1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
.\" sniffit config file man page - Brecht Claerhout
.\"
.TH SNIFFIT 5
.SH NAME
sniffit \- configuration file for sniffit (name arbirtary)
.SH DESCRIPTION
This page describes the format for the config file for
.B sniffit
(see
.BR sniffit (8)
). This file allows you to specify in great detail witch packets should
be processed by
.B sniffit.
This file also controls (or will control) some functions for the
continuous logging ('-L' option).
.LP
A
.B sniffit
config file might look like (Be sure to end it with a BLANK line):
.IP
.nf
# Sniffit Sample Config file -- Brecht Claerhout
logfile /var/adm/sniffit.today.log
# First select all packets!
select both mhosts 1
select both mhosts 2
# Now deselect all packets from/to those damn 'surfers'
deselect both port 80
deselect both port 8001
.fi
.LP
This file will tell
.B sniffit
to process all packets on the subnet except those FROM/TO ports 80 and
8001 (thus we don't want logs of those mass WWW connections witch turn
our logs unreadable).
.SH "GLOBAL FORMAT"
The file consists of lines, lines are formed by fields, fields are
separated with SPACES (NO TABS).
Unix comment lines (starting with '#' are allowed).
So this gives us:
.IP
<field1> <field2> <field3> <field4> <field5>
.SH "FIELD FORMAT"
.IP "<field1>"
.B select
-
.B Sniffit
will look for packets that match the following description
(other fields)
.IP
.B deselect
-
.B Sniffit
will ignore packets that match the description
.IP
.B logfile
- change the logfile name to <field2> instead of the default 'sniffit.log'
.IP "<field2>"
.B from
- Packets FROM the host matching the following desc. are considered.
.IP
.B to
- similar, Packets TO the....
.IP
.B both
- similar, Packets FROM or TO the....
.IP
.B "a filename"
- as an argument of 'logfile' in <field1>
.IP "<field3>"
.B host
- The (de)selection criteria involves a hostname.
.IP
.B port
- similar, ... a portnumber
.IP
.B mhosts
- The (de)selection criteria involves multiple-hosts, like with the
wildcars in 0.3.0, but without the 'x'
.IP "<field4>"
Either a hostname, a portnumber, a service name or a numbet-dot partial
notation indicating multiple hosts depending on <field3>
(service names like 'ftp' are resolved as the services available present on
the host that runs Sniffit, and translated into a port nr)
.IP "<field5>"
A portnumber, if <field3> was 'host' or 'mhosts' (optional, if not filled
in, all ports are going to be (de)selected)
.SH "FILE INTERPRETING"
The config file is interpreted SEQUENTIAL, so watch it, don't mix lines
in a file. Example:
.IP
.nf
select both mhosts 100.100.12.
deselect both port 80
select both host 100.100.12.2
This file will get you the packets:
a) Send by hosts '100.100.12.*'
b) EXCEPT the WWW packets
c) BUT showing the WWW packets concerning
100.100.12.2
.fi
.IP
.nf
select both mhosts 100.100.12.
select both host 100.100.12.2
deselect both port 80
Will give you the packets (probably unwanted result):
a) Send by hosts '100.100.12.*'
b) Send from/to 100.100.12.2 (useless line)
c) deselecting all WWW packets on the subnet
.ni
.SH AUTHOR
Brecht Claerhout <coder@reptile.rug.ac.be>
.SH "SEE ALSO"
.BR sniffit (8)
|
