle|
|00005430| 30 5c 66 50 2e 0a 2e 54 | 50 0a 2e 42 20 5c 2d 6c |0\fP...T|P..B \-l|
|00005440| 0a 4d 61 6b 65 20 73 74 | 64 6f 75 74 20 6c 69 6e |.Make st|dout lin|
|00005450| 65 20 62 75 66 66 65 72 | 65 64 2e 20 20 55 73 65 |e buffer|ed. Use|
|00005460| 66 75 6c 20 69 66 20 79 | 6f 75 20 77 61 6e 74 20 |ful if y|ou want |
|00005470| 74 6f 20 73 65 65 20 74 | 68 65 20 64 61 74 61 0a |to see t|he data.|
|00005480| 77 68 69 6c 65 20 63 61 | 70 74 75 72 69 6e 67 20 |while ca|pturing |
|00005490| 69 74 2e 20 20 45 2e 67 | 2e 2c 0a 2e 62 72 0a 60 |it. E.g|.,..br.`|
|000054a0| 60 74 63 70 64 75 6d 70 | 5c 20 5c 20 5c 2d 6c 5c |`tcpdump|\ \ \-l\|
|000054b0| 20 5c 20 7c 5c 20 5c 20 | 74 65 65 20 64 61 74 27 | \ |\ \ |tee dat'|
|000054c0| 27 20 6f 72 0a 60 60 74 | 63 70 64 75 6d 70 5c 20 |' or.``t|cpdump\ |
|000054d0| 5c 20 5c 2d 6c 20 5c 20 | 5c 20 3e 20 64 61 74 5c |\ \-l \ |\ > dat\|
|000054e0| 20 5c 20 26 5c 20 5c 20 | 74 61 69 6c 5c 20 5c 20 | \ &\ \ |tail\ \ |
|000054f0| 5c 2d 66 5c 20 5c 20 64 | 61 74 27 27 2e 0a 2e 54 |\-f\ \ d|at''...T|
|00005500| 50 0a 2e 42 20 5c 2d 6e | 0a 44 6f 6e 27 74 20 63 |P..B \-n|.Don't c|
|00005510| 6f 6e 76 65 72 74 20 68 | 6f 73 74 20 61 64 64 72 |onvert h|ost addr|
|00005520| 65 73 73 65 73 20 61 6e | 64 20 70 6f 72 74 20 6e |esses an|d port n|
|00005530| 75 6d 62 65 72 73 20 74 | 6f 20 6e 61 6d 65 73 2e |umbers t|o names.|
|00005540| 0a 2e 54 50 0a 2e 42 20 | 5c 2d 4f 0a 44 6f 20 6e |..TP..B |\-O.Do n|
|00005550| 6f 74 20 72 75 6e 20 74 | 68 65 20 70 61 63 6b 65 |ot run t|he packe|
|00005560| 74 2d 6d 61 74 63 68 69 | 6e 67 20 63 6f 64 65 20 |t-matchi|ng code |
|00005570| 6f 70 74 69 6d 69 7a 65 | 72 2e 0a 2e 54 50 0a 2e |optimize|r...TP..|
|00005580| 42 20 5c 2d 70 0a 5c 66 | 49 44 6f 6e 27 74 5c 66 |B \-p.\f|IDon't\f|
|00005590| 50 20 70 75 74 20 74 68 | 65 20 69 6e 74 65 72 66 |P put th|e interf|
|000055a0| 61 63 65 0a 69 6e 74 6f | 20 70 72 6f 6d 69 73 63 |ace.into| promisc|
|000055b0| 75 6f 75 73 20 6d 6f 64 | 65 20 28 69 2e 65 2e 2c |uous mod|e (i.e.,|
|000055c0| 20 5c 66 49 74 63 70 64 | 75 6d 70 5c 66 50 20 77 | \fItcpd|ump\fP w|
|000055d0| 69 6c 6c 20 73 65 65 20 | 6f 6e 6c 79 0a 62 72 6f |ill see |only.bro|
|000055e0| 61 64 63 61 73 74 20 70 | 61 63 6b 65 74 73 20 61 |adcast p|ackets a|
|000055f0| 6e 64 20 70 61 63 6b 65 | 74 73 20 64 65 73 74 69 |nd packe|ts desti|
|00005600| 6e 65 64 20 66 6f 72 20 | 74 68 69 73 20 6d 61 63 |ned for |this mac|
|00005610| 68 69 6e 65 29 2e 0a 2e | 54 50 0a 2e 42 20 5c 2d |hine)...|TP..B \-|
|00005620| 71 0a 51 75 69 63 6b 20 | 28 71 75 69 65 74 3f 29 |q.Quick |(quiet?)|
