1.\" $OpenBSD: tcpdump.8,v 1.116 2024/02/26 06:49:38 jmc Exp $ 2.\" 3.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that: (1) source code distributions 8.\" retain the above copyright notice and this paragraph in its entirety, (2) 9.\" distributions including binary code include the above copyright notice and 10.\" this paragraph in its entirety in the documentation or other materials 11.\" provided with the distribution, and (3) all advertising materials mentioning 12.\" features or use of this software display the following acknowledgement: 13.\" ``This product includes software developed by the University of California, 14.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15.\" the University nor the names of its contributors may be used to endorse 16.\" or promote products derived from this software without specific prior 17.\" written permission. 18.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21.\" 22.Dd $Mdocdate: February 26 2024 $ 23.Dt TCPDUMP 8 24.Os 25.Sh NAME 26.Nm tcpdump 27.Nd dump traffic on a network 28.Sh SYNOPSIS 29.Nm tcpdump 30.Op Fl AadefILlNnOopqStvXx 31.Op Fl B Ar fildrop 32.Op Fl c Ar count 33.Op Fl D Ar direction 34.Op Fl E Oo Ar espalg : Oc Ns Ar espkey 35.Op Fl F Ar file 36.Op Fl i Ar interface 37.Op Fl r Ar file 38.Op Fl s Ar snaplen 39.Op Fl T Ar type 40.Op Fl w Ar file 41.Op Fl y Ar datalinktype 42.Op Ar expression 43.Sh DESCRIPTION 44.Nm 45prints out the headers of packets on a network interface that match the boolean 46.Ar expression . 47You must have read access to 48.Pa /dev/bpf . 49.Pp 50The options are as follows: 51.Bl -tag -width "-c count" 52.It Fl A 53Print each packet in ASCII. 54If the 55.Fl e 56option is also specified, the link-level header will be included. 57The smaller of the entire packet or 58.Ar snaplen 59bytes will be printed. 60.It Fl a 61Attempt to convert network and broadcast addresses to names. 62.It Fl B Ar fildrop 63Configure the drop action specified by 64.Ar fildrop 65to be used when the filter expression matches a packet. 66The actions are: 67.Pp 68.Bl -tag -width "capture" -offset indent -compact 69.It Cm pass 70Matching packets are accepted and captured. 71.It Cm capture 72Matching packets are dropped and captured. 73.It Cm drop 74Matching packets are dropped but not captured. 75.El 76.Pp 77The default action is 78.Cm pass . 79.It Fl c Ar count 80Exit after receiving 81.Ar count 82packets. 83.It Fl D Ar direction 84Select packets flowing in the specified 85.Ar direction . 86Valid directions are: 87.Cm in 88and 89.Cm out . 90The default is to accept packets flowing in any direction. 91.It Fl d 92Dump the compiled packet-matching code in a human readable form to 93standard output and stop. 94.It Fl dd 95Dump packet-matching code as a C program fragment. 96.It Fl ddd 97Dump packet-matching code as decimal numbers 98preceded with a count. 99.It Fl E Oo Ar espalg : Oc Ns Ar espkey 100Try to decrypt RFC 4835 ESP 101.Pq Encapsulating Security Payload 102traffic using the specified hex key 103.Ar espkey . 104Supported algorithms for 105.Ar espalg 106are: 107.Cm aes128 , 108.Cm aes128-hmac96 , 109.Cm blowfish , 110.Cm blowfish-hmac96 , 111.Cm cast , 112.Cm cast-hmac96 , 113.Cm des3 , 114.Cm des3-hmac96 , 115.Cm des 116and 117.Cm des-hmac96 . 118The algorithm defaults to 119.Cm aes128-hmac96 . 120This option should be used for debugging only, since the key will show up in 121.Xr ps 1 122output. 123.It Fl e 124Print the link-level header on each dump line. 125.It Fl F Ar file 126Use 127.Ar file 128as input for the filter expression. 129Any additional expressions given on the command line are ignored. 130.It Fl f 131Print 132.Dq foreign 133internet addresses numerically rather than symbolically. 134This option is intended to get around serious brain damage in 135Sun's yp server \(em usually it hangs forever translating non-local 136internet numbers. 137.It Fl I 138Print the interface on each dump line. 139.It Fl i Ar interface 140Listen on 141.Ar interface . 142If unspecified, 143.Nm 144searches the system interface list for the lowest numbered, configured 145.Dq up 146interface 147.Pq excluding loopback . 148Ties are broken by choosing the earliest match. 149.Ar interface 150may be either a network interface or a USB interface, for example 151.Ar usb0 . 152.It Fl L 153List the supported data link types for the interface and exit. 154.It Fl l 155Make stdout line buffered. 156Useful if you want to see the data while capturing it. 157For example: 158.Pp 159.Dl # tcpdump -l | tee dat 160or 161.Dl # tcpdump -l > dat & tail -f dat 162.It Fl N 163Do not print domain name qualification of host names. 164For example, if you specify this flag then 165.Nm 166will print 167.Dq nic 168instead of 169.Dq nic.ddn.mil . 170.It Fl n 171Do not convert addresses 172.Pq host addresses, port numbers, etc. 173to names. 174.It Fl O 175Do not run the packet-matching code optimizer. 176This is useful only if you suspect a bug in the optimizer. 177.It Fl o 178Print a guess of the possible operating system(s) of hosts that sent 179TCP SYN packets. 180See 181.Xr pf.os 5 182for a description of the passive operating system fingerprints. 183.It Fl p 184Do not put the interface into promiscuous mode. 185The interface might be in promiscuous mode for some other reason; hence, 186.Fl p 187cannot be used as an abbreviation for 188.Dq ether host \&"{local-hw-addr}\&" 189or 190.Dq ether broadcast . 191.It Fl q 192Quick 193.Pq quiet? 194output. 195Print less protocol information so output lines are shorter. 196.It Fl r Ar file 197Read packets from a 198.Ar file 199which was created with the 200.Fl w 201option. 202Standard input is used if 203.Ar file 204is 205.Ql - . 206.It Fl S 207Print absolute, rather than relative, TCP sequence numbers. 208.It Fl s Ar snaplen 209Analyze at most the first 210.Ar snaplen 211bytes of data from each packet rather than the default of 116. 212116 bytes is adequate for IPv6, ICMP, TCP, and UDP, 213but may truncate protocol information from name server and NFS packets 214.Pq see below . 215Packets truncated because of a limited 216.Ar snaplen 217are indicated in the output with 218.Dq Op | Ns Em proto , 219where 220.Em proto 221is the name of the protocol level at which the truncation has occurred. 222Taking larger snapshots both increases the amount of time it takes 223to process packets and, effectively, decreases the amount of packet buffering. 224This may cause packets to be lost. 225You should limit 226.Ar snaplen 227to the smallest number that will capture the protocol information 228you're interested in. 229.It Fl T Ar type 230Force packets selected by 231.Ar expression 232to be interpreted as the specified 233.Ar type . 