.\" @(#) $Header: /tcpdump/master/tcpdump/tcpdump.1,v 1.72.2.3 2000/07/13 05:53:47 guy Exp $ (LBL)
.\"
.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
.\"	The Regents of the University of California.  All rights reserved.
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that: (1) source code distributions
.\" retain the above copyright notice and this paragraph in its entirety, (2)
.\" distributions including binary code include the above copyright notice and
.\" this paragraph in its entirety in the documentation or other materials
.\" provided with the distribution, and (3) all advertising materials mentioning
.\" features or use of this software display the following acknowledgement:
.\" ``This product includes software developed by the University of California,
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
.\" the University nor the names of its contributors may be used to endorse
.\" or promote products derived from this software without specific prior
.\" written permission.
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.\" Japanese Version Copyright (c) 1998
.\"           MAEHARA Kohichi
.\"                  &
.\"           HANATAKA Shinya
.\"         all rights reserved.
.\" Translated Tue Jan 6 00:00:00 JST 1998
.\"     by  MAEHARA Kouhichi <maeharak@kw.netlaputa.ne.jp>
.\"     by  HANATAKA Shinya <hanataka@abyss.rim.or.jp>
.\"
.\" Updated Fri Sep 11 00:55:00 JST 2000
.\"	by  Kentaro Shirakata <argrath@ub32.org>
.\"
.TH TCPDUMP 1  "30 June 1997"
.SH ̾
tcpdump \- ͥåȥΥȥեåפ
.SH 
.na
.B tcpdump
[
.B \-adeflnNOpqRStvxX
] [
.B \-c
.I count
] [
.B \-F
.I file
]
.br
.ti +8
[
.B \-i
.I interface
]
[
.B \-m
.I module
]
[
.B \-r
.I file
]
.br
.ti +8
[
.B \-s
.I snaplen
]
[
.B \-T
.I type
]
[
.B \-w
.I file
]
.br
.ti +8
[
.I expression
]
.br
.ad
.SH 
.LP
\fItcpdump\fP Ͽͤ \fIＰ\fP ˰פͥåȥ󥿡եΥѥåȤΥإåɽ롣
.LP
.B nit  bpf Ѥ SunOSξ:
.I tcpdump 
ư뤿ˤ 
.I /dev/nit 
 
.I /dev/bpf* 
ɤ߹߸¤äƤɬפ롣
.B dlpi Ѥ Solaris ξ:
ۥͥåȥǥХȤ 
.IR /dev/le
ȤäΤɤ߹߸¤äƤɬפ롣
.B dlpi Ѥ HP-UX ξ:
¹ԼԤ root Ǥ뤫ޤ root  setuid ƥ󥹥ȡ뤵Ƥɬפ롣
.B snoop Ѥ IRIX ξ:
¹ԼԤ root Ǥ뤫ޤ root  setuid ƥ󥹥ȡ뤵Ƥɬפ롣
.B Linux ξ:
¹ԼԤ root Ǥ뤫ޤ root  setuid ƥ󥹥ȡ뤵Ƥɬפ롣
.B Ultrix  Digital UNIX ξ:
ޤѡ桼 
.IR pfconfig(8) 
Ѥ̵Ʃ⡼(promicuous-mode)ͭˤɬפ롣
θϰ̥桼 
.BR tcpdump 
¹ԲǽǤ롣
.B BSD ξ: 
.IR /dev/bpf* 
Фɤ߹߸¤ɬס
.SH ץ
.TP
.B \-a
ͥåȥȥ֥ɥ㥹ȥɥ쥹 DNS ̾Ѵ롣
.TP
.B \-c
\fIcount\fP ĤΥѥåȤΤ˽λ롣
.TP
.B \-d
ѥ뤵줿ѥåȥޥå󥰥ɤʹ֤ɤɸϤ˥פλ롣
.TP
.B \-dd
ѥåȥޥå󥰥ɤ 
.B C
ΰȤѲǽʤǥפ롣
.TP
.B \-ddd
ѥåȥޥå󥰥ɤ ʿǥפ(count Ԥ)
.TP
.B \-e
ƥ׹Ԥ˥󥯥٥إåɽ롣
.TP
.B \-f
ֳΡץ󥿡ͥåȥɥ쥹򥷥ܥǤϤʤƿͤɽ
(Υץϼ Sun  yp ӥ򱪲󤹤뤳ȤտޤƤ 
\(em Sun  yp ӥϥǤϤʤ󥿡ͥåȥɥ쥹Ѵ褦Ȥ
ʵפưߤƤޤХ)
.TP
.B \-F
ե륿ＰλؼϤȤ \fIfile\fP Ѥ롣
θ˥ޥɥ饤ǾＰˤؼͿƤ̵뤹롣
.TP
.B \-i
\fIinterface\fP ƻ뤹롣
ؼΤʤ tcpdump ϥƥΥ󥿡եΥꥹȤ
Ǥ⾮ֹͭˤʤäƤ(â롼ץХåϽ)õФ
ؼ줿󥿡ե¸ߤʤϤäȤᤤΤ򤵤롣
.TP
.B \-l
ɸϤХåե󥰤롣ǡѤʤƻ뤹ͭ
롣:
.br
``tcpdump\ \ \-l\ \ |\ \ tee dat'' or
``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''.
.TP
.B \-n
ɥ쥹(ۥȥɥ쥹ݡֹʤ)̾Ѵʤ
.TP
.B \-N
ۥȤΥɥᥤ̾ɽʤ
ĤޤꤳѤ \fItcpdump\fP ``nic.ddn.mil'' ɽ뤫 ``nic'' ɽ롣
.TP
.B \-m
SMI MIB ⥸塼ե \fImodule\fR ɤ߹ࡣ
ʣ MIB ⥸塼ɤ߹Ūǡ
ΥץʣѤ뤳Ȥ롣
.TP
.B \-O
ѥåȥޥå󥰥ɥץƥޥߤ롣
ϥץƥޥΥХ򵿤äƤˤΤͭפǤ롣
.TP
.B \-p
̵Ʃ⡼ɤ \fIѤʤ\fPʤ顢¾ͳǥ󥿡
ե̵Ʃ⡼ɤˤʤäƤޤȤ⤢뤳Ȥդ뤳ȡ
Τ `-p' ץ `ether host {loca-lw-addr} or ether broadcast' 
ξάȤƤϻѤǤʤ
.TP
.B \-q
Ф䤤(ȤŤ)ϡꤵ줿ץȥξ󤷤ϤʤΤǡϹԤûΤȤʤ롣
.TP
.B \-r
ѥåȤ(-w ץǺ)\fIfile\fRɤ߹ࡣ
\fIfile\fRȤ ``-'' ꤷˤɸϤѤ롣
.TP
.B \-s
ǥեȤ 68 Х(SunOS  NIT ǤϺǾϼºݤˤ 96 Х)ä \fIsnaplen\fP ХȤ򤪤ΤΤΥѥåȤФѤ롣
IP, ICMP, TCP, UDP ˤĤƤ 68 ХȤнʬ͡ॵФ NFS ξˤ­ʤ⤷ʤ()