|00005630| 20 6f 75 74 70 75 74 2e | 20 20 50 72 69 6e 74 20 | output.| Print |
|00005640| 6c 65 73 73 20 70 72 6f | 74 6f 63 6f 6c 20 69 6e |less pro|tocol in|
|00005650| 66 6f 72 6d 61 74 69 6f | 6e 20 73 6f 20 6f 75 74 |formatio|n so out|
|00005660| 70 75 74 0a 6c 69 6e 65 | 73 20 61 72 65 20 73 68 |put.line|s are sh|
|00005670| 6f 72 74 65 72 2e 0a 2e | 54 50 0a 2e 42 20 5c 2d |orter...|TP..B \-|
|00005680| 73 0a 73 6e 61 72 66 20 | 5c 66 49 73 6e 61 70 6c |s.snarf |\fIsnapl|
|00005690| 65 6e 5c 66 50 20 62 79 | 74 65 73 20 6f 66 20 64 |en\fP by|tes of d|
|000056a0| 61 74 61 20 66 72 6f 6d | 20 65 61 63 68 20 70 61 |ata from| each pa|
|000056b0| 63 6b 65 74 20 72 61 74 | 68 65 72 20 74 68 61 6e |cket rat|her than|
|000056c0| 20 74 68 65 0a 64 65 66 | 61 75 6c 74 20 39 36 2e | the.def|ault 96.|
|000056d0| 20 20 39 36 20 62 79 74 | 65 73 20 69 73 20 61 64 | 96 byt|es is ad|
|000056e0| 65 71 75 61 74 65 20 66 | 6f 72 20 49 50 2c 20 49 |equate f|or IP, I|
|000056f0| 43 4d 50 2c 20 54 43 50 | 20 61 6e 64 20 55 44 50 |CMP, TCP| and UDP|
|00005700| 20 62 75 74 0a 6d 61 79 | 20 74 72 75 6e 63 61 74 | but.may| truncat|
|00005710| 65 20 70 72 6f 74 6f 63 | 6f 6c 20 69 6e 66 6f 72 |e protoc|ol infor|
|00005720| 6d 61 74 69 6f 6e 20 66 | 72 6f 6d 20 6e 61 6d 65 |mation f|rom name|
|00005730| 20 73 65 72 76 65 72 20 | 61 6e 64 20 4e 46 53 20 | server |and NFS |
|00005740| 70 61 63 6b 65 74 73 0a | 28 73 65 65 20 62 65 6c |packets.|(see bel|
|00005750| 6f 77 29 2e 20 20 4e 6f | 74 65 20 74 68 61 74 20 |ow). No|te that |
|00005760| 74 61 6b 69 6e 67 20 6c | 61 72 67 65 72 20 73 6e |taking l|arger sn|
|00005770| 61 70 73 68 6f 74 73 20 | 62 6f 74 68 20 69 6e 63 |apshots |both inc|
|00005780| 72 65 61 73 65 73 20 74 | 68 65 0a 61 6d 6f 75 6e |reases t|he.amoun|
|00005790| 74 20 6f 66 20 74 69 6d | 65 20 69 74 20 74 61 6b |t of tim|e it tak|
|000057a0| 65 73 20 74 6f 20 70 72 | 6f 63 65 73 73 20 70 61 |es to pr|ocess pa|
|000057b0| 63 6b 65 74 73 20 61 6e | 64 2c 20 65 66 66 65 63 |ckets an|d, effec|
|000057c0| 74 69 76 65 6c 79 2c 0a | 64 65 63 72 65 61 73 65 |tively,.|decrease|
|000057d0| 73 20 74 68 65 20 61 6d | 6f 75 6e 74 20 6f 66 20 |s the am|ount of |
|000057e0| 70 61 63 6b 65 74 20 62 | 75 66 66 65 72 69 6e 67 |packet b|uffering|
|000057f0| 2e 20 20 54 68 69 73 20 | 6d 61 79 20 63 61 75 73 |. This |may caus|
|00005800| 65 20 70 61 63 6b 65 74 | 73 0a 74 6f 20 62 65 20 |e packet|s.to be |
|00005810| 6c 6f 73 74 2e 20 20 59 | 6f 75 20 73 68 6f 75 6c |lost. Y|ou shoul|
|00005820| 64 20 6c 69 6d 69 74 20 | 5c 66 49 73 6e 61 70 6c |d limit |\fIsnapl|
