1.\" $OpenBSD: tcpdump.8,v 1.112 2021/09/07 06:48:42 denis Exp $ 2.\" 3.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that: (1) source code distributions 8.\" retain the above copyright notice and this paragraph in its entirety, (2) 9.\" distributions including binary code include the above copyright notice and 10.\" this paragraph in its entirety in the documentation or other materials 11.\" provided with the distribution, and (3) all advertising materials mentioning 12.\" features or use of this software display the following acknowledgement: 13.\" ``This product includes software developed by the University of California, 14.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15.\" the University nor the names of its contributors may be used to endorse 16.\" or promote products derived from this software without specific prior 17.\" written permission. 18.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21.\" 22.Dd $Mdocdate: September 7 2021 $ 23.Dt TCPDUMP 8 24.Os 25.Sh NAME 26.Nm tcpdump 27.Nd dump traffic on a network 28.Sh SYNOPSIS 29.Nm tcpdump 30.Op Fl AadefILlNnOopqStvXx 31.Op Fl B Ar fildrop 32.Op Fl c Ar count 33.Op Fl D Ar direction 34.Op Fl E Oo Ar espalg : Oc Ns Ar espkey 35.Op Fl F Ar file 36.Op Fl i Ar interface 37.Op Fl r Ar file 38.Op Fl s Ar snaplen 39.Op Fl T Ar type 40.Op Fl w Ar file 41.Op Fl y Ar datalinktype 42.Op Ar expression 43.Sh DESCRIPTION 44.Nm 45prints out the headers of packets on a network interface that match the boolean 46.Ar expression . 47You must have read access to 48.Pa /dev/bpf . 49.Pp 50The options are as follows: 51.Bl -tag -width "-c count" 52.It Fl A 53Print each packet in ASCII. 54If the 55.Fl e 56option is also specified, the link-level header will be included. 57The smaller of the entire packet or 58.Ar snaplen 59bytes will be printed. 60.It Fl a 61Attempt to convert network and broadcast addresses to names. 62.It Fl B Ar fildrop 63Configure the drop action specified by 64.Ar fildrop 65to be used when the filter expression matches a packet. 66The actions are: 67.Pp 68.Bl -tag -width "capture" -offset indent -compact 69.It Cm pass 70Matching packets are accepted and captured. 71.It Cm capture 72Matching packets are dropped and captured. 73.It Cm drop 74Matching packets are dropped but not captured. 75.El 76.Pp 77The default action is 78.Cm pass . 79.It Fl c Ar count 80Exit after receiving 81.Ar count 82packets. 83.It Fl D Ar direction 84Select packets flowing in the specified 85.Ar direction . 86Valid directions are: 87.Cm in 88and 89.Cm out . 90The default is to accept packets flowing in any direction. 91.It Fl d 92Dump the compiled packet-matching code in a human readable form to 93standard output and stop. 94.It Fl dd 95Dump packet-matching code as a C program fragment. 96.It Fl ddd 97Dump packet-matching code as decimal numbers 98preceded with a count. 99.It Fl E Oo Ar espalg : Oc Ns Ar espkey 100Try to decrypt RFC 4835 ESP 101.Pq Encapsulating Security Payload 102traffic using the specified hex key 103.Ar espkey . 104Supported algorithms for 105.Ar espalg 106are: 107.Cm aes128 , 108.Cm aes128-hmac96 , 109.Cm blowfish , 110.Cm blowfish-hmac96 , 111.Cm cast , 112.Cm cast-hmac96 , 113.Cm des3 , 114.Cm des3-hmac96 , 115.Cm des 116and 117.Cm des-hmac96 . 118The algorithm defaults to 119.Cm aes128-hmac96 . 120This option should be used for debugging only, since the key will show up in 121.Xr ps 1 122output. 123.It Fl e 124Print the link-level header on each dump line. 125.It Fl F Ar file 126Use 127.Ar file 128as input for the filter expression. 129Any additional expressions given on the command line are ignored. 130.It Fl f 131Print 132.Dq foreign 133internet addresses numerically rather than symbolically. 134This option is intended to get around serious brain damage in 135Sun's yp server \(em usually it hangs forever translating non-local 136internet numbers. 137.It Fl I 138Print the interface on each dump line. 139.It Fl i Ar interface 140Listen on 141.Ar interface . 142If unspecified, 143.Nm 144searches the system interface list for the lowest numbered, configured 145.Dq up 146interface 147.Pq excluding loopback . 148Ties are broken by choosing the earliest match. 149.Ar interface 150may be either a network interface or a USB interface, for example 151.Ar usb0 . 152.It Fl L 153List the supported data link types for the interface and exit. 154.It Fl l 155Make stdout line buffered. 156Useful if you want to see the data while capturing it. 157For example: 158.Pp 159.Dl # tcpdump -l | tee dat 160or 161.Dl # tcpdump -l > dat & tail -f dat 162.It Fl N 163Do not print domain name qualification of host names. 164For example, if you specify this flag then 165.Nm 166will print 167.Dq nic 168instead of 169.Dq nic.ddn.mil . 170.It Fl n 171Do not convert addresses 172.Pq host addresses, port numbers, etc. 173to names. 174.It Fl O 175Do not run the packet-matching code optimizer. 176This is useful only if you suspect a bug in the optimizer. 177.It Fl o 178Print a guess of the possible operating system(s) of hosts that sent 179TCP SYN packets. 180See 181.Xr pf.os 5 182for a description of the passive operating system fingerprints. 183.It Fl p 184Do not put the interface into promiscuous mode. 185The interface might be in promiscuous mode for some other reason; hence, 186.Fl p 187cannot be used as an abbreviation for 188.Dq ether host \&"{local-hw-addr}\&" 189or 190.Dq ether broadcast . 191.It Fl q 192Quick 193.Pq quiet? 194output. 195Print less protocol information so output lines are shorter. 196.It Fl r Ar file 197Read packets from a 198.Ar file 199which was created with the 200.Fl w 201option. 202Standard input is used if 203.Ar file 204is 205.Ql - . 206.It Fl S 207Print absolute, rather than relative, TCP sequence numbers. 208.It Fl s Ar snaplen 209Analyze at most the first 210.Ar snaplen 211bytes of data from each packet rather than the default of 116. 212116 bytes is adequate for IPv6, ICMP, TCP, and UDP, 213but may truncate protocol information from name server and NFS packets 214.Pq see below . 215Packets truncated because of a limited 216.Ar snaplen 217are indicated in the output with 218.Dq Op | Ns Em proto , 219where 220.Em proto 221is the name of the protocol level at which the truncation has occurred. 222Taking larger snapshots both increases the amount of time it takes 223to process packets and, effectively, decreases the amount of packet buffering. 224This may cause packets to be lost. 225You should limit 226.Ar snaplen 227to the smallest number that will capture the protocol information 228you're interested in. 229.It Fl T Ar type 230Force packets selected by 231.Ar expression 232to be interpreted as the specified 233.Ar type . 