234Currently known types are: 235.Pp 236.Bl -tag -width "erspan" -offset indent -compact 237.It Cm cnfp 238Cisco NetFlow protocol 239.It Cm erspan 240Cisco Encapsulated Remote Switch Port Analyzer (ERSPAN) over GRE 241.It Cm geneve 242Generic Network Virtualization Encapsulation 243.It Cm gre 244Generic Routing Encapsulation over UDP 245.It Cm mpls 246Multiprotocol Label Switching over UDP 247.It Cm rpc 248Remote Procedure Call 249.It Cm rtcp 250Real-Time Applications control protocol 251.It Cm rtp 252Real-Time Applications protocol 253.It Cm sack 254RFC 2018 TCP Selective Acknowledgements Options 255.It Cm tcp 256Transmission Control Protocol 257.It Cm tftp 258Trivial File Transfer Protocol 259.It Cm vat 260Visual Audio Tool 261.It Cm vrrp 262Virtual Router Redundancy protocol 263.It Cm vxlan 264Virtual eXtensible Local Area Network 265.It Cm wb 266distributed White Board 267.It Cm wg 268WireGuard tunnel 269.El 270.It Fl t 271Do not print a timestamp on each dump line. 272.It Fl tt 273Print an unformatted timestamp on each dump line. 274.It Fl ttt 275Print day and month in timestamp. 276.It Fl tttt 277Print timestamp difference between packets. 278.It Fl ttttt 279Print timestamp difference since the first packet. 280.It Fl v 281.Pq Slightly more 282verbose output. 283For example, the time to live 284.Pq TTL 285and type of service 286.Pq ToS 287information in an IP packet are printed. 288.It Fl vv 289Even more verbose output. 290For example, additional fields are printed from NFS reply packets. 291.It Fl w Ar file 292Write the raw packets to 293.Ar file 294rather than parsing and printing them out. 295They can be analyzed later with the 296.Fl r 297option. 298Standard output is used if 299.Ar file 300is 301.Ql - . 302.It Fl X 303Print each packet in hex and ASCII. 304If the 305.Fl e 306option is also specified, the link-level header will be included. 307The smaller of the entire packet or 308.Ar snaplen 309bytes will be printed. 310.It Fl x 311Print each packet in hex. 312If the 313.Fl e 314option is also specified, the link-level header will be included. 315The smaller of the entire packet or 316.Ar snaplen 317bytes will be printed. 318.It Fl y Ar datalinktype 319Set the data link type to use while capturing to 320.Ar datalinktype . 321Commonly used types include 322.Cm EN10MB , 323.Cm IEEE802_11 , 324and 325.Cm IEEE802_11_RADIO . 326The choices applicable to a particular device can be listed using 327.Fl L . 328.El 329.Pp 330.Ar expression 331selects which packets will be dumped. 332If no 333.Ar expression 334is given, all packets on the net will be dumped. 335Otherwise, only packets satisfying 336.Ar expression 337will be dumped. 338.Pp 339The filter expression consists of one or more 340.Em primitives . 341Primitives usually consist of an 342.Ar id 343.Pq name or number 344preceded by one or more qualifiers. 345There are three different kinds of qualifier: 346.Bl -tag -width "proto" 347.It Ar type 348Specify which kind of address component the 349.Ar id 350name or number refers to. 351Possible types are 352.Cm host , 353.Cm net 354and 355.Cm port . 356E.g., 357.Dq host foo , 358.Dq net 128.3 , 359.Dq port 20 . 360If there is no type qualifier, 361.Cm host 362is assumed. 363.It Ar dir 364Specify a particular transfer direction to and/or from 365.Ar id . 366Possible directions are 367.Cm src , 368.Cm dst , 369.Cm src or dst , 370.Cm src and dst , 371.Cm ra , 372.Cm ta , 373.Cm addr1 , 374.Cm addr2 , 375.Cm addr3 , 376and 377.Cm addr4 . 378E.g., 379.Dq src foo , 380.Dq dst net 128.3 , 381.Dq src or dst port ftp-data . 382If there is no 383.Ar dir 384qualifier, 385.Cm src or dst 386is assumed. 387The 388.Cm ra , 389.Cm ta , 390.Cm addr1 , 391.Cm addr2 , 392.Cm addr3 , 393and 394.Cm addr4 395qualifiers are only valid for IEEE 802.11 Wireless LAN link layers. 396For null link layers (i.e., point-to-point protocols such as SLIP 397.Pq Serial Line Internet Protocol 398or the 399.Xr pflog 4 400header), the 401.Cm inbound 402and 403.Cm outbound 404qualifiers can be used to specify a desired direction. 405.It Ar proto 406Restrict the match to a particular protocol. 407Possible protocols are: 408.Cm ah , 409.Cm arp , 410.Cm atalk , 411.Cm decnet , 412.Cm esp , 413.Cm ether , 414.Cm fddi , 415.Cm icmp , 416.Cm icmp6 , 417.Cm igmp , 418.Cm igrp , 419.Cm ip , 420.Cm ip6 , 421.Cm lat , 422.Cm mopdl , 423.Cm moprc , 424.Cm pim , 425.Cm rarp , 426.Cm sca , 427.Cm stp , 428.Cm tcp , 429.Cm udp , 430and 431.Cm wlan . 432E.g., 433.Dq ether src foo , 434.Dq arp net 128.3 , 435.Dq tcp port 21 , 436and 437.Dq wlan addr2 0:2:3:4:5:6 . 438If there is no protocol qualifier, 439all protocols consistent with the type are assumed. 440E.g., 441.Dq src foo 442means 443.Do 444.Pq ip or arp or rarp 445src foo 446.Dc 447.Pq except the latter is not legal syntax ; 448.Dq net bar 449means 450.Do 451.Pq ip or arp or rarp 452net bar 453.Dc ; 454and 455.Dq port 53 456means 457.Do 458.Pq TCP or UDP 459port 53 460.Dc . 461.Pp 462.Cm fddi 463is actually an alias for 464.Cm ether ; 465the parser treats them identically as meaning 466.Qo 467the data link level used on the specified network interface 468.Qc . 469FDDI 470.Pq Fiber Distributed Data Interface 471headers contain Ethernet-like source and destination addresses, 472and often contain Ethernet-like packet types, 473so it's possible to filter these FDDI fields just as with the analogous 474Ethernet fields. 475FDDI headers also contain other fields, 476but they cannot be named explicitly in a filter expression. 477.Pp 478Similarly, 479.Cm tr 480and 481.Cm wlan 482are aliases for 483.Cm ether ; 484the previous paragraph's statements about FDDI headers also apply to Token Ring 485and 802.11 wireless LAN headers. 486For 802.11 headers, the destination address is the DA field 487and the source address is the SA field; 488the BSSID, RA, and TA fields aren't tested. 489.El 490.Pp 491In addition to the above, there are some special primitive 492keywords that don't follow the pattern: 493.Cm gateway , 494.Cm broadcast , 495.Cm less , 496.Cm greater , 497and arithmetic expressions. 498All of these are described below. 499.Pp 500More complex filter expressions are built up by using the words 501.Cm and , 502.Cm or , 503and 504.Cm not 505to combine primitives 506e.g., 507.Do 508host foo and not port ftp and not port ftp-data 509.Dc . 510To save typing, identical qualifier lists can be omitted 511e.g., 512.Dq tcp dst port ftp or ftp-data or domain 513is exactly the same as 514.Do 515tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain 516.Dc . 517.Pp 518Allowable primitives are: 519.Bl -tag -width "ether proto proto" 520.It Cm dst host Ar host 521True if the IPv4/v6 destination field of the packet is 522.Ar host , 523which may be either an address or a name. 524.It Cm src host Ar host 525True if the IPv4/v6 source field of the packet is 526.Ar host . 527.It Cm host Ar host 528True if either the IPv4/v6 source or destination of the packet is 529.Ar host . 530.Pp 531Any of the above 532.Ar host 533expressions can be prepended with the keywords, 534.Cm ip , arp , rarp , 535or 536.Cm ip6 , 537as in: 538.Pp 539.D1 Cm ip host Ar host 540.Pp 541which is equivalent to: 542.Bd -ragged -offset indent 543.Cm ether proto 544.Ar ip 545.Cm and host 546.Ar host 547.Ed 548.Pp 549If 550.Ar host 551is a name with multiple IP addresses, each address will be checked for a match. 552.It Cm ether dst Ar ehost 553True if the Ethernet destination address is 554.Ar ehost . 