1.\" $OpenBSD: tcpdump.8,v 1.37 2003/07/17 08:45:37 markus Exp $ 2.\" 3.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that: (1) source code distributions 8.\" retain the above copyright notice and this paragraph in its entirety, (2) 9.\" distributions including binary code include the above copyright notice and 10.\" this paragraph in its entirety in the documentation or other materials 11.\" provided with the distribution, and (3) all advertising materials mentioning 12.\" features or use of this software display the following acknowledgement: 13.\" ``This product includes software developed by the University of California, 14.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 15.\" the University nor the names of its contributors may be used to endorse 16.\" or promote products derived from this software without specific prior 17.\" written permission. 18.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 19.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 20.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 21.\" 22.Dd May 25, 1999 23.Dt TCPDUMP 8 24.Os 25.Sh NAME 26.Nm tcpdump 27.Nd dump traffic on a network 28.Sh SYNOPSIS 29.Nm tcpdump 30.Op Fl adeflnNOpqStvxX 31.Op Fl c Ar count 32.Op Fl F Ar file 33.Op Fl i Ar interface 34.Op Fl r Ar file 35.Op Fl s Ar snaplen 36.Op Fl T Ar type 37.Op Fl w Ar file 38.Op Fl E Oo Ar espalg: Oc Ar espkey 39.Op Ar expression 40.Sh DESCRIPTION 41.Nm 42prints out the headers of packets on a network interface 43that match the boolean 44.Ar expression . 45You must have read access to 46.Pa /dev/bpf\&* . 47.Pp 48The options are as follows: 49.Bl -tag -width Ds 50.It Fl a 51Attempt to convert network and broadcast addresses to names. 52.It Fl c Ar count 53Exit after receiving 54.Ar count 55packets. 56.It Fl d 57Dump the compiled packet-matching code in a human readable form to 58standard output and stop. 59.It Fl dd 60Dump packet-matching code as a 61.Tn C 62program fragment. 63.It Fl ddd 64Dump packet-matching code as decimal numbers 65preceded with a count. 66.It Fl e 67Print the link-level header on each dump line. 68.It Fl f 69Print 70.Dq foreign 71internet addresses numerically rather than symbolically. 72This option is intended to get around serious brain damage in 73Sun's yp server \(em usually it hangs forever translating non-local 74internet numbers. 75.It Fl F Ar file 76Use 77.Ar file 78as input for the filter expression. 79Any additional expressions given on the command line are ignored. 80.It Fl i Ar interface 81Listen on 82.Ar interface . 83If unspecified, 84.Nm 85searches the system interface list for the 86lowest numbered, configured 87.Dq up 88interface (excluding loopback). 89Ties are broken by choosing the earliest match. 90.It Fl l 91Make stdout line buffered. 92Useful if you want to see the data while capturing it. 93E.g., 94.Bd -ragged -offset indent 95.Nm 96.Fl l 97| tee dat 98.Ed 99or 100.br 101.Bd -ragged -offset indent -compact 102.Nm 103.Fl l 104> dat & tail 105.Fl f 106dat 107.Ed 108.It Fl n 109Do not convert addresses (i.e., host addresses, port numbers, etc.) 110to names. 111.It Fl N 112Do not print domain name qualification of host names. 113For example, if you specify this flag then 114.Nm 115will print 116.Dq nic 117instead of 118.Dq nic.ddn.mil . 119.It Fl O 120Do not run the packet-matching code optimizer. 121This is useful only if you suspect a bug in the optimizer. 122.It Fl p 123Do not put the interface into promiscuous mode. 124The interface might be in promiscuous mode for some other reason; hence, 125.Fl p 126cannot be used as an abbreviation for 127.Dq ether host "{local\&-hw\&-addr}" 128or 129.Dq ether broadcast . 130.It Fl q 131Quick (quiet?) output. 132Print less protocol information so output lines are shorter. 133.It Fl r Ar file 134Read packets from a 135.Ar file 136which was created with the 137.Fl w 138option. 139Standard input is used if 140.Ar file 141is 142.Ql - . 143.It Fl s Ar snaplen 144Analyze at most the first 145.Ar snaplen 146bytes of data from each packet rather than the 147default of 68. 14868 bytes is adequate for 149.Tn IP , 150.Tn ICMP , 151.Tn TCP , 152and 153.Tn UDP 154but may truncate protocol information from name server and 155.Tn NFS 156packets (see below). 157Packets truncated because of a limited 158.Ar snaplen 159are indicated in the output with 160.Dq Op \*(Ba Ns Em proto , 161where 162.Em proto 163is the name of the protocol level at which the truncation has occurred. 164Taking larger snapshots both increases 165the amount of time it takes to process packets and, effectively, 166decreases the amount of packet buffering. 167This may cause packets to be lost. 168You should limit 169.Ar snaplen 170to the smallest number that will 171capture the protocol information you're interested in. 172.It Fl T Ar type 173Force packets selected by 174.Ar expression 175to be interpreted as the 176specified 177.Ar type . 178Currently known types are 179.Cm cnfp 180.Pq Cisco NetFlow protocol , 181.Cm rpc 182.Pq Remote Procedure Call , 183.Cm rtp 184.Pq Real\&-Time Applications protocol , 185.Cm rtcp 186.Pq Real\&-Time Applications control protocol , 187.Cm sack 188.Po 189.Tn RFC 2018 190No Selective Acknowledgements 191.Pc , 192.Cm vat 193.Pq Visual Audio Tool , 194and 195.Cm wb 196.Pq distributed White Board . 197.It Xo 198.Fl E Oo Ar espalg: Oc Ar espkey 199.Xc 200Try to decrypt 201.Tn RFC 2406 202.Cm ESP 203traffic using the specified hex key 204.Ar espkey . 205Supported algorithms for 206.Ar espalg 207are: 208.Cm aes128 , 209.Cm aes128-hmac96 , 210.Cm blowfish , 211.Cm blowfish-hmac96 , 212.Cm cast , 213.Cm cast-hmac96 , 214.Cm des3 , 215.Cm des3-hmac96 , 216.Cm des 217and 218.Cm des-hmac96 . 219The algorithm defaults to 220.Cm aes128-hmac96 . 221This option should be used for debugging only, since 222the key will show up in 223.Xr ps 1 224output. 225.It Fl S 226Print absolute, rather than relative, 227.Tn TCP 228sequence numbers. 229.It Fl t 230Do not print a timestamp on each dump line. 231.It Fl tt 232Print an unformatted timestamp on each dump line. 233.It Fl ttt 234Print day and month in timestamp. 235.It Fl v 236(Slightly more) verbose output. 