234Currently known types are: 235.Pp 236.Bl -tag -width "erspan" -offset indent -compact 237.It Cm cnfp 238Cisco NetFlow protocol 239.It Cm erspan 240Cisco Encapsulated Remote Switch Port Analyzer (ERSPAN) over GRE 241.It Cm geneve 242Generic Network Virtualization Encapsulation 243.It Cm gre 244Generic Routing Encapsulation over UDP 245.It Cm mpls 246Multiprocol Label Switching over UDP 247.It Cm rpc 248Remote Procedure Call 249.It Cm rtcp 250Real-Time Applications control protocol 251.It Cm rtp 252Real-Time Applications protocol 253.It Cm sack 254RFC 2018 TCP Selective Acknowledgements Options 255.It Cm tcp 256Transmission Control Protocol 257.It Cm tftp 258Trivial File Transfer Protocol 259.It Cm vat 260Visual Audio Tool 261.It Cm vrrp 262Virtual Router Redundancy protocol 263.It Cm vxlan 264Virtual eXtensible Local Area Network 265.It Cm wb 266distributed White Board 267.It Cm wg 268WireGuard tunnel 269.El 270.It Fl t 271Do not print a timestamp on each dump line. 272.It Fl tt 273Print an unformatted timestamp on each dump line. 274.It Fl ttt 275Print day and month in timestamp. 276.It Fl tttt 277Print timestamp difference between packets. 278.It Fl ttttt 279Print timestamp difference since the first packet. 280.It Fl v 281.Pq Slightly more 282verbose output. 283For example, the time to live 284.Pq TTL 285and type of service 286.Pq ToS 287information in an IP packet are printed. 288.It Fl vv 289Even more verbose output. 290For example, additional fields are printed from NFS reply packets. 291.It Fl w Ar file 292Write the raw packets to 293.Ar file 294rather than parsing and printing them out. 295They can be analyzed later with the 296.Fl r 297option. 298Standard output is used if 299.Ar file 300is 301.Ql - . 302.It Fl X 303Print each packet in hex and ASCII. 304If the 305.Fl e 306option is also specified, the link-level header will be included. 307The smaller of the entire packet or 308.Ar snaplen 309bytes will be printed. 310.It Fl x 311Print each packet in hex. 312If the 313.Fl e 314option is also specified, the link-level header will be included. 315The smaller of the entire packet or 316.Ar snaplen 317bytes will be printed. 318.It Fl y Ar datalinktype 319Set the data link type to use while capturing to 320.Ar datalinktype . 321Commonly used types include 322.Cm EN10MB , 323.Cm IEEE802_11 , 324and 325.Cm IEEE802_11_RADIO . 326The choices applicable to a particular device can be listed using 327.Fl L . 328.El 329.Pp 330.Ar expression 331selects which packets will be dumped. 332If no 333.Ar expression 334is given, all packets on the net will be dumped. 335Otherwise, only packets satisfying 336.Ar expression 337will be dumped. 338.Pp 339The filter expression consists of one or more 340.Em primitives . 341Primitives usually consist of an 342.Ar id 343.Pq name or number 344preceded by one or more qualifiers. 345There are three different kinds of qualifier: 346.Bl -tag -width "proto" 347.It Ar type 348Specify which kind of address component the 349.Ar id 350name or number refers to. 351Possible types are 352.Cm host , 353.Cm net 354and 355.Cm port . 356E.g., 357.Dq host foo , 358.Dq net 128.3 , 359.Dq port 20 . 360If there is no type qualifier, 361.Cm host 362is assumed. 363.It Ar dir 364Specify a particular transfer direction to and/or from 365.Ar id . 366Possible directions are 367.Cm src , 368.Cm dst , 369.Cm src or dst , 370.Cm src and dst , 371.Cm ra , 372.Cm ta , 373.Cm addr1 , 374.Cm addr2 , 375.Cm addr3 , 376and 377.Cm addr4 . 378E.g., 379.Dq src foo , 380.Dq dst net 128.3 , 381.Dq src or dst port ftp-data . 382If there is no 383.Ar dir 384qualifier, 385.Cm src or dst 386is assumed. 387The 388.Cm ra , 389.Cm ta , 390.Cm addr1 , 391.Cm addr2 , 392.Cm addr3 , 393and 394.Cm addr4 395qualifiers are only valid for IEEE 802.11 Wireless LAN link layers. 396For null link layers (i.e., point-to-point protocols such as SLIP 397.Pq Serial Line Internet Protocol 398or the 399.Xr pflog 4 400header), the 401.Cm inbound 402and 403.Cm outbound 404qualifiers can be used to specify a desired direction. 405.It Ar proto 406Restrict the match to a particular protocol. 407Possible protocols are: 408.Cm ah , 409.Cm arp , 410.Cm atalk , 411.Cm decnet , 412.Cm esp , 413.Cm ether , 414.Cm fddi , 415.Cm icmp , 416.Cm icmp6 , 417.Cm igmp , 418.Cm igrp , 419.Cm ip , 420.Cm ip6 , 421.Cm lat , 422.Cm mopdl , 423.Cm moprc , 424.Cm pim , 425.Cm rarp , 426.Cm sca , 427.Cm stp , 428.Cm tcp , 429.Cm udp , 430and 431.Cm wlan . 432E.g., 433.Dq ether src foo , 434.Dq arp net 128.3 , 435.Dq tcp port 21 , 436and 437.Dq wlan addr2 0:2:3:4:5:6 . 438If there is no protocol qualifier, 439all protocols consistent with the type are assumed. 440E.g., 441.Dq src foo 442means 443.Do 444.Pq ip or arp or rarp 445src foo 446.Dc 447.Pq except the latter is not legal syntax ; 448.Dq net bar 449means 450.Do 451.Pq ip or arp or rarp 452net bar 453.Dc ; 454and 455.Dq port 53 456means 457.Do 458.Pq TCP or UDP 459port 53 460.Dc . 461.Pp 462.Cm fddi 463is actually an alias for 464.Cm ether ; 465the parser treats them identically as meaning 466.Qo 467the data link level used on the specified network interface 468.Qc . 469FDDI 470.Pq Fiber Distributed Data Interface 471headers contain Ethernet-like source and destination addresses, 472and often contain Ethernet-like packet types, 473so it's possible to filter these FDDI fields just as with the analogous 474Ethernet fields. 475FDDI headers also contain other fields, 476but they cannot be named explicitly in a filter expression. 477.Pp 478Similarly, 479.Cm tr 480and 481.Cm wlan 482are aliases for 483.Cm ether ; 484the previous paragraph's statements about FDDI headers also apply to Token Ring 485and 802.11 wireless LAN headers. 486For 802.11 headers, the destination address is the DA field 487and the source address is the SA field; 488the BSSID, RA, and TA fields aren't tested. 489.El 490.Pp 491In addition to the above, there are some special primitive 492keywords that don't follow the pattern: 493.Cm gateway , 494.Cm broadcast , 495.Cm less , 496.Cm greater , 497and arithmetic expressions. 498All of these are described below. 499.Pp 500More complex filter expressions are built up by using the words 501.Cm and , 502.Cm or , 503and 504.Cm not 505to combine primitives 506e.g., 507.Do 508host foo and not port ftp and not port ftp-data 509.Dc . 510To save typing, identical qualifier lists can be omitted 511e.g., 512.Dq tcp dst port ftp or ftp-data or domain 513is exactly the same as 514.Do 515tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain 516.Dc . 517.Pp 518Allowable primitives are: 519.Bl -tag -width "ether proto proto" 520.It Cm dst host Ar host 521True if the IPv4/v6 destination field of the packet is 522.Ar host , 523which may be either an address or a name. 524.It Cm src host Ar host 525True if the IPv4/v6 source field of the packet is 526.Ar host . 527.It Cm host Ar host 528True if either the IPv4/v6 source or destination of the packet is 529.Ar host . 530.Pp 531Any of the above 532.Ar host 533expressions can be prepended with the keywords, 534.Cm ip , arp , rarp , 535or 536.Cm ip6 , 537as in: 538.Pp 539.D1 Cm ip host Ar host 540.Pp 541which is equivalent to: 542.Bd -ragged -offset indent 543.Cm ether proto 544.Ar ip 545.Cm and host 546.Ar host 547.Ed 548.Pp 549If 550.Ar host 551is a name with multiple IP addresses, each address will be checked for a match. 552.It Cm ether dst Ar ehost 553True if the Ethernet destination address is 554.Ar ehost . 