555.Ar ehost 556may be either a name from 557.Pa /etc/ethers 558or a number (see 559.Xr ether_aton 3 560for a numeric format). 561.It Cm ether src Ar ehost 562True if the Ethernet source address is 563.Ar ehost . 564.It Cm ether host Ar ehost 565True if either the Ethernet source or destination address is 566.Ar ehost . 567.It Cm gateway Ar host 568True if the packet used 569.Ar host 570as a gateway; i.e., the Ethernet source or destination address was 571.Ar host 572but neither the IP source nor the IP destination was 573.Ar host . 574.Ar host 575must be a name and must be found both by the machine's 576host-name-to-IP-address resolution mechanisms (host name file, DNS, NIS, 577etc.) and by the machine's host-name-to-Ethernet-address resolution mechanism 578(such as 579.Pa /etc/ethers ) . 580An equivalent expression is: 581.Bd -ragged -offset indent 582.Cm ether host 583.Ar ehost 584.Cm and not host 585.Ar host 586.Ed 587.Pp 588which can be used with either names or numbers for host/ehost. 589This syntax does not work in an IPv6-enabled configuration at this moment. 590.It Cm dst net Ar net 591True if the IPv4/v6 destination address of the packet has a network 592number of 593.Ar net , 594which may be either a name from the networks database 595(such as 596.Pa /etc/networks ) 597or a network number. 598An IPv4 network number can be written as a dotted quad (e.g. 192.168.1.0), 599dotted triple (e.g. 192.168.1), dotted pair (e.g 172.16), 600or single number (e.g. 10); 601the netmask is 255.255.255.255 for a dotted quad 602(which means that it's really a host match), 603255.255.255.0 for a dotted triple, 255.255.0.0 for a dotted pair, 604or 255.0.0.0 for a single number. 605An IPv6 network number must be written out fully; 606the netmask is ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 607so IPv6 "network" matches are really always host matches, 608and a network match requires a netmask length. 609.It Cm src net Ar net 610True if the IPv4/v6 source address of the packet has a network number of 611.Ar net . 612.It Cm net Ar net 613True if either the IPv4/v6 source or destination address of the packet 614has a network number of 615.Ar net . 616.It Cm net Ar net Cm mask Ar netmask 617True if the IPv4 address matches 618.Ar net 619with the specific 620.Ar netmask . 621May be qualified with 622.Cm src 623or 624.Cm dst . 625Note that this syntax is not valid for IPv6 networks. 626.It Cm net Ar net Ns / Ns Ar len 627True if the IPv4/v6 address matches 628.Ar net 629with a netmask 630.Ar len 631bits wide. 632May be qualified with 633.Cm src 634or 635.Cm dst . 636.It Cm dst port Ar port 637True if the packet is IP/TCP, IP/UDP, IP6/TCP or IP6/UDP 638and has a destination port value of 639.Ar port . 640The 641.Ar port 642can be a number or a name used in 643.Pa /etc/services 644(see 645.Xr tcp 4 646and 647.Xr udp 4 ) . 648If a name is used, both the port number and protocol are checked. 649If a number or ambiguous name is used, 650only the port number is checked (e.g.\& 651.Dq dst port 513 652will print both 653TCP/login traffic and UDP/who traffic, and 654.Dq port domain 655will print both TCP/domain and UDP/domain traffic). 656.It Cm src port Ar port 657True if the packet has a source port value of 658.Ar port . 659.It Cm port Ar port 660True if either the source or destination port of the packet is 661.Ar port . 662.Pp 663Any of the above port expressions can be prepended with the keywords 664.Cm tcp 665or 666.Cm udp , 667as in: 668.Pp 669.D1 Cm tcp src port Ar port 670.Pp 671which matches only TCP packets whose source port is 672.Ar port . 673.It Cm less Ar length 674True if the packet has a length less than or equal to 675.Ar length . 676This is equivalent to: 677.Pp 678.D1 Cm len <= Ar length 679.It Cm greater Ar length 680True if the packet has a length greater than or equal to 681.Ar length . 682This is equivalent to: 683.Pp 684.D1 Cm len >= Ar length 685.It Cm sample Ar samplerate 686True if the packet has been randomly selected or sampled at a rate of 1 per 687.Ar samplerate . 688.It Cm ip proto Ar protocol 689True if the packet is an IPv4 packet (see 690.Xr ip 4 ) 691of protocol type 692.Ar protocol . 693.Ar protocol 694can be a number, or one of the names from 695.Xr protocols 5 , 696such as 697.Cm icmp , 698.Cm icmp6 , 699.Cm igmp , 700.Cm igrp , 701.Cm pim , 702.Cm ah , 703.Cm esp , 704.Cm vrrp , 705.Cm udp , 706or 707.Cm tcp . 708Note that the identifiers 709.Cm tcp , 710.Cm udp , 711and 712.Cm icmp 713are also keywords and must be escaped using a backslash character 714.Pq \e . 715Note that this primitive does not chase the protocol header chain. 716.It Cm ip6 proto Ar protocol 717True if the packet is an IPv6 packet of protocol type 718.Ar protocol . 719Note that this primitive does not chase the protocol header chain. 720.It Cm ether broadcast 721True if the packet is an Ethernet broadcast packet. 722The 723.Cm ether 724keyword is optional. 725.It Cm ip broadcast 726True if the packet is an IPv4 broadcast packet. 727It checks for both the all-zeroes and all-ones broadcast conventions, 728and looks up the subnet mask on the interface on which the capture is 729being done. 730.Pp 731If the subnet mask of the interface on which the capture is being done 732is not known, a value of PCAP_NETMASK_UNKNOWN can be supplied; 733tests for IPv4 broadcast addresses will fail to compile, 734but all other tests in the filter program will be OK. 735.It Cm ether multicast 736True if the packet is an Ethernet multicast packet. 737The 738.Cm ether 739keyword is optional. 740This is shorthand for 741.Dq ether[0] & 1 != 0 . 742.It Cm ip multicast 743True if the packet is an IPv4 multicast packet. 744.It Cm ip6 multicast 745True if the packet is an IPv6 multicast packet. 746.It Cm ether proto Ar protocol 747True if the packet is of ether type 748.Ar protocol . 749.Ar protocol 750can be a number, or one of the names 751.Cm ip , 752.Cm ip6 , 753.Cm arp , 754.Cm rarp , 755.Cm atalk , 756.Cm atalkarp , 757.Cm decnet , 758.Cm decdts , 759.Cm decdns , 760.Cm lanbridge , 761.Cm lat , 762.Cm mopdl , 763.Cm moprc , 764.Cm pup , 765.Cm sca , 766.Cm sprite , 767.Cm stp , 768.Cm vexp , 769.Cm vprod , 770or 771.Cm xns . 772These identifiers are also keywords and must be escaped 773using a backslash character 774.Pq Sq \e . 775.Pp 776In the case of FDDI (e.g., 777.Dq fddi protocol arp ) , 778and IEEE 802.11 wireless LANs (such as 779.Dq wlan protocol arp ) , 780for most of those protocols 781the protocol identification comes from the 802.2 Logical Link Control 782.Pq LLC 783header, which is usually layered on top of the FDDI or 802.11 header. 784.Pp 785When filtering for most protocol identifiers on FDDI or 802.11, 786the filter checks only the protocol ID field of an LLC header 787in so-called SNAP format with an Organizational Unit Identifier (OUI) of 7880x000000, for encapsulated Ethernet; it doesn't check whether the packet 789is in SNAP format with an OUI of 0x000000. 790The exceptions are: 791.Bl -tag -width "atalk" 792.It iso 793The filter checks the DSAP (Destination Service Access Point) and 794SSAP (Source Service Access Point) fields of the LLC header. 