|00005830| 65 6e 5c 66 50 20 74 6f | 20 74 68 65 0a 73 6d 61 |en\fP to| the.sma|
|00005840| 6c 6c 65 73 74 20 6e 75 | 6d 62 65 72 20 74 68 61 |llest nu|mber tha|
|00005850| 74 20 77 69 6c 6c 20 63 | 61 70 74 75 72 65 20 74 |t will c|apture t|
|00005860| 68 65 20 70 72 6f 74 6f | 63 6f 6c 20 69 6e 66 6f |he proto|col info|
|00005870| 72 6d 61 74 69 6f 6e 20 | 79 6f 75 27 72 65 0a 69 |rmation |you're.i|
|00005880| 6e 74 65 72 65 73 74 65 | 64 20 69 6e 2e 0a 2e 54 |ntereste|d in...T|
|00005890| 50 0a 2e 42 20 5c 2d 74 | 0a 5c 66 49 44 6f 6e 27 |P..B \-t|.\fIDon'|
|000058a0| 74 5c 66 50 20 70 72 69 | 6e 74 20 61 20 74 69 6d |t\fP pri|nt a tim|
|000058b0| 65 73 74 61 6d 70 20 6f | 6e 20 65 61 63 68 20 64 |estamp o|n each d|
|000058c0| 75 6d 70 20 6c 69 6e 65 | 2e 0a 2e 54 50 0a 2e 42 |ump line|...TP..B|
|000058d0| 20 5c 2d 76 0a 28 53 6c | 69 67 68 74 6c 79 20 6d | \-v.(Sl|ightly m|
|000058e0| 6f 72 65 29 20 76 65 72 | 62 6f 73 65 20 6f 75 74 |ore) ver|bose out|
|000058f0| 70 75 74 2e 20 20 46 6f | 72 20 65 78 61 6d 70 6c |put. Fo|r exampl|
|00005900| 65 2c 20 74 68 65 20 74 | 69 6d 65 20 74 6f 20 6c |e, the t|ime to l|
|00005910| 69 76 65 0a 61 6e 64 20 | 74 79 70 65 20 6f 66 20 |ive.and |type of |
|00005920| 73 65 72 76 69 63 65 20 | 69 6e 66 6f 72 6d 61 74 |service |informat|
|00005930| 69 6f 6e 20 69 6e 20 61 | 6e 20 49 50 20 70 61 63 |ion in a|n IP pac|
|00005940| 6b 65 74 20 69 73 20 70 | 72 69 6e 74 65 64 2e 0a |ket is p|rinted..|
|00005950| 2e 54 50 0a 2e 42 20 5c | 2d 78 0a 50 72 69 6e 74 |.TP..B \|-x.Print|
|00005960| 20 65 61 63 68 20 70 61 | 63 6b 65 74 20 28 6d 69 | each pa|cket (mi|
|00005970| 6e 75 73 20 69 74 73 20 | 31 34 20 62 79 74 65 20 |nus its |14 byte |
|00005980| 65 74 68 65 72 6e 65 74 | 20 68 65 61 64 65 72 29 |ethernet| header)|
|00005990| 20 69 6e 20 68 65 78 2e | 0a 54 68 65 20 73 6d 61 | in hex.|.The sma|
|000059a0| 6c 6c 65 73 74 20 6f 66 | 20 65 6e 74 69 72 65 20 |llest of| entire |
|000059b0| 70 61 63 6b 65 74 20 6f | 72 0a 2e 49 20 73 6e 61 |packet o|r..I sna|
|000059c0| 70 6c 65 6e 0a 62 79 74 | 65 73 20 77 69 6c 6c 20 |plen.byt|es will |
|000059d0| 62 65 20 70 72 69 6e 74 | 65 64 2e 0a 2e 49 50 20 |be print|ed...IP |
|000059e0| 22 5c 66 49 20 65 78 70 | 72 65 73 73 69 6f 6e 5c |"\fI exp|ression\|
|000059f0| 66 50 22 0a 2e 52 53 0a | 73 65 6c 65 63 74 73 20 |fP"..RS.|selects |
|00005a00| 77 68 69 63 68 20 70 61 | 63 6b 65 74 73 20 77 69 |which pa|ckets wi|
|00005a10| 6c 6c 20 62 65 20 64 75 | 6d 70 65 64 2e 20 20 49 |ll be du|mped. I|
