tcpdump.man

This directory contains source code for tcpdump, a tool for network monitoring and data acquisition

TCPDUMP(1)                                             TCPDUMP(1)


NAME
       tcpdump - dump traffic on a network

SYNOPSIS
       tcpdump [ -aCdeflnNOpqStvx ] [ -c count ] [ -F file ]
               [ -i interface ] [ -r file ] [ -s snaplen ]
               [ -T type ] [ -w file ] [ expression ]

DESCRIPTION
       Tcpdump  prints  out  the  headers of packets on a network
       interface that match the boolean expression.

       Under SunOS with nit or bpf: To run tcpdump you must  have
       read  access to /dev/nit or /dev/bpf*.  Under Solaris with
       dlpi: You must have read  access  to  the  network  pseudo
       device, e.g.  /dev/le.  Under HP-UX with dlpi: You must be
       root or it must be installed setuid to root.   Under  IRIX
       with  snoop:  You  must  be  root  or it must be installed
       setuid to root.  Under Linux: You must be root or it  must
       be  installed  setuid  to  root.  Under Ultrix and Digital
       UNIX: Once the  super-user  has  enabled  promiscuous-mode
       operation  using  pfconfig(8),  any  user may run tcpdump.
       Under BSD: You must have read access to /dev/bpf*.

OPTIONS
       -a     Attempt to convert network and broadcast  addresses
              to names.

       -c     Exit after receiving count packets.

       -C     Print to screen using direct screen writes. This
              is usually alot faster that suing 'stdout' and DOS,
              but output cannot be redirected to file. tcpdump
              also muust have been compiled with this feature.

       -d     Dump  the  compiled packet-matching code in a human
              readable form to standard output and stop.

       -dd    Dump packet-matching code as a C program  fragment.

       -ddd   Dump  packet-matching code as decimal numbers (pre-
              ceded with a count).

       -e     Print the link-level header on each dump line.

       -f     Print  `foreign'  internet  addresses   numerically
              rather  than  symbolically (this option is intended
              to get around serious  brain  damage  in  Sun's  yp
              server -- usually it hangs forever translating non-
              local internet numbers).

       -F     Use file as input for the  filter  expression.   An
              additional  expression given on the command line is
              ignored.

       -i     Listen  on  interface.   If  unspecified,   tcpdump
              searches  the  system interface list for the lowest
              numbered, configured up interface (excluding  loop-
              back).   Ties  are  broken by choosing the earliest
              match.

       -l     Make stdout line buffered.  Useful if you  want  to
              see the data while capturing it.  E.g.,
              ``tcpdump  -l  |  tee  dat''  or  ``tcpdump  -l   >
              dat  &  tail  -f  dat''.

       -n     Don't convert addresses (i.e., host addresses, port
              numbers, etc.) to names.

       -N     Don't  print  domain  name  qualification  of  host
              names.  E.g., if you give this  flag  then  tcpdump
              will print ``nic'' instead of ``nic.ddn.mil''.

       -O     Do  not  run  the  packet-matching  code optimizer.
              This is useful only if you suspect  a  bug  in  the
              optimizer.

       -p     Don't  put  the  interface  into  promiscuous mode.
              Note that the interface  might  be  in  promiscuous
              mode  for  some other reason; hence, `-p' cannot be
              used as an abbreviation for `ether host  {local-hw-
              addr} or ether broadcast'.

       -q     Quick  (quiet?) output.  Print less protocol infor-
              mation so output lines are shorter.

       -r     Read packets from file (which was created with  the
              -w  option).   Standard  input  is  used if file is
              ``-''.

       -s     Snarf snaplen bytes of data from each packet rather
              than the default of 68 (with SunOS's NIT, the mini-
              mum is actually 96).  68 bytes is adequate for  IP,
              ICMP,  TCP and UDP but may truncate protocol infor-
              mation  from  name  server  and  NFS  packets  (see
              below).   Packets  truncated  because  of a limited
              snapshot  are  indicated   in   the   output   with
              ``[|proto]'', where proto is the name of the proto-
              col level at which  the  truncation  has  occurred.
              Note  that  taking  larger snapshots both increases
              the amount of time it takes to process packets and,
              effectively, decreases the amount of packet buffer-
              ing.  This may  cause  packets  to  be  lost.   You
              should  limit  snaplen  to the smallest number that
              will capture the protocol information you're inter-
              ested in.

       -T     Force packets selected by "expression" to be inter-
              preted the specified type.  Currently  known  types
              are  rpc  (Remote  Procedure  Call), rtp (Real-Time
              Applications protocol),  rtcp  (Real-Time  Applica-
              tions  control  protocol), vat (Visual Audio Tool),
              and wb (distributed White Board).

