📄 readme
字号:
ipgrab Mike Borellamike@borella.netNOPSAM------------------------------------------------------------------------------COPYRIGHTCopyright (C) 1997-99 Mike BorellaRedistribution and use in source and binary forms are permittedprovided that this paragraph is duplicated in all such forms and inany documentation, advertising materials, and other materials relatedto such distribution and use acknowledge that the software wasdeveloped by Mike Borella. The name of the Author may not be used toendorse or promote products derived from this software withoutspecific prior written permission.THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIEDWARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OFMERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.Some of this code has been taken from tcpdump, which was developed bythe Network Research Group at Lawrence Berkeley National Lab, and iscopyrighted by the University of California Regents.------------------------------------------------------------------------------DESCRIPTIONThis program reads and parses packets from the link layer through thetransport layer, dumping explicit header information along the way.It is a lot like tcpdump from LBL except that I've made an effort todump every relevant header field possible. The overall structure ofthe code is loosely based on tcpdump and I've lifted a few modulesfrom the tcpdump distribution when necessary, rather than re-inventingthe wheel. In particular, the address conversion hashing routines arepretty much lifted verbatim, as well as the TCP options section.I expect that this code can be used for detailed packet leveldebugging of existing or new protocols. Also, I imagine that it couldbe a useful teaching and instruction tool for TCP/IP or securitycourses. I've made an effort to make the code readable, sometimeseven at the expense of efficiency, so that one can use it to learnabout the pcap library calls and the header field data structures.Would you like to see new features and protocols supported? Do youhave a proprietary protocol that you'd like to test? Two ways to makeit happen: (1) write a module yourself - if you send me a copy I'llmerge it into my source and acknowledge you as author, (2) ask me towrite it - send me email for details.-------------------------------------------------------------------------------INSTALLATIONYou must have the pcap library (libpcap) version 0.3 or greaterinstalled. In particular, the pcap.h and net/bpf.h files must be inan appropriate include directory (just grabbing a pre-compiledlibpcap.so won't cut it). Download pcap fromhttp://www-nrg.ee.lbl.gov.Run the configure script to create a Makefile, then type 'make'. Ifyou need to install any other libraries or headers, configure shouldtell you.It should compile cleanly on Linux 2.0.x and 2.2.x, FreeBSD 3.2, and Solaris 2.7. Unfortunately the Solaris port will crash on IPX RIP packets. I hope to fix this soon.-------------------------------------------------------------------------------OPERATIONSee man page for details.-------------------------------------------------------------------------------THANKSMarty Roesch fixed some of the timestamping, and provided the code forpayload output. Jorgen Pehrson provided the buffered output option.Stuart Stock added a lot of fixes to ISAKMP. Cullen Jennings contributedthe MGCP parser.Lots of other people suggested things that eventually made their wayinto the code, in one form or another.-------------------------------------------------------------------------------PROTOCOLS KNOWNFully Supported: - IP - TCP - UDP - ARP - Ethernet - SLIP - Raw IP - Loopback - ESP - AH - IPXPartially Supported or Untested: - IPX/RIP - SPX - DNS - DHCP - L2TP - RIP - SIP - SDP - ISAKMP - RSIP - MGCPCurrently Broken: - RTP-------------------------------------------------------------------------------TO DO- Config file for protocols that use varying ports (RTP, etc.)- IPv6 and IGMP support.- SNMP, PPP, NTP, and NetBios support.- PPTP
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -