.\" @(#) $Header: tcpdump.1,v 1.67 97/06/30 16:31:50 leres Exp $ (LBL)
.\"
.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
.\"	The Regents of the University of California.  All rights reserved.
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that: (1) source code distributions
.\" retain the above copyright notice and this paragraph in its entirety, (2)
.\" distributions including binary code include the above copyright notice and
.\" this paragraph in its entirety in the documentation or other materials
.\" provided with the distribution, and (3) all advertising materials mentioning
.\" features or use of this software display the following acknowledgement:
.\" ``This product includes software developed by the University of California,
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
.\" the University nor the names of its contributors may be used to endorse
.\" or promote products derived from this software without specific prior
.\" written permission.
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.\" Japanese Version Copyright (c) 1998
.\"           MAEHARA Kohichi
.\"                  &
.\"           HANATAKA Shinya
.\"         all rights reserved.
.\" Translated Tue Jan 6 00:00:00 JST 1998
.\"     by  MAEHARA Kouhichi <maeharak@kw.netlaputa.ne.jp>
.\"     by  HANATAKA Shinya <hanataka@abyss.rim.or.jp>
.\"
.\"
.TH TCPDUMP 1  "30 June 1997"
.SH ̾
tcpdump \- ͥåȥΥȥեåפ롣
.SH 
.na
.B tcpdump
[
.B \-adeflnNOpqStvx
] [
.B \-c
.I count
] [
.B \-F
.I file
]
.br
.ti +8
[
.B \-i
.I interface
] [
.B \-r
.I file
]
[
.B \-s
.I snaplen
]
.br
.ti +8
[
.B \-T
.I type
]
[
.B \-w
.I file
]
[
.I expression
]
.br
.ad
.SH 
.LP
\fItcpdump\fP Ͽͤ \fIＰ\fP ˰פͥåȥ󥿡եΥѥåȤΥإåɽ롣
.LP
.B nit  bpf Ѥ SunOSξ:
.I tcpdump 
ư뤿ˤ 
.I /dev/nit 
ޤ 
.IR /dev/bpf* 
˥꡼ɸ¤äƤɬפ롣
.B dlpi Ѥ Solaris ξ:
ۥͥåȥǥХȤ 
.IR /dev/le 
ȤäΤ˥꡼ɸ¤äƤɬפ롣
.B dlpi Ѥ HP-UX ξ:
¹ԼԤ root Ǥ뤫ޤ root  setuid ƥ󥹥ȡ뤵Ƥɬפ롣
.B snoop Ѥ IRIX ξ:
¹ԼԤ root Ǥ뤫ޤ root  setuid ƥ󥹥ȡ뤵Ƥɬפ롣
.B Linux ξ:
¹ԼԤ root Ǥ뤫ޤ root  setuid ƥ󥹥ȡ뤵Ƥɬפ롣
.B Ultrix  Digital UNIX ξ:
ޤѡ桼 
.IR pfconfig(8) 
Ѥ̵Ʃ⡼(promicuous-mode)ͭˤɬפ롣
θϰ̥桼 
.BR tcpdump 
¹ԲǽǤ롣
.B BSD ξ: 
.IR /dev/bpf* 
Ф꡼ɸ¤ɬס
.SH ץ
.TP
.B \-a
ͥåȥȥ֥ɥ㥹ȥɥ쥹 DNS ̾Ѵ롣
.TP
.B \-c
\fIcount\fP ĤΥѥåȤΤ˽λ롣
.TP
.B \-d
ѥ뤵줿ѥåȥޥå󥰥ɤʹ֤ɤɸϤ˥פλ롣
.TP
.B \-dd
ѥåȥޥå󥰥ɤ 
.B C
ΰȤѲǽʤǥפ롣
.TP
.B \-ddd
ѥåȥޥå󥰥ɤ ʿǥפ(count Ԥ)
.TP
.B \-e
ƥ׹Ԥ˥󥯥٥إåɽ롣
.TP
.B \-f
ֳΡץ󥿡ͥåȥɥ쥹򥷥ܥǤϤʤƿͤɽ(
Υץϼ Sun  yp ӥ򱪲󤹤뤳ȤտޤƤ 
\(em Sun  yp ӥϥǤϤʤ󥿡ͥåȥɥ쥹Ѵ褦ȤȱʵפưߤƤޤХ)
.TP
.B \-F
ե륿ＰλؼϤȤ \fIfile\fP Ѥ롣ɲäƥ
ޥɥ饤Ϳ줿Ｐˤؼ̵뤹롣
.TP
.B \-i
\fIinterface\fP ƻ뤹롣ؼΤʤ tcpdump ϥƥΥ󥿡եΥꥹȤǤ⾮ֹͭˤʤäƤ(â loopback Ͻ)õФؼ줿󥿡ե¸ߤʤϤäȤᤤΤ򤵤롣
.TP
.B \-l
ɸϤХåե󥰤롣ǡѤʤƻ뤹ͭ
롣㡢
.br
``tcpdump\ \ \-l\ \ |\ \ tee dat'' or
``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''.