snapshot ¤Τ˸ڤΤƤ줿ѥåȤϽϻ``[|\fIproto\fP]'' ηǼ롣
 \fIproto\fP ڤΤƤ٥бץȥ̾Ǥ롣
礭 snapshot ȤȥѥåȤ֤äޤΤۤפХåեί뤳ȤǤ̤Ƥޤդ뤳ȡ
ʤѥåȤʤǽ⤢롣ץȥξɬ׺Ǿ¤ \fIsnaplen\fP Ȥ뤳ȡ
.TP
.B \-T
"\fIexpression\fP"(Ｐ) 򤵤줿ѥåȤ˻ؼ줿 \fItype\fR Ǥؼ롣ͭ type  
\fBrpc\fR (Remote Procedure Call)
\fBrtp\fR (Real-Time Applications protocol)
\fBrtcp\fR (Real-Time Applications control protocol)
\fBsnmp\fR (Simple Network Management Protocol),
\fBvat\fR (Visual Audio Tool)
\fBwb\fR (distributed White Board)
.TP
.B \-R
ESP/AH ѥåȤŤ(RFC1825  RFC1829)˽äƤȲꤹ롣
Υץ󤬻ꤵȡ\fItcpdump\fP  relplay prevention եɤɽʤ
ESP/AH ˤϥץȥСեɤʤΤǡ
\fItcpdump\fP  ESP/AH ץȥΥС뤳Ȥʤ
.TP
.B \-S
TCP ֹͤǤϤʤͤɽ롣
.TP
.B \-t
׹Ԥ˻־ɽ\fIʤ\fP
.TP
.B \-tt
׹Ԥɽ־ʤ
.TP
.B \-v
(äȤ)ܺ٤ʽϡIP ѥåȤˤ ¸(TTL) 䥵ӥμξʤɤɽ롣
.TP
.B \-vv
äȾܺ٤ʽϡNFSѥåȤˤղåեɤʤɤɽ롣
.TP
.B \-vvv
˾ܺ٤ʽϡ
㤨Сtelnet \fBSB\fP ... \fBSE\fP ץɽ롣
.B \-X
ץꤵȡtelnet ץ 16 ɽǤɽ롣
.TP
.B \-w
ѥåȤϡɽ뤫Τޤ \fIfile\fR ˽񤭽Ф
ΥեϤȤ \-r ץѤɽ뤳ȤǤ롣
\fIfile\fR Ȥ `-' ؼɸϤѤ롣
.TP
.B \-x
(󥯥٥إå)٤ƤΥѥåȤ 16 ʤɽ롣ѥåΤ 
.I snaplen 
ХȤξɽ롣
.TP
.B \-X
16 ɽȤˡ ASCII ʸɽ롣
äơ
.B \-x
ץ⥻åȤȡѥåȤ 16 ʤ ASCII ʸξɽ롣
ϿץȥϤȤǤ롣
.B \-x
ץꤵƤʤƤ⡢
ѥåȤʬˤäƤ 16 ʤ ASCII ʸξɽ뤳Ȥ⤢롣
.IP "\fI expression(Ｐ)\fP"
.RS
פѥåȤμ򤹤롣
\fIexpression\fP ͿʤȤϡͥåȥΤ٤ƤΥѥåȤפ롣
ǤʤС\fIexpression\fP `true'() ȤʤѥåȤפ롣
.LP
\fIexpression\fPϰİʾ
.IR primitive ()
롣ǤϰİʾνҤԤĤ 
.I id
(̾ǤֹǤ褤)Ǥ롣ҤˤϻĤμब:
.IP \fItype\fP
Ҥ id̾ޤ id ֹ椬ؤΤμ򼨤ѲǽʤΤ 
.BR host ,
.BR net ,
.B port 
Ǥ롣: `host foo'`net 128.3'`port 20'
type Ҥ̵ϡ
.B host 
ؼƤΤȤߤʤ
.IP \fIdir\fP
Ҥ 
.I id 
˸ơޤ 
.I id 
ءΤɤ餫뤤ξ̿ꤹ롣ȤƻؼǤΤ 
.BR src ,
.BR dst ,
.BR "src or dst" ,
.B "src and dst"
Ǥ롣㡢 `src foo'`dst net 128.3'`src or dst port ftp-data'
dir Ҥꤵʤ 
.B "src or dst"
ؼƤΤȤߤʤ`null' (ʤ slip Τ褦
ʥݥȥġݥȥץȥ)ˤƤϡꤹ뽤ҤȤ
.B inbound
 
.B outbound 
ѲǽǤ롣
.IP \fIproto\fP
ҤϰפΥץȥ¤롣Ѳǽʥץȥϰʲ̤:
.BR ether ,
.BR fddi ,
.BR mopdl ,
.BR ip ,
.BR ip6 ,
.BR arp ,
.BR rarp ,
.BR decnet ,
.BR lat ,
.BR sca ,
.BR moprc ,
.BR mopdl ,
.BR icmp ,
.BR icmp6 ,
.BR tcp ,
.BR udp 
: `ether src foor'`arp net 128.3'`tcp port 21'
proto Ҥؼʤ type ̷⤷ʤϰϤƤΥץȥ
뤬ؼƤΤȤߤʤ
: `src foo'  `(ip or arp or rarp) src foo' 
(Τ褦ʽʸˡޤ)̣
`net bar'  `(ip or arp or rarp) net bar' ̣