795.It stp 796The filter checks the DSAP of the LLC header. 797.It atalk 798The filter checks for a SNAP-format packet with an OUI of 0x080007 799and the AppleTalk etype. 800.El 801.Pp 802In the case of Ethernet, the filter checks the Ethernet type field 803for most of those protocols. 804The exceptions are: 805.Bl -tag -width "iso and stp" 806.It iso and stp 807The filter checks for an 802.3 frame and then checks the LLC header as 808it does for FDDI and 802.11. 809.It atalk 810The filter checks both for the AppleTalk etype in an Ethernet frame and 811for a SNAP-format packet as it does for FDDI, Token Ring, and 802.11. 812.El 813.It Cm decnet src Ar host 814True if the DECNET source address is 815.Ar host , 816which may be an address of the form 817.Dq 10.123 , 818or a DECNET host name. 819DECNET host name support is only available on systems that are 820configured to run DECNET. 821.It Cm decnet dst Ar host 822True if the DECNET destination address is 823.Ar host . 824.It Cm decnet host Ar host 825True if either the DECNET source or destination address is 826.Ar host . 827.It Cm ifname Ar interface 828True if the packet was logged as coming from the specified interface 829(applies only to packets logged by 830.Xr pf 4 ) . 831.It Cm on Ar interface 832Synonymous with the 833.Cm ifname 834modifier. 835.It Cm rnr Ar num 836True if the packet was logged as matching the specified PF rule number 837in the main ruleset (applies only to packets logged by 838.Xr pf 4 ) . 839.It Cm rulenum Ar num 840Synonymous with the 841.Cm rnr 842modifier. 843.It Cm reason Ar code 844True if the packet was logged with the specified PF reason code. 845Known codes are: 846.Cm match , 847.Cm bad-offset , 848.Cm fragment , 849.Cm short , 850.Cm normalize , 851.Cm memory , 852.Cm bad-timestamp , 853.Cm congestion , 854.Cm ip-option , 855.Cm proto-cksum , 856.Cm state-mismatch , 857.Cm state-insert , 858.Cm state-limit , 859.Cm src-limit , 860and 861.Cm synproxy 862(applies only to packets logged by 863.Xr pf 4 ) . 864.It Cm rset Ar name 865True if the packet was logged as matching the specified PF ruleset 866name of an anchored ruleset (applies only to packets logged by 867.Xr pf 4 ) . 868.It Cm ruleset Ar name 869Synonymous with the 870.Cm rset 871modifier. 872.It Cm srnr Ar num 873True if the packet was logged as matching the specified PF rule number 874of an anchored ruleset (applies only to packets logged by 875.Xr pf 4 ) . 876.It Cm subrulenum Ar num 877Synonymous with the 878.Cm srnr 879modifier. 880.It Cm action Ar act 881True if PF took the specified action when the packet was logged. 882Known actions are: 883.Cm pass 884and 885.Cm block , 886.Cm nat , 887.Cm rdr , 888.Cm binat , 889.Cm match 890and 891.Cm scrub 892(applies only to packets logged by 893.Xr pf 4 ) . 894.It Cm ip , ip6 , arp , rarp , atalk , decnet , iso , stp 895Abbreviations for 896.Cm ether proto Ar p , 897where 898.Ar p 899is one of the above protocols. 900.It Cm lat , moprc , mopdl 901Abbreviations for 902.Cm ether proto Ar p , 903where 904.Ar p 905is one of the above protocols. 906.Cm tcpdump 907does not currently know how to parse these. 908.It Xo 909.Cm ah , 910.Cm esp , 911.Cm icmp , 912.Cm icmp6 , 913.Cm igmp , 914.Cm igrp , 915.Cm pim , 916.Cm tcp , 917.Cm udp 918.Xc 919Abbreviations for 920.Cm ip proto Ar p 921or 922.Cm ip6 proto Ar p , 923where 924.Ar p 925is one of the above protocols. 926.It Cm wlan addr1 Ar ehost 927True if the first IEEE 802.11 address is 928.Ar ehost . 929.It Cm wlan addr2 Ar ehost 930True if the second IEEE 802.11 address is 931.Ar ehost . 932.It Cm wlan addr3 Ar ehost 933True if the third IEEE 802.11 address is 934.Ar ehost . 935.It Cm wlan addr4 Ar ehost 936True if the fourth IEEE 802.11 address is 937.Ar ehost . 938The fourth address field is only used for 939WDS (Wireless Distribution System) frames. 940.It Cm wlan host Ar ehost 941True if either the first, second, third, or fourth 942IEEE 802.11 address is 943.Ar ehost . 944.It Cm type Ar wlan_type 945True if the IEEE 802.11 frame type matches the specified 946.Ar wlan_type . 947Valid types are: 948.Cm mgt , 949.Cm ctl , 950.Cm data , 951or a numeric value. 952.It Cm type Ar wlan_type Cm subtype Ar wlan_subtype 953True if the IEEE 802.11 frame type matches the specified 954.Ar wlan_type 955and frame subtype matches the specified 956.Ar wlan_subtype . 957.Pp 958If the specified 959.Ar wlan_type 960is 961.Cm mgt , 962then valid values for 963.Ar wlan_subtype 964are 965.Cm assoc-req , 966.Cm assoc-resp , 967.Cm reassoc-req , 968.Cm reassoc-resp , 969.Cm probe-req , 970.Cm probe-resp , 971.Cm beacon , 972.Cm atim , 973.Cm disassoc , 974.Cm auth , 975and 976.Cm deauth . 977.Pp 978If the specified 979.Ar wlan_type 980is 981.Cm ctl , 982then valid values for 983.Ar wlan_subtype 984are 985.Cm ps-poll , 986.Cm rts , 987.Cm cts , 988.Cm ack , 989.Cm cf-end , 990and 991.Cm cf-end-ack . 992.Pp 993If the specified 994.Ar wlan_type 995is 996.Cm data , 997then valid values for 998.Ar wlan_subtype 999are 1000.Cm data , 1001.Cm data-cf-ack , 1002.Cm data-cf-poll , 1003.Cm data-cf-ack-poll , 1004.Cm null , 1005.Cm cf-ack , 1006.Cm cf-poll , 1007.Cm cf-ack-poll , 1008.Cm qos-data , 1009.Cm qos-data-cf-ack , 1010.Cm qos-data-cf-poll , 1011.Cm qos-data-cf-ack-poll , 1012.Cm qos , 1013.Cm qos-cf-poll , 1014and 1015.Cm qos-cf-ack-poll . 1016.It Cm subtype Ar wlan_subtype 1017True if the IEEE 802.11 frame subtype matches the specified 1018.Ar wlan_subtype 1019and frame has the type to which the specified 1020.Ar wlan_subtype 1021belongs. 1022.It Cm dir Ar dir 1023True if the IEEE 802.11 frame direction matches the specified 1024.Cm dir . 1025Valid directions are: 1026.Cm nods , 1027.Cm tods , 1028.Cm fromds , 1029.Cm dstods , 1030or a numeric value. 1031.It Cm vlan Op Ar vlan_id 1032True if the packet is an IEEE 802.1Q VLAN packet. 1033If 1034.Ar vlan_id 1035is specified, only true if the packet has the specified ID. 1036Note that the first 1037.Cm vlan 1038keyword encountered in 1039.Ar expression 1040changes the decoding offsets for the remainder of 1041.Ar expression 1042on the assumption that the packet is a VLAN packet. 1043This expression may be used more than once, to filter on VLAN hierarchies. 1044Each use of that expression increments the filter offsets by 4. 1045.Pp 1046For example, 1047to filter on VLAN 200 encapsulated within VLAN 100: 1048.Pp 1049.Dl vlan 100 && vlan 200 1050.Pp 1051To filter IPv4 protocols encapsulated in VLAN 300 encapsulated within any 1052higher order VLAN: 1053.Pp 1054.Dl vlan && vlan 300 && ip 1055.It Cm mpls Op Ar label 1056True if the packet is an MPLS (Multi-Protocol Label Switching) packet. 1057If 1058.Ar label 1059is specified, only true if the packet has the specified label. 1060Note that the first 1061.Cm mpls 1062keyword encountered in 1063.Ar expression 1064changes the decoding offsets for the remainder of 1065.Ar expression 1066on the assumption that the packet is an MPLS packet. 1067This expression may be used more than once, to filter on MPLS labels. 1068Each use of that expression increments the filter offsets by 4. 1069.Pp 1070For example, 1071to filter on MPLS label 42 first and requires the next label to be 12: 1072.Pp 1073.Dl mpls 42 && mpls 12 1074.Pp 1075To filter on network 192.0.2.0/24 transported inside packets with label 42: 1076.Pp 1077.Dl mpls 42 && net 192.0.2.0/24 1078.It Ar expr relop expr 1079True if the relation holds, where 1080.Ar relop 1081is one of 1082.Sq > , 1083.Sq < , 1084.Sq >= , 1085.Sq <= , 1086.Sq = , 1087.Sq != , 1088and 1089.Ar expr 1090is an arithmetic expression composed of integer constants 1091(expressed in standard C syntax), the normal binary operators 1092.Pf ( Sq + , 1093.Sq - , 1094.Sq * , 1095.Sq / , 1096.Sq & , 1097.Sq | , 1098.Sq << , 1099.Sq >> ) , 1100a length operator, a random operator, and special packet data accessors. 1101Note that all comparisons are unsigned, so that, for example, 11020x80000000 and 0xffffffff are > 0. 1103To access data inside the packet, use the following syntax: 1104.Pp 1105.D1 Ar proto Ns Op Ar expr : Ns Ar size 1106.Pp 1107.Ar proto 1108is one of 1109.Cm ether , 1110.Cm fddi , 1111.Cm tr , 1112.Cm wlan , 1113.Cm ppp , 1114.Cm slip , 1115.Cm link , 1116.Cm ip , 1117.Cm arp , 1118.Cm rarp , 1119.Cm tcp , 1120.Cm udp , 1121.Cm icmp , 1122.Cm ip6 , 1123or 1124.Cm radio , 1125and indicates the protocol layer for the index operation 1126.Pf ( Cm ether , 1127.Cm fddi , 1128.Cm wlan , 1129.Cm tr , 1130.Cm ppp , 1131.Cm slip , 1132and 1133.Cm link 1134all refer to the link layer; 1135.Cm radio 1136refers to the "radio header" added to some 802.11 captures). 1137Note that 1138.Cm tcp , 1139.Cm udp , 1140and other upper-layer protocol types only apply to IPv4, not IPv6 1141(this will be fixed in the future). 1142The byte offset, relative to the indicated protocol layer, is given by 1143.Ar expr . 1144.Ar size 1145is optional and indicates the number of bytes in the field of interest; 1146it can be either one, two, or four, and defaults to one. 1147The length operator, indicated by the keyword 1148.Cm len , 1149gives the length of the packet. 1150The random operator, indicated by the keyword 1151.Cm random , 1152generates a random number. 1153.Pp 1154For example, 1155.Dq ether[0] & 1 != 0 1156catches all multicast traffic. 1157The expression 1158.Dq ip[0] & 0xf != 5 1159catches all IPv4 packets with options. 1160The expression 1161.Dq ip[6:2] & 0x1fff = 0 1162catches only unfragmented IPv4 datagrams and frag zero of fragmented 1163IPv4 datagrams. 1164This check is implicitly applied to the 1165.Cm tcp 1166and 1167.Cm udp 1168index operations. 1169For instance, 1170.Dq tcp[0] 1171always means the first byte of the TCP header, 1172and never means the first byte of an intervening fragment. 1173.Pp 1174Some offsets and field values may be expressed as names rather than 1175as numeric values. 1176The following protocol header field offsets are available: 1177.Cm icmptype 1178(ICMP type field), 1179.Cm icmpcode 1180(ICMP code field), and 1181.Cm tcpflags 1182(TCP flags field). 1183.Pp 1184The following ICMP type field values are available: 1185.Cm icmp-echoreply , 1186.Cm icmp-unreach , 1187.Cm icmp-sourcequench , 1188.Cm icmp-redirect , 1189.Cm icmp-echo , 1190.Cm icmp-routeradvert , 1191.Cm icmp-routersolicit , 1192.Cm icmp-timxceed , 1193.Cm icmp-paramprob , 1194.Cm icmp-tstamp , 1195.Cm icmp-tstampreply , 1196.Cm icmp-ireq , 1197.Cm icmp-ireqreply , 1198.Cm icmp-maskreq , 1199.Cm and 1200.Cm icmp-maskreply . 1201.Pp 1202The following TCP flags field values are available: 1203.Cm tcp-fin , 1204.Cm tcp-syn , 1205.Cm tcp-rst , 1206.Cm tcp-push , 1207.Cm tcp-ack , 1208.Cm tcp-urg . 1209.El 1210.Pp 1211Primitives may be combined using 1212a parenthesized group of primitives and operators. 1213Parentheses are special to the shell and must be escaped. 1214Allowable primitives and operators are: 1215.Bd -ragged -offset indent 1216Negation 1217.Po 1218.Dq Cm \&! 1219or 1220.Dq Cm not 1221.Pc 1222.Pp 1223Concatenation 1224.Po 1225.Dq Cm && 1226or 1227.Dq Cm and 1228.Pc 1229.Pp 1230Alternation 1231.Po 1232.Dq Cm || 1233or 1234.Dq Cm or 1235.Pc 1236.Ed 1237.Pp 1238Negation has highest precedence. 1239Alternation and concatenation have equal precedence and associate 1240left to right. 1241Explicit 1242.Cm and 1243tokens, not juxtaposition, 1244are now required for concatenation. 1245.Pp 1246If an identifier is given without a keyword, the most recent keyword 1247is assumed. 1248For example, 1249.Bd -ragged -offset indent 1250.Cm not host 1251vs 1252.Cm and 1253ace 1254.Ed 1255.Pp 1256is short for 1257.Bd -ragged -offset indent 1258.Cm not host 1259vs 1260.Cm and host 1261ace 1262.Ed 1263.Pp 1264which should not be confused with 1265.Bd -ragged -offset indent 1266.Cm not 1267.Pq Cm host No vs Cm or No ace 1268.Ed 1269.Sh EXAMPLES 1270To print all packets arriving at or departing from sundown: 1271.Pp 1272.Dl # tcpdump host sundown 1273.Pp 1274To print traffic between helios and either hot or ace 1275(the expression is quoted to prevent the shell from misinterpreting 1276the parentheses): 1277.Pp 1278.Dl # tcpdump 'host helios and (hot or ace)' 1279.Pp 1280To print all IP packets between ace and any host except helios: 1281.Pp 1282.Dl # tcpdump ip host ace and not helios 1283.Pp 1284To print all traffic between local hosts and hosts at Berkeley: 1285.Pp 1286.Dl # tcpdump net ucb-ether 1287.Pp 1288To print all FTP traffic through internet gateway snup: 1289.Pp 1290.Dl # tcpdump 'gateway snup and (port ftp or ftp-data)' 1291.Pp 1292To print traffic neither sourced from nor destined for local network 1293192.168.7.0/24 (if you gateway to one other net, this stuff should 1294never make it onto your local network): 1295.Pp 1296.Dl # tcpdump ip and not net 192.168.7.0/24 1297.Pp 1298To print the start and end packets 1299.Pq the SYN and FIN packets 1300of each TCP connection that involves a host that is not in local 1301network 192.168.7.0/24: 1302.Bd -literal -offset indent 1303# tcpdump 'tcp[13] & 3 != 0 and not src and dst net 192.168.7.0/24' 1304.Ed 1305.Pp 1306To print only the SYN packets of HTTP connections: 1307.Pp 1308.Dl # tcpdump 'tcp[tcpflags] = tcp-syn and port http' 1309.Pp 1310To print IP packets longer than 576 bytes sent through gateway snup: 1311.Pp 1312.Dl # tcpdump 'gateway snup and ip[2:2] > 576' 1313.Pp 1314To print IP broadcast or multicast packets that were 1315.Em not 1316sent via Ethernet broadcast or multicast: 1317.Bd -literal -offset indent 1318# tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224' 1319.Ed 1320.Pp 1321To print all ICMP packets that are not echo requests/replies 1322.Pq i.e., not ping packets : 1323.Pp 1324.Dl # tcpdump 'icmp[0] != 8 and icmp[0] != 0' 1325.Pp 1326To print only echo request ICMP packets: 1327.Pp 1328.Dl # tcpdump 'icmp[icmptype] = icmp-echo' 1329.Pp 1330To print and decrypt all ESP packets with SPI 0x00001234: 1331.Pp 1332.Dl # tcpdump -E des3-hmac96:ab...def 'ip[20:4] = 0x00001234' 1333.Pp 1334To print raw wireless frames passing the iwn0 interface: 1335.Dl # tcpdump -i iwn0 -y IEEE802_11_RADIO -v 1336.Sh OUTPUT FORMAT 1337The output of 1338.Nm 1339is protocol dependent. 1340The following gives a brief description and examples of most of the formats. 