SNOOPY(8) SNOOPY(8) NAME sniffer, snoopy - spy on Ethernet packets SYNOPSIS snoopy [ -abcdeEgilnoprsStux9 ] [ -N count ] [ -F filter ] [ device ] sniffer [ -p ] [ -F filter ] [ device ] DESCRIPTION Snoopy displays the header and data bytes of packets received from the local Ethernet. The following options each select packets from a particular protocol. If more than one flag is given, packets from all those protocols are displayed. a ARP b BOOTP c ICMP e all Ethernet packets E ESP g GRE i IP l IL o OSPF r RUDP, a Plan 9 reliable datagram protocol t TCP u UDP The following options control output format. n do not translate addresses into names x display the body of the message in hex instead of UTF 9 display the body as a 9p message N limit the number of bytes of the body to display to count (default 20) SNOOPY(8) SNOOPY(8) Finally, some options control data flow and packet filter- ing. s read only the first 64 bytes of each packet, i.e., open ether type -2 instead of -1. S read packets from standard input, often a pipe from sniffer or a file containing a dump from a previous invocation of sniffer. d write the packets to /tmp/snoopydump in the same format as sniffer. F filter out all packets whose source or destination does not match filter, which may be an IP address, an ether- net address, or a TCP or UDP port. p don't turn on promiscuous mode Sniffer reads packets off the local Ethernet and writes them, preceded by a 2 byte big endian length and a 4 byte big endian millisecond time, to standard output. The output can be saved to a file or piped into snoopy. The -p and -F options are the same as for snoopy. FILES /net/ether Ethernet device SOURCE /sys/src/cmd/ip/snoopy.c /sys/src/cmd/ip/sniffer.c BUGS The CPU servers do not take well to running in promiscuous mode. If run on them, snoopy may kill their Ethernets.