237For example, the time to live 238and type of service information in an 239.Tn IP 240packet are printed. 241.It Fl vv 242Even more verbose output. 243For example, additional fields are printed from 244.Tn NFS 245reply packets. 246.It Fl w Ar file 247Write the raw packets to 248.Ar file 249rather than parsing and printing 250them out. 251They can be analyzed later with the 252.Fl r 253option. 254Standard output is used if 255.Ar file 256is 257.Ql - . 258.It Fl x 259Print each packet (minus its link-level header) 260in hex. 261The smaller of the entire packet or 262.Ar snaplen 263bytes will be printed. 264.It Fl X 265Like 266.Fl x 267but dumps the packet in emacs-hexl like format. 268.It Ar expression 269selects which packets will be dumped. 270If no 271.Ar expression 272is given, all packets on the net will be dumped. 273Otherwise, only packets satisfying 274.Ar expression 275will be dumped. 276.Pp 277The 278.Ar expression 279consists of one or more primitives. 280Primitives usually consist of an 281.Ar id 282(name or number) 283preceded by one or more qualifiers. 284There are three different kinds of qualifiers: 285.Bl -tag -width "proto" 286.It Fa type 287Specify which kind of address component the 288.Ar id 289name or number refers to. 290Possible types are 291.Cm host , 292.Cm net 293and 294.Cm port . 295E.g., 296.Dq host foo , 297.Dq net 128.3 , 298.Dq port 20 . 299If there is no type qualifier, 300.Cm host 301is assumed. 302.It Ar dir 303Specify a particular transfer direction to and/or from 304.Ar id . 305Possible directions are 306.Cm src , 307.Cm dst , 308.Cm src or dst , 309and 310.Cm src and dst . 311E.g., 312.Dq src foo , 313.Dq dst net 128.3 , 314.Dq src or dst port ftp\&-data . 315If there is no 316.Ar dir 317qualifier, 318.Cm src or dst 319is assumed. 320For null link layers (i.e., point-to-point protocols such as 321.Tn SLIP 322or the pflog header) 323the 324.Cm inbound 325and 326.Cm outbound 327qualifiers can be used to specify a desired direction. 328.It Ar proto 329Restrict the match to a particular protocol. 330Possible protocols are: 331.Cm ether , 332.Cm fddi , 333.Cm ip , 334.Cm arp , 335.Cm rarp , 336.Cm decnet , 337.Cm lat , 338.Cm moprc , 339.Cm mopdl , 340.Cm tcp , 341and 342.Cm udp . 343E.g., 344.Dq ether src foo , 345.Dq arp net 128.3 , 346.Dq tcp port 21 . 347If there is 348no protocol qualifier, all protocols consistent with the type are 349assumed. 350E.g., 351.Dq src foo 352means 353.Do 354.Pq ip or arp or rarp 355src foo 356.Dc 357(except the latter is not legal syntax), 358.Dq net bar 359means 360.Do 361.Pq ip or arp or rarp 362net bar 363.Dc 364and 365.Dq port 53 366means 367.Do 368.Pq tcp or udp 369port 53 370.Dc . 371.Pp 372.Cm fddi 373is actually an alias for 374.Cm ether ; 375the parser treats them identically as meaning 376.Qo 377the data link level used on the specified network interface 378.Qc . 379.Tn FDDI 380headers contain Ethernet-like source 381and destination addresses, and often contain Ethernet-like packet 382types, so you can filter on these 383.Tn FDDI 384fields just as with the analogous Ethernet fields. 385.Tn FDDI 386headers also contain other fields, 387but you cannot name them explicitly in a filter expression. 388.El 389.Pp 390In addition to the above, there are some special primitive 391keywords that don't follow the pattern: 392.Cm gateway , 393.Cm broadcast , 394.Cm less , 395.Cm greater , 396and arithmetic expressions. 397All of these are described below. 398.Pp 399More complex filter expressions are built up by using the words 400.Cm and , 401.Cm or , 402and 403.Cm not 404to combine primitives. 405e.g., 406.Do 407host foo and not port ftp and not port ftp-data 408.Dc . 409To save typing, identical qualifier lists can be omitted. 410e.g., 411.Dq tcp dst port ftp or ftp-data or domain 412is exactly the same as 413.Do 414tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain 415.Dc . 416.Pp 417Allowable primitives are: 418.Bl -tag -width "ether proto proto" 419.It Cm dst host Ar host 420True if the 421.Tn IP 422destination field of the packet is 423.Ar host , 424which may be either an address or a name. 425.It Cm src host Ar host 426True if the 427.Tn IP 428source field of the packet is 429.Ar host . 430.It Cm host Ar host 431True if either the 432.Tn IP 433source or destination of the packet is 434.Ar host . 435.Pp 436Any of the above 437.Ar host 438expressions can be prepended with the keywords, 439.Cm ip , 440.Cm arp , 441or 442.Cm rarp 443as in: 444.Pp 445.D1 Cm ip host Ar host 446.Pp 447which is equivalent to: 448.Bd -ragged -offset indent 449.Cm ether proto 450.Ar ip 451.Cm and host 452.Ar host 453.Pp 454.Ed 455If 456.Ar host 457is a name with multiple 458.Tn IP 459addresses, each address will 460be checked for a match. 461.It Cm ether dst Ar ehost 462True if the Ethernet destination address is 463.Ar ehost . 464.Ar ehost 465may be either a name from 466.Pa /etc/ethers 467or a number (see 468.Xr ethers 3 469for a numeric format). 470.It Cm ether src Ar ehost 471True if the Ethernet source address is 472.Ar ehost . 473.It Cm ether host Ar ehost 474True if either the Ethernet source or destination address is 475.Ar ehost . 476.It Cm gateway Ar host 477True if the packet used 478.Ar host 479as a gateway; i.e., the Ethernet source or destination address was 480.Ar host 481but neither the 482.Tn IP 483source nor the 484.Tn IP 485destination was 486.Ar host . 487.Ar host 488must be a name and must be found in both 489.Pa /etc/hosts 490and 491.Pa /etc/ethers . 492An equivalent expression is 493.Bd -ragged -offset indent 494.Cm ether host 495.Ar ehost 496.Cm and not host 497.Ar host 498.Ed 499.Pp 500which can be used with either names or numbers for 501.Ar host Ns \&/ Ns Ar ehost . 502.It Cm dst net Ar net 503True if the 504.Tn IP 505destination address of the packet has a network 506number of 507.Ar net . 508.Ar net 509may be either a name from 510.Pa /etc/networks 511or a network number (see 512.Xr networks 5 513for details). 514.It Cm src net Ar net 515True if the 516.Tn IP 517source address of the packet has a network 518number of 519.Ar net . 520.It Cm net Ar net 521True if either the 522.Tn IP 523source or destination address of the packet has a network 524number of 525.Ar net . 