.TP
.B \-n
ɥ쥹(ۥȥɥ쥹ݡֹʤ)̾Ѵʤ
.TP
.B \-N
ۥȤΥɥᥤ̾ɽʤĤޤꤳѤ \fItcpdump\fP ``nic.ddn.mil'' ɽ뤫 ``nic'' ɽ롣
.TP
.B \-O
ѥåȥޥå󥰥ɥץƥޥߤ롣ϥץƥޥΥХ򵿤äƤˤΤͭפǤ롣
.TP
.B \-p
̵Ʃ⡼ɤ \fIѤʤ \fPʤ顢¾ͳǥ󥿡
ե̵Ʃ⡼ɤˤʤäƤޤȤ⤢뤳Ȥդ衣
 `-p' ץ `ether host {loca-lw-addr} or ether broadcast' 
ξάȤƤϻѤǤʤ
.TP
.B \-q
Ф䤤(ȤŤ)ϡꤵ줿ץȥξ󤷤ϤʤΤǡϹԤûΤȤʤ롣
.TP
.B \-r
ѥåȤ(-w ץǺ)\fIfile\fRɤ߹ࡣ\fIfile\fR
Ȥ ``-'' ꤷˤɸϤѤ롣
.TP
.B \-s
ǥեȤ 68 Х(SunOS  NIT ǤϺǾϼºݤˤ 96 Х)ä \fIsnaplen\fP ХȤ򤪤ΤΤΥѥåȤФѤ롣IP, ICMP ,TCP  UDP ˤĤƤ 68 ХȤнʬ͡ॵФ NFS ξˤ­ʤ⤷ʤ()

snapshot ¤Τ˸ڤΤƤ줿ѥåȤϽϻ``[|\fIproto\fP]'' 
ηǼ  \fIproto\fP ڼΤƤ٥бץȥ̾Ǥ롣礭 snapshot ȤȡѥåȤ֤äޤΤۤפХåեί뤳ȤǤ̤Ƥޤդ뤳ȡʤѥåȤʤǽ⤢롣ץȥξɬ׺Ǿ¤ \fIsnaplen\fP Ȥ褦ˡ
.TP
.B \-T
"\fIexpression\fP"(Ｐ) 򤵤줿ѥåȤ˻ؼ줿 \fItype\fR Ǥؼ롣ͭ type  
\fBrpc\fR (Remote Procedure Call)
\fBrtp\fR (Real-Time Applications protocol)
\fBrtcp\fR (Real-Time Applications control protocol)
\fBvat\fR (Visual Audio Tool)
\fBwb\fR (distributed White Board)
.TP
.B \-S
TCP ֹͤǤϤʤͤɽ롣
.TP
.B \-t
׹Ԥ˻־ɽ\fIʤ\fP
.TP
.B \-tt
׹Ԥɽ־ʤ
.TP
.B \-v
(äȤ)ܺ٤ʽϡȤСIP ѥåȤˤ ¸(TTL)  ӥμξɽ롣
.TP
.B \-vv
äȾܺ٤ʽϡȤСNFSѥåȤˤղåեɤɽ
.TP
.B \-w
ѥåȤϡɽ뤫Τޤ \fIfile\fR ˽񤭽ФΥեϤȤ \-r ץѤɽ뤳ȤǤ롣\fIfile\fR Ȥ `-' ؼɸϤѤ롣
.TP
.B \-x
(󥯥٥إå)٤ƤΥѥåȤϻʤɽ롣ѥåΤ 
.I snaplen 
ХȤξɽ롣
.IP "\fI expression(Ｐ)\fP"
.RS
פѥåȤμ򤹤롣\fIexpression\fP ͿʤȤϡͥåȥΤ٤ƤΥѥåȤפ롣ǤʤС\fIexpression\fP `true'() ȤʤѥåȤפ롣
.LP
\fIexpression\fPϰİʾ
.I primitives()
롣ǤϰİʾνҤԤĤ 
.I id
(̾ǤֹǤ褤)Ǥ롣ҤˤϻĤμब:
.IP \fItype\fP
Ҥ id̾ޤ id ֹ椬ؤΤμ򼨤Ѳǽʤ
 
.BR host
.B net
.B port 
Ǥ롣㡢`host foo'`net 128.3'`port 20'
type Ҥ̵ϡ
.B host 
ؼƤΤȤߤʤ
.IP \fIdir\fP
Ҥ 
.I id 
˸ơޤ 
.I id 
ءΤɤ餫뤤ξ̿ꤹ롣ȤƻؼǤΤ 
.BR src
.B dst
.B "src or dst"
.B "src and"
.B dst
Ǥ롣㡢 `src foo'`dst net 128.3'`src or dst port ftp-data'
dir Ҥꤵʤ 
.B "src or dst"
 ؼ줤ƤΤȤߤʤ`null' (ʤ slip Τ褦
ʥݥȥġݥȥץȥ)ˤƤϡꤹ뽤ҤȤ

.B inbound
 
.B outbound 
ѲǽǤ롣
.IP \fIproto\fP
ҤϰפΥץȥ¤롣Ѳǽʥץȥϰʲ̤:
.BR ether
.BR fddi
.BR ip
.BR arp
.BR rarp
.BR decnet
.BR lat
.BR sca
.BR moprc
.BR mopdl
.BR tcp
.BR udp
㡢`ether src foor'`arp net 128.3'`tcp port 21'
proto Ҥؼʤ type ̷⤷ʤϰϤƤΥץȥ
뤬ؼƤΤȤߤʤ
㡢`src foo'  `(ip or arp or rarp) src foo' 
(Τ褦ʽʸˡޤ)
̣`net bar'  `(ip or arp or rarp) net bar' ̣ޤ `port 53'  `(tcp or udp) port 53' ̣롣
.LP
[`fddi'ϼºݤˤ `ether' ̾Ǥ;ϻ``Υͥåȥ
󥿡եѤǡ''Ȥư롣FDDI إ
ϥͥåŪʥӥǥƥ͡󥢥ɥ쥹ޤߡ
ͥåŪʥѥåȥפޤΤǡ FDDI եɤ 
ͥåȤƱȤ̤Ǥ롣FDDI إåˤϤ¾Υե
ޤޤ뤬ˤĤƤϥե륿ξＰŪ˻ؼ뤳ȤϤ
ʤ]
.LP
嵭˲äơ̤`'򼨤ɤ:
.BR gateway
.BR broadcast
.BR less
.BR greater
arithmtic expression(ͤˤＰ) ˤĤƤϤΤȤǵҤ롣
.LP
äʣʥե륿Ｐ 
.BR and
.B or 
.BR not 
ȳǤȹ礻ɽǤ롣㡢`host foo and not port ftp and not port ftp-data'ŪʽҤϾάƥ׿򸺤餹ȤǤ롣㡢`tcp dst port ftp or ftp-data or domain' `tcp dst prot ftp or tcp dst port ftp-data or tcp dst prot domain'Ʊ̣Ǥ롣
.LP
ƤǤȤ߹碌;
.IP "\fBdst host \fIhost\fR"
ѥåȤ IP ǥƥ͡եɤ \fIhost\fP ǤȤɥ쥹Ǥ̾Ǥ褤
.IP "\fBsrc host \fIhost\fR"
ѥåȤ IP եɤ \fIhost\fP ǤȤ
.IP "\fBhost \fIhost\fP