555.Ar ehost 556may be either a name from 557.Pa /etc/ethers 558or a number (see 559.Xr ether_aton 3 560for a numeric format). 561.It Cm ether src Ar ehost 562True if the Ethernet source address is 563.Ar ehost . 564.It Cm ether host Ar ehost 565True if either the Ethernet source or destination address is 566.Ar ehost . 567.It Cm gateway Ar host 568True if the packet used 569.Ar host 570as a gateway; i.e., the Ethernet source or destination address was 571.Ar host 572but neither the IP source nor the IP destination was 573.Ar host . 574.Ar host 575must be a name and must be found both by the machine's 576host-name-to-IP-address resolution mechanisms (host name file, DNS, NIS, 577etc.) and by the machine's host-name-to-Ethernet-address resolution mechanism 578(such as 579.Pa /etc/ethers ) . 580An equivalent expression is: 581.Bd -ragged -offset indent 582.Cm ether host 583.Ar ehost 584.Cm and not host 585.Ar host 586.Ed 587.Pp 588which can be used with either names or numbers for host/ehost. 589This syntax does not work in an IPv6-enabled configuration at this moment. 590.It Cm dst net Ar net 591True if the IPv4/v6 destination address of the packet has a network 592number of 593.Ar net , 594which may be either a name from the networks database 595(such as 596.Pa /etc/networks ) 597or a network number. 598An IPv4 network number can be written as a dotted quad (e.g. 192.168.1.0), 599dotted triple (e.g. 192.168.1), dotted pair (e.g 172.16), 600or single number (e.g. 10); 601the netmask is 255.255.255.255 for a dotted quad 602(which means that it's really a host match), 603255.255.255.0 for a dotted triple, 255.255.0.0 for a dotted pair, 604or 255.0.0.0 for a single number. 605An IPv6 network number must be written out fully; 606the netmask is ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff, 607so IPv6 "network" matches are really always host matches, 608and a network match requires a netmask length. 609.It Cm src net Ar net 610True if the IPv4/v6 source address of the packet has a network number of 611.Ar net . 612.It Cm net Ar net 613True if either the IPv4/v6 source or destination address of the packet 614has a network number of 615.Ar net . 616.It Cm net Ar net Cm mask Ar netmask 617True if the IPv4 address matches 618.Ar net 619with the specific 620.Ar netmask . 621May be qualified with 622.Cm src 623or 624.Cm dst . 625Note that this syntax is not valid for IPv6 networks. 626.It Cm net Ar net Ns / Ns Ar len 627True if the IPv4/v6 address matches 628.Ar net 629with a netmask 630.Ar len 631bits wide. 632May be qualified with 633.Cm src 634or 635.Cm dst . 636.It Cm dst port Ar port 637True if the packet is IP/TCP, IP/UDP, IP6/TCP or IP6/UDP 638and has a destination port value of 639.Ar port . 640The 641.Ar port 642can be a number or a name used in 643.Pa /etc/services 644(see 645.Xr tcp 4 646and 647.Xr udp 4 ) . 648If a name is used, both the port number and protocol are checked. 649If a number or ambiguous name is used, 650only the port number is checked (e.g.\& 651.Dq dst port 513 652will print both 653TCP/login traffic and UDP/who traffic, and 654.Dq port domain 655will print both TCP/domain and UDP/domain traffic). 656.It Cm src port Ar port 657True if the packet has a source port value of 658.Ar port . 659.It Cm port Ar port 660True if either the source or destination port of the packet is 661.Ar port . 662.Pp 663Any of the above port expressions can be prepended with the keywords 664.Cm tcp 665or 666.Cm udp , 667as in: 668.Pp 669.D1 Cm tcp src port Ar port 670.Pp 671which matches only TCP packets whose source port is 672.Ar port . 673.It Cm less Ar length 674True if the packet has a length less than or equal to 675.Ar length . 676This is equivalent to: 677.Pp 678.D1 Cm len <= Ar length 679.It Cm greater Ar length 680True if the packet has a length greater than or equal to 681.Ar length . 682This is equivalent to: 683.Pp 684.D1 Cm len >= Ar length 685.It Cm sample Ar samplerate 686True if the packet has been randomly selected or sampled at a rate of 1 per 687.Ar samplerate . 688.It Cm ip proto Ar protocol 689True if the packet is an IPv4 packet (see 690.Xr ip 4 ) 691of protocol type 692.Ar protocol . 693.Ar protocol 694can be a number, or one of the names from 695.Xr protocols 5 , 696such as 697.Cm icmp , 698.Cm icmp6 , 699.Cm igmp , 700.Cm igrp , 701.Cm pim , 702.Cm ah , 703.Cm esp , 704.Cm vrrp , 705.Cm udp , 706or 707.Cm tcp . 708Note that the identifiers 709.Cm tcp , 710.Cm udp , 711and 712.Cm icmp 713are also keywords and must be escaped using a backslash character 714.Pq \e . 715Note that this primitive does not chase the protocol header chain. 716.It Cm ip6 proto Ar protocol 717True if the packet is an IPv6 packet of protocol type 718.Ar protocol . 719Note that this primitive does not chase the protocol header chain. 720.It Cm ether broadcast 721True if the packet is an Ethernet broadcast packet. 722The 723.Cm ether 724keyword is optional. 725.It Cm ip broadcast 726True if the packet is an IPv4 broadcast packet. 727It checks for both the all-zeroes and all-ones broadcast conventions, 728and looks up the subnet mask on the interface on which the capture is 729being done. 730.Pp 731If the subnet mask of the interface on which the capture is being done 732is not known, a value of PCAP_NETMASK_UNKNOWN can be supplied; 733tests for IPv4 broadcast addresses will fail to compile, 734but all other tests in the filter program will be OK. 735.It Cm ether multicast 736True if the packet is an Ethernet multicast packet. 737The 738.Cm ether 739keyword is optional. 740This is shorthand for 741.Dq ether[0] & 1 != 0 . 742.It Cm ip multicast 743True if the packet is an IPv4 multicast packet. 744.It Cm ip6 multicast 745True if the packet is an IPv6 multicast packet. 746.It Cm ether proto Ar protocol 747True if the packet is of ether type 748.Ar protocol . 749.Ar protocol 750can be a number, or one of the names 751.Cm ip , 752.Cm ip6 , 753.Cm arp , 754.Cm rarp , 755.Cm atalk , 756.Cm atalkarp , 757.Cm decnet , 758.Cm decdts , 759.Cm decdns , 760.Cm lanbridge , 761.Cm lat , 762.Cm mopdl , 763.Cm moprc , 764.Cm pup , 765.Cm sca , 766.Cm sprite , 767.Cm stp , 768.Cm vexp , 769.Cm vprod , 770or 771.Cm xns . 772These identifiers are also keywords and must be escaped 773using a backslash character 774.Pq Sq \e . 775.Pp 776In the case of FDDI (e.g., 777.Dq fddi protocol arp ) , 778and IEEE 802.11 wireless LANS (such as 779.Dq wlan protocol arp ) , 780for most of those protocols 781the protocol identification comes from the 802.2 Logical Link Control 782.Pq LLC 783header, which is usually layered on top of the FDDI or 802.11 header. 784.Pp 785When filtering for most protocol identifiers on FDDI or 802.11, 786the filter checks only the protocol ID field of an LLC header 787in so-called SNAP format with an Organizational Unit Identifier (OUI) of 7880x000000, for encapsulated Ethernet; it doesn't check whether the packet 789is in SNAP format with an OUI of 0x000000. 790The exceptions are: 791.Bl -tag -width "atalk" 792.It iso 793The filter checks the DSAP (Destination Service Access Point) and 794SSAP (Source Service Access Point) fields of the LLC header. 