Snoop 是Solaris 系統中自帶的工具， 是一個用於顯示網絡通訊的程序， 它
可捕獲IP 包並將其顯示或保存到指定文件. (限超級用戶使用snoop)
Snoop 可將捕獲的包以一行的形式加以總結或用多行加以詳細的描述(有
調用不同的參數–v -V來實現). 在總結方式下(-V ) , 將僅顯示最高層的相關協
議, 例如一個NFS 包將僅顯示NFS 信息, 其低層的RPC, UDP, IP, Ethernet 幀信息將不會顯示, 但是當加上相應的參數(-v ), 這些信息都能被顯示出來.
參數簡介：
[ -a ] # Listen to packets on audio
[ -d device ] # settable to le?, ie?, bf?, tr?
[ -s snaplen ] # Truncate packets
[ -c count ] # Quit after count packets
[ -P ] # Turn OFF promiscuous mode
[ -D ] # Report dropped packets
[ -S ] # Report packet size
[ -i file ] # Read previously captured packets
[ -o file ] # Capture packets in file
[ -n file ] # Load addr-to-name table from file
[ -N ] # Create addr-to-name table
[ -t r|a|d ] # Time: Relative, Absolute or Delta
[ -v ] # Verbose packet display
[ -V ] # Show all summary lines
[ -p first[,last] ] # Select packet(s) to display
[ -x offset[,length] ] # Hex dump from offset for length
[ -C ] # Print packet filter code
由於snoop 的使用非常靈活, 希望能通過下面一些例子的學習來其常見用法.
1. 監聽所有以本機爲源和目的的包並將其顯示出來.
# snoop
2. 監聽所有以主機A爲源和目的的包並將其顯示出來. ( A爲主機名, 下同)
- 2 -
# snoop A
3. 監聽所有A和B之間的包並將其保存到文件file.
# snoop -o file A B
4. 顯示文件file 中指定的包(99-108)
# snoop - i file -p 99,108
99 0.0027 boutique ->; sunroof NFS C GETATTR FH=8E6C
100 0.0046 sunroof ->; boutique NFS R GETATTR OK
101 0.0080 boutique ->; sunroof NFS C RENAME FH=8E6C MTra00192
to .nfs08
102 0.0102 marmot ->; viper NFS C LOOKUP FH=561E screen.r.13.i386
103 0.0072 viper ->; marmot NFS R LOOKUP No such file or directory
104 0.0085 bugbomb ->; sunroof RLOGIN C PORT=1023 h
105 0.0005 kandinsky ->; sparky RSTAT C Get Statistics
106 0.0004 beeblebrox ->; sunroof NFS C GETATTR FH=0307
107 0.0021 sparky ->; kandinsky RSTAT R
108 0.0073 office ->; jeremiah NFS C READ FH=2584 at 40960 for 8192
5. 詳細查看文件file 中第101 個包:
# snoop - i file - v -p101
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 101 arrived at 16:09:53.59
ETHER: Packet size = 210 bytes
ETHER: Destination = 8:0:20:1:3d:94, Sun
ETHER: Source = 8:0:69:1:5f:e, Silicon Graphics
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4, header length = 20 bytes
IP: Type of service = 00
IP: ..0. .... = routine
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 196 bytes
IP: Identification 19846
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = more fragments
?
- 3 -
?
6. 查看主機A和主機B之間的NFS 包(命令中的and 和or 爲相應的邏輯運
算)
# snoop - i file rpc nfs and A and B
1 0.0000 A ->; B NFS C GETATTR FH=8E6C
2 0.0046 B ->; A NFS R GETATTR OK
3 0.0080 A ->; B NFS C RENAME FH=8E6C MTra00192 to .nfs08
7. 將這些符合條件的包保存到另一文件file2 中:
# snoop - i file -o file2 rpc nfs A B
8. 監聽主機A和主機B間所有TCP 80 端口或UDP80端口的包
# snoop A and B and (tcp or udp) and port 80
9. 監聽所有的廣播包
# snoop broadcast
Using device /dev/hme (promiscuous mode)
10.10.10.50 ->; BROADCAST UDP D=177 S=2541 LEN=35
10.10.10.50 ->; BROADCAST UDP D=177 S=2541 LEN=35
10.10.10.50 ->; BROADCAST UDP D=177 S=2541 LEN=35
10. 監聽所有的多播包, 並顯示詳細內容.