ѥåȤ IP ޤ IP ǥƥ͡եɤ \fIhost\fP ǤȤ嵭γ host 򺹤Ｐˤ \fBip\fP\fBarp\fPޤ \fBrarp\fP ղäƤ褤
.in +.5i
.nf
\fBip host \fIhost\fR
.fi
.in -.5i
ϲƱ
.in +.5i
.nf
\fBether proto \fI\\ip\fB and host \fIhost\fR
.fi
.in -.5i
⤷ \fIhost\fP ̾ʣ IP ɥ쥹ĻϤ줾Υɥ쥹˰פ롣
.IP "\fBether dst \fIehost\fP
ͥåȥǥƥ͡󥢥ɥ쥹 \fIehost\fP ǤȤ˿
\fIehost\fP  /etc/ethers ͤǤ(ͤΥեޥåȤˤĤƤ 
.IR ethers(3N)
򻲾ȤΤ)
.IP "\fBether src \fIehost\fP
ͥåȥɥ쥹 \fIehost\fP ǤȤ˿
.IP "\fBether host \fIehost\fP
ͥåȥɥ쥹ǥƥ͡󥢥ɥ쥹 \fIehost\fP ǤȤ˿
.IP "\fBgateway\fP \fIhost\fP
ѥåȤ \fIhost\fP 򥲡ȥȤƤȤ˿ʤͥåȥ/ǥƥ͡󥢥ɥ쥹 \fIhost\fP Ǥ뤬IP /ǥƥ͡󥢥ɥ쥹 \fIhost\fP ǤϤʤȤΤȡ\fPhost\fP ̾Ǥꡢޤ /etc/hosts  /etc/ethers ξ˵ܤƤʤФʤʤ(
ξＰ \fIhost / ehost\fP 줾ֹ̾ǵҤ
.in +.5i
.nf
\fBether host \fIehost \fBand not host \fIhost\fR
.fi
.in -.5i
ƱǤ)
.IP "\fBdst net \fInet\fR"
ѥåȤ IP ǥƥ͡󥢥ɥ쥹 \fInet\fP ͥåȥ
ޤǤȤ˿\fInet\fP /etc/networks ˵ܤ̾ͥå
ֹǤ( \fInetworks(4)\fP 򻲾)
.IP "\fBsrc net \fInet\fR"
ѥåȤ IP ɥ쥹 \fInet\fP ͥåȥΤΤǤȤ˿
.IP "\fBnet \fInet\fR"
ѥåȤ IP /ǥƥ͡󥢥ɥ쥹 \fInet\fP ͥåȥǤȤ˿
.IP "\fBnet \fInet\fR \fBmask \fImask\fR"
IP ɥ쥹 netmask ǥޥ \fInet\fR ˰פȤ˿\fBsrc\fR  \fBdst\fR ǽƤ褤
.IP "\fBnet \fInet\fR/\fIlen\fR"
IP ɥ쥹 \fIlen\fR ӥåȤnetmask ǥޥ \fInet\fR ˰פȤ˿\fBsrc\fR  \fBdst\fR ǽƤ褤
.IP "\fBdst port \fIport\fR"
ѥåȤ ip/tcp  ip/udp ǤǡԤ port ֹ椬 \fIport\fP ǤȤ˿\fIPort\fP ֹοͤ /etc/services ˤ̾ѤǤ(
.IR tcp(4P)
 
.IR udp(4P)
򻲾ȤΤ)̾ѤƤ port ֹ protocol ξǾȹ礵롣ֹ椫¿ŤƤ̾ѤƤ port ֹȹ礵() \fBdst port  513\fR  tcp/login  udp/who ξ̿ɽ뤷\fBport domain\fR  tcp/domain  udp/domain ξɽ롣
.IP "\fBsrc port \fIport\fR"
ѥåȤ port ֹ \fIport\fP 򥽡ˤƤȤ
.IP "\fBport \fIport\fR"
ѥåȤΥǥƥ͡ \fIport\fP ǤȤ 
port ꤹＰ \fBtcp\fP  \fBudp\fP ΥɤղäƤ褤:
.in +.5i
.nf
\fBtcp src port \fIport\fR
.fi
.in -.5i
 \fIport\fP 򥽡Ȥ tcp ΥѥåȤΤߤ˰פ롣
.IP "\fBless \fIlength\fR"
ѥåȤ \fIlength\fP ʲΤȤ˿
ϲƱ:
.in +.5i
.nf
\fBlen <= \fIlength\fP.
.fi
.in -.5i
.IP "\fBgreater \fIlength\fR"
ѥåȤ \fIlength\fP ʾΤȤ˿
ϲƱ:
.in +.5i
.nf
\fBlen >= \fIlength\fP.
.fi
.in -.5i
.IP "\fBip proto \fIprotocol\fR"
ѥåȤ \fIprotocol\fP  IP ѥå( 
.IR ip(4P)
򻲾)ΥץȥΤΤ
Ȥ\fIprotocol\fP ȤѤǤΤϿͤ \fIicmp\fP
\fIigrp\fP\fIudp\fP\fInd\fP\fItcp\fP Ǥ롣\fItcp\fP\fIudp\fP
\fIicmp\fP ϥɤǤ⤢ΤǡХåå(\\)ǥ
ȤƲᤵΤ򤹤ɬפ롣C-Chell Ǥ \\\\ Ȥ
.IP "\fBether broadcast\fR"
ѥåȤͥåȤΥ֥ɥ㥹ȤǤȤ\fIether\fP ϤʤƤ褤
.IP "\fBip broadcast\fR"
ѥåȤ IP ֥ɥ㥹ȥѥåȤǤȤ 0   1 ξΥ֥ɥ㥹ȷб˥֥ͥåȥޥˤбƤ롣
.IP "\fBether multicast\fR"
ѥåȤͥåȤΥޥ㥹ȤǤȤ\fIether\fP Ϥʤ
褤 `\fBether[0] & 1 != 0\fP'ξάˡǤ롣
.IP "\fBip multicast\fR"
ѥåȤ IP Υޥ㥹ȤǤȤ
.IP  "\fBether proto \fIprotocol\fR"
ѥåȤ ether  \fIprotocol\fR ΤΤǤȤ
\fIprotocol\fP ˤֹ椫 \fIip\fP\fIarp\fP\fIrarp\fP ̾
Ѳǽμ̻ҤϥɤǤ⤢ΤǡХåå(\\)
ɤȤƲᤵΤ򤹤ɬפ롣
[ FDDI (Ȥ `\fBfddi protocol arp\fR')ξ硢ץȥμˡ
802.2 Logical Link Control (LLC) إåˤ롣̾
FDDI إåƬ֤Ƥ롣\fItcpdump\fP  ץȥ뼱̻Ҥ
ե륿ˡƤ FDDI ѥåȤ LLC إåäƤơ
 LLC إå SNAP ȸƤФˤʤäƤΤȤߤʤ ]
.IP "\fBdecnet src \fIhost\fR"
DECNET ˤƥɥ쥹``10.123''Τ褦ʥɥ쥹 DECNETΥ