795.It stp 796The filter checks the DSAP of the LLC header. 797.It atalk 798The filter checks for a SNAP-format packet with an OUI of 0x080007 799and the AppleTalk etype. 800.El 801.Pp 802In the case of Ethernet, the filter checks the Ethernet type field 803for most of those protocols. 804The exceptions are: 805.Bl -tag -width "iso and stp" 806.It iso and stp 807The filter checks for an 802.3 frame and then checks the LLC header as 808it does for FDDI and 802.11. 809.It atalk 810The filter checks both for the AppleTalk etype in an Ethernet frame and 811for a SNAP-format packet as it does for FDDI, Token Ring, and 802.11. 812.El 813.It Cm decnet src Ar host 814True if the DECNET source address is 815.Ar host , 816which may be an address of the form 817.Dq 10.123 , 818or a DECNET host name. 819DECNET host name support is only available on systems that are 820configured to run DECNET. 821.It Cm decnet dst Ar host 822True if the DECNET destination address is 823.Ar host . 824.It Cm decnet host Ar host 825True if either the DECNET source or destination address is 826.Ar host . 827.It Cm ifname Ar interface 828True if the packet was logged as coming from the specified interface 829(applies only to packets logged by 830.Xr pf 4 ) . 831.It Cm on Ar interface 832Synonymous with the 833.Cm ifname 834modifier. 835.It Cm rnr Ar num 836True if the packet was logged as matching the specified PF rule number 837in the main ruleset (applies only to packets logged by 838.Xr pf 4 ) . 839.It Cm rulenum Ar num 840Synonymous with the 841.Cm rnr 842modifier. 843.It Cm reason Ar code 844True if the packet was logged with the specified PF reason code. 845Known codes are: 846.Cm match , 847.Cm bad-offset , 848.Cm fragment , 849.Cm short , 850.Cm normalize , 851.Cm memory , 852.Cm bad-timestamp , 853.Cm congestion , 854.Cm ip-option , 855.Cm proto-cksum , 856.Cm state-mismatch , 857.Cm state-insert , 858.Cm state-limit , 859.Cm src-limit , 860and 861.Cm synproxy 862(applies only to packets logged by 863.Xr pf 4 ) . 864.It Cm rset Ar name 865True if the packet was logged as matching the specified PF ruleset 866name of an anchored ruleset (applies only to packets logged by 867.Xr pf 4 ) . 868.It Cm ruleset Ar name 869Synonymous with the 870.Cm rset 871modifier. 872.It Cm srnr Ar num 873True if the packet was logged as matching the specified PF rule number 874of an anchored ruleset (applies only to packets logged by 875.Xr pf 4 ) . 876.It Cm subrulenum Ar num 877Synonymous with the 878.Cm srnr 879modifier. 880.It Cm action Ar act 881True if PF took the specified action when the packet was logged. 882Known actions are: 883.Cm pass 884and 885.Cm block , 886.Cm nat , 887.Cm rdr , 888.Cm binat , 889.Cm match 890and 891.Cm scrub 892(applies only to packets logged by 893.Xr pf 4 ) . 894.It Cm ip , ip6 , arp , rarp , atalk , decnet , iso , stp 895Abbreviations for 896.Cm ether proto Ar p , 897where 898.Ar p 899is one of the above protocols. 900.It Cm lat , moprc , mopdl 901Abbreviations for 902.Cm ether proto Ar p , 903where 904.Ar p 905is one of the above protocols. 906.Cm tcpdump 907does not currently know how to parse these. 908.It Xo 909.Cm ah , 910.Cm esp , 911.Cm icmp , 912.Cm icmp6 , 913.Cm igmp , 914.Cm igrp , 915.Cm pim , 916.Cm tcp , 917.Cm udp 918.Xc 919Abbreviations for 920.Cm ip proto Ar p 921or 922.Cm ip6 proto Ar p , 923where 924.Ar p 925is one of the above protocols. 926.It Cm wlan addr1 Ar ehost 927True if the first IEEE 802.11 address is 928.Ar ehost . 929.It Cm wlan addr2 Ar ehost 930True if the second IEEE 802.11 address is 931.Ar ehost . 932.It Cm wlan addr3 Ar ehost 933True if the third IEEE 802.11 address is 934.Ar ehost . 935.It Cm wlan addr4 Ar ehost 936True if the fourth IEEE 802.11 address is 937.Ar ehost . 938The fourth address field is only used for 939WDS (Wireless Distribution System) frames. 940.It Cm wlan host Ar ehost 941True if either the first, second, third, or fourth 942IEEE 802.11 address is 943.Ar ehost . 944.It Cm type Ar wlan_type 945True if the IEEE 802.11 frame type matches the specified 946.Ar wlan_type . 947Valid types are: 948.Cm mgt , 949.Cm ctl , 950.Cm data , 951or a numeric value. 952.It Cm type Ar wlan_type Cm subtype Ar wlan_subtype 953True if the IEEE 802.11 frame type matches the specified 954.Ar wlan_type 955and frame subtype matches the specified 956.Ar wlan_subtype . 957.Pp 958If the specified 959.Ar wlan_type 960is 961.Cm mgtv , 962then valid values for 963.Ar wlan_subtype 964are 965.Cm assoc-req , 966.Cm assoc-resp , 967.Cm reassoc-req , 968.Cm reassoc-resp , 969.Cm probe-req , 970.Cm probe-resp , 971.Cm beacon , 972.Cm atim , 973.Cm disassoc , 974.Cm auth , 975and 976.Cm deauth . 977.Pp 978If the specified 979.Ar wlan_type 980is 981.Cm ctl , 982then valid values for 983.Ar wlan_subtype 984are 985.Cm ps-poll , 986.Cm rts , 987.Cm cts , 988.Cm ack , 989.Cm cf-end , 990and 991.Cm cf-end-ack . 992.Pp 993If the specified 994.Ar wlan_type 995is 996.Cm data , 997then valid values for 998.Ar wlan_subtype 999are 1000.Cm data , 1001.Cm data-cf-ack , 1002.Cm data-cf-poll , 1003.Cm data-cf-ack-poll , 1004.Cm null , 1005.Cm cf-ack , 1006.Cm cf-poll , 1007.Cm cf-ack-poll , 1008.Cm qos-data , 1009.Cm qos-data-cf-ack , 1010.Cm qos-data-cf-poll , 1011.Cm qos-data-cf-ack-poll , 1012.Cm qos , 1013.Cm qos-cf-poll , 1014and 1015.Cm qos-cf-ack-poll . 1016.It Cm subtype Ar wlan_subtype 1017True if the IEEE 802.11 frame subtype matches the specified 1018.Ar wlan_subtype 1019and frame has the type to which the specified 1020.Ar wlan_subtype 1021belongs. 1022.It Cm dir Ar dir 1023True if the IEEE 802.11 frame direction matches the specified 1024.Cm dir . 1025Valid directions are: 1026.Cm nods , 1027.Cm tods , 1028.Cm fromds , 1029.Cm dstods , 1030or a numeric value. 1031.It Cm vlan Op Ar vlan_id 1032True if the packet is an IEEE 802.1Q VLAN packet. 1033If 1034.Ar vlan_id 1035is specified, only true if the packet has the specified ID. 1036Note that the first 1037.Cm vlan 1038keyword encountered in 1039.Ar expression 1040changes the decoding offsets for the remainder of 1041.Ar expression 1042on the assumption that the packet is a VLAN packet. 1043This expression may be used more than once, to filter on VLAN hierarchies. 1044Each use of that expression increments the filter offsets by 4. 1045.Pp 1046For example, 1047to filter on VLAN 200 encapsulated within VLAN 100: 1048.Pp 1049.Dl vlan 100 && vlan 200 1050.Pp 1051To filter IPv4 protocols encapsulated in VLAN 300 encapsulated within any 1052higher order VLAN: 1053.Pp 1054.Dl vlan && vlan 300 && ip 1055.It Cm mpls Op Ar label 1056True if the packet is an MPLS (Multi-Protocol Label Switching) packet. 1057If 1058.Ar label 1059is specified, only true if the packet has the specified label. 1060Note that the first 1061.Cm mpls 1062keyword encountered in 1063.Ar expression 1064changes the decoding offsets for the remainder of 1065.Ar expression 1066on the assumption that the packet is an MPLS packet. 1067This expression may be used more than once, to filter on MPLS labels. 1068Each use of that expression increments the filter offsets by 4. 