ޤ `port 53'  `(tcp or udp) port 53' ̣롣
.LP
[`fddi'ϼºݤˤ `ether' ̾Ǥ;ϻ``Υͥåȥ
󥿡եѤǡ''Ȥư롣FDDI إ
ϥͥåŪʥӥǥƥ͡󥢥ɥ쥹ޤߡ
ͥåŪʥѥåȥפޤΤǡ FDDI եɤ 
ͥåȤƱȤ̤Ǥ롣FDDI إåˤϤ¾Υե
ޤޤ뤬ˤĤƤϥե륿ξＰŪ˻ؼ뤳ȤϤ
ʤ]
.LP
嵭˲äơ̤`'򼨤ɤ롣
.BR gateway ,
.BR broadcast ,
.BR less ,
.B greater
arithmtic expression(ͤˤＰ)Ǥ롣ˤĤƤϤΤȤǵҤ롣
.LP
äʣʥե륿Ｐ 
.BR and ,
.BR or ,
.B not 
ȳǤȹ礻ɽǤ롣
:`host foo and not port ftp and not port ftp-data'
ŪʽҤϾάƥ׿򸺤餹ȤǤ롣
:`tcp dst port ftp or ftp-data or domain' 
`tcp dst prot ftp or tcp dst port ftp-data or tcp dst prot domain'Ʊ̣Ǥ롣
.LP
ƤǤȤ߹碌ϰʲ̤ꡣ
.IP "\fBdst host \fIhost\fR"
ѥåȤ IPv4/v6 ǥƥ͡եɤ \fIhost\fP ǤȤɥ쥹Ǥ̾Ǥ褤
.IP "\fBsrc host \fIhost\fR"
ѥåȤ IPv4/v6 եɤ \fIhost\fP ǤȤ
.IP "\fBhost \fIhost\fP
ѥåȤ IPv4/v6 ޤ IP/v4/v6 ǥƥ͡եɤ \fIhost\fP ǤȤ
嵭γ host 򼨤Ｐˤ \fBip\fP\fBarp\fP\fBrarp\fP\fBip6\fP Τ줫ղäƤ褤
.in +.5i
.nf
\fBip host \fIhost\fR
.fi
.in -.5i
ϲƱ
.in +.5i
.nf
\fBether proto \fI\\ip\fB and host \fIhost\fR
.fi
.in -.5i
⤷ \fIhost\fP ̾ʣ IP ɥ쥹ĻϤ줾Υɥ쥹˰פ롣
.IP "\fBether dst \fIehost\fP
ͥåȥǥƥ͡󥢥ɥ쥹 \fIehost\fP ǤȤ˿
\fIehost\fP  /etc/ethers ͤǤ(ͤΥեޥåȤˤĤƤ 
.IR ethers (3N)
򻲾ȤΤ)
.IP "\fBether src \fIehost\fP
ͥåȥɥ쥹 \fIehost\fP ǤȤ˿
.IP "\fBether host \fIehost\fP
ͥåȥɥ쥹ǥƥ͡󥢥ɥ쥹 \fIehost\fP ǤȤ˿
.IP "\fBgateway\fP \fIhost\fP
ѥåȤ \fIhost\fP 򥲡ȥȤƤȤ˿
ʤͥåȥ/ǥƥ͡󥢥ɥ쥹 \fIhost\fP Ǥ뤬
IP /ǥƥ͡󥢥ɥ쥹 \fIhost\fP ǤϤʤȤΤȡ
\fPhost\fP ̾Ǥꡢޤ /etc/hosts  /etc/ethers ξ˵ܤƤʤФʤʤ
(ξＰ \fIhost / ehost\fP 줾ֹ̾ǵҤ
.in +.5i
.nf
\fBether host \fIehost \fBand not host \fIhost\fR
.fi
.in -.5i
ƱǤ)
ʸˡϺΤȤ IPv6 ͭˤǤưʤ
.IP "\fBdst net \fInet\fR"
ѥåȤ IPv4/v6 ǥƥ͡󥢥ɥ쥹 \fInet\fP ͥåȥ
ޤǤȤ˿\fInet\fP /etc/networks ˵ܤ̾ͥå
ֹǤ( \fInetworks(4)\fP 򻲾)
.IP "\fBsrc net \fInet\fR"
ѥåȤ IPv4/v6 ɥ쥹 \fInet\fP ͥåȥΤΤǤȤ˿
.IP "\fBnet \fInet\fR"
ѥåȤ IPv4/v6 /ǥƥ͡󥢥ɥ쥹 \fInet\fP ͥåȥǤȤ˿
.IP "\fBnet \fInet\fR \fBmask \fImask\fR"
IP ɥ쥹 netmask ǥޥ \fInet\fR ˰פȤ˿\fBsrc\fR  \fBdst\fR ǽƤ褤
ʸˡ \fInet\fR  IPv6 ΤȤˤǤ뤳Ȥա
.IP "\fBnet \fInet\fR/\fIlen\fR"
IPv4/v6 ɥ쥹 \fIlen\fR ӥåȤnetmask ǥޥ \fInet\fR ˰פȤ˿\fBsrc\fR  \fBdst\fR ǽƤ褤
.IP "\fBdst port \fIport\fR"
ѥåȤ ip/tcp  ip/udp  ipv6/tcp  ipv6/udp Ǥǡ
Ԥ port ֹ椬 \fIport\fP ǤȤ˿
\fIPort\fP ֹοͤ /etc/services ˤ̾ѤǤ(
.IR tcp (4P)
 