ȥ͡ηǻؼ 
.IR host 
ȰפȤ[DECNETΥۥȥ͡ DECNET³줿 
ultrix ƥˤƤΤѲǽǤ롣]
.IP "\fBdecnet dst \fIhost\fR"
DECNETˤƥǥƥ͡󥢥ɥ쥹 
.IR host 
˰פȤ
.IP "\fBdecnet host \fIhost\fR"
DECNETˤơޤϥǥƥ͡󥢥ɥ쥹 
.IR host 
˰פȤ˿
.IP "\fBip\fR, \fBarp\fR, \fBrarp\fR, \fBdecnet\fR"
ˤ:
.in +.5i
.nf
\fBether proto \fIp\fR
.fi
.in -.5i
\fIp\fR 򤽤Τ줫ΥץȥȤΤƱǤ롣
.IP "\fBlat\fR, \fBmoprc\fR, \fBmopdl\fR"
ˤ:
.in +.5i
.nf
\fBether proto \fIp\fR
.fi
.in -.5i
\fIp\fR 򤽤Τ줫ΥץȥȤΤƱǤ롣
\fItcpdump\fP ϤΥץȥβˡΤˤΤʤ
뤳ȡ
.IP  "\fBtcp\fR, \fBudp\fR, \fBicmp\fR"
ˤ:
.in +.5i
.nf
\fBip proto \fIp\fR
.fi
.in -.5i
\fIp\fR 򤽤Τ줫ΥץȥȤΤƱǤ롣
.IP  "\fIexpr relop expr\fR"
طΩƤп\fIrelop\fR(黻) ><>=<==!= Τ
줫ĤǤꡢ\fIexpr\fR(ɽ) ˤɽ (ɽˡɸ
Ū C ʸˡˤ)ɸŪ黻[+-*/&|]Ĺ黻ҡ
åȥǡ黻ҤΤ줫ѥåΥǡФŬѤˤϤΤ褦˵Ҥ:
.in +.5i
.nf
\fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
.fi
.in -.5i
\fIproto\fR  \fBetherfddiiparprarptcpudp\fR\fBicmp\fR Τ줫оݤΥץȥؤؼ롣ؼ줿
ȥؤˤĤƤΥХȥեåȤ \fIexpr\fR ǻꤹ롣
\fIsize\fR ؼܤեɤǤΥХȿǻؼ뤬
 onetwo ޤ four Τ줫Ѥ롣ؼΤʤ one 
ȤߤʤĹ黻Ҥϥ \fBlen\fP Ǽ졢ѥåĹͿ롣
ȤС`\fBether[0] & 1 != 0\fP'ȤＰϤ٤ƤΥޥ㥹
ˤ̿Ȥ館롣`\fBip[0] & 0xf != 5\fP' ȤＰϤ٤ƤΥ
ץդ IP ѥåȤȤ館롣`\fBip[6:2] & 0x1fff = 0\fP'ϥե
ȲƤʤǡफ 0 ֤(ǽ)ե饰Ȥɽ롣
ʤξ \fBtcp\fP  \fBudp\fP ؤŬѤżƤ롣
 \fBtcp[0]\fP  TCP \fIإå\fP κǽΥХȤ̣뤬ե
ȤƬΥХȤǤϤꤨʤ
.LP
Ǥʣ礵Ѥ:
.IP
̤ǥ롼ʬǤȱ黻(̤ϥˤȤäƤ̤ʰ̣ĤΤǤ֤󥨥פʤФʤʤ)
.IP
 (`\fB!\fP' or `\fBnot\fP').
.IP
 (`\fB&&\fP' or `\fBand\fP').
.IP
 (`\fB||\fP' or `\fBor\fP').
.LP
ϤäȤ⤤ͥ٤ġȷƱͥ٤ޤ
ɾ롣
ʻǤʤŪ \fBand\fR ȡɬפʤȤդ뤳ȡ
.LP
ɤʤǼ̻Ҥ줿硢ľˤ줿ɤ
ʤäƤȤߤʤ롣
ȤС
.in +.5i
.nf
\fBnot host vs and ace\fR
.fi
.in -.5i

.in +.5i
.nf
\fBnot host vs and host ace\fR
.fi
.in -.5i
ξάǤꡢ
.in +.5i
.nf
\fBnot ( host vs or ace )\fR
.fi
.in -.5i
Ȥϰ㤦
.LP
tcpdump ϤＰԹΤ褤褦ˡñȤƤʣȤƤ褤̤˥Υ᥿饯ޤ褦ʾＰξñΥȤȤϤΤ褤ʣΰɾľ˶Ƿ礵롣
.SH 
.LP
ۥ \fIsundown\fP ˤƤϥѥåȤɽ:
.RS
.nf
\fBtcpdump host sundown\fP
.fi
.RE
.LP
ۥ \fIhelios\fR  \fIhot\fR 뤤 \fIace\fR Ȥ̿ɽ:
.RS
.nf
\fBtcpdump host helios and \\( hot or ace \\)\fP
.fi
.RE
.LP
ۥ \fIace\fR  \fIhelios\fR ƤΥۥȤȤIPѥåȤɽ:
.RS
.nf
\fBtcpdump ip host ace and not helios\fP
.fi
.RE
.LP
ͥåȤΥۥȷȥͥåȥ Berkeley ΥۥȷȤ̿ɽ:
.RS
.nf
.B
tcpdump net ucb-ether
.fi
.RE
.LP
󥿡ͥåȤؤΥȥ \fIsnup\fP ̲᤹Ƥ ftp ̿ɽ(Ｐϥ뤬̤(ä)᤹Τ򤱤뤿˥ȤƤդ):
.RS
.nf
.B
tcpdump 'gateway snup and (port ftp or ftp-data)'
.fi
.RE
.LP
ۥȤؤϤ̿ɽ(¾ΥͥåȥؤΥȥǤȤơͥåȥ):
.RS
.nf
.B
tcpdump ip and not net \fIlocalnet\fP
.fi
.RE
.LP
ۥȰʳؤ TCP ̿ TCP ȤȥɤΥѥå(SYN  FIN Υѥå)ɽ:
.RS
.nf
.B
tcpdump 'tcp[13] & 3 != 0 and not src and dst net \fIlocalnet\fP'
.fi
.RE
.LP
ȥ \fIsnup\fP ̲᤹ 576 ХȰʾ IP ѥåȤɽ
:
.RS
.nf
.B
tcpdump 'gateway snup and ip[2:2] > 576'
.fi
.RE
.LP
ͥåȤΥ֥ɥ㥹Ȥޤϥޥ㥹Ȥ
.I ɬפȤʤ
IP Υ֥ɥ㥹Ȥޤϥޥ㥹Ȥɽ:
.RS
.nf
.B
tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
.fi
.RE
.LP
echo ׵/(Ĥޤ ping Υѥå)ʳΤ٤Ƥ ICMP ѥåȤɽ:
.RS
.nf
.B
tcpdump 'icmp[0] != 8 and icmp[0] != 0"
.fi
.RE
.SH Ϸ
.LP
\fItcpdump\fP νϤϥץȥ˰¸롣ʬͼδñʲǤ롣
.de HD
.sp 1.5
.B
..