526.It Cm dst port Ar port 527True if the packet is ip/tcp or ip/udp and has a 528destination port value of 529.Ar port . 530The 531.Ar port 532can be a number or a name used in 533.Pa /etc/services 534(see 535.Xr tcp 4 536and 537.Xr udp 4 ) . 538If a name is used, both the port 539number and protocol are checked. 540If a number or ambiguous name is used only the port number is checked; 541e.g., 542.Dq Cm dst port No 513 543will print both 544tcp/login traffic and udp/who traffic, and 545.Dq Cm dst port No domain 546will print 547both tcp/domain and udp/domain traffic. 548.It Cm src port Ar port 549True if the packet has a source port value of 550.Ar port . 551.It Cm port Ar port 552True if either the source or destination port of the packet is 553.Ar port . 554.Pp 555Any of the above port expressions can be prepended with the keywords 556.Cm tcp 557or 558.Cm udp , 559as in: 560.Pp 561.D1 Cm tcp src port Ar port 562.Pp 563which matches only 564.Tn TCP 565packets whose source port is 566.Ar port . 567.It Cm less Ar length 568True if the packet has a length less than or equal to 569.Ar length . 570This is equivalent to: 571.Pp 572.D1 Cm len \*(Le Ar length . 573.Pp 574.It Cm greater Ar length 575True if the packet has a length greater than or equal to 576.Ar length . 577This is equivalent to: 578.Pp 579.D1 Cm len \*(Ge Ar length . 580.Pp 581.It Cm ip proto Ar proto 582True if the packet is an 583.Tn IP 584packet (see 585.Xr ip 4 ) 586of protocol type 587.Ar proto . 588.Ar proto 589can be a number or one of the names 590.Cm icmp , 591.Cm udp , 592.Cm nd , 593or 594.Cm tcp . 595The identifiers 596.Cm tcp , 597.Cm udp , 598and 599.Cm icmp 600are also shell keywords and must be escaped. 601.It Cm ether broadcast 602True if the packet is an Ethernet broadcast packet. 603The 604.Cm ether 605keyword is optional. 606.It Cm ip broadcast 607True if the packet is an 608.Tn IP 609broadcast packet. 610It checks for both 611the all-zeroes and all-ones broadcast conventions and looks up 612the local subnet mask. 613.It Cm ether multicast 614True if the packet is an Ethernet multicast packet. 615The 616.Cm ether 617keyword is optional. 618This is shorthand for 619.Do 620.Cm ether Ns [0] \&& 1 !\&= 0 621.Dc . 622.It Cm ip multicast 623True if the packet is an 624.Tn IP 625multicast packet. 626.It Cm ether proto Ar proto 627True if the packet is of ether type 628.Ar proto . 629.Ar proto 630can be a number or a name like 631.Cm ip , 632.Cm arp , 633or 634.Cm rarp . 635These identifiers are also shell keywords 636and must be escaped. 637In the case of 638.Tn FDDI 639(e.g., 640.Dq Cm fddi protocol arp ) , 641the 642protocol identification comes from the 802.2 Logical Link Control 643.Pq Tn LLC 644header, which is usually layered on top of the 645.Tn FDDI 646header. 647.Nm 648assumes, when filtering on the protocol identifier, 649that all 650.Tn FDDI 651packets include an 652.Tn LLC 653header, and that the 654.Tn LLC 655header 656is in so-called 657.Tn SNAP 658format. 659.It Cm decnet src Ar host 660True if the 661.Tn DECNET 662source address is 663.Ar host , 664which may be an address of the form 665.Dq 10.123 , 666or a 667.Tn DECNET 668host name. 669.Tn DECNET 670host name support is only available on 671systems that are configured to run 672.Tn DECNET . 673.It Cm decnet dst Ar host 674True if the 675.Tn DECNET 676destination address is 677.Ar host . 678.It Cm decnet host Ar host 679True if either the 680.Tn DECNET 681source or destination address is 682.Ar host . 683.It Cm ifname Ar interface 684True if the packet was logged as coming from the specified interface (applies 685only to packets logged by 686.Xr pf 4 ) . 687.It Cm on Ar interface 688Synonymous with the 689.Ar ifname 690modifier. 691.It Cm rnr Ar num 692True if the packet was logged as matching the specified PF rule number 693in the main ruleset (applies only to packets logged by 694.Xr pf 4 ) . 695.It Cm rulenum Ar num 696Synonomous with the 697.Ar rnr 698modifier. 699.It Cm reason Ar code 700True if the packet was logged with the specified PF reason code. 701The known codes are: 702.Ar match , 703.Ar bad-offset , 704.Ar fragment , 705.Ar short , 706.Ar normalize , 707and 708.Ar memory . 709(applies only to packets logged by 710.Xr pf 4 ) . 711.It Cm rset Ar name 712True if the packet was logged as matching the specified PF ruleset 713name of an anchored ruleset (applies only to packets logged by 714.Xr pf 4 ) . 715.It Cm ruleset Ar name 716Synonomous with the 717.Ar rset 718modifier. 719.It Cm srnr Ar num 720True if the packet was logged as matching the specified PF rule number 721of an anchored ruleset (applies only to packets logged by 722.Xr pf 4 ) . 723.It Cm subrulenum Ar num 724Synonomous with the 725.Ar srnr 726modifier. 727.It Cm action Ar act 728True if PF took the specified action when the packet was logged. 729Known actions are: 730.Ar pass , 731and 732.Ar block . 733(applies only to packets logged by 734.Xr pf 4 ) . 735.It Xo Cm ip , 736.Cm arp , 737.Cm rarp , 738.Cm decnet , 739.Cm lat , 740.Cm moprc , 741.Cm mopdl 742.Xc 743Abbreviations for: 744.Pp 745.D1 Cm ether proto Ar p 746.Pp 747where 748.Ar p 749is one of the above protocols. 750.Nm 751does not currently know how to parse 752.Cm lat , 753.Cm moprc , 754or 755.Cm mopdl . 756.It Cm tcp , udp , icmp 757Abbreviations for: 758.Cm ip proto Ar p 759where 760.Ar p 761is one of the above protocols. 762.It Ar expr relop expr 763True if the relation holds, where 764.Ar relop 765is one of 766.Ql > , 767.Ql < , 768.Ql >= , 769.Ql <= , 770.Ql = , 771.Ql != , 772and 773.Ar expr 774is an arithmetic expression composed of integer constants 775(expressed in standard 776.Tn C 777syntax), 778the normal binary operators 779.Pf ( Ns Ql + , 780.Ql - , 781.Ql * , 782.Ql / , 783.Ql & , 784.Ql | ) , 785a length operator, and special packet data accessors. 786To access 787data inside the packet, use the following syntax: 788.Bd -ragged -offset indent 789.Ar proto Op Ar expr No : Ar size 790.Ed 791.Pp 792.Ar proto 793is one of 794.Cm ether , 795.Cm fddi , 796.Cm ip , 797.Cm arp , 798.Cm rarp , 799.Cm tcp , 800.Cm udp , 801or 802.Cm icmp , 803and 804indicates the protocol layer for the index operation. 