|00005a20| 66 20 6e 6f 20 5c 66 49 | 65 78 70 72 65 73 73 69 |f no \fI|expressi|
|00005a30| 6f 6e 5c 66 50 0a 69 73 | 20 67 69 76 65 6e 2c 20 |on\fP.is| given, |
|00005a40| 61 6c 6c 20 70 61 63 6b | 65 74 73 20 6f 6e 20 74 |all pack|ets on t|
|00005a50| 68 65 20 6e 65 74 20 77 | 69 6c 6c 20 62 65 20 64 |he net w|ill be d|
|00005a60| 75 6d 70 65 64 2e 20 20 | 4f 74 68 65 72 77 69 73 |umped. |Otherwis|
|00005a70| 65 2c 0a 6f 6e 6c 79 20 | 70 61 63 6b 65 74 73 20 |e,.only |packets |
|00005a80| 66 6f 72 20 77 68 69 63 | 68 20 5c 66 49 65 78 70 |for whic|h \fIexp|
|00005a90| 72 65 73 73 69 6f 6e 5c | 66 50 20 69 73 20 60 74 |ression\|fP is `t|
|00005aa0| 72 75 65 27 20 77 69 6c | 6c 20 62 65 20 64 75 6d |rue' wil|l be dum|
|00005ab0| 70 65 64 2e 0a 2e 4c 50 | 0a 54 68 65 20 5c 66 49 |ped...LP|.The \fI|
|00005ac0| 65 78 70 72 65 73 73 69 | 6f 6e 5c 66 50 20 63 6f |expressi|on\fP co|
|00005ad0| 6e 73 69 73 74 73 20 6f | 66 20 6f 6e 65 20 6f 72 |nsists o|f one or|
|00005ae0| 20 6d 6f 72 65 20 0a 2e | 49 20 70 72 69 6d 69 74 | more ..|I primit|
|00005af0| 69 76 65 73 2e 0a 50 72 | 69 6d 69 74 69 76 65 73 |ives..Pr|imitives|
|00005b00| 20 75 73 75 61 6c 6c 79 | 20 63 6f 6e 73 69 73 74 | usually| consist|
|00005b10| 20 6f 66 20 61 6e 0a 2e | 49 20 69 64 0a 28 6e 61 | of an..|I id.(na|
|00005b20| 6d 65 20 6f 72 20 6e 75 | 6d 62 65 72 29 20 70 72 |me or nu|mber) pr|
|00005b30| 65 63 65 64 65 64 20 62 | 79 20 6f 6e 65 20 6f 72 |eceded b|y one or|
|00005b40| 20 6d 6f 72 65 20 71 75 | 61 6c 69 66 69 65 72 73 | more qu|alifiers|
|00005b50| 2e 20 20 54 68 65 72 65 | 20 61 72 65 20 74 68 72 |. There| are thr|
|00005b60| 65 65 0a 64 69 66 66 65 | 72 65 6e 74 20 6b 69 6e |ee.diffe|rent kin|
|00005b70| 64 73 20 6f 66 20 71 75 | 61 6c 69 66 69 65 72 3a |ds of qu|alifier:|
|00005b80| 0a 2e 49 50 20 5c 66 49 | 74 79 70 65 5c 66 50 0a |..IP \fI|type\fP.|
|00005b90| 71 75 61 6c 69 66 69 65 | 72 73 20 73 61 79 20 77 |qualifie|rs say w|
|00005ba0| 68 61 74 20 6b 69 6e 64 | 20 6f 66 20 74 68 69 6e |hat kind| of thin|
|00005bb0| 67 20 74 68 65 20 69 64 | 20 6e 61 6d 65 20 6f 72 |g the id| name or|
|00005bc0| 20 6e 75 6d 62 65 72 20 | 72 65 66 65 72 73 20 74 | number |refers t|
|00005bd0| 6f 2e 0a 50 6f 73 73 69 | 62 6c 65 20 74 79 70 65 |o..Possi|ble type|
|00005be0| 73 20 61 72 65 0a 2e 42 | 52 20 68 6f 73 74 20 2c |s are..B|R host ,|
|00005bf0| 0a 2e 42 20 6e 65 74 0a | 61 6e 64 0a 2e 42 52 20 |..B net.|and..BR |
|00005c00| 70 6f 72 74 20 2e 0a 45 | 2e 67 2e 2c 20 60 68 6f |port ..E|.g., `ho|
|00005c10| 73 74 20 66 6f 6f 27 2c | 20 60 6e 65 74 20 31 32 |st foo',| `net 12|