1069.Pp 1070For example, 1071to filter on MPLS label 42 first and requires the next label to be 12: 1072.Pp 1073.Dl mpls 42 && mpls 12 1074.Pp 1075To filter on network 192.0.2.0/24 transported inside packets with label 42: 1076.Pp 1077.Dl mpls 42 && net 192.0.2.0/24 1078.It Ar expr relop expr 1079True if the relation holds, where 1080.Ar relop 1081is one of 1082.Sq > , 1083.Sq < , 1084.Sq >= , 1085.Sq <= , 1086.Sq = , 1087.Sq != , 1088and 1089.Ar expr 1090is an arithmetic expression composed of integer constants 1091(expressed in standard C syntax), the normal binary operators 1092.Pf ( Sq + , 1093.Sq - , 1094.Sq * , 1095.Sq / , 1096.Sq & , 1097.Sq | , 1098.Sq << , 1099.Sq >> ) , 1100a length operator, a random operator, and special packet data accessors. 1101Note that all comparisons are unsigned, so that, for example, 11020x80000000 and 0xffffffff are > 0. 1103To access data inside the packet, use the following syntax: 1104.Pp 1105.D1 Ar proto Ns Op Ar expr : Ns Ar size 1106.Pp 1107.Ar proto 1108is one of 1109.Cm ether , 1110.Cm fddi , 1111.Cm tr , 1112.Cm wlan , 1113.Cm ppp , 1114.Cm slip , 1115.Cm link , 1116.Cm ip , 1117.Cm arp , 1118.Cm rarp , 1119.Cm tcp , 1120.Cm udp , 1121.Cm icmp , 1122.Cm ip6 , 1123or 1124.Cm radio , 1125and indicates the protocol layer for the index operation 1126.Pf ( Cm ether , 1127.Cm fddi , 1128.Cm wlan , 1129.Cm tr , 1130.Cm ppp , 1131.Cm slip , 1132and 1133.Cm link 1134all refer to the link layer; 1135.Cm radio 1136refers to the "radio header" added to some 802.11 captures). 1137Note that 1138.Cm tcp , 1139.Cm udp , 1140and other upper-layer protocol types only apply to IPv4, not IPv6 1141(this will be fixed in the future). 1142The byte offset, relative to the indicated protocol layer, is given by 1143.Ar expr . 1144.Ar size 1145is optional and indicates the number of bytes in the field of interest; 1146it can be either one, two, or four, and defaults to one. 1147The length operator, indicated by the keyword 1148.Cm len , 1149gives the length of the packet. 1150The random operator, indicated by the keyword 1151.Cm random , 1152generates a random number. 1153.Pp 1154For example, 1155.Dq ether[0] & 1 != 0 1156catches all multicast traffic. 1157The expression 1158.Dq ip[0] & 0xf != 5 1159catches all IPv4 packets with options. 1160The expression 1161.Dq ip[6:2] & 0x1fff = 0 1162catches only unfragmented IPv4 datagrams and frag zero of fragmented 1163IPv4 datagrams. 1164This check is implicitly applied to the 1165.Cm tcp 1166and 1167.Cm udp 1168index operations. 1169For instance, 1170.Dq tcp[0] 1171always means the first byte of the TCP header, 1172and never means the first byte of an intervening fragment. 1173.Pp 1174Some offsets and field values may be expressed as names rather than 1175as numeric values. 1176The following protocol header field offsets are available: 1177.Cm icmptype 1178(ICMP type field), 1179.Cm icmpcode 1180(ICMP code field), and 1181.Cm tcpflags 1182(TCP flags field). 1183.Pp 1184The following ICMP type field values are available: 1185.Cm icmp-echoreply , 1186.Cm icmp-unreach , 1187.Cm icmp-sourcequench , 1188.Cm icmp-redirect , 1189.Cm icmp-echo , 1190.Cm icmp-routeradvert , 1191.Cm icmp-routersolicit , 1192.Cm icmp-timxceed , 1193.Cm icmp-paramprob , 1194.Cm icmp-tstamp , 1195.Cm icmp-tstampreply , 1196.Cm icmp-ireq , 1197.Cm icmp-ireqreply , 1198.Cm icmp-maskreq , 1199.Cm and 1200.Cm icmp-maskreply . 1201.Pp 1202The following TCP flags field values are available: 1203.Cm tcp-fin , 1204.Cm tcp-syn , 1205.Cm tcp-rst , 1206.Cm tcp-push , 1207.Cm tcp-ack , 1208.Cm tcp-urg . 1209.El 1210.Pp 1211Primitives may be combined using 1212a parenthesized group of primitives and operators. 1213Parentheses are special to the shell and must be escaped. 1214Allowable primitives and operators are: 1215.Bd -ragged -offset indent 1216Negation 1217.Po 1218.Dq Cm \&! 1219or 1220.Dq Cm not 1221.Pc 1222.Pp 1223Concatenation 1224.Po 1225.Dq Cm && 1226or 1227.Dq Cm and 1228.Pc 1229.Pp 1230Alternation 1231.Po 1232.Dq Cm || 1233or 1234.Dq Cm or 1235.Pc 1236.Ed 1237.Pp 1238Negation has highest precedence. 1239Alternation and concatenation have equal precedence and associate 1240left to right. 1241Explicit 1242.Cm and 1243tokens, not juxtaposition, 1244are now required for concatenation. 1245.Pp 1246If an identifier is given without a keyword, the most recent keyword 1247is assumed. 1248For example, 1249For example, 1250.Bd -ragged -offset indent 1251.Cm not host 1252vs 1253.Cm and 1254ace 1255.Ed 1256.Pp 1257is short for 1258.Bd -ragged -offset indent 1259.Cm not host 1260vs 1261.Cm and host 1262ace 1263.Ed 1264.Pp 1265which should not be confused with 1266.Bd -ragged -offset indent 1267.Cm not 1268.Pq Cm host No vs Cm or No ace 1269.Ed 1270.Sh EXAMPLES 1271To print all packets arriving at or departing from sundown: 1272.Pp 1273.Dl # tcpdump host sundown 1274.Pp 1275To print traffic between helios and either hot or ace 1276(the expression is quoted to prevent the shell from misinterpreting 1277the parentheses): 1278.Pp 1279.Dl # tcpdump 'host helios and (hot or ace)' 1280.Pp 1281To print all IP packets between ace and any host except helios: 1282.Pp 1283.Dl # tcpdump ip host ace and not helios 1284.Pp 1285To print all traffic between local hosts and hosts at Berkeley: 1286.Pp 1287.Dl # tcpdump net ucb-ether 1288.Pp 1289To print all FTP traffic through internet gateway snup: 1290.Pp 1291.Dl # tcpdump 'gateway snup and (port ftp or ftp-data)' 1292.Pp 1293To print traffic neither sourced from nor destined for local network 1294192.168.7.0/24 (if you gateway to one other net, this stuff should 1295never make it onto your local network): 1296.Pp 1297.Dl # tcpdump ip and not net 192.168.7.0/24 1298.Pp 1299To print the start and end packets 1300.Pq the SYN and FIN packets 1301of each TCP connection that involves a host that is not in local 1302network 192.168.7.0/24: 1303.Bd -literal -offset indent 1304# tcpdump 'tcp[13] & 3 != 0 and not src and dst net 192.168.7.0/24' 1305.Ed 1306.Pp 1307To print only the SYN packets of HTTP connections: 1308.Pp 1309.Dl # tcpdump 'tcp[tcpflags] = tcp-syn and port http' 1310.Pp 1311To print IP packets longer than 576 bytes sent through gateway snup: 1312.Pp 1313.Dl # tcpdump 'gateway snup and ip[2:2] > 576' 1314.Pp 1315To print IP broadcast or multicast packets that were 1316.Em not 1317sent via Ethernet broadcast or multicast: 1318.Bd -literal -offset indent 1319# tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224' 1320.Ed 1321.Pp 1322To print all ICMP packets that are not echo requests/replies 1323.Pq i.e., not ping packets : 1324.Pp 1325.Dl # tcpdump 'icmp[0] != 8 and icmp[0] != 0' 1326.Pp 1327To print only echo request ICMP packets: 1328.Pp 1329.Dl # tcpdump 'icmp[icmptype] = icmp-echo' 1330.Pp 1331To print and decrypt all ESP packets with SPI 0x00001234: 1332.Pp 1333.Dl # tcpdump -E des3-hmac96:ab...def 'ip[20:4] = 0x00001234' 1334.Pp 1335To print raw wireless frames passing the iwn0 interface: 1336.Dl # tcpdump -i iwn0 -y IEEE802_11_RADIO -v 1337.Sh OUTPUT FORMAT 1338The output of 1339.Nm 1340is protocol dependent. 1341The following gives a brief description and examples of most of the formats. 