805The byte offset, relative to the indicated protocol layer, is 806given by 807.Ar expr . 808.Ar size 809is optional and indicates the number of bytes in the 810field of interest; it can be either one, two, or four, and defaults to one. 811The length operator, indicated by the keyword 812.Cm len , 813gives the 814length of the packet. 815.Pp 816For example, 817.Dq Cm ether Ns [0] \&& 1 !\&= 0 818catches all multicast traffic. 819The expression 820.Dq Cm ip Ns [0] \&& 0xf !\&= 5 821catches all 822.Tn IP 823packets with options. 824The expression 825.Dq Cm ip Ns [6:2] \&& 0x1fff \&= 0 826catches only unfragmented datagrams and frag zero of fragmented datagrams. 827This check is implicitly applied to the 828.Cm tcp 829and 830.Cm udp 831index operations. 832For instance, 833.Dq Cm tcp Ns [0] 834always means the first 835byte of the 836.Tn TCP 837header, 838and never means the first byte of an 839intervening fragment. 840.El 841.Pp 842Primitives may be combined using 843a parenthesized group of primitives and operators. 844Parentheses are special to the shell and must be escaped. 845Allowed primitives and operators are: 846.Bd -ragged -offset indent 847Negation 848.Po 849.Dq Cm ! 850or 851.Dq Cm not 852.Pc 853.br 854Concatenation 855.Po 856.Dq Cm \&&\&& 857or 858.Dq Cm and 859.Pc 860.br 861Alternation 862.Po 863.Dq Cm || 864or 865.Dq Cm or 866.Pc 867.Ed 868.Pp 869Negation has highest precedence. 870Alternation and concatenation have equal precedence and associate 871left to right. 872Explicit 873.Cm and 874tokens, not juxtaposition, 875are now required for concatenation. 876.Pp 877If an identifier is given without a keyword, the most recent keyword 878is assumed. 879For example, 880.Bd -ragged -offset indent 881.Cm not host 882vs 883.Cm and 884ace 885.Ed 886.Pp 887is short for 888.Bd -ragged -offset indent 889.Cm not host 890vs 891.Cm and host 892ace 893.Ed 894.Pp 895which should not be confused with 896.Bd -ragged -offset indent 897.Cm not 898.Pq Cm host No vs Cm or No ace 899.Ed 900.Pp 901Expression arguments can be passed to 902.Nm 903as either a single argument 904or as multiple arguments, whichever is more convenient. 905Generally, if the expression contains shell metacharacters, it is 906easier to pass it as a single, quoted argument. 907Multiple arguments are concatenated with spaces before being parsed. 908.Sh EXAMPLES 909To print all packets arriving at or departing from sundown: 910.Bd -ragged -offset indent 911.Nm 912.Cm host No sundown 913.Ed 914.Pp 915To print traffic between helios and either hot or ace: 916.Bd -ragged -offset indent 917.Nm 918.Cm host 919helios 920.Cm and 921.Pq hot Cm or No ace 922.Ed 923.Pp 924To print all 925.Tn IP 926packets between ace and any host except helios: 927.Bd -ragged -offset indent 928.Nm 929.Cm ip host 930ace 931.Cm and not 932helios 933.Ed 934.Pp 935To print all traffic between local hosts and hosts at Berkeley: 936.Bd -ragged -offset indent 937.Nm 938.Cm net 939ucb\(enether 940.Ed 941.Pp 942To print all 943.Tn FTP 944traffic through internet gateway snup: 945.Bd -ragged -offset indent 946.Nm 947\&' 948.Cm gateway 949snup 950.Cm and 951.Pq Cm port No ftp Cm or No ftp\&-data 952\&' 953.Pp 954The expression is quoted to prevent the shell from 955mis\(eninterpreting the parentheses. 956.Ed 957.Pp 958To print traffic neither sourced from nor destined for local hosts 959.Po 960if you gateway to one other net, this stuff should never make it 961onto your local net 962.Pc : 963.Bd -ragged -offset indent 964.Nm 965.Cm ip and not net 966localnet 967.Ed 968.Pp 969To print the start and end packets (the 970.Tn SYN 971and 972.Tn FIN 973packets) 974of each 975.Tn TCP 976connection that involves a non-local host: 977.Bd -ragged -offset indent 978.Nm 979\&' 980.Cm tcp Ns [13] \&& 3 !\&= 0 981.Cm and not src and dst net 982localnet 983\&' 984.Ed 985.Pp 986To print 987.Tn IP 988packets longer than 576 bytes sent through gateway snup: 989.Bd -ragged -offset indent 990.Nm 991\&' 992.Cm gateway snup and ip Ns [2:2] \&> 576 993\&' 994.Ed 995.Pp 996To print 997.Tn IP 998broadcast or multicast packets that were 999.Em not 1000sent via Ethernet broadcast or multicast: 1001.Bd -ragged -offset indent 1002.Nm 1003\&' 1004.Cm ether Ns [0] \&& 1 = 0 1005.Cm and ip Ns [16] \&>\&= 224 1006\&' 1007.Ed 1008.Pp 1009To print all 1010.Tn ICMP 1011packets that are not echo requests/replies (i.e., not ping packets): 1012.Bd -ragged -offset indent 1013.Nm 1014\&' 1015.Cm icmp Ns [0] != 8 1016.Cm and icmp Ns [0] !\&= 0 1017\&' 1018.Ed 1019.Pp 1020To print and decrypt all 1021.Tn ESP 1022packets with 1023.Tn SPI 10240x00001234: 1025.Bd -ragged -offset indent 1026.Nm 1027-E des3-hmac96:ab...def 1028\&' 1029.Cm ip Ns [20:4] = 0x00001234 1030\&' 1031.Ed 1032.El 1033.Sh OUTPUT FORMAT 1034The output of 1035.Nm 1036is protocol dependent. 1037The following gives a brief description and examples of most of the formats. 1038.Pp 1039.Em Link Level Headers 1040.Pp 1041If the 1042.Fl e 1043option is given, the link level header is printed out. 1044On Ethernets, the source and destination addresses, protocol, 1045and packet length are printed. 1046.Pp 1047On the packet filter logging interface 1048.Pa pflog , 1049logging reason (rule match, bad-offset, fragment, short, 1050normalize, memory), action taken (pass/block), direction (in/out) and interface 1051information are printed out for each packet. 1052.Pp 1053On 1054.Tn FDDI 1055networks, the 1056.Fl e 1057option causes 1058.Nm 1059to print the frame control 1060field, the source and destination addresses, 1061and the packet length. 1062The frame control field governs the 1063interpretation of the rest of the packet. 1064Normal packets (such as those containing 1065.Tn IP 1066datagrams) 1067are 1068.Dq async 1069packets, with a priority 1070value between 0 and 7; for example, 1071.Sy async4 . 1072Such packets 1073are assumed to contain an 802.2 Logical Link Control 1074.Pq Tn LLC 1075packet; 1076the 1077.Tn LLC 1078header is printed if it is 1079.Em not 1080an 1081.Tn ISO 1082datagram or a 1083so-called 1084.Tn SNAP 1085packet. 1086.Pp 1087The following description assumes familiarity with 1088the 1089.Tn SLIP 1090compression algorithm described in 1091.Tn RFC 1144 . 