SNOOPY(8) SNOOPY(8)
NAME
sniffer, snoopy - spy on Ethernet packets
SYNOPSIS
snoopy [ -abcdeEgilnoprsStux9 ] [ -N count ] [ -F filter ] [
device ]
sniffer [ -p ] [ -F filter ] [ device ]
DESCRIPTION
Snoopy displays the header and data bytes of packets
received from the local Ethernet. The following options
each select packets from a particular protocol. If more
than one flag is given, packets from all those protocols are
displayed.
a ARP
b BOOTP
c ICMP
e all Ethernet packets
E ESP
g GRE
i IP
l IL
o OSPF
r RUDP, a Plan 9 reliable datagram protocol
t TCP
u UDP
The following options control output format.
n do not translate addresses into names
x display the body of the message in hex instead of UTF
9 display the body as a 9p message
N limit the number of bytes of the body to display to
count (default 20)
Page 1 Plan 9 (printed 4/19/24)
SNOOPY(8) SNOOPY(8)
Finally, some options control data flow and packet filter-
ing.
s read only the first 64 bytes of each packet, i.e., open
ether type -2 instead of -1.
S read packets from standard input, often a pipe from
sniffer or a file containing a dump from a previous
invocation of sniffer.
d write the packets to /tmp/snoopydump in the same format
as sniffer.
F filter out all packets whose source or destination does
not match filter, which may be an IP address, an ether-
net address, or a TCP or UDP port.
p don't turn on promiscuous mode
Sniffer reads packets off the local Ethernet and writes
them, preceded by a 2 byte big endian length and a 4 byte
big endian millisecond time, to standard output. The output
can be saved to a file or piped into snoopy. The -p and -F
options are the same as for snoopy.
FILES
/net/ether
Ethernet device
SOURCE
/sys/src/cmd/ip/snoopy.c
/sys/src/cmd/ip/sniffer.c
BUGS
The CPU servers do not take well to running in promiscuous
mode. If run on them, snoopy may kill their Ethernets.
Page 2 Plan 9 (printed 4/19/24)