.HD
󥯥٥إå
.LP
`-e' ץ󤬻ؼƤ硢󥯥٥إåɽ롣
ͥåȤǤϥӥǥƥ͡Υɥ쥹ȥѥåĹɽ롣
.LP
FDDI ΥͥåȥˤƤ '-e' ץˤ \fItcpdump\fP ϡ
ӥǥƥ͡Υɥ쥹ȥѥåĹʤե졼եɤɽ롣(ե졼եɤϥѥåȤλĤʬβ
򤪤ʤ)(IP ǡޤ褦)̾ΥѥåȤͥ 
0  7 `async' ѥåȤǤ;Ȥ `\fBasync 4\fR'
褦ʥѥåȤ 802.2 LLC ޤȤߤʤ롣LLCإåϤ줬 ISO 
ǡ䤤 SNAP ѥå \fIǤʤ\fR ʤСɽ롣
.LP
\fI(:ʲεҤ RFC-1144 ˤ SLIP ̥르ꥺ򤷤ƤΤ
ߤʤƵҤƤ)\fP
.LP
SLIP ³Ǥϡؼ(``I''ϡ``O'')ѥåȥפȰ̾ɽ롣
ǽ˥ѥåȥפɽ롣
פˤ \fIip\fP\fIutcp\fP\fIctcp\fP λब롣
\fIip\fR ѥåȤˤĤƤʾΥ󥯾ɽʤ
TCPѥåȤ³̻Ҥɽ롣
ѥåȤ̤ƤϤ沽줿إåɽ롣
\fB*S+\fIn\fR\fB*SA+\fIn\fR 
ɽ̤ʾ֤⤢롣 \fIn\fR ϥֹ(ޤϥֹ ack)ѹ줿򼨤
̤ʾǤʤСޤѹβϤ롣
ѹ U(urgent pointer)W(windows)A(ack)S(sequence number)I(packet ID)˺ʬ(+n  -n)ޤϿ(=n)ȹ礻Ǽ롣
Ǹ˥ѥåȤΥǡ٤ƤȰ̤줿إåĹɽ롣
.LP
줿³̻ҤĽϤ밵TCPѥåȤ򼨤
ack  6󹹿졢ֹ 49Ǥ ѥåȤ ID 6Ǥ;
3ХȤΥǡ6ХȤΰ̥إå
.RS
.nf
\fBO ctcp * A+6 S+49 I+6 3 (6)\fP
.fi
.RE
.HD
ARP/RARP ѥå
.LP
arp/rarp Ϥ׵ΥפȤΰɽ롣եޥåȤ켫
ȤƤȤʤ롣ûϥۥ \fIrtsg\fP  \fIcsam\fP ؤ `rlogin' γϻΤΤǤ롣
.RS
.nf
.sp .5
\f(CWarp who-has csam tell rtsg
arp reply csam is-at CSAM\fP
.sp .5
.fi
.RE
ܤ rtsg  󥿡ͥåȥۥ csam Υͥåȥɥ쥹Ҥͤ arp ѥåȤͻҡcsam ϥͥåȥɥ쥹ֿƤ(ǥͥåȥɥ쥹ʸǡ󥿡ͥåȥɥ쥹ϾʸɽƤ)
.LP
 \fBtcpdump \-n\fP Ǽ¹ԤȤΤ褦˴ά:
.RS
.nf
.sp .5
\f(CWarp who-has 128.3.254.6 tell 128.3.254.68
arp reply 128.3.254.6 is-at 02:07:01:00:01:c4\fP
.fi
.RE
.LP
\fBTcpdump \-e\fP Ǽ¹ԤȺǽΥѥåȤ֥ɥ㥹Ȥܤ point-to-point Ǥ뤳ȤƤȤ:
.RS
.nf
.sp .5
\f(CWRTSG Broadcast 0806  64: arp who-has csam tell rtsg
CSAM RTSG 0806  64: arp reply csam is-at CSAM\fP
.sp .5
.fi
.RE
ǽΥѥåȤ source Υͥåȥɥ쥹 RTSG ǡǥƥ͡󤬥ͥåȤΥ֥ɥ㥹ȤǤꡢץեɤϽϻʤ 0806(ETHER_ARP)Ĺ 64 ХȤǤ뤳Ȥ狼롣
.HD
TCP ѥå
.LP
\fI(: ʲ RFC-793 ǵҤ TCPץȥ򤷤ƤΤ
ߤʤƵҤƤ롣⤷Υץȥ̤Ƥʤ褦ʤ顢ε
ҤǤʤtcpdump ΤΤ䤯ˤʤ)\fP
.LP
ŪʥեޥåȤϲ̤:
.RS
.nf
.sp .5
\fIsrc > dst: flags data-seqno ack window urgent options\fP
.sp .5
.fi
.RE
\fIsrc\fP  \fIdst\fP  ȥǥƥ͡Ȥʤ IPɥ
ȥݡֹǤ롣\fIflags\fP  S(SYN)F(FIN)P(PUSH) R(RST) ȹ礻Ĥ `.'(ե饰ʤ)Ǥ롣\fIdata-seqno\fP ϤΥѥåȤ˴ޤޤǡΥ󥹶֤ΰ򼨤(򻲾)\fIack\fP Ϥ³ˤ뼡δԤ
ǡΥֹ档\fIwindow\fP Ϥ³ˤФѰդƤХåե֤ΥХȿ\fIurg\fP ϤΥѥåȤ `urgent' ǡޤޤ뤳Ȥ򼨤\fIoptions\fP  tcp Υץ <>ǰϤޤ(<mss 1024>)
.LP
\fIsrcdst\fP  \fIflags\fP Ϥʤ餺ɽ롣¾ΥեɤϥѥåȤ TCP ץȥإå˰¸ΤɬפʾΤɽ롣
.LP
ϥۥ \fIrtsg\fP  \fIcsam\fP ؤrlogin γϻΰ
.RS
.nf
.sp .5
\s-2\f(CWrtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024>
csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024>
rtsg.1023 > csam.login: . ack 1 win 4096
rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096
csam.login > rtsg.1023: . ack 2 win 4096
rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096
csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077
csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1
csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1\fP\s+2
.sp .5
.fi
.RE
ܤ rtsg  tcp port ֹ 1023  csam  \fIlogin\fP ݡȤ
ѥåȤɽǤ롣\fBS\fP  \fISYN\fP ե饰åȤƤ뤳
Ȥ򼨤ѥåȤΥֹ 768512 ǤΥѥåȤϥǡ
ޤޤʤ(Τ褦 \fInbytes\fP ХȤΥ桼ǡޤॷ
ֹ \fIfirst\fP 顢\fIlast\fP (last ϴޤޤʤ)򼨤 
`first:last(nbytes)'ɽ)ޤΥѥåȤˤ ack ꤵ
餺 window  4096 Хȡ祻ȥ(mss)ץ
  1024 ХȤꤵƤ
.LP
Фơcsam  rtsg  SYN Ф ack ޤ¾ƱƤΥѥåȤ֤Ƥ롣ǡrtsg  csam  SYN  ack ֤
`.' ϥե饰åȤƤʤȤ򼨤ΥѥåȤˤϥǡޤޤʤΤǡֹʤack ΥֹϾ 1 Ǥդ뤳ȡ
ǽ tcp Ρֲáפ򸫤ȡ\fBtcpdump\fP ϤΥѥåȤΥ
ֹϤ롣βäΥѥåȤϡΥֹ
줿ֹȤκۤɽ롣
ϺǽʳΥֹϤβäΥǡˤŪ
ХȰ֤ȤƲǤ뤳Ȥ̣ (ƥǡ 1 Ϥ
) '-S' ץϤεǽ̵뤷ơΥֹϤ롣
.LP
6 ܤ rtsg  scam  19 Х(rtsg  csam ء2 Х
 20 Хܤޤ)
Υǡ롣ΥѥåȤˤ PUSH ե饰ꤵƤ롣7 ܤǡ
csam  rtsg ǡȸäƤ뤬ˤ 21 
Хܤϴޤޤʤcsam μ window  19 ХȾʤäƤ뤳Ȥ
顢ΥǡϥåȥХåեαޤäƤȿ¬롣csam Ϥ
 1ХȤΥǡ rtsg 롣8 ܤ 9 ܤȤ csam  
urgent  pushed դΥѥå 2Х rtsg Ƥ롣
.LP
⤷snapshot  \fBtcpdump\fP  TCP إåƤªʤäϡǤ
β򤷤ơλĤˤϲǽäΤ뤳Ȥ򼨤
``[|\fItcp\fP]''ɽ롣إå˰̣ʥץ(ȤС
ꡢإåĹäꤹ length Ȥ)ꤵƤ
ϡtcpdump  ``[\fIbad opt\fP]''ɽʾΥץ
ߤ(줬ɤϤ뤫狼ʤΤ)إåĹץ
Ȥ򼨤ƤΤˡIP ǡĹϤ˥ץޤʤȤ򼨤 tcpdump  ``[bad hdr length]''ɽ롣
.HD
.B
UDP ѥå
.LP
UDP Ϥ rwho ΥѥåȤ:
.RS
.nf
.sp .5
\f(CWactinide.who > broadcast.who: udp 84\fP
.sp .5
.fi
.RE
ϥۥ \fIactinide\fP  \fIwho\fP ΥݡȤ udp ǡ
ۥ \fIbroadcast\fP ʤ󥿡ͥåȥ֥ɥ㥹ȥɥ
 \fIwho\fP ΥݡȤ줿ȤɽƤ롣ѥåȤϥ桼ǡ 84 
ХȤޤǤ롣
.LP
ĤΤ UDP ӥ˴ؤƤ(Υޤϥǥ͡
Υݡֹ)᤹뤳ȤǤ̤ؤˤץȥ
ɽ롣ä˥ɥᥤ͡ॵӥ׵(RFC-1034/1035)
NFS ˤĤƤ Sun RPC (RFC-1050)ˤĤƽϤ롣
.HD
UDP ͡ॵӥ׵
.LP
\fI(:ʲ RFC-1035 ǵҤ ɥᥤ͡ॵӥץȥ
򤷤ƤΤȤߤʤƵҤƤ롣⤷Υץȥ̤Ƥʤ褦ʤ顢ʲεҤϤפ󤫤פ󤫤⤷ʤ)
.LP
͡ॵФ׵ϡ
.RS
.nf
.sp .5
\fIsrc > dst: id op? flags qtype qclass name (len)\fP
.sp .5
\f(CWh2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37)\fP
.sp .5
.fi
Τ褦ʷǤ롣
.RE
ۥ \fIh2opolo\fP  \fIhelios\fP Υɥᥤ͡ॵФФơ\fIucb-bax.berkeley.edu.\fP Ȥ̾ˤĤƤΥɥ쥹쥳(qtype=A)Ҥͤ롣䤤礻 
id  `3'`+'ϺƵǽ(\fIrecursion desired\fP)ե饰ꤵƤ뤳Ȥ򼨤
䤤碌 UDP  IP Υإåϴޤޤ᤺ 37ХȤ롣礻ɸŪ \fIQuery\fP ʤΤ op եɤϾάƤ롣⤷op ե
Ĥʤ顢줬ʤǤ졢`3'  `+' δ֤ɽ롣ޤƱͤˡ
礻饹(qclass)ɸŪ \fIC_IN\fP ʤΤǡάƤ롣ۤ礻
ξ `A' ³ɽ롣
.LP
㳰ŪʤΤ򸡽Ф硢ɲäΥեɤ[ ] ǰϤɽ
:⤷礻(query)˲͡ॵСҥ󤬴ޤޤ硢
.IR ancount ,
.IR nscount ,
.IR arcount
Ϥ줾\fIn\fP 򥫥ȿȤơ
`[\fIn\fPa]'`[\fIn\fPn]'  `[\fIn\fPau]' Τ褦ɽ롣
⤷󤪤軰ХȤˤĤαbitꤵƤ(AARA
ޤ rcode)礫`must be zero' ӥåȤꤵƤ
`[b2&3=\fIx\fP]'ɽ롣 \fIx\fP ϥإå󤪤軰ХȤνϻɽǤ롣
.HD
UDP ͡ॵб
.LP
͡ॵФαϡ
.RS
.nf
.sp .5
\fIsrc > dst:  id op rcode flags a/n/au type class data (len)\fP
.sp .5
\f(CWhelios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273)
helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97)\fP
.sp .5
.fi
Τ褦ʷǤ롣
.RE
ǽǤϡ\fIhelios\fP  \fIh2opolo\fP  id 3 ׵˻Ĥβ
쥳ɡĤΥ͡ॵХ쥳ɤȼĤθҥ쥳ɤƤ롣
ǽβ A 쥳ɤǡΥǡϥ󥿡ͥåȥɥ쥹 128.32.137.3 Ǥ롣
Υ UDP  IP Υإåϴޤޤ 273 ХȤǤ롣
(query) op  response code(ξ NoError)ϡA 쥳ɤΥ
(C_IN)Ʊͤ˾άƤ롣
.LP
 \fIhelios\fP ϥɥᥤ¸ߤʤȤ response code
(NXDomain) DzϤʤ͡ॵФϰġҥ쥳ɤʤȤ򤷤Ƥ롣
`*'  \fIauthoritative answer\fP ӥåȤꤵƤ뤳Ȥ򼨤
ʤΤǡ type ȥ饹ӥǡɽʤ 
.LP
ۤΥե饰`\-'(RA(Ƶ)ꤵ\fIʤ\fP)`|'TC(ޤ
줿å)ꤵƤ롣`question' 󤬰ĤǤʤ
ˤϡ`[\fIn\fPq]'ȽϤ롣
.LP
͡ॵФαϥǥեȤ \fIsnaplen\fP Ǥ 68ХȤ
ʤ꤬ʤΤǡΥѥåȤɽΤ˽ʬʤξª