.IR udp (4P)
򻲾ȤΤ)̾ѤƤ port ֹ protocol ξǾȹ礵롣
ֹ椫¿ŤƤ̾ѤƤ port ֹȹ礵
(: \fBdst port  513\fR  tcp/login  udp/who ξ̿ɽ뤷
\fBport domain\fR  tcp/domain  udp/domain ξɽ)
.IP "\fBsrc port \fIport\fR"
ѥåȤ \fIport\fP ֹΥݡȤ򥽡ˤƤȤ
.IP "\fBport \fIport\fR"
ѥåȤΥǥƥ͡ݡȤ \fIport\fP ǤȤ
 port ꤹＰ \fBtcp\fP  \fBudp\fP ΥɤղäƤ褤:
.in +.5i
.nf
\fBtcp src port \fIport\fR
.fi
.in -.5i
 \fIport\fP 򥽡Ȥ tcp ΥѥåȤΤߤ˰פ롣
.IP "\fBless \fIlength\fR"
ѥåȤ \fIlength\fP ʲΤȤ˿
ϲƱ:
.in +.5i
.nf
\fBlen <= \fIlength\fP.
.fi
.in -.5i
.IP "\fBgreater \fIlength\fR"
ѥåȤ \fIlength\fP ʾΤȤ˿
ϲƱ:
.in +.5i
.nf
\fBlen >= \fIlength\fP.
.fi
.in -.5i
.IP "\fBip proto \fIprotocol\fR"
ѥåȤ \fIprotocol\fP Υץȥ IP ѥå( 
.IR ip (4P)
򻲾)ΤΤǤȤ
\fIprotocol\fP ȤѤǤΤϿͤ \fIicmp\fP
\fIigrp\fP\fIudp\fP\fInd\fP\fItcp\fP Ǥ롣\fItcp\fP\fIudp\fP
\fIicmp\fP ϥɤǤ⤢ΤǡХåå(\\)ǥ
ȤƲᤵΤ򤹤ɬפ롣C-Shell Ǥ \\\\ Ȥ
ǤϥץȥإåפʤȤա
.IP "\fBip6 proto \fIprotocol\fR"
ѥåȤ\fIprotocol\fP IPv6 ѥåȤǤȤ˿
ǤϥץȥإåפʤȤա
.IP "\fBip6 protochain \fIprotocol\fR"
ѥåȤ IPv6 ѥåȤǤꡢ
Υץȥإå\fIprotocol\fRΥץȥإå˿
㤨С
.in +.5i
.nf
.\fBip6 protochain 6\fR
.fi
.in -.5i
 ץȥإå TCP ץȥ IPv6 ѥåȤ˰פ롣
ѥåȤˤϡ㤨ǧڥإå롼ƥ󥰥إå
hop-by-hopإåʤɤIPv6 إå TCP إåδ֤˴ޤޤ뤫⤷ʤ
ǤФ BPF ɤʣǡ
\fItcpdump\fP BPF ŬɤǺŬǤʤ
Τᡢ٤⤷ʤ
.IP "\fBip protochain \fIprotocol\fR"
\fBip6 protochain \fIprotocol\fR Ʊͤ IPv4 ΤΤΤǤ롣
.IP "\fBether broadcast\fR"
ѥåȤͥåȤΥ֥ɥ㥹ȤǤȤ\fIether\fP ϤʤƤ褤
.IP "\fBip broadcast\fR"
ѥåȤ IP ֥ɥ㥹ȥѥåȤǤȤ 0   1 ξΥ֥ɥ㥹ȷб˥֥ͥåȥޥˤбƤ롣
.IP "\fBether multicast\fR"
ѥåȤͥåȤΥޥ㥹ȤǤȤ\fIether\fP Ϥʤ
褤 `\fBether[0] & 1 != 0\fP'ξάˡǤ롣
.IP "\fBip multicast\fR"
ѥåȤ IP Υޥ㥹ȤǤȤ
.IP "\fBip6 multicast\fR"
ѥåȤ IPv6 ޥ㥹ȥѥåȤǤȤ
.IP  "\fBether proto \fIprotocol\fR"
ѥåȤ ether  \fIprotocol\fR ΤΤǤȤ
\fIprotocol\fP ˤֹ椫 \fIip\fP\fIip6\fP\fIarp\fP\fIrarp\fP ̾
Ѳǽμ̻ҤϥɤǤ⤢ΤǡХåå(\\)
ɤȤƲᤵΤ򤹤ɬפ롣
[ FDDI (Ȥ `\fBfddi protocol arp\fR')ξ硢ץȥμˡ
802.2 Logical Link Control (LLC) إåˤ롣̾
FDDI إåƬ֤Ƥ롣\fItcpdump\fP  ץȥ뼱̻Ҥ
ե륿ˡƤ FDDI ѥåȤ LLC إåäƤơ
 LLC إå SNAP ȸƤФˤʤäƤΤȤߤʤ ]
.IP "\fBdecnet src \fIhost\fR"
DECNET ˤƥɥ쥹``10.123''Τ褦ʥɥ쥹 DECNETΥ
ȥ͡ηǻؼ 
.I host 
ȰפȤ[DECNETΥۥȥ͡ DECNET³줿 
ultrix ƥˤƤΤѲǽǤ롣]
.IP "\fBdecnet dst \fIhost\fR"
DECNETˤƥǥƥ͡󥢥ɥ쥹 
.I host 
˰פȤ
.IP "\fBdecnet host \fIhost\fR"
DECNETˤơޤϥǥƥ͡󥢥ɥ쥹 
.I host 
˰פȤ˿
.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBdecnet\fR"
ˤ:
.in +.5i
.nf
\fBether proto \fIp\fR
.fi
.in -.5i
\fIp\fR 򤽤Τ줫ΥץȥȤΤƱǤ롣
.IP "\fBlat\fR, \fBmoprc\fR, \fBmopdl\fR"
ˤ:
.in +.5i
.nf
\fBether proto \fIp\fR
.fi
.in -.5i
\fIp\fR 򤽤Τ줫ΥץȥȤΤƱǤ롣
\fItcpdump\fP ϤΥץȥβˡΤˤΤʤ
뤳ȡ
.IP  "\fBtcp\fR, \fBudp\fR, \fBicmp\fR"
ˤ:
.in +.5i
.nf
\fBip proto \fIp\fR\fBip6 proto \fIp\fR
.fi
.in -.5i
\fIp\fR 򤽤Τ줫ΥץȥȤΤƱǤ롣
.IP  "\fIexpr relop expr\fR"
طΩƤп\fIrelop\fR(黻) ><>=<==!= Τ
줫ĤǤꡢ\fIexpr\fR(ɽ) ˤɽ (ɽˡɸ
Ū C ʸˡˤ)ɸŪ黻[+-*/&|]Ĺ黻ҡ
åȥǡ黻ҤΤ줫ѥåΥǡФŬѤˤϤΤ褦˵Ҥ:
.in +.5i
.nf
\fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
.fi
.in -.5i
\fIproto\fR  \fBetherfddiiparprarptcpudpicmpip6\fR Τ줫
оݤΥץȥؤؼ롣
\fItcp, udp\fR Ȥ¾ξ̥ץȥؤ IPv4 ǤΤѤǤ
IPv6ǤѤǤʤȤա(Ͼ轤)
ؼ줿ץȥؤˤĤƤΥХȥեåȤ \fIexpr\fR ǻꤹ롣
\fIsize\fR ؼܤեɤǤΥХȿǻؼ뤬
 onetwo ޤ four Τ줫Ѥ롣ؼΤʤ one 
ȤߤʤĹ黻Ҥϥ \fBlen\fP Ǽ졢ѥåĹͿ롣
ȤС`\fBether[0] & 1 != 0\fP'ȤＰϤ٤ƤΥޥ㥹
ˤ̿Ȥ館롣`\fBip[0] & 0xf != 5\fP' ȤＰϤ٤ƤΥ
ץդ IP ѥåȤȤ館롣`\fBip[6:2] & 0x1fff = 0\fP'ϥե
ȲƤʤǡफ 0 ֤(ǽ)ե饰Ȥɽ롣
ʤξ \fBtcp\fP  \fBudp\fP ؤŬѤżƤ롣
 \fBtcp[0]\fP  TCP \fIإå\fP κǽΥХȤ̣뤬ե
ȤƬΥХȤǤϤꤨʤ
.LP
Ǥʣ礵Ѥ:
.IP
̤ǥ롼ʬǤȱ黻(̤ϥˤȤäƤ̤ʰ̣ĤΤǤ֤󥨥פʤФʤʤ)
.IP
 (`\fB!\fP' or `\fBnot\fP').
.IP
 (`\fB&&\fP' or `\fBand\fP').
.IP
 (`\fB||\fP' or `\fBor\fP').
.LP
ϤäȤ⤤ͥ٤ġȷƱͥ٤
鱦ɾ롣
ʻǤʤŪ \fBand\fR ȡɬפʤȤդ뤳ȡ
.LP
ɤʤǼ̻Ҥ줿硢ľˤ줿ɤ
ȼäƤȤߤʤ롣
ȤС
.in +.5i
.nf
\fBnot host vs and ace\fR
.fi
.in -.5i