1342.Ss Link Level Headers 1343If the 1344.Fl e 1345option is given, the link level header is printed out. 1346On Ethernets, the source and destination addresses, protocol, 1347and packet length are printed. 1348.Pp 1349On the packet filter logging interface 1350.Xr pflog 4 , 1351logging reason 1352.Pq rule match, bad-offset, fragment, bad-timestamp, short, normalize, memory , 1353action taken 1354.Pq pass/block , 1355direction 1356.Pq in/out 1357and interface information are printed out for each packet. 1358.Pp 1359On FDDI networks, the 1360.Fl e 1361option causes 1362.Nm 1363to print the frame control field, the source and destination addresses, 1364and the packet length. 1365The frame control field governs the interpretation of the rest of the packet. 1366Normal packets 1367.Pq such as those containing IP datagrams 1368are 1369.Dq async 1370packets, with a priority value between 0 and 7; for example, 1371.Sy async4 . 1372Such packets are assumed to contain an 802.2 Logical Link Control 1373.Pq LLC 1374packet; the LLC header is printed if it is 1375.Em not 1376an ISO datagram or a so-called SNAP packet. 1377.Pp 1378The following description assumes familiarity with the 1379SLIP compression algorithm described in RFC 1144. 1380.Pp 1381On SLIP links, a direction indicator 1382.Po 1383.Ql I 1384for inbound, 1385.Ql O 1386for outbound 1387.Pc , 1388packet type, and compression information are printed out. 1389The packet type is printed first. 1390The three types are 1391.Cm ip , 1392.Cm utcp , 1393and 1394.Cm ctcp . 1395No further link information is printed for IP packets. 1396For TCP packets, the connection identifier is printed following the type. 1397If the packet is compressed, its encoded header is printed out. 1398The special cases are printed out as 1399.Cm *S+ Ns Ar n 1400and 1401.Cm *SA+ Ns Ar n , 1402where 1403.Ar n 1404is the amount by which the sequence number 1405.Pq or sequence number and ack 1406has changed. 1407If it is not a special case, zero or more changes are printed. 1408A change is indicated by 1409.Sq U 1410.Pq urgent pointer , 1411.Sq W 1412.Pq window , 1413.Sq A 1414.Pq ack , 1415.Sq S 1416.Pq sequence number , 1417and 1418.Sq I 1419.Pq packet ID , 1420followed by a delta 1421.Pq +n or -n , 1422or a new value 1423.Pq =n . 1424Finally, the amount of data in the packet and compressed header length 1425are printed. 1426.Pp 1427For example, the following line shows an outbound compressed TCP packet, 1428with an implicit connection identifier; the ack has changed by 6, 1429the sequence number by 49, and the packet ID by 6; 1430there are 3 bytes of data and 6 bytes of compressed header: 1431.Bd -ragged -offset indent 1432O 1433.Cm ctcp No * 1434.Cm A No +6 1435.Cm S No +49 1436.Cm I No +6 3 1437.Pq 6 1438.Ed 1439.Ss ARP/RARP Packets 1440arp/rarp output shows the type of request and its arguments. 1441The format is intended to be self-explanatory. 1442Here is a short sample taken from the start of an rlogin 1443from host rtsg to host csam: 1444.Bd -literal -offset indent 1445arp who-has csam tell rtsg 1446arp reply csam is-at CSAM 1447.Ed 1448.Pp 1449In this example, Ethernet addresses are in caps and internet addresses 1450in lower case. 1451The first line says that rtsg sent an arp packet asking for 1452the Ethernet address of internet host csam. 1453csam replies with its Ethernet address CSAM. 1454.Pp 1455This would look less redundant if we had done 1456.Nm 1457.Fl n : 1458.Bd -literal -offset indent 1459arp who-has 128.3.254.6 tell 128.3.254.68 1460arp reply 128.3.254.6 is-at 02:07:01:00:01:c4 1461.Ed 1462.Pp 1463If we had done 1464.Nm 1465.Fl e , 1466the fact that the first packet is 1467broadcast and the second is point-to-point would be visible: 1468.Bd -literal -offset indent 1469RTSG Broadcast 0806 64: arp who-has csam tell rtsg 1470CSAM RTSG 0806 64: arp reply csam is-at CSAM 1471.Ed 1472.Pp 1473For the first packet this says the Ethernet source address is RTSG, 1474the destination is the Ethernet broadcast address, 1475the type field contained hex 0806 (type 1476.Dv ETHER_ARP ) 1477and the total length was 64 bytes. 1478.Ss TCP Packets 1479The following description assumes familiarity with the TCP protocol 1480described in RFC 793. 1481If you are not familiar with the protocol, neither this description nor 1482.Nm 1483will be of much use to you. 1484.Pp 1485The general format of a TCP protocol line is: 1486.Bd -ragged -offset indent 1487.Ar src No > Ar dst : 1488.Ar flags src-os data-seqno ack window urgent options 1489.Ed 1490.Pp 1491.Ar src 1492and 1493.Ar dst 1494are the source and destination IP addresses and ports. 1495.Ar flags 1496is some combination of 1497.Sq S 1498.Pq SYN , 1499.Sq F 1500.Pq FIN , 1501.Sq P 1502.Pq PUSH , 1503or 1504.Sq R 1505.Pq RST , 1506.Sq W 1507.Pq congestion Window reduced , 1508.Sq E 1509.Pq ecn ECHO 1510or a single 1511.Ql \&. 1512.Pq no flags . 1513.Ar src-os 1514will list a guess of the source host's operating system if the 1515.Fl o 1516command line flag was passed to 1517.Nm tcpdump . 1518.Ar data-seqno 1519describes the portion of sequence space covered 1520by the data in this packet 1521.Pq see example below . 1522.Ar ack 1523is the sequence number of the next data expected by the other 1524end of this connection. 1525.Ar window 1526is the number of bytes of receive buffer space available 1527at the other end of this connection. 1528.Ar urgent 1529indicates there is urgent data in the packet. 1530.Ar options 1531are TCP options enclosed in angle brackets e.g., 1532<mss 1024>. 1533.Pp 1534.Ar src , dst 1535and 1536.Ar flags 1537are always present. 1538The other fields depend on the contents of the packet's TCP protocol header and 1539are output only if appropriate. 1540.Pp 1541Here is the opening portion of an rlogin from host rtsg to host csam. 1542.Bd -unfilled -offset 2n 1543rtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024> 1544csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024> 1545rtsg.1023 > csam.login: . ack 1 win 4096 1546rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096 1547csam.login > rtsg.1023: . ack 2 win 4096 1548rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096 1549csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077 1550csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1 1551csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1 1552.Ed 1553.Pp 1554The first line says that TCP port 1023 on rtsg sent a packet 1555to port login on host csam. 1556The 1557.Ql S 1558indicates that the SYN flag was set. 1559The packet sequence number was 768512 and it contained no data. 1560The notation is 1561.Sm off 1562.So 1563.Ar first : last 1564.Po Ar nbytes 1565.Pc 1566.Sc 1567.Sm on 1568which means sequence numbers 1569.Ar first 1570up to but not including 1571.Ar last 1572which is 1573.Ar nbytes 1574bytes of user data. 1575There was no piggy-backed ack, the available receive window was 4096 1576bytes and there was a max-segment-size option requesting an mss of 1024 bytes. 1577.Pp 1578Csam replies with a similar packet except it includes a piggy-backed 1579ack for rtsg's SYN. 1580Rtsg then acks csam's SYN. 1581The 1582.Ql \&. 