1092.Pp 1093On 1094.Tn SLIP 1095links, a direction indicator 1096.Po 1097.Ql I 1098for inbound , 1099.Ql O 1100for outbound 1101.Pc , 1102packet type, and compression information are printed out. 1103The packet type is printed first. 1104The three types are 1105.Cm ip , 1106.Cm utcp , 1107and 1108.Cm ctcp . 1109No further link information is printed for 1110.Cm ip 1111packets. 1112For 1113.Tn TCP 1114packets, the connection identifier is printed following the type. 1115If the packet is compressed, its encoded header is printed out. 1116The special cases are printed out as 1117.Cm \&*S\&+ Ns Ar n 1118and 1119.Cm \&*SA\&+ Ns Ar n , 1120where 1121.Ar n 1122is the amount by which 1123the sequence number (or sequence number and ack) 1124has changed. 1125If it is not a special case, zero or more changes are printed. 1126A change is indicated by 1127.Sq U 1128.Pq urgent pointer , 1129.Sq W 1130.Pq window , 1131.Sq A 1132.Pq ack , 1133.Sq S 1134.Pq sequence number , 1135and 1136.Sq I 1137.Pq packet ID , 1138followed by a delta 1139.Pq \&+n or \&-n , 1140or a new value 1141.Pq \&=n . 1142Finally, the amount of data in the packet and compressed header length 1143are printed. 1144.Pp 1145For example, the following line shows an outbound compressed 1146.Tn TCP 1147packet, 1148with an implicit connection identifier; the ack has changed by 6, 1149the sequence number by 49, and the packet ID 1150by 6; there are 3 bytes of 1151data and 6 bytes of compressed header: 1152.Bd -ragged -offset indent 1153O 1154.Cm ctcp No \&* 1155.Cm A No \&+6 1156.Cm S No \&+49 1157.Cm I No \&+6 3 1158.Pq 6 1159.Ed 1160.Pp 1161.Tn Em ARP\&/ Ns Tn Em RARP Packets 1162.Pp 1163arp/rarp output shows the type of request and its arguments. 1164The format is intended to be self-explanatory. 1165Here is a short sample taken from the start of an 1166rlogin from host rtsg to host csam: 1167.Bd -literal -offset indent 1168arp who\&-has csam tell rtsg 1169arp reply csam is\&-at CSAM 1170.Ed 1171.Pp 1172In this example, Ethernet addresses are in caps and internet 1173addresses in lower case. 1174The first line says that rtsg sent an arp packet asking 1175for the Ethernet address of internet host csam. 1176csam replies with its Ethernet address CSAM. 1177.Pp 1178This would look less redundant if we had done 1179.Nm 1180.Fl n : 1181.Bd -literal -offset indent 1182arp who\&-has 128.3.254.6 tell 128.3.254.68 1183arp reply 128.3.254.6 is-at 02:07:01:00:01:c4 1184.Ed 1185.Pp 1186If we had done 1187.Nm 1188.Fl e , 1189the fact that the first packet is 1190broadcast and the second is point-to-point would be visible: 1191.Bd -literal -offset indent 1192RTSG Broadcast 0806 64: arp who-has csam tell rtsg 1193CSAM RTSG 0806 64: arp reply csam is-at CSAM 1194.Ed 1195.Pp 1196For the first packet this says the Ethernet source address is RTSG, the 1197destination is the Ethernet broadcast address, the type field 1198contained hex 0806 (type 1199.Dv ETHER_ARP ) 1200and the total length was 64 bytes. 1201.Pp 1202.Tn Em TCP Packets 1203.Pp 1204The following description assumes familiarity with 1205the 1206.Tn TCP 1207protocol described in 1208.Tn RFC 793 . 1209If you are not familiar 1210with the protocol, neither this description nor 1211.Nm 1212will be of much use to you. 1213.Pp 1214The general format of a tcp protocol line is: 1215.Bd -ragged -offset indent 1216.Ar src No \&> Ar dst : 1217.Ar flags data\&-seqno ack window urgent options 1218.Ed 1219.Pp 1220.Ar src 1221and 1222.Ar dst 1223are the source and destination 1224.Tn IP 1225addresses and ports. 1226.Ar flags 1227is some combination of 1228.Sq S 1229.Pq Tn SYN , 1230.Sq F 1231.Pq Tn FIN , 1232.Sq P 1233.Pq Tn PUSH , 1234or 1235.Sq R 1236.Pq Tn RST , 1237.Sq W 1238.Pq Tn congestion Window reduced , 1239.Sq E 1240.Pq Tn ecn ECHO 1241or a single 1242.Ql \&. 1243.Pq no flags . 1244.Ar data\&-seqno 1245describes the portion of sequence space covered 1246by the data in this packet (see example below). 1247.Ar ack 1248is the sequence number of the next data expected by the other 1249end of this connection. 1250.Ar window 1251is the number of bytes of receive buffer space available 1252at the other end of this connection. 1253.Ar urg 1254indicates there is urgent data in the packet. 1255.Ar options 1256are tcp options enclosed in angle brackets (e.g., 1257.Aq mss 1024 ) . 1258.Pp 1259.Ar src , Ar dst 1260and 1261.Ar flags 1262are always present. 1263The other fields depend on the contents of the packet's tcp protocol header and 1264are output only if appropriate. 1265.Pp 1266Here is the opening portion of an rlogin from host rtsg to host csam. 1267.Bd -literal -offset indent 1268rtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024> 1269csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024> 1270rtsg.1023 > csam.login: . ack 1 win 4096 1271rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096 1272csam.login > rtsg.1023: . ack 2 win 4096 1273rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096 1274csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077 1275csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1 1276csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1 1277.Ed 1278.Pp 1279The first line says that tcp port 1023 on rtsg sent a packet 1280to port login on host csam. 1281The 1282.Ql S 1283indicates that the 1284.Tn SYN 1285flag was set. 1286The packet sequence number was 768512 and it contained no data. 1287The notation is 1288.Sm off 1289.So 1290.Ar first : Ns Ar last 1291.Ns Po Ns Ar nbytes 1292.Pc 1293.Sc 1294.Sm on 1295which means 1296sequence 1297numbers 1298.Ar first 1299up to but not including 1300.Ar last 1301which is 1302.Ar nbytes 1303bytes of user data. 1304There was no piggy-backed ack, the available receive window was 4096 1305bytes and there was a max-segment-size option requesting an mss of 13061024 bytes. 1307.Pp 1308Csam replies with a similar packet except it includes a piggy-backed 1309ack for rtsg's 1310.Tn SYN . 1311Rtsg then acks csam's 1312.Tn SYN . 1313The 1314.Ql \&. 1315means no flags were set. 1316The packet contained no data so there is no data sequence number. 1317The ack sequence number is a 32-bit integer. 