1341.Ss Link Level Headers 1342If the 1343.Fl e 1344option is given, the link level header is printed out. 1345On Ethernets, the source and destination addresses, protocol, 1346and packet length are printed. 1347.Pp 1348On the packet filter logging interface 1349.Xr pflog 4 , 1350logging reason 1351.Pq rule match, bad-offset, fragment, bad-timestamp, short, normalize, memory , 1352action taken 1353.Pq pass/block , 1354direction 1355.Pq in/out 1356and interface information are printed out for each packet. 1357.Pp 1358On FDDI networks, the 1359.Fl e 1360option causes 1361.Nm 1362to print the frame control field, the source and destination addresses, 1363and the packet length. 1364The frame control field governs the interpretation of the rest of the packet. 1365Normal packets 1366.Pq such as those containing IP datagrams 1367are 1368.Dq async 1369packets, with a priority value between 0 and 7; for example, 1370.Sy async4 . 1371Such packets are assumed to contain an 802.2 Logical Link Control 1372.Pq LLC 1373packet; the LLC header is printed if it is 1374.Em not 1375an ISO datagram or a so-called SNAP packet. 1376.Pp 1377The following description assumes familiarity with the 1378SLIP compression algorithm described in RFC 1144. 1379.Pp 1380On SLIP links, a direction indicator 1381.Po 1382.Ql I 1383for inbound, 1384.Ql O 1385for outbound 1386.Pc , 1387packet type, and compression information are printed out. 1388The packet type is printed first. 1389The three types are 1390.Cm ip , 1391.Cm utcp , 1392and 1393.Cm ctcp . 1394No further link information is printed for IP packets. 1395For TCP packets, the connection identifier is printed following the type. 1396If the packet is compressed, its encoded header is printed out. 1397The special cases are printed out as 1398.Cm *S+ Ns Ar n 1399and 1400.Cm *SA+ Ns Ar n , 1401where 1402.Ar n 1403is the amount by which the sequence number 1404.Pq or sequence number and ack 1405has changed. 1406If it is not a special case, zero or more changes are printed. 1407A change is indicated by 1408.Sq U 1409.Pq urgent pointer , 1410.Sq W 1411.Pq window , 1412.Sq A 1413.Pq ack , 1414.Sq S 1415.Pq sequence number , 1416and 1417.Sq I 1418.Pq packet ID , 1419followed by a delta 1420.Pq +n or -n , 1421or a new value 1422.Pq =n . 1423Finally, the amount of data in the packet and compressed header length 1424are printed. 1425.Pp 1426For example, the following line shows an outbound compressed TCP packet, 1427with an implicit connection identifier; the ack has changed by 6, 1428the sequence number by 49, and the packet ID by 6; 1429there are 3 bytes of data and 6 bytes of compressed header: 1430.Bd -ragged -offset indent 1431O 1432.Cm ctcp No * 1433.Cm A No +6 1434.Cm S No +49 1435.Cm I No +6 3 1436.Pq 6 1437.Ed 1438.Ss ARP/RARP Packets 1439arp/rarp output shows the type of request and its arguments. 1440The format is intended to be self-explanatory. 1441Here is a short sample taken from the start of an rlogin 1442from host rtsg to host csam: 1443.Bd -literal -offset indent 1444arp who-has csam tell rtsg 1445arp reply csam is-at CSAM 1446.Ed 1447.Pp 1448In this example, Ethernet addresses are in caps and internet addresses 1449in lower case. 1450The first line says that rtsg sent an arp packet asking for 1451the Ethernet address of internet host csam. 1452csam replies with its Ethernet address CSAM. 1453.Pp 1454This would look less redundant if we had done 1455.Nm 1456.Fl n : 1457.Bd -literal -offset indent 1458arp who-has 128.3.254.6 tell 128.3.254.68 1459arp reply 128.3.254.6 is-at 02:07:01:00:01:c4 1460.Ed 1461.Pp 1462If we had done 1463.Nm 1464.Fl e , 1465the fact that the first packet is 1466broadcast and the second is point-to-point would be visible: 1467.Bd -literal -offset indent 1468RTSG Broadcast 0806 64: arp who-has csam tell rtsg 1469CSAM RTSG 0806 64: arp reply csam is-at CSAM 1470.Ed 1471.Pp 1472For the first packet this says the Ethernet source address is RTSG, 1473the destination is the Ethernet broadcast address, 1474the type field contained hex 0806 (type 1475.Dv ETHER_ARP ) 1476and the total length was 64 bytes. 1477.Ss TCP Packets 1478The following description assumes familiarity with the TCP protocol 1479described in RFC 793. 1480If you are not familiar with the protocol, neither this description nor 1481.Nm 1482will be of much use to you. 1483.Pp 1484The general format of a TCP protocol line is: 1485.Bd -ragged -offset indent 1486.Ar src No > Ar dst : 1487.Ar flags src-os data-seqno ack window urgent options 1488.Ed 1489.Pp 1490.Ar src 1491and 1492.Ar dst 1493are the source and destination IP addresses and ports. 1494.Ar flags 1495is some combination of 1496.Sq S 1497.Pq SYN , 1498.Sq F 1499.Pq FIN , 1500.Sq P 1501.Pq PUSH , 1502or 1503.Sq R 1504.Pq RST , 1505.Sq W 1506.Pq congestion Window reduced , 1507.Sq E 1508.Pq ecn ECHO 1509or a single 1510.Ql \&. 1511.Pq no flags . 1512.Ar src-os 1513will list a guess of the source host's operating system if the 1514.Fl o 1515command line flag was passed to 1516.Nm tcpdump . 1517.Ar data-seqno 1518describes the portion of sequence space covered 1519by the data in this packet 1520.Pq see example below . 1521.Ar ack 1522is the sequence number of the next data expected by the other 1523end of this connection. 1524.Ar window 1525is the number of bytes of receive buffer space available 1526at the other end of this connection. 1527.Ar urgent 1528indicates there is urgent data in the packet. 1529.Ar options 1530are TCP options enclosed in angle brackets e.g., 1531<mss 1024>. 1532.Pp 1533.Ar src , dst 1534and 1535.Ar flags 1536are always present. 1537The other fields depend on the contents of the packet's TCP protocol header and 1538are output only if appropriate. 1539.Pp 1540Here is the opening portion of an rlogin from host rtsg to host csam. 1541.Bd -unfilled -offset 2n 1542rtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024> 1543csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024> 1544rtsg.1023 > csam.login: . ack 1 win 4096 1545rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096 1546csam.login > rtsg.1023: . ack 2 win 4096 1547rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096 1548csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077 1549csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1 1550csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1 1551.Ed 1552.Pp 1553The first line says that TCP port 1023 on rtsg sent a packet 1554to port login on host csam. 1555The 1556.Ql S 1557indicates that the SYN flag was set. 1558The packet sequence number was 768512 and it contained no data. 1559The notation is 1560.Sm off 1561.So 1562.Ar first : last 1563.Po Ar nbytes 1564.Pc 1565.Sc 1566.Sm on 1567which means sequence numbers 1568.Ar first 1569up to but not including 1570.Ar last 1571which is 1572.Ar nbytes 1573bytes of user data. 1574There was no piggy-backed ack, the available receive window was 4096 1575bytes and there was a max-segment-size option requesting an mss of 1024 bytes. 1576.Pp 1577Csam replies with a similar packet except it includes a piggy-backed 1578ack for rtsg's SYN. 1579Rtsg then acks csam's SYN. 1580The 1581.Ql \&. 