|00005c20| 38 2e 33 27 2c 20 60 70 | 6f 72 74 20 32 30 27 2e |8.3', `p|ort 20'.|
|00005c30| 20 20 49 66 20 74 68 65 | 72 65 20 69 73 20 6e 6f | If the|re is no|
|00005c40| 20 74 79 70 65 0a 71 75 | 61 6c 69 66 69 65 72 2c | type.qu|alifier,|
|00005c50| 0a 2e 42 20 68 6f 73 74 | 0a 69 73 20 61 73 73 75 |..B host|.is assu|
|00005c60| 6d 65 64 2e 0a 2e 49 50 | 20 5c 66 49 64 69 72 5c |med...IP| \fIdir\|
|00005c70| 66 50 0a 71 75 61 6c 69 | 66 69 65 72 73 20 73 70 |fP.quali|fiers sp|
|00005c80| 65 63 69 66 79 20 61 20 | 70 61 72 74 69 63 75 6c |ecify a |particul|
|00005c90| 61 72 20 74 72 61 6e 66 | 65 72 20 64 69 72 65 63 |ar tranf|er direc|
|00005ca0| 74 69 6f 6e 20 74 6f 20 | 61 6e 64 2f 6f 72 20 66 |tion to |and/or f|
|00005cb0| 72 6f 6d 0a 2e 49 20 69 | 64 2e 0a 50 6f 73 73 69 |rom..I i|d..Possi|
|00005cc0| 62 6c 65 20 64 69 72 65 | 63 74 69 6f 6e 73 20 61 |ble dire|ctions a|
|00005cd0| 72 65 0a 2e 42 52 20 73 | 72 63 20 2c 0a 2e 42 52 |re..BR s|rc ,..BR|
|00005ce0| 20 64 73 74 20 2c 0a 2e | 42 20 22 73 72 63 20 6f | dst ,..|B "src o|
|00005cf0| 72 20 64 73 74 22 0a 61 | 6e 64 0a 2e 42 52 20 22 |r dst".a|nd..BR "|
|00005d00| 73 72 63 20 61 6e 64 20 | 64 73 74 22 20 2e 0a 45 |src and |dst" ..E|
|00005d10| 2e 67 2e 2c 20 60 73 72 | 63 20 66 6f 6f 27 2c 20 |.g., `sr|c foo', |
|00005d20| 60 64 73 74 20 6e 65 74 | 20 31 32 38 2e 33 27 2c |`dst net| 128.3',|
|00005d30| 20 60 73 72 63 20 6f 72 | 20 64 73 74 20 70 6f 72 | `src or| dst por|
|00005d40| 74 20 66 74 70 2d 64 61 | 74 61 27 2e 20 20 49 66 |t ftp-da|ta'. If|
|00005d50| 0a 74 68 65 72 65 20 69 | 73 20 6e 6f 20 64 69 72 |.there i|s no dir|
|00005d60| 20 71 75 61 6c 69 66 69 | 65 72 2c 0a 2e 42 20 22 | qualifi|er,..B "|
|00005d70| 73 72 63 20 6f 72 20 64 | 73 74 22 0a 69 73 20 61 |src or d|st".is a|
|00005d80| 73 73 75 6d 65 64 2e 0a | 2e 49 50 20 5c 66 49 70 |ssumed..|.IP \fIp|
|00005d90| 72 6f 74 6f 5c 66 50 0a | 71 75 61 6c 69 66 69 65 |roto\fP.|qualifie|
|00005da0| 72 73 20 72 65 73 74 72 | 69 63 74 20 74 68 65 20 |rs restr|ict the |
|00005db0| 6d 61 74 63 68 20 74 6f | 20 61 20 70 61 72 74 69 |match to| a parti|
|00005dc0| 63 75 6c 61 72 20 70 72 | 6f 74 6f 63 6f 6c 2e 20 |cular pr|otocol. |
|00005dd0| 20 50 6f 73 73 69 62 6c | 65 0a 70 72 6f 74 6f 73 | Possibl|e.protos|
|00005de0| 20 61 72 65 3a 0a 2e 42 | 52 20 65 74 68 65 72 20 | are:..B|R ether |
|00005df0| 2c 0a 2e 42 52 20 69 70 | 20 2c 0a 2e 42 52 20 61 |,..BR ip| ,..BR a|
|00005e00| 72 70 20 2c 0a 2e 42 52 | 20 72 61 72 70 20 2c 0a |rp ,..BR| rarp ,.|
|00005e10| 2e 42 20 74 63 70 0a 61 | 6e 64 0a 2e 42 52 20 75 |.B tcp.a|nd..BR u|