1318The first time 1319.Nm 1320sees a tcp connection, it prints the sequence number from the packet. 1321On subsequent packets of the connection, the difference between 1322the current packet's sequence number and this initial sequence number 1323is printed. 1324This means that sequence numbers after the first can be interpreted 1325as relative byte positions in the connection's data stream 1326.Po 1327with the first data byte each direction being 1 1328.Pc . 1329.Fl S 1330will override this 1331feature, causing the original sequence numbers to be output. 1332.Pp 1333On the 6th line, rtsg sends csam 19 bytes of data 1334.Po 1335bytes 2 through 20 1336in the rtsg -> csam side of the connection 1337.Pc . 1338The 1339.Tn PUSH 1340flag is set in the packet. 1341On the 7th line, csam says it's received data sent by rtsg up to 1342but not including byte 21. 1343Most of this data is apparently sitting in the 1344socket buffer since csam's receive window has gotten 19 bytes smaller. 1345Csam also sends one byte of data to rtsg in this packet. 1346On the 8th and 9th lines, 1347csam sends two bytes of urgent, pushed data to rtsg. 1348.Pp 1349.Tn Em UDP Packets 1350.Pp 1351.Tn UDP 1352format is illustrated by this rwho packet: 1353.Bd -literal -offset indent 1354actinide.who \&> broadcast.who: udp 84 1355.Ed 1356.Pp 1357This says that port who on host actinide sent a udp datagram to port 1358who on host broadcast, the Internet 1359broadcast address. 1360The packet contained 84 bytes of user data. 1361.Pp 1362Some 1363.Tn UDP 1364services are recognized (from the source or destination port number) 1365and the higher level protocol information printed. 1366In particular, Domain Name service requests 1367.Pq Tn RFC 1034/1035 1368and 1369.Tn Sun RPC 1370calls 1371.Pq Tn RFC 1050 1372to 1373.Tn NFS . 1374.Pp 1375.Tn Em UDP Name Server Requests 1376.Pp 1377The following description assumes familiarity with 1378the Domain Service protocol described in 1379.Tn RFC 1035 . 1380If you are not familiar 1381with the protocol, the following description will appear to be written 1382in greek. 1383.Pp 1384Name server requests are formatted as 1385.Bd -ragged -offset indent 1386.Ar src 1387> 1388.Ar dst : 1389.Ar id op Ns ? 1390.Ar flags qtype qclass name 1391.Pq Ar len 1392.Pp 1393e.g., 1394.Pp 1395h2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37) 1396.Ed 1397.Pp 1398Host h2opolo asked the domain server on helios for an address record 1399.Pq Ar qtype Ns \&=A 1400associated with the name 1401ucbvax.berkeley.edu. 1402The query 1403.Ar id 1404was 3. 1405The 1406.Ql + 1407indicates the recursion desired flag was set. 1408The query length was 37 bytes, not including the 1409.Tn UDP 1410and 1411.Tn IP 1412protocol headers. 1413The query operation was the normal one 1414.Pq Query 1415so the 1416.Ar op 1417field was omitted. 1418If 1419.Ar op 1420had been anything else, it would 1421have been printed between the 14223 and the 1423.Ql + . 1424Similarly, the 1425.Ar qclass 1426was the normal one 1427.Pq Tn C_IN 1428and was omitted. 1429Any other 1430.Ar qclass 1431would have been printed immediately after the A. 1432.Pp 1433A few anomalies are checked and may result in extra fields enclosed in 1434square brackets: if a query contains an answer, name server or 1435authority section, 1436.Ar ancount , 1437.Ar nscount , 1438or 1439.Ar arcount 1440are printed as 1441.Dq Bq Ar n Ns a , 1442.Dq Bq Ar n Ns n , 1443or 1444.Dq Bq Ar n Ns au 1445where 1446.Ar n 1447is the appropriate count. 1448If any of the response bits are set 1449.Po 1450.Tn AA , RA 1451or rcode 1452.Pc 1453or any of the 1454.Dq must be zero 1455bits are set in bytes two and three, 1456.Dq Bq b2\&&3\&= Ns Ar x 1457is printed, where 1458.Ar x 1459is the hex value of header bytes two and three. 1460.Pp 1461.Tn Em UDP Name Server Responses 1462.Pp 1463Name server responses are formatted as 1464.Bd -ragged -offset indent 1465.Ar src No > Ar dst : 1466.Ar id op rcode flags 1467.Ar a 1468/ 1469.Ar n 1470/ 1471.Ar au 1472.Ar type class data 1473.Pq Ar len 1474.Pp 1475e.g., 1476.Pp 1477helios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273) 1478.br 1479helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97) 1480.Ed 1481.Pp 1482In the first example, helios responds to query 1483.Ar id 14843 from h2opolo 1485with 3 answer records, 3 name server records and 7 authority records. 1486The first answer record is type A 1487.Pq address and its data is internet 1488address 128.32.137.3. 1489The total size of the response was 273 bytes, excluding 1490.Tn UDP 1491and 1492.Tn IP 1493headers. 1494The 1495.Ar op 1496.Pq Query 1497and 1498.Ar rcode 1499.Pq NoError 1500were omitted, as was the 1501.Ar class 1502.Pq Tn C_IN 1503of the A record. 1504.Pp 1505In the second example, 1506helios responds to query 1507.Ar op 15082 with a 1509.Ar rcode 1510of non-existent domain 1511.Pq NXDomain 1512with no answers, 1513one name server and no authority records. 1514The 1515.Ql * 1516indicates that the authoritative answer bit was set. 1517Since there were no answers, no 1518.Ar type , 1519.Ar class 1520or 1521.Ar data 1522were printed. 1523.Pp 1524Other flag characters that might appear are 1525.Ql - 1526(recursion available, 1527.Tn RA , 1528.Em not 1529set) 1530and 1531.Dq \*(Ba 1532(truncated message, 1533.Tn TC , 1534set). 1535If the question section doesn't contain exactly one entry, 1536.Dq Bq Ar n Ns q 1537is printed. 1538.Pp 1539Name server requests and responses tend to be large and the 1540default 1541.Ar snaplen 1542of 68 bytes may not capture enough of the packet 1543to print. 1544Use the 1545.Fl s 1546flag to increase the 1547.Ar snaplen 1548if you 1549need to seriously investigate name server traffic. 1550.Dq Fl s No 128 1551has worked well for me. 1552.Pp 1553.Tn Em NFS Requests and Replies 1554.Pp 1555.Tn Sun NFS 1556.Pq Network File System 1557requests and replies are printed as: 1558.Bd -ragged -offset indent 1559.Ar src Ns . Ns Ar xid 1560> 1561.Ar dst Ns . Ns Ar nfs : 1562.Ns Ar len 1563.Ns Ar op args 1564.br 1565.Ar src Ns . Ns Ar nfs 1566> 1567.Ar dst Ns . Ns Ar xid : 1568.Ns Ar reply stat len op results 1569.Ed 1570.Bd -literal -offset indent 1571sushi.6709 > wrl.nfs: 112 readlink fh 21,24/10.73165 1572wrl.nfs > sushi.6709: reply ok 40 readlink "../var" 1573sushi.201b > wrl.nfs: 1574 144 lookup fh 9,74/4096.6878 "xcolors" 1575wrl.nfs > sushi.201b: 1576 reply ok 128 lookup fh 9,74/4134.3150 1577.Ed 1578.Pp 1579In the first line, host sushi sends a transaction with ID 15806709 to wrl. 1581The number following the src host is a transaction ID, 1582.Em not 1583the source port. 1584The request was 112 bytes, excluding the 1585.Tn UDP 1586and 1587.Tn IP 1588headers. 