.in +.5i
.nf
\fBnot host vs and host ace\fR
.fi
.in -.5i
ξάǤꡢ
.in +.5i
.nf
\fBnot ( host vs or ace )\fR
.fi
.in -.5i
Ȥϰ㤦
.LP
tcpdump ϤＰԹΤ褤褦ˡñȤƤʣȤƤ褤
̤˥Υ᥿饯ޤ褦ʾＰξñΥȤȤϤΤ褤
ʣΰɾľ˶Ƿ礵롣
.SH 
.LP
ۥ \fIsundown\fP ˤƤϥѥåȤɽ:
.RS
.nf
\fBtcpdump host sundown\fP
.fi
.RE
.LP
ۥ \fIhelios\fR  \fIhot\fR 뤤 \fIace\fR Ȥ̿ɽ:
.RS
.nf
\fBtcpdump host helios and \\( hot or ace \\)\fP
.fi
.RE
.LP
ۥ \fIace\fR  \fIhelios\fR ƤΥۥȤȤIPѥåȤɽ:
.RS
.nf
\fBtcpdump ip host ace and not helios\fP
.fi
.RE
.LP
ͥåȤΥۥȷȥͥåȥ Berkeley ΥۥȷȤ̿ɽ:
.RS
.nf
.B
tcpdump net ucb-ether
.fi
.RE
.LP
󥿡ͥåȤؤΥȥ \fIsnup\fP ̲᤹Ƥ ftp ̿ɽ(Ｐϥ뤬̤(ä)᤹Τ򤱤뤿˥ȤƤդ):
.RS
.nf
.B
tcpdump 'gateway snup and (port ftp or ftp-data)'
.fi
.RE
.LP
ۥȤؤϤ̿ɽ(¾ΥͥåȥؤΥȥǤȤơͥåȥ):
.RS
.nf
.B
tcpdump ip and not net \fIlocalnet\fP
.fi
.RE
.LP
ۥȰʳؤ TCP ̿ TCP ȤȥɤΥѥå(SYN  FIN Υѥå)ɽ:
.RS
.nf
.B
tcpdump 'tcp[13] & 3 != 0 and not src and dst net \fIlocalnet\fP'
.fi
.RE
.LP
ȥ \fIsnup\fP ̲᤹ 576 ХȰʾ IP ѥåȤɽ:
.RS
.nf
.B
tcpdump 'gateway snup and ip[2:2] > 576'
.fi
.RE
.LP
ͥåȤΥ֥ɥ㥹Ȥޤϥޥ㥹Ȥ
.I ɬפȤʤ
IP Υ֥ɥ㥹Ȥޤϥޥ㥹Ȥɽ:
.RS
.nf
.B
tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
.fi
.RE
.LP
echo ׵/(Ĥޤ ping Υѥå)ʳΤ٤Ƥ ICMP ѥåȤɽ:
.RS
.nf
.B
tcpdump 'icmp[0] != 8 and icmp[0] != 0"
.fi
.RE
.SH Ϸ
.LP
\fItcpdump\fP νϤϥץȥ˰¸롣ʬͼδñʲǤ롣
.de HD
.sp 1.5
.B
..
.HD
󥯥٥إå
.LP
`-e' ץ󤬻ؼƤ硢󥯥٥إåɽ롣
ͥåȤǤϥӥǥƥ͡Υɥ쥹ȥѥåĹɽ롣
.LP
FDDI ΥͥåȥˤƤ '-e' ץˤ \fItcpdump\fP ϡ
ӥǥƥ͡Υɥ쥹ȥѥåĹʤե졼եɤɽ롣(ե졼եɤϥѥåȤλĤʬβ
򤪤ʤ)(IP ǡޤ褦)̾ΥѥåȤͥ 
0  7 `async' ѥåȤǤ;Ȥ `\fBasync 4\fR'
褦ʥѥåȤ 802.2 LLC ޤȤߤʤ롣LLCإåϤ줬 ISO 
ǡ䤤 SNAP ѥå \fIǤʤ\fR ʤСɽ롣
.LP
\fI(:ʲεҤ RFC-1144 ˤ SLIP ̥르ꥺ򤷤ƤΤ
ߤʤƵҤƤ)\fP
.LP
SLIP ³Ǥϡؼ(``I''ϡ``O'')ѥåȥפȰ̾ɽ롣
ǽ˥ѥåȥפɽ롣
פˤ \fIip\fP\fIutcp\fP\fIctcp\fP λब롣
\fIip\fR ѥåȤˤĤƤʾΥ󥯾ɽʤ
TCPѥåȤ³̻Ҥɽ롣
ѥåȤ̤ƤϤ沽줿إåɽ롣
\fB*S+\fIn\fR\fB*SA+\fIn\fR 
ɽ̤ʾ֤⤢롣 \fIn\fR ϥֹ(ޤϥֹ ack)ѹ줿򼨤
̤ʾǤʤСޤѹβϤ롣
ѹ U(urgent pointer)W(windows)A(ack)S(sequence number)I(packet ID)˺ʬ(+n  -n)ޤϿ(=n)ȹ礻Ǽ롣
Ǹ˥ѥåȤΥǡ٤ƤȰ̤줿إåĹɽ롣
.LP
줿³̻ҤĽϤ밵TCPѥåȤ򼨤
ack  6󹹿졢ֹ 49Ǥ ѥåȤ ID 6Ǥ;
3ХȤΥǡ6ХȤΰ̥إå
.RS
.nf
\fBO ctcp * A+6 S+49 I+6 3 (6)\fP
.fi
.RE
.HD
ARP/RARP ѥå
.LP
arp/rarp Ϥ׵ΥפȤΰɽ롣եޥåȤ켫
ȤƤȤʤ롣ûϥۥ \fIrtsg\fP  \fIcsam\fP ؤ `rlogin' γϻΤΤǤ롣
.RS
.nf
.sp .5
\f(CWarp who-has csam tell rtsg
arp reply csam is-at CSAM\fR
.sp .5
.fi
.RE
ܤ rtsg  󥿡ͥåȥۥ csam Υͥåȥɥ쥹Ҥͤ arp ѥåȤͻҡcsam ϥͥåȥɥ쥹ֿƤ(ǥͥåȥɥ쥹ʸǡ󥿡ͥåȥɥ쥹ϾʸɽƤ)
.LP
 \fBtcpdump \-n\fP Ǽ¹ԤȤΤ褦˴ά:
.RS
.nf
.sp .5
\f(CWarp who-has 128.3.254.6 tell 128.3.254.68
arp reply 128.3.254.6 is-at 02:07:01:00:01:c4\fP
.fi
.RE
.LP
\fBTcpdump \-e\fP Ǽ¹ԤȺǽΥѥåȤ֥ɥ㥹Ȥܤ point-to-point Ǥ뤳ȤƤȤ:
.RS
.nf
.sp .5
\f(CWRTSG Broadcast 0806  64: arp who-has csam tell rtsg
CSAM RTSG 0806  64: arp reply csam is-at CSAM\fR
.sp .5
.fi
.RE
ǽΥѥåȤ source Υͥåȥɥ쥹 RTSG ǡ
ǥƥ͡󤬥ͥåȤΥ֥ɥ㥹ȤǤꡢ
ץեɤ 16 ʤ 0806(ETHER_ARP)Ĺ 64 ХȤǤ뤳Ȥ狼롣
.HD
TCP ѥå
.LP
\fI(: ʲ RFC-793 ǵҤ TCPץȥ򤷤ƤΤ
ߤʤƵҤƤ롣⤷Υץȥ̤Ƥʤ褦ʤ顢ε
ҤǤʤtcpdump ΤΤΩʤ)\fP
.LP
ŪʥեޥåȤϲ̤:
.RS
.nf
.sp .5
\fIsrc > dst: flags data-seqno ack window urgent options\fP
.sp .5
.fi
.RE
\fIsrc\fP  \fIdst\fP  ȥǥƥ͡Ȥʤ IPɥ쥹ȥݡֹǤ롣
\fIflags\fP  S(SYN)F(FIN)P(PUSH) R(RST) ȹ礻Ĥ `.'(ե饰ʤ)Ǥ롣
\fIdata-seqno\fP ϤΥѥåȤ˴ޤޤǡΥ󥹶֤ΰ򼨤(򻲾)
\fIack\fP Ϥ³ˤ뼡δԤǡΥֹ档
\fIwindow\fP Ϥ³ˤФѰդƤХåե֤ΥХȿ
\fIurg\fP ϤΥѥåȤ `urgent' ǡޤޤ뤳Ȥ򼨤
\fIoptions\fP  tcp Υץ <>ǰϤޤ(<mss 1024>)
.LP
\fIsrcdst\fP  \fIflags\fP Ϥʤ餺ɽ롣¾ΥեɤϥѥåȤ TCP ץȥإå˰¸ΤɬפʾΤɽ롣
.LP
ϥۥ \fIrtsg\fP  \fIcsam\fP ؤrlogin γϻΰ
.RS
.nf
.sp .5
\s-2\f(CWrtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024>
csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024>
rtsg.1023 > csam.login: . ack 1 win 4096
rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096
csam.login > rtsg.1023: . ack 2 win 4096
rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096
csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077
csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1
csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1\fR\s+2
.sp .5
.fi
.RE
ܤ rtsg  TCP ݡֹ 1023  csam  \fIlogin\fP ݡȤ
ѥåȤɽǤ롣\fBS\fP  \fISYN\fP ե饰åȤƤ뤳
Ȥ򼨤ѥåȤΥֹ 768512 ǤΥѥåȤϥǡ
ޤޤʤ(Τ褦 \fInbytes\fP ХȤΥ桼ǡޤॷ
ֹ \fIfirst\fP 顢\fIlast\fP (last ϴޤޤʤ)򼨤 
`first:last(nbytes)'ɽ)ޤΥѥåȤˤ ack ꤵ
餺 window  4096 Хȡ祻ȥ(mss)ץ
  1024 ХȤꤵƤ
.LP
Фơcsam  rtsg  SYN Ф ack ޤ¾ƱƤΥѥåȤ֤Ƥ롣
ǡrtsg  csam  SYN  ack ֤`.' ϥե饰åȤƤʤȤ򼨤
ΥѥåȤˤϥǡޤޤʤΤǡֹʤack ΥֹϾ 1 Ǥդ뤳ȡ
ǽ tcp Ρֲáפ򸫤ȡ\fBtcpdump\fP ϤΥѥåȤΥ
ֹϤ롣βäΥѥåȤϡΥֹ
줿ֹȤκۤɽ롣
ϺǽʳΥֹϤβäΥǡˤŪ
ХȰ֤ȤƲǤ뤳Ȥ̣ (ƥǡ 1 Ϥ
) '-S' ץϤεǽ̵뤷ơΥֹϤ롣
.LP
6 ܤ rtsg  scam  19 Х(rtsg  csam ء2 Х
 20 Хܤޤ)
Υǡ롣ΥѥåȤˤ PUSH ե饰ꤵƤ롣7 ܤǡ
csam  rtsg ǡȸäƤ뤬ˤ 21 
Хܤϴޤޤʤcsam μ window  19 ХȾʤäƤ뤳Ȥ
顢ΥǡϥåȥХåեαޤäƤȿ¬롣csam Ϥ
 1ХȤΥǡ rtsg 롣8 ܤ 9 ܤȤ csam  
urgent  pushed դΥѥå 2Х rtsg Ƥ롣
.LP
⤷snapshot  \fBtcpdump\fP  TCP إåƤªʤäϡǤ
β򤷤ơλĤˤϲǽäΤ뤳Ȥ򼨤
``[|\fItcp\fP]''ɽ롣إå˰̣ʥץ(ȤС
ꡢإåĹäꤹ length Ȥ)ꤵƤ
ϡtcpdump  ``[\fIbad opt\fP]''ɽʾΥץ
ߤ(줬ɤϤ뤫狼ʤΤ)
إåĹץȤ򼨤ƤΤˡ
IP ǡĹϤ˥ץޤʤȤ򼨤 tcpdump  ``[bad hdr length]''ɽ롣
.HD
.B
UDP ѥå
.LP
UDP Ϥ rwho ΥѥåȤ:
.RS
.nf
.sp .5
\f(CWactinide.who > broadcast.who: udp 84\fP
.sp .5
.fi
.RE
ϥۥ \fIactinide\fP  \fIwho\fP ΥݡȤ UDP ǡब
ۥ \fIbroadcast\fP ʤ󥿡ͥåȥ֥ɥ㥹ȥɥ쥹
\fIwho\fP ΥݡȤ줿ȤɽƤ롣
ѥåȤϥ桼ǡ 84 ХȤޤǤ롣
.LP
ĤΤ UDP ӥ˴ؤƤ(Υޤϥǥ͡
Υݡֹ)᤹뤳ȤǤ̤ؤˤץȥ
ɽ롣ä˥ɥᥤ͡ॵӥ׵(RFC-1034/1035)
NFS ˤĤƤ Sun RPC (RFC-1050)ˤĤƽϤ롣
.HD
UDP ͡ॵӥ׵
.LP
\fI(:ʲ RFC-1035 ǵҤ ɥᥤ͡ॵӥץȥ
򤷤ƤΤȤߤʤƵҤƤ롣
⤷Υץȥ̤Ƥʤ褦ʤ顢ʲεҤϤפ󤫤פ󤫤⤷ʤ)
.LP
͡ॵФ׵ϡ
.RS
.nf
.sp .5
\fIsrc > dst: id op? flags qtype qclass name (len)\fP
.sp .5
\f(CWh2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37)\fR
.sp .5
.fi
Τ褦ʷǤ롣
.RE
ۥ \fIh2opolo\fP  \fIhelios\fP Υɥᥤ͡ॵФФơ
\fIucb-bax.berkeley.edu.\fP Ȥ̾ˤĤƤΥɥ쥹쥳(qtype=A)Ҥͤ롣
䤤碌 id  `3'`+'ϺƵǽ(\fIrecursion desired\fP)ե饰ꤵƤ뤳Ȥ򼨤
䤤碌 UDP  IP Υإåϴޤޤ᤺ 37ХȤ롣
礻ɸŪ \fIQuery\fP ʤΤ op եɤϾάƤ롣
⤷op եɤĤʤ顢줬ʤǤ졢`3'  `+' δ֤ɽ롣
ޤƱͤˡ礻饹(qclass)ɸŪ \fIC_IN\fP ʤΤǡάƤ롣
ۤ礻饹ξ `A' ³ɽ롣
.LP
㳰ŪʤΤ򸡽Ф硢ɲäΥեɤ[ ] ǰϤɽ
:⤷礻(query)˲͡ॵСҥ󤬴ޤޤ硢
.IR ancount ,
.IR nscount ,
.I arcount
Ϥ줾\fIn\fP 򥫥ȿȤơ
`[\fIn\fPa]'`[\fIn\fPn]'  `[\fIn\fPau]' Τ褦ɽ롣
⤷󤪤軰ХȤˤĤαbitꤵƤ(AARA 
ޤ rcode)礫`must be zero' ӥåȤꤵƤ
`[b2&3=\fIx\fP]'ɽ롣 \fIx\fP ϥإå󤪤軰ХȤ 16 ɽǤ롣
.HD
UDP ͡ॵб
.LP
͡ॵФαϡ
.RS
.nf
.sp .5
\fIsrc > dst:  id op rcode flags a/n/au type class data (len)\fP
.sp .5
\f(CWhelios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273)
helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97)\fR
.sp .5
.fi
Τ褦ʷǤ롣
.RE
ǽǤϡ\fIhelios\fP  \fIh2opolo\fP  id 3 ׵˻Ĥβ
쥳ɡĤΥ͡ॵХ쥳ɤȼĤθҥ쥳ɤƤ롣
ǽβ A 쥳ɤǡΥǡϥ󥿡ͥåȥɥ쥹 128.32.137.3 Ǥ롣
Υ UDP  IP Υإåϴޤޤ 273 ХȤǤ롣
(query) op  response code(ξ NoError)ϡA 쥳ɤΥ
(C_IN)Ʊͤ˾άƤ롣
.LP
 \fIhelios\fP ϥɥᥤ¸ߤʤȤ response code
(NXDomain) DzϤʤ͡ॵФϰġҥ쥳ɤʤȤ򤷤Ƥ롣
`*'  \fIauthoritative answer\fP ӥåȤꤵƤ뤳Ȥ򼨤
ʤΤǡ type ȥ饹ӥǡɽʤ 
.LP
ۤΥե饰`\-'(RA(Ƶ)ꤵ\fIʤ\fP)`|'TC(ޤ
줿å)ꤵƤ롣`question' 󤬰ĤǤʤ
ˤϡ`[\fIn\fPq]'ȽϤ롣
.LP
͡ॵФαϥǥեȤ \fIsnaplen\fP Ǥ 68 ХȤ礭ʤ꤬ʤΤǡ
ΥѥåȤɽΤ˽ʬʤξªʤȤ롣
͡ॵӥ̩̿˲ϤȤϡ\fB\-s\fP ե饰Ѥ snaplen ĥ٤Ǥ롣
\fB\`-s 128\fP'餤Ǥ

.HD
SMB/CIFS Ÿ
.LP
tcpdump  UDP/137, UDP/138, TCP/139 ФŪ絬Ϥ SMB/CIFS/NBT ǥɵǽġ
IPX  NetBEUI SMB ǥɤǤ⤢롣

ǥեȤǤŪϤʥǥɤԤ졢
-v ץѤڤ˾ܺ٤ʥǥɤԤ롣
-v ץդξ硢ҤȤĤ SMB ѥåȤ 1 ̰ʾξФ⤢Τǡ
ɬפʾΤ -v ץĤ뤳ȡ

UNICODE ʸޤ SMB åǥɤϡ
Ķѿ USE_UNICODE  1 򥻥åȤۤ⤷ʤ
UNICODE ʸưФѥåϴޤ롣

SMB ѥåȤη all teեɤ̣뤫ξϡ
www.cifs.org  samba.org ߥ顼Ȥ pub/samba/specs/ ǥ쥯ȥ򻲾ȤΤȡ
SMB ѥå Andrew Tridgell (tridge@samba.org) 񤤤

.HD
NFS ׵Ȳ
.LP
Sun NFS(Network File System)׵ȱϼΤ褦˽Ϥ:
.RS
.nf
.sp .5
\fIsrc.xid > dst.nfs: len op args\fP
\fIsrc.nfs > dst.xid: reply stat len op results\fP
.sp .5
\f(CW
sushi.6709 > wrl.nfs: 112 readlink fh 21,24/10.73165
wrl.nfs > sushi.6709: reply ok 40 readlink "../var"
sushi.201b > wrl.nfs:
	144 lookup fh 9,74/4096.6878 "xcolors"
wrl.nfs > sushi.201b:
	reply ok 128 lookup fh 9,74/4134.3150
\fR
.sp .5
.fi
.RE
ܤϥۥ \fIsushi\fP  id \fI6709\fP ǥȥ󥶥׵ \fIwrl\fP Ƥ (src ۥȤ³ port ֹ \fIǤϤʤ\fP ȥ󥶥 id Ǥդ)
׵ UDP  IP Υإå 112 ХȤǤ롣ư׵ϥեϥɥ(\fIfh\fP) 21,24/10.731657119 Ф \fIreadlink\fP (ܥå󥯤ͤɤ)Ǥ롣
(ǤϡʤȤˡǥХ major  minor ֹФ 
inode ֹ桢generation ֹ椬եϥɥ뤫ФǤƤ)
\fIWrl\fP ϥ󥯤Ƥ `ok' Ƥ롣
.LP
ܤǤ \fIsushi\fP  \fIwrl\fP Ф ǥ쥯ȥե 9,74/4096.8678  
`\fIxcolors\fP' õФ褦׵ᤷƤ롣
Ϥǡμˤäư¸Ƥ뤳Ȥդ뤳ȡ
νϷ NFS ץȥͤȤȤɤ˼ˤʤ褦տޤ줿Ǥ롣
.LP
-v(verbose) ե饰ͿƤ硢ɲäξϤ롣:
.RS
.nf
.sp .5
\f(CW
sushi.1372a > wrl.nfs:
	148 read fh 21,11/12.195 8192 bytes @ 24576
wrl.nfs > sushi.1372a:
	reply ok 1472 read REG 100664 ids 417/0 sz 29388
\fP
.sp .5
.fi
.RE
(\-v  IP إå TTL  IDե饰ơեɤɽ
ǤϾάƤ)ܤǤϡ\fIsushi\fP  \fIwrl\fP Фơ file 21,11/12.195 ΥХȥեå 24576  8192 Хɤ߽Ф׵
Ƥ롣\fIWrl\fP  `ok' ֤Ƥ; ܤɽƤ뤳Υ
åȤϥե饰Ȳ줿ΰܤΥѥåȤǤ뤿ᡢ1472 
ȤΤߤǤ(ĤΥХȤϤθΥե饰ȤȤ³
Υե饰Ȥ NFS إå UDP إåʤΤǡե륿Ｐλ꼡ɽʤȤ)
ޤ \-v ե饰Ƥ뤳ȤˤꡢĤΥե°
ɽ(եǡղä): եΥ
(``REG'' ̤Υե)եΥ⡼(Ȭʤ)uid  gidޤեΥʤɡ
.LP
\-v ե饰ʣͿ(\-vvΤ)äȾܺ٤ʾ󤬽Ϥ롣
.LP
NFS ׵ϤȤƤ礭Τǡsnaplen äʤȽʬʾɽ
ʤ⤷ʤȤդ뤳ȡ
NFS ̿ƻ뤹 `\fB\-s 192\fP' ƤߤȤ褤
.LP
NFSѥåȤ RPCˤäƼ̤뤳ȤǤʤʤ
顢\fItcpdump\fP  ``Ƕ''׵ФƤơΥȥ
 ID˰פ뤫Ĵ٤롣б׵ζ᤯̿ƤʤϤȲϤǤʤ⤷ʤ
.HD
AFS ׵ȱ
.LP
Transarc AFS (Andrew File System) ׵ȱϰʲΤ褦ɽ롣
.HD
.RS
.nf
.sp .5
\fIsrc.sport > dst.dport: rx packet-type\fP
\fIsrc.sport > dst.dport: rx packet-type service call call-name args\fP
\fIsrc.sport > dst.dport: rx packet-type service reply call-name args\fP
.sp .5
\f(CW
elvis.7001 > pike.afsfs:
	rx data fs call rename old fid 536876964/1/1 ".newsrc.new"
	new fid 536876964/1/1 ".newsrc"
pike.afsfs > elvis.7001: rx data fs reply rename
\fR
.sp .5
.fi
.RE
ǽιԤǡۥ elvis  RX ѥåȤ pike Ƥ롣
 fs (ե륵) ӥؤ RX ǡѥåȤǡ
RPC ƤӽФγϤǤ롣
RPC ƤӽФϥ͡ǡŤǥ쥯ȥե ID  536876964/1/1
Ťե̾`.newsrc.new'
ǥ쥯ȥե ID  536876964/1/1
ե̾ `.newsrc' Ǥ롣
ۥ pike  ͡ƤӽФФ RPC ѥå
(ǡѥåȤǤꡢǥѥåȤǤϤʤΤ̣)
ֿƤ롣
.LP
̤ˡƤ AFS RPC ϾʤȤ RPC ƤӽФ̾ϥǥɤ롣
ۤȤɤ AFC RPC ϾʤȤ⤤Ĥΰϥǥɤ
(̤ `̣' Τߤǥɤ)
.LP
ɽեޥåȤϼŪʤΤܻؤƤ뤬
AFS  RX ư˾ܤʤ͡ˤȤäƤϤ餯ǤϤʤ
.LP
-v (ܺ) ץ 2 ꤵȡɲþɽ롣
 RX ƤӽФ IDƤӽФֹ桢ֹ桢ꥢֹ桢RX ѥåȥե饰ʤɤǤ롣
.LP
 -v ץ󤬻ꤵȡƥǥåȥӥ ID ɽ롣
.LP
ǥѥåȤΥ顼ɤɽ롣
âUbik ӡѥåȤ㳰Ǥ롣
(ʤʤ顢Ubik ץȥˤǥѥåȤϻɼ̣뤫Ǥ)
.LP
AFS ׵礭
¿ΰ\fIsnaplen\fP䤵ʤȤ餯ɽʤȤդ뤳ȡ
AFS ̿ƻ뤹 `\fB-s 256\fP' ƤߤȤ褤
.LP
AFS ѥåȤŪ RPC ̤ʤ
ˡ\fItcpdump\fP``Ƕ''׵ФƤơ
ƤӽФֹȥӥ ID ѤƱȾȹ礵롣
⤷б׵ȷդʤä硢ΥѥåȤϥѡǤʤ

.HD
KIP Appletalk (UDP  DDP)
.LP
UDP ǡ˳Ǽ줿åץȡ DDP ѥåȤϼФơ
DDP ѥåȤȤɽ(ʤ٤Ƥ UDP إåϼΤƤ)
.I /etc/atalk.names 
ե뤬 åץȡͥåȤȥΡֹ̾ѴΤѤ롣
եηϲ̤ꡣ
.RS
.nf
.sp .5
\fIֹ		̾\fP

\f(CW1.254	ether
16.1		icsd-net
1.254.110	ace\fR
.sp .5
.fi
.RE
ǽԤϥåץȡͥåȥ̾Ϳ롣ܤΥۥȤ̾Ϳ(ۥȤϥͥåȥֹ軰ƥåȤǼ̤ \- 
ͥåȥֹ󥪥ƥåȤ \fIʤФʤ餺\fPޤۥ
ϻƥåȤ \fIʤФʤʤ\fPֹ̾϶ʸǶڤ(blank  tab)
.I /etc/atalk.names 
ե϶Ԥȥȹ(`#'ǻϤޤ)ޤǤ褤
.LP
åץȡΥɥ쥹ϼηɽ롣
.RS
.nf
.sp .5
\fInet.host.port\fP

\f(CW144.1.209.2 > icsd-net.112.220
office.2 > icsd-net.112.220
jssmag.149.235 > icsd-net.2\fR
.sp .5
.fi
.RE
(
.I /etc/atalk.names
ʤޤϤŬڤʥåץȡΥͥåֹ桢ۥֹ椬ޤޤʤϡɥ쥹Ͽɽ)
ǽ ͥåȥ 144.1 ΥΡ 209  NBP(DDP Υݡֹ 2 )ͥåȥ icsd ΥΡ 112 ݡֹ220 ֤ؤ򼨤
ܤƱͤΡ̾(`office') 狼äƤ㡣
ܤϥͥåȥ jssmag ΥΡ 149  235 ֥ݡȤ icsd-net  NBPݡȤؤΥ֥ɥ㥹Ȥ򼨤
֥ɥ㥹ȥɥ쥹(255)ϥۥֹȼʤͥåȥ̾ν
ϤǼ̤Ǥ뤳Ȥդ뤳 \- /etc/atalk.names ˥Ρ̾ȥͥ
ȥ̾򵭽ҤƤΤϤ褤ͤǤ)
.LP
NBP(̾ץȥ) ATP(åץȡȥ󥶥ץȥ)ѥåȤˤĤƤϡƤϤ롣
¾Υץȥϥץȥ̾(̾狼ʤֹ)ȥѥåȤΥɽǤ롣