|00005e20| 64 70 20 2e 0a 45 2e 67 | 2e 2c 20 60 65 74 68 65 |dp ..E.g|., `ethe|
|00005e30| 72 20 73 72 63 20 66 6f | 6f 27 2c 20 60 61 72 70 |r src fo|o', `arp|
|00005e40| 20 6e 65 74 20 31 32 38 | 2e 33 27 2c 20 60 74 63 | net 128|.3', `tc|
|00005e50| 70 20 70 6f 72 74 20 32 | 31 27 2e 20 20 49 66 20 |p port 2|1'. If |
|00005e60| 74 68 65 72 65 20 69 73 | 0a 6e 6f 20 70 72 6f 74 |there is|.no prot|
|00005e70| 6f 20 71 75 61 6c 69 66 | 69 65 72 2c 20 61 6c 6c |o qualif|ier, all|
|00005e80| 20 70 72 6f 74 6f 63 6f | 6c 73 20 63 6f 6e 73 69 | protoco|ls consi|
|00005e90| 73 74 65 6e 74 20 77 69 | 74 68 20 74 68 65 20 74 |stent wi|th the t|
|00005ea0| 79 70 65 20 61 72 65 0a | 61 73 73 75 6d 65 64 2e |ype are.|assumed.|
|00005eb0| 20 20 45 2e 67 2e 2c 20 | 60 73 72 63 20 66 6f 6f | E.g., |`src foo|
|00005ec0| 27 20 6d 65 61 6e 73 20 | 60 28 65 74 68 65 72 20 |' means |`(ether |
|00005ed0| 6f 72 20 69 70 20 6f 72 | 20 61 72 70 20 6f 72 20 |or ip or| arp or |
|00005ee0| 72 61 72 70 29 20 73 72 | 63 20 66 6f 6f 27 0a 28 |rarp) sr|c foo'.(|
|00005ef0| 65 78 63 65 70 74 20 74 | 68 65 20 6c 61 74 74 65 |except t|he latte|
|00005f00| 72 20 69 73 20 6e 6f 74 | 20 6c 65 67 61 6c 20 73 |r is not| legal s|
|00005f10| 79 6e 74 61 78 29 2c 20 | 60 6e 65 74 20 62 61 72 |yntax), |`net bar|
|00005f20| 27 20 6d 65 61 6e 73 20 | 60 28 69 70 20 6f 72 0a |' means |`(ip or.|
|00005f30| 61 72 70 20 6f 72 20 72 | 61 72 70 29 20 6e 65 74 |arp or r|arp) net|
|00005f40| 20 62 61 72 27 20 61 6e | 64 20 60 70 6f 72 74 20 | bar' an|d `port |
|00005f50| 35 33 27 20 6d 65 61 6e | 73 20 60 28 74 63 70 20 |53' mean|s `(tcp |
|00005f60| 6f 72 20 75 64 70 29 20 | 70 6f 72 74 20 35 33 27 |or udp) |port 53'|
|00005f70| 2e 0a 2e 4c 50 0a 49 6e | 20 61 64 64 69 74 69 6f |...LP.In| additio|
|00005f80| 6e 20 74 6f 20 74 68 65 | 20 61 62 6f 76 65 2c 20 |n to the| above, |
|00005f90| 74 68 65 72 65 20 61 72 | 65 20 73 6f 6d 65 20 73 |there ar|e some s|
|00005fa0| 70 65 63 69 61 6c 20 60 | 70 72 69 6d 69 74 69 76 |pecial `|primitiv|
|00005fb0| 65 27 20 6b 65 79 77 6f | 72 64 73 0a 74 68 61 74 |e' keywo|rds.that|
|00005fc0| 20 64 6f 6e 27 74 20 66 | 6f 6c 6c 6f 77 20 74 68 | don't f|ollow th|
|00005fd0| 65 20 70 61 74 74 65 72 | 6e 3a 0a 2e 42 52 20 67 |e patter|n:..BR g|
|00005fe0| 61 74 65 77 61 79 20 2c | 0a 2e 42 52 20 62 72 6f |ateway ,|..BR bro|
|00005ff0| 61 64 63 61 73 74 20 2c | 0a 2e 42 52 20 6c 65 73 |adcast ,|..BR les|
|00006000| 73 20 2c 0a 2e 42 20 67 | 72 65 61 74 65 72 0a 61 |s ,..B g|reater.a|
|00006010| 6e 64 20 61 72 69 74 68 | 6d 65 74 69 63 20 65 78 |nd arith|metic ex|
|00006020| 70 72 65 73 73 69 6f 6e | 73 2e 20 20 41 6c 6c 20 |pression|s. All |
|00006030| 6f 66 20 74 68 65 73 65 | 20 61 72 65 20 64 65 73 |of these| are des|
|00006040| 63 72 69 62 65 64 20 62 | 65 6c 6f 77 2e 0a 2e 4c |cribed b|elow...L|
|00006050| 50 0a 4d 6f 72 65 20 63 | 6f 6d 70 6c 65 78 20 66 |P.More c|omplex f|
|00006060| 69 6c 74 65 72 20 65 78 | 70 72 65 73 73 69 6f 6e |ilter ex|pression|
|00006070| 73 20 61 72 65 20 62 75 | 69 6c 74 20 75 70 20 62 |s are bu|ilt up b|
|00006080| 79 20 75 73 69 6e 67 20 | 74 68 65 20 77 6f 72 64 |y using |the word|
|00006090| 73 0a 2e 42 52 20 61 6e | 64 20 2c 0a 2e 42 20 6f |s..BR an|d ,..B o|
|000060a0| 72 0a 61 6e 64 0a 2e 42 | 20 6e 6f 74 0a 74 6f 20 |r.and..B| not.to |
|000060b0| 63 6f 6d 62 69 6e 65 20 | 70 72 69 6d 69 74 69 76 |combine |primitiv|
|000060c0| 65 73 2e 20 20 45 2e 67 | 2e 2c 20 60 68 6f 73 74 |es. E.g|., `host|
|000060d0| 20 66 6f 6f 20 61 6e 64 | 20 6e 6f 74 20 70 6f 72 | foo and| not por|
|000060e0| 74 20 66 74 70 20 61 6e | 64 20 6e 6f 74 20 70 6f |t ftp an|d not po|
|000060f0| 72 74 20 66 74 70 2d 64 | 61 74 61 27 2e 0a 54 6f |rt ftp-d|ata'..To|
|00006100| 20 73 61 76 65 20 74 79 | 70 69 6e 67 2c 20 69 64 | save ty|ping, id|
|00006110| 65 6e 74 69 63 61 6c 20 | 71 75 61 6c 69 66 69 65 |entical |qualifie|
|00006120| 72 20 6c 69 73 74 73 20 | 63 61 6e 20 62 65 20 6f |r lists |can be o|
|00006130| 6d 69 74 74 65 64 2e 20 | 20 45 2e 67 2e 2c 0a 60 |mitted. | E.g.,.`|
|00006140| 74 63 70 20 64 73 74 20 | 70 6f 72 74 20 66 74 70 |tcp dst |port ftp|
|00006150| 20 6f 72 20 66 74 70 2d | 64 61 74 61 20 6f 72 20 | or ftp-|data or |
|00006160| 64 6f 6d 61 69 6e 27 20 | 69 73 20 65 78 61 63 74 |domain' |is exact|
|00006170| 6c 79 20 74 68 65 20 73 | 61 6d 65 20 61 73 0a 60 |ly the s|ame as.`|
|00006180| 74 63 70 20 64 73 74 20 | 70 6f 72 74 20 66 74 70 |tcp dst |port ftp|
|00006190| 20 6f 72 20 74 63 70 20 | 64 73 74 20 70 6f 72 74 | or tcp |dst port|
|000061a0| 20 66 74 70 2d 64 61 74 | 61 20 6f 72 20 74 63 70 | ftp-dat|a or tcp|
|000061b0| 20 64 73 74 20 70 6f 72 | 74 20 64 6f 6d 61 69 6e | dst por|t domain|
|000061c0| 27 2e 0a 2e 4c 50 0a 41 | 6c 6c 6f 77 61 62 6c 65 |'...LP.A|llowable|
|000061d0| 20 70 72 69 6d 69 74 69 | 76 65 73 20 61 72 65 3a | primiti|ves are:|
|000061e0| 0a 2e 49 50 20 22 5c 66 | 42 64 73 74 20 68 6f 73 |..IP "\f|Bdst hos|
|000061f0| 74 20 5c 66 49 68 6f 73 | 74 5c 66 52 22 0a 54 72 |t \fIhos|t\fR".Tr|
|00006200| 75 65 20 69 66 20 74 68 | 65 20 49 50 20 64 65 73 |ue if th|e IP des|
|00006210| 74 69 6e 61 74 69 6f 6e | 20 66 69 65 6c 64 20 6f |tination| field o|