ʤȤ롣
͡ॵӥ̩̿˲ϤȤϡ\fB\-s\fP ե饰Ѥơsnaplen ĥ٤Ǥ롣\fB\`-s 128\fP'餤Ǥ

.HD
NFS ׵Ȳ
.LP
Sun NFS(Network File System)׵ȱϼΤ褦˽Ϥ:
.RS
.nf
.sp .5
\fIsrc.xid > dst.nfs: len op args\fP
\fIsrc.nfs > dst.xid: reply stat len op results\fP
.sp .5
\f(CW
sushi.6709 > wrl.nfs: 112 readlink fh 21,24/10.73165
wrl.nfs > sushi.6709: reply ok 40 readlink "../var"
sushi.201b > wrl.nfs:
	144 lookup fh 9,74/4096.6878 "xcolors"
wrl.nfs > sushi.201b:
	reply ok 128 lookup fh 9,74/4134.3150
\fP
.sp .5
.fi
.RE
ܤϥۥ \fIsushi\fP  id \fI6709\fP ǥȥ󥶥׵ \fIwrl\fP Ƥ (src ۥȤ³ port ֹ \fIǤϤʤ\fP ȥ󥶥 id Ǥդ)
׵ UDP  IP Υإå 112 ХȤǤ롣ư׵ϥեϥɥ(\fIfh\fP) 21,24/10.731657119 Ф \fIreadlink\fP (ܥå󥯤ͤɤ)Ǥ롣
(ǤϡʤȤˡǥХ major  minor ֹФ 
inode ֹ桢generation ֹ椬եϥɥ뤫ФǤƤ)
\fIWrl\fP ϥ󥯤Ƥ `ok' Ƥ롣
.LP
ܤǤ \fIsushi\fP  \fIwrl\fP Ф ǥ쥯ȥե 9,74/4096.8678  
`\fIxcolors\fP' õФ褦׵ᤷƤ롣Ϥǡ
ˤäư¸Ƥ뤳Ȥդ衣νϷ NFS ץȥ
ͤȤȤɤ˼ˤʤ褦տޤ줿Ǥ롣
.LP
-v(verbose) ե饰ͿƤ硢ɲäξϤ롣:
.RS
.nf
.sp .5
\f(CW
sushi.1372a > wrl.nfs:
	148 read fh 21,11/12.195 8192 bytes @ 24576
wrl.nfs > sushi.1372a:
	reply ok 1472 read REG 100664 ids 417/0 sz 29388
\fP
.sp .5
.fi
.RE
(\-v  IP إå TTL  IDե饰ơեɤɽ
ǤϾάƤ)ܤǤϡ\fIsushi\fP  \fIwrl\fP Фơ file 21,11/12.195 ΥХȥեå 24576  8192 Хɤ߽Ф׵
Ƥ롣\fIWrl\fP  `ok' ֤Ƥ; ܤɽƤ뤳Υ
åȤϥե饰Ȳ줿ΰܤΥѥåȤǤ뤿ᡢ1472 
ȤΤߤǤ(ĤΥХȤϤθΥե饰ȤȤ³
Υե饰Ȥ NFS إå UDP إåʤΤǡե륿Ｐλ꼡ɽʤȤ)
ޤ \-v ե饰Ƥ뤳ȤˤꡢĤΥե°
ɽ(եǡղä): եΥ
(``REG'' ̤Υե)եΥ⡼(Ȭʤ)uid  gidޤեΥʤɡ
.LP
\-v ե饰ʣͿ(\-vvΤ)äȾܺ٤ʾ󤬽Ϥ롣
.LP
NFS ׵ϤȤƤ礭Τǡsnaplen äʤȽʬʾɽ
ʤ⤷ʤȤդ衣NFS ̿ƻ뤹 `\fB\-s 192\fP' ƤߤȤ褤
.LP
NFSѥåȤ RPCˤäƼ̤뤳ȤǤʤʤ
顢\fItcpdump\fP  ``Ƕ''׵ФƤơΥȥ
 ID˰פ뤫Ĵ٤롣б׵ζ᤯̿ƤʤϤȲϤǤʤ⤷ʤ
.HD
KIP åץȡ (UDP  DDP)
.LP
UDP ǡ˳Ǽ줿åץȡ DDP ѥåȤϼФơDDP ѥåȤȤɽ(ʤ٤Ƥ UDP إåϼΤƤ)
.I /etc/atalk.names 
ե뤬 åץȡͥåȤȥΡֹ̾ѴΤѤ롣եηϲ̤ꡢ
.RS
.nf
.sp .5
\fIֹ		̾\fP

\f(CW1.254	ether
16.1		icsd-net
1.254.110	ace\fP
.sp .5
.fi
.RE
ǽԤϥåץȡͥåȥ̾Ϳ롣ܤΥۥȤ̾Ϳ(ۥȤϥͥåȥֹ軰ƥåȤǼ̤ \- 
ͥåȥֹ󥪥ƥåȤ \fIʤФʤ餺\fPޤۥ
ϻƥåȤ \fIʤФʤʤ\fPֹ̾϶ʸǶڤ(blank  tab)
.I /etc/atalk.names 
ե϶Ԥȥȹ(`#'ǻϤޤ)ޤǤ褤
.LP
åץȡΥɥ쥹ϼηɽ
.RS
.nf
.sp .5
\fInet.host.port\fP

\f(CW144.1.209.2 > icsd-net.112.220
office.2 > icsd-net.112.220
jssmag.149.235 > icsd-net.2\fP
.sp .5
.fi
.RE
(
.I /etc/atalk.names
ʤޤϤŬڤʥåץȡΥͥåֹ桢ۥֹ椬ޤޤʤϡɥ쥹Ͽɽ)
ǽ ͥåȥ 144.1 ΥΡ 209  NBP(DDP Υݡֹ 2 )ͥåȥ icsd ΥΡ 112 ݡֹ220 ֤ؤ򼨤
ܤƱͤΡ̾(`office') 狼äƤ㡣
ܤϥͥåȥ jssmag ΥΡ 149  235 ֥ݡȤ icsd-net  NBPݡȤؤΥ֥ɥ㥹Ȥ򼨤
֥ɥ㥹ȥɥ쥹(255)ϥۥֹȼʤͥåȥ̾ν
ϤǼ̤Ǥ뤳Ȥդ뤳 \- /etc/atalk.names ˥Ρ̾ȥͥ
ȥ̾򵭽ҤƤΤϤ褤ͤǤ)
.LP
NBP(̾ץȥ) ATP(åץȡȥ󥶥ץȥ)ѥåȤˤĤƤϡƤϤ롢¾Υץȥϥץȥ̾(ޤϡ̾狼ʤСֹ)ȥѥåȤΥɽǤ

\fBNBP ѥå\fP ϼΤ褦ɽ:
.RS
.nf
.sp .5
\s-2\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"
jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250
techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fP\s+2
.sp .5
.fi