       -S     Print absolute, rather than relative, TCP  sequence
              numbers.

       -t     Don't print a timestamp on each dump line.

       -tt    Print an unformatted timestamp on each dump line.

       -v     (Slightly  more)  verbose output.  For example, the
              time to live and type of service information in  an
              IP packet is printed.

       -vv    Even  more verbose output.  For example, additional
              fields are printed from NFS reply packets.

       -w     Write the raw packets to file rather  than  parsing
              and  printing  them out.  They can later be printed
              with the -r option.  Standard  output  is  used  if
              file is ``-''.

       -x     Print  each packet (minus its link level header) in
              hex.  The smaller of the entire packet  or  snaplen
              bytes will be printed.

        expression
              selects  which  packets  will  be  dumped.   If  no
              expression is given, all packets on the net will be
              dumped.   Otherwise, only packets for which expres-
              sion is `true' will be dumped.

              The expression consists of one or more  primitives.
              Primitives  usually  consist of an id (name or num-
              ber) preceded by one or more qualifiers.  There are
              three different kinds of qualifier:

              type   qualifiers  say  what  kind  of thing the id
                     name or number refers  to.   Possible  types
                     are  host,  net and port.  E.g., `host foo',
                     `net 128.3', `port 20'.  If there is no type
                     qualifier, host is assumed.

              dir    qualifiers  specify  a  particular  transfer
                     direction  to  and/or  from  id.    Possible
                     directions  are src, dst, src or dst and src
                     and dst.  E.g., `src foo', `dst net  128.3',
                     `src  or dst port ftp-data'.  If there is no
                     dir qualifier, src or dst is  assumed.   For
                     `null' link layers (i.e. point to point pro-
                     tocols such as slip) the  inbound  and  out-
                     bound  qualifiers  can  be used to specify a
                     desired direction.

              proto  qualifiers restrict the match to a  particu-
                     lar  protocol.   Possible protos are: ether,
                     fddi,  ip,  arp,  rarp,  decnet,  lat,  sca,
                     moprc, mopdl, tcp and udp.  E.g., `ether src
                     foo', `arp net 128.3', `tcp  port  21'.   If
                     there  is  no proto qualifier, all protocols
                     consistent with the type are assumed.  E.g.,
                     `src  foo'  means  `(ip  or arp or rarp) src
                     foo' (except the latter is  not  legal  syn-
                     tax),  `net  bar' means `(ip or arp or rarp)
                     net bar' and `port 53' means `(tcp  or  udp)
                     port 53'.

              [`fddi'  is  actually  an  alias  for  `ether'; the
              parser treats them  identically  as  meaning  ``the
              data  link  level  used  on  the  specified network
              interface.''  FDDI  headers  contain  Ethernet-like
              source and destination addresses, and often contain
              Ethernet-like packet types, so you  can  filter  on
              these FDDI fields just as with the analogous Ether-
              net  fields.   FDDI  headers  also  contain   other
              fields,  but  you  cannot name them explicitly in a
              filter expression.]

              In addition to the above, there  are  some  special
              `primitive' keywords that don't follow the pattern:
              gateway, broadcast, less,  greater  and  arithmetic
              expressions.  All of these are described below.

              More  complex  filter  expressions  are built up by
              using the words and, or and not to  combine  primi-
              tives.   E.g.,  `host  foo and not port ftp and not
              port ftp-data'.  To save typing,  identical  quali-
              fier lists can be omitted.  E.g., `tcp dst port ftp
              or ftp-data or domain' is exactly the same as  `tcp
              dst  port  ftp  or tcp dst port ftp-data or tcp dst
              port domain'.

              Allowable primitives are:

              dst host host
                     True if the  IP  destination  field  of  the
                     packet  is  host,  which  may  be  either an
                     address or a name.

              src host host
                     True if the IP source field of the packet is
                     host.

              host host
                     True  if either the IP source or destination
                     of the packet is host.   Any  of  the  above
                     host  expressions  can be prepended with the
                     keywords, ip, arp, or rarp as in:
                          ip host host
                     which is equivalent to:
                          ether proto \ip and host host

                     If  host  is  a  name   with   multiple   IP
                     addresses,  each address will be checked for
                     a match.

              ether dst ehost
                     True if the ethernet destination address  is
                     ehost.   Ehost  may  be  either  a name from
                     /etc/ethers or a number (see ethers(3N)  for
                     numeric format).

              ether src ehost
                     True  if  the  ethernet  source  address  is
                     ehost.

              ether host ehost
                     True if either the ethernet source or desti-
                     nation address is ehost.

              gateway host
                     True  if  the packet used host as a gateway.
                     I.e., the  ethernet  source  or  destination
                     address  was  host but neither the IP source
                     nor the IP destination was host.  Host  must