|00006220| 66 20 74 68 65 20 70 61 | 63 6b 65 74 20 69 73 20 |f the pa|cket is |
|00006230| 5c 66 49 68 6f 73 74 5c | 66 50 2c 0a 77 68 69 63 |\fIhost\|fP,.whic|
|00006240| 68 20 6d 61 79 20 62 65 | 20 65 69 74 68 65 72 20 |h may be| either |
|00006250| 61 6e 20 61 64 64 72 65 | 73 73 20 6f 72 20 61 20 |an addre|ss or a |
|00006260| 6e 61 6d 65 2e 0a 54 68 | 65 20 6b 65 79 77 6f 72 |name..Th|e keywor|
|00006270| 64 20 5c 66 42 68 6f 73 | 74 5c 66 50 20 69 73 20 |d \fBhos|t\fP is |
|00006280| 6f 70 74 69 6f 6e 61 6c | 2e 0a 2e 49 50 20 22 5c |optional|...IP "\|
|00006290| 66 42 73 72 63 20 68 6f | 73 74 20 5c 66 49 68 6f |fBsrc ho|st \fIho|
|000062a0| 73 74 5c 66 52 22 0a 54 | 72 75 65 20 69 66 20 74 |st\fR".T|rue if t|
|000062b0| 68 65 20 49 50 20 73 6f | 75 72 63 65 20 66 69 65 |he IP so|urce fie|
|000062c0| 6c 64 20 6f 66 20 74 68 | 65 20 70 61 63 6b 65 74 |ld of th|e packet|
|000062d0| 20 69 73 20 5c 66 49 68 | 6f 73 74 5c 66 50 2e 0a | is \fIh|ost\fP..|
|000062e0| 54 68 65 20 6b 65 79 77 | 6f 72 64 20 5c 66 42 68 |The keyw|ord \fBh|
|000062f0| 6f 73 74 5c 66 50 20 69 | 73 20 6f 70 74 69 6f 6e |ost\fP i|s option|
|00006300| 61 6c 2e 0a 2e 49 50 20 | 22 5c 66 42 68 6f 73 74 |al...IP |"\fBhost|
|00006310| 20 5c 66 49 68 6f 73 74 | 5c 66 50 0a 54 72 75 65 | \fIhost|\fP.True|
|00006320| 20 69 66 20 65 69 74 68 | 65 72 20 74 68 65 20 49 | if eith|er the I|
|00006330| 50 20 73 6f 75 72 63 65 | 20 6f 72 20 64 65 73 74 |P source| or dest|
|00006340| 69 6e 61 74 69 6f 6e 20 | 6f 66 20 74 68 65 20 70 |ination |of the p|
|00006350| 61 63 6b 65 74 20 69 73 | 20 5c 66 49 68 6f 73 74 |acket is| \fIhost|
|00006360| 5c 66 50 2e 0a 41 6e 79 | 20 6f 66 20 74 68 65 20 |\fP..Any| of the |
|00006370| 61 62 6f 76 65 20 68 6f | 73 74 20 65 78 70 72 65 |above ho|st expre|
|00006380| 73 73 69 6f 6e 73 20 63 | 61 6e 20 62 65 20 70 72 |ssions c|an be pr|
|00006390| 65 70 65 6e 64 65 64 20 | 77 69 74 68 20 74 68 65 |epended |with the|
|000063a0| 20 6b 65 79 77 6f 72 64 | 73 2c 0a 5c 66 42 69 70 | keyword|s,.\fBip|
|000063b0| 5c 66 50 2c 20 5c 66 42 | 61 72 70 5c 66 50 2c 20 |\fP, \fB|arp\fP, |
|000063c0| 6f 72 20 5c 66 42 72 61 | 72 70 5c 66 50 20 61 73 |or \fBra|rp\fP as|
|000063d0| 20 69 6e 3a 0a 2e 69 6e | 20 2b 2e 35 69 0a 2e 6e | in:..in| +.5i..n|
|000063e0| 66 0a 5c 66 42 69 70 20 | 68 6f 73 74 20 5c 66 49 |f.\fBip |host \fI|
|000063f0| 68 6f 73 74 5c 66 52 0a | 2e 66 69 0a 2e 69 6e 20 |host\fR.|.fi..in |
+--------+-------------------------+-------------------------+--------+--------+
Only 25.0 KB of data is shown above.