1583means no flags were set. 1584The packet contained no data so there is no data sequence number. 1585The ack sequence number is a 32-bit integer. 1586The first time 1587.Nm 1588sees a TCP connection, it prints the sequence number from the packet. 1589On subsequent packets of the connection, the difference between 1590the current packet's sequence number and this initial sequence number 1591is printed. 1592This means that sequence numbers after the first can be interpreted 1593as relative byte positions in the connection's data stream 1594.Po 1595with the first data byte each direction being 1 1596.Pc . 1597.Fl S 1598will override this 1599feature, causing the original sequence numbers to be output. 1600.Pp 1601On the 6th line, rtsg sends csam 19 bytes of data 1602.Po 1603bytes 2 through 20 1604in the rtsg -> csam side of the connection 1605.Pc . 1606The PUSH flag is set in the packet. 1607On the 7th line, csam says it's received data sent by rtsg up to 1608but not including byte 21. 1609Most of this data is apparently sitting in the socket buffer 1610since csam's receive window has gotten 19 bytes smaller. 1611Csam also sends one byte of data to rtsg in this packet. 1612On the 8th and 9th lines, 1613csam sends two bytes of urgent, pushed data to rtsg. 1614.Ss UDP Packets 1615UDP format is illustrated by this rwho packet: 1616.Pp 1617.D1 actinide.who > broadcast.who: udp 84 1618.Pp 1619This says that port who on host actinide sent a UDP datagram to port 1620who on host broadcast, the Internet broadcast address. 1621The packet contained 84 bytes of user data. 1622.Pp 1623Some UDP services are recognized 1624.Pq from the source or destination port number 1625and the higher level protocol information printed. 1626In particular, Domain Name service requests 1627.Pq RFC 1034/1035 1628and Sun RPC calls 1629.Pq RFC 1050 1630to NFS. 1631.Ss UDP Name Server Requests 1632The following description assumes familiarity with 1633the Domain Service protocol described in RFC 1035. 1634If you are not familiar with the protocol, 1635the following description will appear to be written in Greek. 1636.Pp 1637Name server requests are formatted as 1638.Bd -ragged -offset indent 1639.Ar src 1640> 1641.Ar dst : 1642.Ar id op Ns ?\& 1643.Ar flags qtype qclass name 1644.Pq Ar len 1645.Ed 1646.Pp 1647For example: 1648.Pp 1649.D1 h2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37) 1650.Pp 1651Host h2opolo asked the domain server on helios for an address record 1652.Pq Ar qtype Ns =A 1653associated with the name 1654ucbvax.berkeley.edu. 1655The query 1656.Ar id 1657was 3. 1658The 1659.Ql + 1660indicates the recursion desired flag was set. 1661The query length was 37 bytes, not including the UDP and IP protocol headers. 1662The query operation was the normal one 1663.Pq Query 1664so the 1665.Ar op 1666field was omitted. 1667If 1668.Ar op 1669had been anything else, it would have been printed between the 3 and the 1670.Ql + . 1671Similarly, the 1672.Ar qclass 1673was the normal one 1674.Pq C_IN 1675and was omitted. 1676Any other 1677.Ar qclass 1678would have been printed immediately after the A. 1679.Pp 1680A few anomalies are checked and may result in extra fields enclosed in 1681square brackets: if a query contains an answer, name server or 1682authority section, 1683.Ar ancount , 1684.Ar nscount , 1685or 1686.Ar arcount 1687are printed as 1688.Dq Bq Ar n Ns a , 1689.Dq Bq Ar n Ns n , 1690or 1691.Dq Bq Ar n Ns au 1692where 1693.Ar n 1694is the appropriate count. 1695If any of the response bits are set 1696.Po 1697AA, RA or rcode 1698.Pc 1699or any of the 1700.Dq must be zero 1701bits are set in bytes two and three, 1702.Dq Bq b2&3= Ns Ar x 1703is printed, where 1704.Ar x 1705is the hex value of header bytes two and three. 1706.Ss UDP Name Server Responses 1707Name server responses are formatted as 1708.Bd -ragged -offset indent 1709.Ar src No > Ar dst : 1710.Ar id op rcode flags 1711.Ar a 1712/ 1713.Ar n 1714/ 1715.Ar au 1716.Ar type class data 1717.Pq Ar len 1718.Ed 1719.Pp 1720For example: 1721.Bd -unfilled -offset indent 1722helios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273) 1723helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97) 1724.Ed 1725.Pp 1726In the first example, helios responds to query 1727.Ar id 17283 from h2opolo 1729with 3 answer records, 3 name server records and 7 authority records. 1730The first answer record is type A 1731.Pq address and its data is internet 1732address 128.32.137.3. 1733The total size of the response was 273 bytes, excluding UDP and IP headers. 1734The 1735.Ar op 1736.Pq Query 1737and 1738.Ar rcode 1739.Pq NoError 1740were omitted, as was the 1741.Ar class 1742.Pq C_IN 1743of the A record. 1744.Pp 1745In the second example, helios responds to query 1746.Ar op 17472 with an 1748.Ar rcode 1749of non-existent domain 1750.Pq NXDomain 1751with no answers, 1752one name server and no authority records. 1753The 1754.Ql * 1755indicates that the authoritative answer bit was set. 1756Since there were no answers, no 1757.Ar type , 1758.Ar class 1759or 1760.Ar data 1761were printed. 1762.Pp 1763Other flag characters that might appear are 1764.Sq - 1765(recursion available, RA, 1766.Em not 1767set) 1768and 1769.Sq | 1770.Pq truncated message, TC, set . 1771If the question section doesn't contain exactly one entry, 1772.Dq Bq Ar n Ns q 1773is printed. 1774.Pp 1775Name server requests and responses tend to be large and the default 1776.Ar snaplen 1777of 96 bytes may not capture enough of the packet to print. 1778Use the 1779.Fl s 1780flag to increase the 1781.Ar snaplen 1782if you need to seriously investigate name server traffic. 1783.Dq Fl s No 128 1784has worked well for me. 1785.Ss NFS Requests and Replies 1786Sun NFS 1787.Pq Network File System 1788requests and replies are printed as: 1789.Bd -ragged -offset indent 1790.Ar src . Ns Ar xid 1791> 1792.Ar dst . Ns nfs : 1793.Ar len op args 1794.Pp 1795.Ar src . Ns nfs 1796> 1797.Ar dst . Ns Ar xid : 1798reply 1799.Ar stat len op results 1800.Ed 1801.Bd -unfilled -offset indent 1802sushi.6709 > wrl.nfs: 112 readlink fh 21,24/10.73165 1803wrl.nfs > sushi.6709: reply ok 40 readlink "../var" 1804sushi.201b > wrl.nfs: 1805 144 lookup fh 9,74/4096.6878 "xcolors" 1806wrl.nfs > sushi.201b: 1807 reply ok 128 lookup fh 9,74/4134.3150 1808.Ed 1809.Pp 1810In the first line, host sushi sends a transaction with ID 6709 to wrl. 1811The number following the src host is a transaction ID, 1812.Em not 1813the source port. 1814The request was 112 bytes, excluding the UDP and IP headers. 1815The 1816.Ar op 1817was a readlink 1818.Pq read symbolic link 1819on fh 1820.Pq Dq file handle 182121,24/10.731657119. 1822If one is lucky, as in this case, the file handle can be interpreted 1823as a major,minor device number pair, followed by the inode number and 1824generation number. 1825Wrl replies with a 1826.Ar stat 1827of ok and the contents of the link. 1828.Pp 1829In the third line, sushi asks wrl to look up the name 1830.Dq xcolors 1831in directory file 9,74/4096.6878. 