\fBNBP ѥå\fP ϼΤ褦ɽ:
.RS
.nf
.sp .5
\s-2\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"
jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250
techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fR\s+2
.sp .5
.fi
.RE
ܤϥͥåȥ icsd  ۥ 112  ͥåȥjssmag إ֥ɥ㥹Ȥ졼饤õ׵Ǥ롣nbp  id  190 
ܤϤ׵ؤΥۥ jssmag.209 α(id ֹ椬ƱǤ뤳Ȥ)ǡ``RM1140''Ȥ̾Υ졼饤 250 ֥ݡȤ˻äƤ뤳ȤƤ롣
ܤƱ׵Ф̤ǥۥ techpit 186֥ݡȤ "tecpit" ϿƤ뤳ȤƤ롣

\fBATP ѥå\fP ϼΤ褦ɽ:
.RS
.nf
.sp .5
\s-2\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001
helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:4 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:6 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp*12266:7 (512) 0xae040000
jssmag.209.165 > helios.132: atp-req  12266<3,5> 0xae030001
helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001
jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fR\s+2
.sp .5
.fi
.RE
jssmga.209 ϥۥ helios Ф
id 12266 ǥȥ󥶥򳫻Ϥ 8ѥå(`<0-7>'ȼ)׵᤹롣
 16 ʿ׵˴ޤޤ `userdata'ΥեɤǤ롣
.LP
helios ȬĤ 512 ХȤΥѥåȤƤ롣ȥ󥶥id 
³ `:' ɽϥȥ󥶥ˤѥåȤΥֹǡå˰Ϥޤ줿 atp إåѥåȤΥǡ̤Ǥ롣ѥå 7 ֤ `*'  EOM ӥåȤꤵƤ뤳Ȥ򼨤
.LP
jssmag.209 ϥѥå 3 ֤ȥѥå 5 ֤κ׵ᤷƤ롣helios 
Ϥjssmag ϥȥ󥶥λ롣ơ
jssmag.209 ϼ׵򳫻Ϥ롣׵ `*'  XO (`') \fIƤʤ\fP Ȥ򼨤

.HD
IP ե饰Ȳ(fragmentation)
.LP
󥿡ͥåȥǡΥե饰Ȳ줿ΤϼΤ褦ɽ롣
.RS
.nf
.sp .5
\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB+)\fR
\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB)\fR
.sp .5
.fi
.RE
(ǽηϤޤ³ե饰Ȥ뤳Ȥ򼨤ܤηϤ
줬ǸΥե饰ȤǤ뤳Ȥ򼨤)
.LP
\fIid\fP ϥե饰Ȥ id \fIsize\fP ϥե饰Ȥ IP إå(ХȤ)\fIoffset\fP ϥե饰ȤΤȤȤΥǡǤΥեå(ХȤ)
.LP
ե饰Ȥξϥե饰ɽ롣ǽΥե饰Ȥˤ
̥ץȥΥإåޤߡե饰Ⱦϥץȥ³
ɽ롣ܰʹߤΥե饰ȤˤϾ̥ץȥξޤޤʤ
Τǡե饰Ⱦϥӥǥƥ͡󥢥ɥ쥹³ɽ롣
ʲ CSNET ³줿 arizona.edu  
lbl-rtsg.arpa ؤ ftp ³ΰ򼨤ˤ 576 ХȤΥǡϤƤʤ:
.RS
.nf
.sp .5
\s-2\f(CWarizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+)
arizona > rtsg: (frag 595a:204@328)
rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560\fP\s+2
.sp .5
.fi
.RE
Ĥ: ܤȤơܤǼ륢ɥ쥹ˤϥݡ
ֹϴޤޤƤʤդ뤳ȡ
TCP ץȥξϺǽΥե饰Ȥ˴ޤޤ뤿ᡢ
ĤΥե饰Ȥɽ٤ݡֹ䥷ֹ椬狼ʤǤ롣
ܤϡܤ TCP Υ󥹾
ˤϼºݤˤ 512 Х(ǽΥե饰Ȥ 308 ХȡܤΥե
Ȥ204 ХȤξ)Υ桼ǡ 308 ХȤǤ뤫Τ褦
ɽƤǤ롣󥹤ϳѥåȤ ack бĴ
ȤǺޤ뤳Ȥ뤫⤷ʤ
.LP
\fIե饰Ȳػߥե饰\fP ꤵ줿ѥåȤξ硢 \fB(DF)\fPɽ롣 
.HD
ɽ
.LP
ǥեȤǤƤνϹԤƬ˥ॹפĤॹפϸߤλ򼡤ηɽ
.RS
.nf
\fIhh:mm:ss.frac\fP
.fi
.RE
ϡkernel λ־ƱͤΤǤ롣ॹפ kernel 
ѥåȤǧλȿǤƤ롣ͥåȥ󥿡ե
ѥåȤ饫ͥ뤬 `ѥå' ˤ
ߤޤǤλֺȿǤƤʤ
.SH Ϣ
traffic(1C), nit(4P), bpf(4), pcap(3)
.SH 
Ԥ:
.LP
Van Jacobson,
Craig Leres and
Steven McCanne, all of the
Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
.LP
ǿǤ tcpdump.org ˤäƴƤ롣
.LP
.RS
.I http://www.tcpdump.org/
.RE
.LP
IPv6/IPsec ΥݡȤ WIDE/KAME ץȤˤäɲä줿
Υץ Eric Young  SSLeay 饤֥θ˻ѤƤ롣
.SH Х
Х䡢ĥΤꤤʤɤϡʲΥɥ쥹äƤۤ
.LP
.RS
tcpdump-workers@tcpdump.org
.RE
.LP
ɤδ£ʤɤϰʲΥɥ쥹äƤۤ
.LP
.RS
patches@tcpdump.org
.RE
.LP
NIT ϳؽФƤ̿ϸ뤳ȤǤʤBPF Ϥ줬ǽǤ롣ԤѤ侩롣
.LP
ӤˤäƤϡIPե饰Ȥƹۤꡢ̥ץȥĹ׻뤯餤ΤȤɬפȤʤ
.LP
͡ॵФεհ׵ΤɽǤʤ()Ϥष
˴ޤޤ׵Ȥɽ롣հ׵ˤϥХդޤƤơ
Τ tcpdump ǤϤʤƥ͡ॵӥǤ٤ȹ
Ƥͤ⤤롣
.LP
åץ EtherTalk  DDP ѥåȤ KIP DDP ѥåȤΤ褦ưפ 
dump ǤϤԤʤʤȤ ethertalk 򰷤Ȥˤʤ
Ƥ(ʤäƤʤ)LBL ͥåȥethertalk ؤΥ
ʤΤǡɤΥƥȤǤʤΤ
.LP
ƻ֤ڤؤȤ˥ѥåȥȥ졼ԤʤäƤȻ֤Ƥ
ޤ(֤ѹ̵뤵)
.LP
FDDI إåФե륿ξＰϤ٤Ƥ FDDI ѥåȤͥå
ΥѥåȤ򥫥ץ벽ƤΤȤߤʤŬѤ롣
ϡIP,ARP  DECNET PhaseIV ˤĤƤư뤬
ISO CLNS Τ褦ʥץȥǤϤޤʤ
椨˥ե륿ϾＰ˰פʤ褦ʥѥåȤ򤢤ޤä
ĤäƤޤ⤷ʤ
.LP
.B "ip6 proto"
ϥإåפ٤ΤȤϤʤäƤʤ
.B tcp

.B udp
إåפ٤Ǥ롣
.LP
\fBtcp[0]\fPΤ褦ʥȥ󥹥ݡإإåФ뻻ɽϡ
IPv6 ѥåȤФƤϤޤƯʤ
IPv4 ѥåȤФƤΤƯ