#snoop –v multicast
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 12:33:2.16
ETHER: Packet size = 69 bytes
ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER: Source = 0:4:76:46:8f:50,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
- 4 -
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 55 bytes
IP: Identification = 14658
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 128 seconds/hops
IP: Protocol = 17 (UDP)
IP: Header checksum = ed38
IP: Source address = 10.10.10.50, 10.10.10.50
IP: Destination address = 255.255.255.255, BROADCAST
IP: No options
IP:
UDP: ----- UDP Header -----
UDP:
UDP: Source port = 2541
UDP: Destination port = 177
UDP: Length = 35
UDP: Checksum = 8E35
UDP:
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 2 arrived at 12:33:12.16
ETHER: Packet size = 69 bytes
ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
ETHER: Source = 0:4:76:46:8f:50,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 55 bytes
IP: Identification = 14985
IP: Flags = 0x0
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 128 seconds/hops
IP: Protocol = 17 (UDP)
IP: Header checksum = ebf1
IP: Source address = 10.10.10.50, 10.10.10.50
- 5 -
IP: Destination address = 255.255.255.255, BROADCAST
IP: No options
IP:
UDP: ----- UDP Header -----
UDP:
UDP: Source port = 2541
UDP: Destination port = 177
UDP: Length = 35
UDP: Checksum = 8E35
UDP:
11．監聽所有的NTP 協議包
# snoop |grep – i NTP
Using device /dev/hme (promiscuous mode)
ts1 ->; 224.0.1.1 NTP broadcast (Tue Jul 23 12:48:50 2002)
ts1 ->; 224.0.1.1 NTP broadcast (Tue Jul 23 12:49:54 2002)
ts1 ->; 224.0.1.1 NTP broadcast (Tue Jul 23 12:50:58 2002)
ts1 ->; 224.0.1.1 NTP broadcast (Tue Jul 23 12:52:02 2002)
ts1 ->; 224.0.1.1 NTP broadcast (Tue Jul 23 12:53:06 2002)
ts1 ->; 224.0.1.1 NTP broadcast (Tue Jul 23 12:54:10 2002)
這裏我們也可看到NTP server 每隔約一分鐘即向多播地址廣播一次.
12.我的常用 snoop -ta -xa 192.168.0.1
18:28:41.61227 192.168.0.1 -> 192.168.0.255 NBT NS Query Request for WWW.163.COM[0], Success
0: ffff ffff ffff 0002 557c 5bb0 0800 4500 ........U|[...E.
16: 004e cd24 0000 8011 eb29 c0a8 0001 c0a8 .N.$.....)......
32: 00ff 0089 0089 003a 5c23 907d 0110 0001 .......:/#.}....
48: 0000 0000 0000 2046 4846 4846 4843 4f44 ...... FHFHFHCOD
64: 4244 4744 4443 4f45 4445 5045 4e43 4143 BDGDDCOEDEPENCAC
80: 4143 4143 4141 4100 0020 0001 ACACAAA.. ..
18:28:42.36233 192.168.0.1 -> 192.168.0.255 NBT NS Query Request for WWW.163.COM[0], Success
0: ffff ffff ffff 0002 557c 5bb0 0800 4500 ........U|[...E.
16: 004e ce75 0000 8011 e9d8 c0a8 0001 c0a8 .N.u............
32: 00ff 0089 0089 003a 5c23 907d 0110 0001 .......:/#.}....
48: 0000 0000 0000 2046 4846 4846 4843 4f44 ...... FHFHFHCOD
64: 4244 4744 4443 4f45 4445 5045 4e43 4143 BDGDDCOEDEPENCAC
80: 4143 4143 4141 4100 0020 0001 ACACAAA.. ..