Solaris下监视包传送的命令snoop
snoop命令用来捕捉和监视网络包。snoop从网络捕捉包并显示它们的内容。snoop使用网络包过滤器和流缓冲器模型来提供有效的网络包捕捉。捕捉的包可以即时显示也可以保存在一个文件中用来以后观察。snoop可以以单行摘要或者详细的多行摘要来显示包内容。在摘要格式上，某些VLAN包除外，仅显示高级协议的数据。如果一个包含有VLAN头并且它的VLAN ID非零，snoop将显示的包会有VLAN标签。例如，一个NFS包将仅显示NFS信息。除了刚才描述的情况下的VLAN信息，底层的RPC、UDP、IP和Ethernet帧信息被抑制，但是可以被显示如果使用了verbose选项。如果没有一个名称服务例如LDAP或者NIS，snoop会显示IP地址。snoop需要一个交互式的接口。
语法：snoop [-aqrCDNPSvV] [-t [r | a | d]] [-c maxcount][-d device] [-i filename] [-n filename] [-o filename][-p first [, last]] [-s snaplen] [-x offset [, length]][expression]
[ -a ] # Listen to packets on audio[ -d device ] # Listen on interface named device
[ -s snaplen ] # Truncate packets
[ -c count ] # Quit after count packets
[ -P ] # Turn OFF promiscuous mode
[ -D ] # Report dropped packets
[ -S ] # Report packet size
[ -i file ] # Read previously captured packets
[ -o file ] # Capture packets in file
[ -n file ] # Load addr-to-name table from file
[ -N ] # Create addr-to-name table
[ -t r|a|d ] # Time: Relative, Absolute or Delta
[ -v ] # Verbose packet display
[ -V ] # Show all summary lines
[ -p first[,last] ] # Select packet(s) to display
[ -x offset[,length] ] # Hex dump from offset for length
[ -C ] # Print packet filter code
[ -q ] # Suppress printing packet count
[ -r ] # Do not resolve address to name
[ filter expression ] # 过滤器表达式
例子:
snoop -o saved host fred
snoop -i saved -tr -v -p19
