snoopy – spy on network packets|
snoopy [ –CDdpst ] [ –M m ] [ –N n ] [ –f filter–expression ] [ –h first–header
] [ packet–source ]
Snoopy reads packets from a packet–source (default /net/ether0),
matches them to a filter (by default anything matches), and writes
matching packets to standard output either in human readable form
(default) or in a binary trace format that can be later read by
snoopy. Packet–source can be the name of an
Ethernet (e.g., /net/ether0), an interface (e.g., /net/ipifc/0),
or a file of captured packets.
–C compute the correct checksum for each packet; on mismatch, add a field !ck=xxxx where xxxx is the correct checksum.
–D output will be a binary trace file in Unix pcap format.
–d output will be a binary trace file.
–t input is a binary trace file as generated with the –d option.
–p do not enter promiscuous mode. Only packets to this interface will be seen.
–s force one output line per packet. The default is multiline.
–M discard all but the first m bytes of each packet. The default is to keep the entire packet. This option is most useful when writing packets to a file with the –d option.
–N dump n data bytes per packet. The default is 32.
–f use filter–expression to filter the packet stream. The default is to match all packets.
–h assume the first header per packet to be of the first–header protocol. The default is ether.
To display only BOOTP and ARP packets:|
Snoopy only dumps ethernet packets, because there's no device
to get IP packets without a media header.|