NAME

sniffer, snoopy − spy on Ethernet packets

SYNOPSIS

­snoopy [ ­-abcdeEgilnoprsStux9 ] [ ­-N ­count ] [ ­-F ­filter ] [ device ]
­sniffer [ ­-p ] [ ­-F ­filter ] [ device ]

DESCRIPTION

­Snoopy displays the header and data bytes of packets received from the local Ethernet.  The following options each select packets from a particular protocol.  If more than one flag is given, packets from all those protocols are displayed. 

­a ARP

­b BOOTP

­c ICMP

­e all Ethernet packets

­E ESP

­g GRE

­i IP

­l IL

­o OSPF

­r RUDP, a Plan 9 reliable datagram protocol

­t TCP

­u UDP

The following options control output format. 

­n do not translate addresses into names

­x display the body of the message in hex instead of UTF

­9 display the body as a 9p message

­N limit the number of bytes of the body to display to ­count (default 20)

Finally, some options control data flow and packet filtering. 

­s read only the first 64 bytes of each packet, i.e., open ether type −2 instead of −1. 

­S read packets from standard input, often a pipe from ­sniffer or a file containing a dump from a previous invocation of sniffer.

­d write the packets to ­/tmp/snoopydump in the same format as sniffer.

­F filter out all packets whose source or destination does not match filter, which may be an IP address, an ethernet address, or a TCP or UDP port.

­p don’t turn on promiscuous mode

Sniffer reads packets off the local Ethernet and writes them, preceded by a 2 byte big endian length and a 4 byte big endian millisecond time, to standard output.  The output can be saved to a file or piped into snoopy. The ­−p and ­−F options are the same as for snoopy.

FILES

­/net/ether
Ethernet device

SOURCE

­/sys/src/cmd/ip/snoopy.c
­/sys/src/cmd/ip/sniffer.c

BUGS

The CPU servers do not take well to running in promiscuous mode.  If run on them, ­snoopy may kill their Ethernets. 

Plan 9  —  July 29, 2000