.RE
ܤϥͥåȥ icsd  ۥ 112  ͥåȥjssmag إ֥ɥ㥹Ȥ졼饤õ׵Ǥ롣nbp  id  190 
ܤϤ׵ؤΥۥ jssmag.209 α(id ֹ椬ƱǤ뤳Ȥ)ǡ``RM1140''Ȥ̾Υ졼饤 250 ֥ݡȤ˻äƤ뤳ȤƤ롣
ܤƱ׵Ф̤ǥۥ techpit 186֥ݡȤ "tecpit" ϿƤ뤳ȤƤ롣

\fBATP ѥå\fP ϼΤ褦ɽ:
.RS
.nf
.sp .5
\s-2\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001
helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:4 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:6 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp*12266:7 (512) 0xae040000
jssmag.209.165 > helios.132: atp-req  12266<3,5> 0xae030001
helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001
jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fP\s+2
.sp .5
.fi
.RE
jssmga.209 ϥۥ helios ФƤ id
12266 ǥȥ󥶥򳫻Ϥ 8ѥå(`<0-7>'ȼ)׵᤹
롣νϻʿ׵˴ޤޤ `userdata'ΥեɤǤ롣
.LP
helios ȬĤ 512 ХȤΥѥåȤƤ롣ȥ󥶥id 
³ `:' ɽϥȥ󥶥ˤѥåȤΥֹǡå˰Ϥޤ줿 atp إåѥåȤΥǡ̤Ǥ롣ѥå 7 ֤ `*'  EOM ӥåȤꤵƤ뤳Ȥ򼨤
.LP
jssmag.209 ϥѥå 3 ֤ȥѥå 5 ֤κ׵ᤷƤ롣helios 
Ϥjssmag ϥȥ󥶥λ롣ơ
jssmag.209 ϼ׵򳫻Ϥ롣׵ `*'  XO (`') \fIƤʤ\fP Ȥ򼨤

.HD
IP ե饰Ȳ(fragmentation)
.LP
󥿡ͥåȥǡΥե饰Ȳ줿ΤϼΤ褦ɽ

.RS
.nf
.sp .5
\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB+)\fR
\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB)\fR
.sp .5
.fi
.RE
(ǽηϤޤ³ե饰Ȥ뤳Ȥ򼨤ܤηϤ
줬ǸΥե饰ȤǤ뤳Ȥ򼨤)
.LP
\fIid\fP ϥե饰Ȥ id \fIsize\fP ϥե饰Ȥ IP إå(ХȤ)\fIoffset\fP ϥե饰ȤΤȤȤΥǡǤΥեå(ХȤ)
.LP
ե饰Ȥξϥե饰ɽ롣ǽΥե饰Ȥˤ
̥ץȥΥإåޤߡե饰Ⱦϥץȥ³
ɽ롣ܰʹߤΥե饰ȤˤϾ̥ץȥξޤޤʤ
Τǡե饰Ⱦϥӥǥƥ͡󥢥ɥ쥹ˤĤ
ɽ롣ʲ CSNET ³줿 arizona.edu  
lbl-rtsg.arpa   ftp ³ΰ򼨤ˤ 576ХȤΥǡϤƤʤ:
.RS
.nf
.sp .5
\s-2\f(CWarizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+)
arizona > rtsg: (frag 595a:204@328)
rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560\fP\s+2
.sp .5
.fi
.RE
Ĥ: ܤȤơܤǼ륢ɥ쥹ˤϥݡ
ֹϴޤޤƤʤդ衣 TCP ץȥξϺǽΥե饰
˴ޤޤ뤿ᡢĤΥե饰Ȥɽ٤ݡֹ䥷
ֹ椬狼ʤǤ롣ܤϡܤ TCP Υ󥹾
ˤϼºݤˤ 512 Х(ǽΥե饰Ȥ 308 ХȡܤΥե
Ȥ204 ХȤξ)Υ桼ǡ 308 ХȤǤ뤫Τ褦
ɽƤǤ롣󥹤ϳѥåȤ ack бĴ
ȤǺޤ뤳Ȥ뤫⤷ʤ
.LP
\fIե饰Ȳػߥե饰\fP ꤵ줿ѥåȤξ硢 \fB(DF)\fPɽ롣 
.HD
ɽ
.LP
ǥեȤǤƤνϹԤˤϥॹפԤ롣ॹפϸߤλ򼡤ηɽ
.RS
.nf
\fIhh:mm:ss.frac\fP
.fi
.RE
ϡkernel λ־ƱͤΤǤ롣ॹפ kernel 
ѥåȤǧλȿǤƤ롣ͥåȥ󥿡ե
ѥåȤ饫ͥ뤬 `ѥå' ˤ
ߤޤǤλֺȿǤƤʤ
.SH Ϣ
traffic(1C), nit(4P), bpf(4), pcap(3)
.SH 
Van Jacobson,
Craig Leres and
Steven McCanne, all of the
Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
.LP
ǿǤϲ ftp ǽǤ:
.LP
.RS
.I ftp://ftp.ee.lbl.gov/tcpdump.tar.Z
.RE
.SH Х
Хä tcpdump@ee.lbl.gov ޤäƤۤ
.LP
NIT ϳؽФƤ̿ϸ뤳ȤǤʤBPF Ϥ줬ǽǤ롣ԤѤ侩롣
.LP
ӤˤäƤϡIPե饰Ȥƹۤꡢ̥ץȥĹ׻뤯餤ΤȤɬפȤʤ
.LP
͡ॵФεհ׵ΤɽǤʤ()Ϥष
˴ޤޤ׵Ȥɽ롣հ׵ˤϥХդޤƤơ
Τ tcpdump ǤϤʤƥ͡ॵӥǤ٤ȹ
Ƥͤ⤤롣
.LP
åץ EtherTalk  DDP ѥåȤ KIP DDP ѥåȤΤ褦ưפ 
dump ǤϤԤʤʤȤ ethertalk 򰷤Ȥˤʤ
Ƥ(ʤäƤʤ)LBL ͥåȥethertalk ؤΥ
ʤΤǡɤΥƥȤǤʤΤ
.LP
ƻ֤ˤ꤫Ȥ˥ѥåȥȥ졼ԤʤäƤȻ֤Ƥ
ޤ(֤ѹ̵뤵)
.LP
FDDI إåФե륿ξＰϤ٤Ƥ FDDI ѥåȤͥå
ΥѥåȤ򥫥ץ벽ƤΤȤߤʤŬѤ롣ϡIP,ARP  DECNET PhaseIV ˤĤƤư뤬ISO CLNS Τ褦ʥץȥǤϤޤʤ椨˥ե륿ϾＰ˰פʤ褦ʥѥåȤ򤢤ޤäƤĤäƤޤ⤷ʤ