1582means no flags were set. 1583The packet contained no data so there is no data sequence number. 1584The ack sequence number is a 32-bit integer. 1585The first time 1586.Nm 1587sees a TCP connection, it prints the sequence number from the packet. 1588On subsequent packets of the connection, the difference between 1589the current packet's sequence number and this initial sequence number 1590is printed. 1591This means that sequence numbers after the first can be interpreted 1592as relative byte positions in the connection's data stream 1593.Po 1594with the first data byte each direction being 1 1595.Pc . 1596.Fl S 1597will override this 1598feature, causing the original sequence numbers to be output. 1599.Pp 1600On the 6th line, rtsg sends csam 19 bytes of data 1601.Po 1602bytes 2 through 20 1603in the rtsg -> csam side of the connection 1604.Pc . 1605The PUSH flag is set in the packet. 1606On the 7th line, csam says it's received data sent by rtsg up to 1607but not including byte 21. 1608Most of this data is apparently sitting in the socket buffer 1609since csam's receive window has gotten 19 bytes smaller. 1610Csam also sends one byte of data to rtsg in this packet. 1611On the 8th and 9th lines, 1612csam sends two bytes of urgent, pushed data to rtsg. 1613.Ss UDP Packets 1614UDP format is illustrated by this rwho packet: 1615.Pp 1616.D1 actinide.who > broadcast.who: udp 84 1617.Pp 1618This says that port who on host actinide sent a UDP datagram to port 1619who on host broadcast, the Internet broadcast address. 1620The packet contained 84 bytes of user data. 1621.Pp 1622Some UDP services are recognized 1623.Pq from the source or destination port number 1624and the higher level protocol information printed. 1625In particular, Domain Name service requests 1626.Pq RFC 1034/1035 1627and Sun RPC calls 1628.Pq RFC 1050 1629to NFS. 1630.Ss UDP Name Server Requests 1631The following description assumes familiarity with 1632the Domain Service protocol described in RFC 1035. 1633If you are not familiar with the protocol, 1634the following description will appear to be written in Greek. 1635.Pp 1636Name server requests are formatted as 1637.Bd -ragged -offset indent 1638.Ar src 1639> 1640.Ar dst : 1641.Ar id op Ns ?\& 1642.Ar flags qtype qclass name 1643.Pq Ar len 1644.Ed 1645.Pp 1646For example: 1647.Pp 1648.D1 h2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37) 1649.Pp 1650Host h2opolo asked the domain server on helios for an address record 1651.Pq Ar qtype Ns =A 1652associated with the name 1653ucbvax.berkeley.edu. 1654The query 1655.Ar id 1656was 3. 1657The 1658.Ql + 1659indicates the recursion desired flag was set. 1660The query length was 37 bytes, not including the UDP and IP protocol headers. 1661The query operation was the normal one 1662.Pq Query 1663so the 1664.Ar op 1665field was omitted. 1666If 1667.Ar op 1668had been anything else, it would have been printed between the 3 and the 1669.Ql + . 1670Similarly, the 1671.Ar qclass 1672was the normal one 1673.Pq C_IN 1674and was omitted. 1675Any other 1676.Ar qclass 1677would have been printed immediately after the A. 1678.Pp 1679A few anomalies are checked and may result in extra fields enclosed in 1680square brackets: if a query contains an answer, name server or 1681authority section, 1682.Ar ancount , 1683.Ar nscount , 1684or 1685.Ar arcount 1686are printed as 1687.Dq Bq Ar n Ns a , 1688.Dq Bq Ar n Ns n , 1689or 1690.Dq Bq Ar n Ns au 1691where 1692.Ar n 1693is the appropriate count. 1694If any of the response bits are set 1695.Po 1696AA, RA or rcode 1697.Pc 1698or any of the 1699.Dq must be zero 1700bits are set in bytes two and three, 1701.Dq Bq b2&3= Ns Ar x 1702is printed, where 1703.Ar x 1704is the hex value of header bytes two and three. 1705.Ss UDP Name Server Responses 1706Name server responses are formatted as 1707.Bd -ragged -offset indent 1708.Ar src No > Ar dst : 1709.Ar id op rcode flags 1710.Ar a 1711/ 1712.Ar n 1713/ 1714.Ar au 1715.Ar type class data 1716.Pq Ar len 1717.Ed 1718.Pp 1719For example: 1720.Bd -unfilled -offset indent 1721helios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273) 1722helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97) 1723.Ed 1724.Pp 1725In the first example, helios responds to query 1726.Ar id 17273 from h2opolo 1728with 3 answer records, 3 name server records and 7 authority records. 1729The first answer record is type A 1730.Pq address and its data is internet 1731address 128.32.137.3. 1732The total size of the response was 273 bytes, excluding UDP and IP headers. 1733The 1734.Ar op 1735.Pq Query 1736and 1737.Ar rcode 1738.Pq NoError 1739were omitted, as was the 1740.Ar class 1741.Pq C_IN 1742of the A record. 1743.Pp 1744In the second example, helios responds to query 1745.Ar op 17462 with an 1747.Ar rcode 1748of non-existent domain 1749.Pq NXDomain 1750with no answers, 1751one name server and no authority records. 1752The 1753.Ql * 1754indicates that the authoritative answer bit was set. 1755Since there were no answers, no 1756.Ar type , 1757.Ar class 1758or 1759.Ar data 1760were printed. 1761.Pp 1762Other flag characters that might appear are 1763.Sq - 1764(recursion available, RA, 1765.Em not 1766set) 1767and 1768.Sq | 1769.Pq truncated message, TC, set . 1770If the question section doesn't contain exactly one entry, 1771.Dq Bq Ar n Ns q 1772is printed. 1773.Pp 1774Name server requests and responses tend to be large and the default 1775.Ar snaplen 1776of 96 bytes may not capture enough of the packet to print. 1777Use the 1778.Fl s 1779flag to increase the 1780.Ar snaplen 1781if you need to seriously investigate name server traffic. 1782.Dq Fl s No 128 1783has worked well for me. 1784.Ss NFS Requests and Replies 1785Sun NFS 1786.Pq Network File System 1787requests and replies are printed as: 1788.Bd -ragged -offset indent 1789.Ar src . Ns Ar xid 1790> 1791.Ar dst . Ns nfs : 1792.Ar len op args 1793.Pp 1794.Ar src . Ns nfs 1795> 1796.Ar dst . Ns Ar xid : 1797reply 1798.Ar stat len op results 1799.Ed 1800.Bd -unfilled -offset indent 1801sushi.6709 > wrl.nfs: 112 readlink fh 21,24/10.73165 1802wrl.nfs > sushi.6709: reply ok 40 readlink "../var" 1803sushi.201b > wrl.nfs: 1804 144 lookup fh 9,74/4096.6878 "xcolors" 1805wrl.nfs > sushi.201b: 1806 reply ok 128 lookup fh 9,74/4134.3150 1807.Ed 1808.Pp 1809In the first line, host sushi sends a transaction with ID 6709 to wrl. 1810The number following the src host is a transaction ID, 1811.Em not 1812the source port. 1813The request was 112 bytes, excluding the UDP and IP headers. 1814The 1815.Ar op 1816was a readlink 1817.Pq read symbolic link 1818on fh 1819.Pq Dq file handle 182021,24/10.731657119. 1821If one is lucky, as in this case, the file handle can be interpreted 1822as a major,minor device number pair, followed by the inode number and 1823generation number. 1824Wrl replies with a 1825.Ar stat 1826of ok and the contents of the link. 1827.Pp 1828In the third line, sushi asks wrl to look up the name 1829.Dq xcolors 1830in directory file 9,74/4096.6878. 