1589The 1590.Ar op 1591was a readlink (read symbolic link) 1592on fh 1593.Pq Dq file handle 159421,24/10.731657119. 1595If one is lucky, as in this case, the file handle can be interpreted 1596as a major,minor device number pair, followed by the inode number and 1597generation number. 1598Wrl replies with a 1599.Ar stat 1600of ok and the contents of the link. 1601.Pp 1602In the third line, sushi asks wrl to lookup the name 1603.Dq xcolors 1604in directory file 9,74/4096.6878. 1605The data printed depends on the operation type. 1606The format is intended to be self-explanatory 1607if read in conjunction with an 1608.Tn NFS 1609protocol spec. 1610.Pp 1611If the 1612.Fl v 1613.Pq verbose 1614flag is given, additional information is printed. 1615For example: 1616.Bd -literal -offset indent 1617sushi.1372a > wrl.nfs: 1618 148 read fh 21,11/12.195 8192 bytes @ 24576 1619wrl.nfs > sushi.1372a: 1620 reply ok 1472 read REG 100664 ids 417/0 sz 29388 1621.Ed 1622.Pp 1623.Fl v 1624also prints the 1625.Tn IP No header Tn TTL , ID , 1626and fragmentation fields, which have been omitted from this example. 1627In the first line, sushi asks wrl 1628to read 8192 bytes from file 21,11/12.195, 1629at byte offset 24576. 1630Wrl replies with a 1631.Ar stat of 1632ok; 1633the packet shown on the 1634second line is the first fragment of the reply, and hence is only 1472 1635bytes long. 1636The other bytes will follow in subsequent fragments, but 1637these fragments do not have 1638.Tn NFS 1639or even 1640.Tn UDP 1641headers and so might not be 1642printed, depending on the filter expression used. 1643Because the 1644.Fl v 1645flag is given, some of the file attributes 1646.Po 1647which are returned in addition to the file data 1648.Pc 1649are printed: the file type 1650.Pq So REG Sc , No for regular file , 1651the file mode 1652.Pq in octal , 1653the UID and GID, and the file size. 1654.Pp 1655If the 1656.Fl v 1657flag is given more than once, even more details are printed. 1658.Pp 1659.Tn NFS 1660requests are very large and much of the detail won't be printed 1661unless 1662.Ar snaplen 1663is increased. 1664Try using 1665.Dq Fl s No 192 1666to watch 1667.Tn NFS 1668traffic. 1669.Pp 1670.Tn NFS 1671reply packets do not explicitly identify the 1672.Tn RPC 1673operation. 1674Instead, 1675.Nm 1676keeps track of 1677.Dq recent 1678requests, and matches them to the 1679replies using the 1680.Ar xid 1681.Pq transaction ID . 1682If a reply does not closely follow the 1683corresponding request, it might not be parsable. 1684.Pp 1685.Tn Em KIP AppleTalk 1686.Pq Tn DDP No in Tn UDP 1687.Pp 1688AppleTalk 1689.Tn DDP 1690packets encapsulated in 1691.Tn UDP 1692datagrams are de-encapsulated and dumped as 1693.Tn DDP 1694packets 1695.Po 1696i.e., all the 1697.Tn UDP 1698header information is discarded 1699.Pc . 1700The file 1701.Pa /etc/atalk.names 1702is used to translate AppleTalk net and node numbers to names. 1703Lines in this file have the form 1704.Bd -unfilled -offset indent 1705.Ar number name 1706 17071.254 ether 170816.1 icsd-net 17091.254.110 ace 1710.Ed 1711.Pp 1712The first two lines give the names of AppleTalk networks. 1713The third line gives the name of a particular host 1714(a host is distinguished from a net by the 3rd octet in the number; 1715a net number 1716.Em must 1717have two octets and a host number 1718.Em must 1719have three octets). 1720The number and name should be separated by whitespace (blanks or tabs). 1721The 1722.Pa /etc/atalk.names 1723file may contain blank lines or comment lines 1724(lines starting with a 1725.Ql # ) . 1726.Pp 1727AppleTalk addresses are printed in the form 1728.Bd -ragged -offset indent 1729.Ar net Ns . Ns Ar host Ns . 1730.Ns Ar port 1731.Pp 1732e.g., 1733.Pp 1734144.1.209.2 > icsd-net.112.220 1735.br 1736office.2 > icsd-net.112.220 1737.br 1738jssmag.149.235 > icsd-net.2 1739.Ed 1740.Pp 1741If 1742.Pa /etc/atalk.names 1743doesn't exist or doesn't contain an entry for some AppleTalk 1744host/net number, addresses are printed in numeric form. 1745In the first example, 1746.Tn NBP 1747.Pq Tn DDP No port 2 1748on net 144.1 node 209 1749is sending to whatever is listening on port 220 of net icsd-net node 112. 1750The second line is the same except the full name of the source node 1751is known 1752.Pq Dq office . 1753The third line is a send from port 235 on 1754net jssmag node 149 to broadcast on the icsd-net 1755.Tn NBP 1756port. 1757The broadcast address (255) is indicated by a net name with no host 1758number; for this reason it is a good idea to keep node names and 1759net names distinct in 1760.Pa /etc/atalk.names . 1761.Pp 1762.Tn NBP 1763.Pq name binding protocol 1764and 1765.Tn ATP 1766.Pq AppleTalk transaction protocol 1767packets have their contents interpreted. 1768Other protocols just dump the protocol name 1769.Po 1770or number if no name is registered for the 1771protocol 1772.Pc 1773and packet size. 1774.Pp 1775.Tn NBP 1776packets are formatted like the following examples: 1777.Bd -literal 1778icsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*" 1779jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250 1780techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186 1781.Ed 1782.Pp 1783The first line is a name lookup request for laserwriters sent by net 1784icsdi-net host 1785112 and broadcast on net jssmag. 1786The nbp ID for the lookup is 190. 1787The second line shows a reply for this request 1788.Pq note that it has the same id 1789from host jssmag.209 saying that it has a laserwriter 1790resource named RM1140 registered on port 250. 1791The third line is 1792another reply to the same request saying host techpit has laserwriter 1793techpit registered on port 186. 