1832The data printed depends on the operation type. 1833The format is intended to be self-explanatory 1834if read in conjunction with an NFS protocol spec. 1835.Pp 1836If the 1837.Fl v 1838.Pq verbose 1839flag is given, additional information is printed. 1840For example: 1841.Bd -unfilled -offset indent 1842sushi.1372a > wrl.nfs: 1843 148 read fh 21,11/12.195 8192 bytes @ 24576 1844wrl.nfs > sushi.1372a: 1845 reply ok 1472 read REG 100664 ids 417/0 sz 29388 1846.Ed 1847.Pp 1848.Fl v 1849also prints the IP header TTL, ID, and fragmentation fields, 1850which have been omitted from this example. 1851In the first line, sushi asks wrl to read 8192 bytes from file 21,11/12.195, 1852at byte offset 24576. 1853Wrl replies with a 1854.Ar stat of 1855ok; 1856the packet shown on the second line is the first fragment of the reply, 1857and hence is only 1472 bytes long. 1858The other bytes will follow in subsequent fragments, 1859but these fragments do not have NFS or even UDP headers and so might not be 1860printed, depending on the filter expression used. 1861Because the 1862.Fl v 1863flag is given, some of the file attributes 1864.Po 1865which are returned in addition to the file data 1866.Pc 1867are printed: the file type 1868.Pq So REG Sc , No for regular file , 1869the file mode 1870.Pq in octal , 1871the UID and GID, and the file size. 1872.Pp 1873If the 1874.Fl v 1875flag is given more than once, even more details are printed. 1876.Pp 1877NFS requests are very large and much of the detail won't be printed unless 1878.Ar snaplen 1879is increased. 1880Try using 1881.Dq Fl s No 192 1882to watch NFS traffic. 1883.Pp 1884NFS reply packets do not explicitly identify the RPC operation. 1885Instead, 1886.Nm 1887keeps track of 1888.Dq recent 1889requests, and matches them to the replies using the 1890.Ar xid 1891.Pq transaction ID . 1892If a reply does not closely follow the corresponding request, 1893it might not be parsable. 1894.Ss IP Fragmentation 1895Fragmented Internet datagrams are printed as 1896.Bd -ragged -offset indent 1897.Po 1898.Cm frag Ar id 1899: 1900.Ar size 1901@ 1902.Ar offset 1903.Op + 1904.Pc 1905.Ed 1906.Pp 1907A 1908.Ql + 1909indicates there are more fragments. 1910The last fragment will have no 1911.Ql + . 1912.Pp 1913.Ar id 1914is the fragment ID. 1915.Ar size 1916is the fragment size 1917.Pq in bytes 1918excluding the IP header. 1919.Ar offset 1920is this fragment's offset 1921.Pq in bytes 1922in the original datagram. 1923.Pp 1924The fragment information is output for each fragment. 1925The first fragment contains the higher level protocol header and the fragment 1926info is printed after the protocol info. 1927Fragments after the first contain no higher level protocol header and the 1928fragment info is printed after the source and destination addresses. 1929For example, here is part of an FTP from arizona.edu to lbl-rtsg.arpa 1930over a CSNET connection that doesn't appear to handle 576 byte datagrams: 1931.Bd -unfilled -offset indent 1932arizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+) 1933arizona > rtsg: (frag 595a:204@328) 1934rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560 1935.Ed 1936.Pp 1937There are a couple of things to note here: first, addresses in the 19382nd line don't include port numbers. 1939This is because the TCP protocol information is all in the first fragment 1940and we have no idea what the port or sequence numbers are when we print 1941the later fragments. 1942Second, the TCP sequence information in the first line is printed as if there 1943were 308 bytes of user data when, in fact, there are 512 bytes 1944.Po 1945308 in the first frag and 204 in the second 1946.Pc . 1947If you are looking for holes in the sequence space or trying to match up acks 1948with packets, this can fool you. 1949.Pp 1950A packet with the IP 1951.Sy don't fragment 1952flag is marked with a trailing 1953.Dq Pq DF . 1954.Ss Timestamps 1955By default, all output lines are preceded by a timestamp. 1956The timestamp is the current clock time in the form 1957.Sm off 1958.Ar hh : mm : ss . frac 1959.Sm on 1960and is as accurate as the kernel's clock. 1961The timestamp reflects the time the kernel first saw the packet. 1962No attempt is made to account for the time lag between when the 1963Ethernet interface removed the packet from the wire and when the kernel 1964serviced the 1965.Dq new packet 1966interrupt. 1967.Ss IP and Protocol Checksum Offload 1968Some network cards support IP and/or protocol checksum offload. 1969Packet headers for such interfaces erroneously indicate a bad checksum, 1970since the checksum is not calculated until after 1971.Nm 1972sees the packet. 1973.Sh SEE ALSO 1974.\" traffic(1C), nit(4P), 1975.Xr ether_aton 3 , 1976.Xr pcap_open_live 3 , 1977.Xr bpf 4 , 1978.Xr ip 4 , 1979.Xr pf 4 , 1980.Xr pflog 4 , 1981.Xr tcp 4 , 1982.Xr udp 4 , 1983.Xr hosts 5 , 1984.Xr pcap-filter 5 , 1985.Xr pf.os 5 , 1986.Xr protocols 5 , 1987.Xr services 5 1988.Sh STANDARDS 1989.Rs 1990.%D September 1981 1991.%R RFC 793 1992.%T Transmission Control Protocol 1993.Re 1994.Pp 1995.Rs 1996.%A P. Mockapetris 1997.%D November 1987 1998.%R RFC 1034 1999.%T Domain Names \(en Concepts and Facilities 2000.Re 2001.Pp 2002.Rs 2003.%A P. Mockapetris 2004.%D November 1987 2005.%R RFC 1035 2006.%T Domain Names \(en Implementation and Specification 2007.Re 2008.Pp 2009.Rs 2010.%D April 1988 2011.%R RFC 1050 2012.%T RPC: Remote Procedure Call Protocol Specification 2013.Re 2014.Pp 2015.Rs 2016.%A V. Jacobson 2017.%D February 1990 2018.%R RFC 1144 2019.%T Compressing TCP/IP Headers for Low-Speed Serial Links 2020.Re 2021.Pp 2022.Rs 2023.%A M. Mathis 2024.%A J. Mahdavi 2025.%A S. Floyd 2026.%A A. Romanow 2027.%D October 1996 2028.%R RFC 2018 2029.%T TCP Selective Acknowledgement Options 2030.Re 2031.Pp 2032.Rs 2033.%A V. Manral 2034.%D April 2007 2035.%R RFC 4835 2036.%T Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH) 2037.Re 2038.Sh AUTHORS 2039.An -nosplit 2040.An Van Jacobson Aq Mt van@ee.lbl.gov , 2041.An Craig Leres Aq Mt leres@ee.lbl.gov , 2042and 2043.An Steven McCanne Aq Mt mccanne@ee.lbl.gov , 2044all of the Lawrence Berkeley Laboratory, University of California, Berkeley, CA. 2045.Sh BUGS 2046Some attempt should be made to reassemble IP fragments, 2047or at least to compute the right length for the higher level protocol. 2048.Pp 2049Name server inverse queries are not dumped correctly: The 2050.Pq empty 2051question section is printed rather than the real query in the answer section. 2052Some believe that inverse queries are themselves a bug and 2053prefer to fix the program generating them rather than 2054.Nm tcpdump . 2055.Pp 2056A packet trace that crosses a daylight saving time change will give 2057skewed time stamps 2058.Pq the time change is ignored . 2059.Pp 2060Filter expressions that manipulate FDDI headers assume that all FDDI packets 2061are encapsulated Ethernet packets. 2062This is true for IP, ARP, and DECNET Phase IV, 2063but is not true for protocols such as ISO CLNS. 2064Therefore, the filter may inadvertently accept certain packets that 2065do not properly match the filter expression. 2066