1831The data printed depends on the operation type. 1832The format is intended to be self-explanatory 1833if read in conjunction with an NFS protocol spec. 1834.Pp 1835If the 1836.Fl v 1837.Pq verbose 1838flag is given, additional information is printed. 1839For example: 1840.Bd -unfilled -offset indent 1841sushi.1372a > wrl.nfs: 1842 148 read fh 21,11/12.195 8192 bytes @ 24576 1843wrl.nfs > sushi.1372a: 1844 reply ok 1472 read REG 100664 ids 417/0 sz 29388 1845.Ed 1846.Pp 1847.Fl v 1848also prints the IP header TTL, ID, and fragmentation fields, 1849which have been omitted from this example. 1850In the first line, sushi asks wrl to read 8192 bytes from file 21,11/12.195, 1851at byte offset 24576. 1852Wrl replies with a 1853.Ar stat of 1854ok; 1855the packet shown on the second line is the first fragment of the reply, 1856and hence is only 1472 bytes long. 1857The other bytes will follow in subsequent fragments, 1858but these fragments do not have NFS or even UDP headers and so might not be 1859printed, depending on the filter expression used. 1860Because the 1861.Fl v 1862flag is given, some of the file attributes 1863.Po 1864which are returned in addition to the file data 1865.Pc 1866are printed: the file type 1867.Pq So REG Sc , No for regular file , 1868the file mode 1869.Pq in octal , 1870the UID and GID, and the file size. 1871.Pp 1872If the 1873.Fl v 1874flag is given more than once, even more details are printed. 1875.Pp 1876NFS requests are very large and much of the detail won't be printed unless 1877.Ar snaplen 1878is increased. 1879Try using 1880.Dq Fl s No 192 1881to watch NFS traffic. 1882.Pp 1883NFS reply packets do not explicitly identify the RPC operation. 1884Instead, 1885.Nm 1886keeps track of 1887.Dq recent 1888requests, and matches them to the replies using the 1889.Ar xid 1890.Pq transaction ID . 1891If a reply does not closely follow the corresponding request, 1892it might not be parsable. 1893.Ss IP Fragmentation 1894Fragmented Internet datagrams are printed as 1895.Bd -ragged -offset indent 1896.Po 1897.Cm frag Ar id 1898: 1899.Ar size 1900@ 1901.Ar offset 1902.Op + 1903.Pc 1904.Ed 1905.Pp 1906A 1907.Ql + 1908indicates there are more fragments. 1909The last fragment will have no 1910.Ql + . 1911.Pp 1912.Ar id 1913is the fragment ID. 1914.Ar size 1915is the fragment size 1916.Pq in bytes 1917excluding the IP header. 1918.Ar offset 1919is this fragment's offset 1920.Pq in bytes 1921in the original datagram. 1922.Pp 1923The fragment information is output for each fragment. 1924The first fragment contains the higher level protocol header and the fragment 1925info is printed after the protocol info. 1926Fragments after the first contain no higher level protocol header and the 1927fragment info is printed after the source and destination addresses. 1928For example, here is part of an FTP from arizona.edu to lbl-rtsg.arpa 1929over a CSNET connection that doesn't appear to handle 576 byte datagrams: 1930.Bd -unfilled -offset indent 1931arizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+) 1932arizona > rtsg: (frag 595a:204@328) 1933rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560 1934.Ed 1935.Pp 1936There are a couple of things to note here: first, addresses in the 19372nd line don't include port numbers. 1938This is because the TCP protocol information is all in the first fragment 1939and we have no idea what the port or sequence numbers are when we print 1940the later fragments. 1941Second, the TCP sequence information in the first line is printed as if there 1942were 308 bytes of user data when, in fact, there are 512 bytes 1943.Po 1944308 in the first frag and 204 in the second 1945.Pc . 1946If you are looking for holes in the sequence space or trying to match up acks 1947with packets, this can fool you. 1948.Pp 1949A packet with the IP 1950.Sy don't fragment 1951flag is marked with a trailing 1952.Dq Pq DF . 1953.Ss Timestamps 1954By default, all output lines are preceded by a timestamp. 1955The timestamp is the current clock time in the form 1956.Sm off 1957.Ar hh : mm : ss . frac 1958.Sm on 1959and is as accurate as the kernel's clock. 1960The timestamp reflects the time the kernel first saw the packet. 1961No attempt is made to account for the time lag between when the 1962Ethernet interface removed the packet from the wire and when the kernel 1963serviced the 1964.Dq new packet 1965interrupt. 1966.Ss IP and Protocol Checksum Offload 1967Some network cards support IP and/or protocol checksum offload. 1968Packet headers for such interfaces erroneously indicate a bad checksum, 1969since the checksum is not calculated until after 1970.Nm 1971sees the packet. 1972.Sh SEE ALSO 1973.\" traffic(1C), nit(4P), 1974.Xr ether_aton 3 , 1975.Xr pcap_open_live 3 , 1976.Xr bpf 4 , 1977.Xr ip 4 , 1978.Xr pf 4 , 1979.Xr pflog 4 , 1980.Xr tcp 4 , 1981.Xr udp 4 , 1982.Xr hosts 5 , 1983.Xr pcap-filter 5 , 1984.Xr pf.os 5 , 1985.Xr protocols 5 , 1986.Xr services 5 1987.Sh STANDARDS 1988.Rs 1989.%D September 1981 1990.%R RFC 793 1991.%T Transmission Control Protocol 1992.Re 1993.Pp 1994.Rs 1995.%A P. Mockapetris 1996.%D November 1987 1997.%R RFC 1034 1998.%T Domain Names \(en Concepts and Facilities 1999.Re 2000.Pp 2001.Rs 2002.%A P. Mockapetris 2003.%D November 1987 2004.%R RFC 1035 2005.%T Domain Names \(en Implementation and Specification 2006.Re 2007.Pp 2008.Rs 2009.%D April 1988 2010.%R RFC 1050 2011.%T RPC: Remote Procedure Call Protocol Specification 2012.Re 2013.Pp 2014.Rs 2015.%A V. Jacobson 2016.%D February 1990 2017.%R RFC 1144 2018.%T Compressing TCP/IP Headers for Low-Speed Serial Links 2019.Re 2020.Pp 2021.Rs 2022.%A M. Mathis 2023.%A J. Mahdavi 2024.%A S. Floyd 2025.%A A. Romanow 2026.%D October 1996 2027.%R RFC 2018 2028.%T TCP Selective Acknowledgement Options 2029.Re 2030.Pp 2031.Rs 2032.%A V. Manral 2033.%D April 2007 2034.%R RFC 4835 2035.%T Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH) 2036.Re 2037.Sh AUTHORS 2038.An -nosplit 2039.An Van Jacobson Aq Mt van@ee.lbl.gov , 2040.An Craig Leres Aq Mt leres@ee.lbl.gov , 2041and 2042.An Steven McCanne Aq Mt mccanne@ee.lbl.gov , 2043all of the Lawrence Berkeley Laboratory, University of California, Berkeley, CA. 2044.Sh BUGS 2045Some attempt should be made to reassemble IP fragments, 2046or at least to compute the right length for the higher level protocol. 2047.Pp 2048Name server inverse queries are not dumped correctly: The 2049.Pq empty 2050question section is printed rather than the real query in the answer section. 2051Some believe that inverse queries are themselves a bug and 2052prefer to fix the program generating them rather than 2053.Nm tcpdump . 2054.Pp 2055A packet trace that crosses a daylight saving time change will give 2056skewed time stamps 2057.Pq the time change is ignored . 2058.Pp 2059Filter expressions that manipulate FDDI headers assume that all FDDI packets 2060are encapsulated Ethernet packets. 2061This is true for IP, ARP, and DECNET Phase IV, 2062but is not true for protocols such as ISO CLNS. 2063Therefore, the filter may inadvertently accept certain packets that 2064do not properly match the filter expression. 2065