1794.Pp 1795.Tn ATP 1796packet formatting is demonstrated by the following example: 1797.Bd -literal -offset indent 1798jssmag.209.165 > helios.132: atp-req 12266<0-7> 0xae030001 1799helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000 1800helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000 1801helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000 1802helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000 1803helios.132 > jssmag.209.165: atp-resp 12266:4 (512) 0xae040000 1804helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000 1805helios.132 > jssmag.209.165: atp-resp 12266:6 (512) 0xae040000 1806helios.132 > jssmag.209.165: atp-resp*12266:7 (512) 0xae040000 1807jssmag.209.165 > helios.132: atp-req 12266<3,5> 0xae030001 1808helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000 1809helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000 1810jssmag.209.165 > helios.132: atp-rel 12266<0-7> 0xae030001 1811jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002 1812.Ed 1813.Pp 1814Jssmag.209 initiates transaction id 12266 with host helios by requesting 1815up to 8 packets 1816.Sm off 1817.Pq the Dq Aq 0 \&- 7 . 1818.Sm on 1819The hex number at the end of the line is the value of the 1820.Ar userdata 1821field in the request. 1822.Pp 1823Helios responds with 8 512\(enbyte packets. 1824The 1825.Dq : Ns Ar n 1826following the 1827transaction id gives the packet sequence number in the transaction 1828and the number in parentheses is the amount of data in the packet, 1829excluding the atp header. 1830The 1831.Ql * 1832on packet 7 indicates that the 1833.Tn EOM 1834bit was set. 1835.Pp 1836Jssmag.209 then requests that packets 3 & 5 be retransmitted. 1837Helios resends them then jssmag.209 releases the transaction. 1838Finally, jssmag.209 initiates the next request. 1839The 1840.Ql * 1841on the request indicates that XO 1842.Pq exactly once 1843was 1844.Em not 1845set. 1846.Pp 1847.Tn Em IP Fragmentation 1848.Pp 1849Fragmented Internet datagrams are printed as 1850.Bd -ragged -offset indent 1851.Po 1852.Cm frag Ar id 1853: 1854.Ar size 1855@ 1856.Ar offset 1857.Op \&+ 1858.Pc 1859.Ed 1860.Pp 1861A 1862.Ql + 1863indicates there are more fragments. 1864The last fragment will have no 1865.Ql + . 1866.Pp 1867.Ar id 1868is the fragment ID. 1869.Ar size 1870is the fragment size 1871.Pq in bytes 1872excluding the 1873.Tn IP 1874header. 1875.Ar offset 1876is this fragment's offset 1877.Pq in bytes 1878in the original datagram. 1879.Pp 1880The fragment information is output for each fragment. 1881The first fragment contains the higher level protocol header and the fragment 1882info is printed after the protocol info. 1883Fragments after the first contain no higher level protocol header and the 1884fragment info is printed after the source and destination addresses. 1885For example, here is part of an ftp from arizona.edu to lbl\(enrtsg.arpa 1886over a 1887.Tn CSNET 1888connection that doesn't appear to handle 576 byte datagrams: 1889.Bd -literal -offset indent 1890arizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+) 1891arizona > rtsg: (frag 595a:204@328) 1892rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560 1893.Ed 1894.Pp 1895There are a couple of things to note here: first, addresses in the 18962nd line don't include port numbers. 1897This is because the 1898.Tn TCP 1899protocol information is all in the first fragment and we have no idea 1900what the port or sequence numbers are when we print the later fragments. 1901Second, the tcp sequence information in the first line is printed as if there 1902were 308 bytes of user data when, in fact, there are 512 bytes 1903.Po 1904308 in the first frag and 204 in the second 1905.Pc . 1906If you are looking for holes 1907in the sequence space or trying to match up acks 1908with packets, this can fool you. 1909.Pp 1910A packet with the 1911.Tn IP 1912.Sy don\&'t fragment 1913flag is marked with a 1914trailing 1915.Dq Pq Tn DF . 1916.Pp 1917.Em Timestamps 1918.Pp 1919By default, all output lines are preceded by a timestamp. 1920The timestamp is the current clock time in the form 1921.Sm off 1922.Ar hh : mm : ss . frac 1923.Sm on 1924and is as accurate as the kernel's clock. 1925The timestamp reflects the time the kernel first saw the packet. 1926No attempt is made to account for the time lag between when the 1927Ethernet interface removed the packet from the wire and when the kernel 1928serviced the 1929.Dq new packet 1930interrupt. 1931.Sh SEE ALSO 1932.\" traffic(1C), nit(4P), 1933.Xr pcap 3 , 1934.Xr bpf 4 1935.Sh AUTHORS 1936Van Jacobson 1937.Pq van@ee.lbl.gov , 1938Craig Leres 1939.Pq leres@ee.lbl.gov 1940and Steven McCanne 1941.Pq mccanne@ee.lbl.gov , 1942all of the 1943Lawrence Berkeley Laboratory, University of California, Berkeley, CA. 1944.Sh BUGS 1945Please send bug reports to tcpdump@ee.lbl.gov or libpcap@ee.lbl.gov. 1946.Pp 1947Some attempt should be made to reassemble 1948.Tn IP 1949fragments or, at least 1950to compute the right length for the higher level protocol. 1951.Pp 1952Name server inverse queries are not dumped correctly: The 1953.Pq empty 1954question section is printed rather than the real query in the answer 1955section. 1956Some believe that inverse queries are themselves a bug and 1957prefer to fix the program generating them rather than 1958.Nm tcpdump . 1959.Pp 1960Apple Ethertalk 1961.Tn DDP 1962packets could be dumped as easily as 1963.Tn KIP DDP 1964packets but aren't. 1965Even if we were inclined to do anything to promote the use of 1966Ethertalk (we aren't, 1967.Tn LBL 1968doesn't allow Ethertalk on any of its 1969networks so we'd would have no way of testing this code). 1970.Pp 1971A packet trace that crosses a daylight saving time change will give 1972skewed time stamps (the time change is ignored). 1973.Pp 1974Filter expressions that manipulate 1975.Tn FDDI 1976headers assume that all 1977.Tn FDDI 1978packets are encapsulated Ethernet packets. 1979This is true for 1980.Tn IP , 1981.Tn ARP , 1982and 1983.Tn DECNET 1984Phase IV, 1985but is not true for protocols such as 1986.Tn ISO CLNS . 1987Therefore, the filter may inadvertently accept certain packets that 1988do not properly match the filter expression. 1989