.\" This file is part of tcpspy, a TCP/IP connection monitor.
.\"
.\" Copyright (c) 2000, 2001, 2002 Tim J. Robbins. 
.\" All rights reserved.
.\" 
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. The name of the author may not be used to endorse or promote products
.\"    derived from this software without specific prior written permission.
.\" 
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
.\" INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
.\" AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL
.\" THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
.\" EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
.\" PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
.\" OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
.\" WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
.\" OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
.\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" $Id: tcpspy.8,v 1.39 2001/05/20 11:52:12 tim Stab $
.TH TCPSPY 8 "May 2001" TJR "tcpspy 1.7"
.SH NAME
tcpspy \- TCP/IP Connection Monitor
.SH SYNOPSIS
.B tcpspy
.RB [ "-dp" ]
.RB [ "-e"
.IR "rule" ]...
.RB [ "-f"
.IR "rulefile" ]...
.RB [ "-F"
.IR "facility" ]
.RB [ "-I"
.IR "interval" ]
.RB [ "-U"
.IR "user" ]
.RB [ "-G"
.IR "group" ]
.SH DESCRIPTION
.I tcpspy
logs information about selected incoming and outgoing TCP/IP connections to
syslog. The following information is logged: username, local address and port,
remote address, port, and optionally the filename of the executable.
.PP
.SS "Options"
.TP
.BI -e " 'rule'"
Log only connections matching the specified rule. Rule syntax is outlined
below. If this option is specified more than once, connections matching any
of the specified rules are logged. You should quote the rule, as shown above.
.TP
.BI -f " rulefile"
Read rules from
.IR rulefile .
Each rule is on a new line. The `#' character may be used to add comments;
everything from this character to the end of the line is ignored.

The
.B -e
and
.B -f
options may be used together.
.TP
.BI -F " facility"
Log to syslog facility
.I facility
instead of the compile-time default setting. See the
.BR syslog.conf (5)
manual page for a list of facilities.
.TP
.BI -I " interval"
Update the internal state every
.I interval
milliseconds, instead of the default of 1000 ms. Connections that last less
than
.I interval
milliseconds may be missed, so you should experiment to find a value small
enough that it catches most connections, but not so small that it causes
tcpspy to use too much CPU time.
.TP
.BI -U " user"
Switch to the specified user after startup.
.I user
may be a numeric user id or a user name from the system password file.
.TP
.BI -G " group"
Switch to the specified group after startup.
.I group
may be a numeric group id or a group name from the system group file.
If a username to switch to with the
.B -U
option is specified but
.B -G
is omitted, tcpspy will switch to that specified user's primary group.
.TP
.B -d
Debugging mode; if this option is specified, tcpspy will not detach from the
console after initialisation, and will log connections to standard output
instead of syslog.
.TP
.B -p
Log the filename of the executable that created/accepted the connection.
You may require superuser privileges to obtain this information for processes
you do not own (this is a kernel limitation).

This option can greatly increase the amount of CPU time required to
process each connection/disconnection.

.PP
.SS "Rule Syntax"
A rule may be specified with the
.B -e
option to log information about connections matching this rule, overriding
the default of logging all connections.
.PP
The following comparison operations are defined:
.TP
.BI user " uid"
True if the local user initiating or accepting the connection has the
.B effective
user id
.IR uid .
.TP
.BI user " \N'34'username\N'34'"
Same as above, but using a username instead of a user id.
.TP
.BI ip
True if the connection is IPv4.
.TP
.BI ip6
True if the connection is IPv6.
.TP
.BI lport " port"
True if the local end of the connection has port number
.IR port .
.TP
.BI lport " [low] - [high]"
True if the local end of the connection has a port number
greater than or equal to
.I low
and less than or equal to
.IR high .
If the form
.I low-
is used, high is assumed to be 65535.
If the form
.I -high
is used, low is assumed to be 0. It is an error to omit both
.IR low " and " high .
.TP
.BI lport " \N'34'service\N'34'"
Same as above, but using a service name from
.I /etc/services
instead of a port number.
.TP
.B rport
Same as
.B lport
but compares the port number of the remote end of the connection.
.TP
.BI laddr " n.n.n.n[/m.m.m.m]"
.TP
.BI laddr " n.n.n.n/m"
.TP
.BI laddr " ip6-addr[/m]"
Interpreted as a "net/mask" expression; true if "net" is equal to the bitwise
AND of the local address of the connection and "mask". If no mask is specified,
a default mask with all bits set (255.255.255.255) is used. The CIDR type netmask
is also possible. With IPv6 only a prefix length netmask is allowed, and the
length defaults to 128. Depending on the address family, these rules contain
an implicit match condition "ip" or "ip6", respectively.
.TP
.B raddr
Same as
.B laddr
but compares the remote address.
.TP
.BI exe " \N'34'pattern\N'34'"
True if the full filename (including directory) of the executable that 
created/accepted the connection matches
.IR pattern ,
a
.BR glob (7)-style
wildcard pattern.

The pattern "" (an empty string) matches connections created/accepted by 
processes whose executable filename is unknown.

If the
.B -p
option is not specified, a warning message will be printed, and the result of
this comparison will always be true.
.PP
Expressions (including the  comparisons listed above) may be joined together
with the following logical operations:
.TP
.IB expr1 " or " expr2
True if either of
.I expr1
or
.I expr2
are true (logical OR).
.TP
.IB expr1 " and " expr2
True if both
.I expr1
and
.I expr2
are true (logical AND).
.TP
.BI not " expr"
True if
.I expr
is false (logical NOT).
.PP
Rules are evaluated from left to right. Whitespace (space, tab and newline)
characters are ignored between "words". Rules consisting of only whitespace
match no connections, but do not cause an error.
Parentheses, '(' and ')' may be placed around expressions to affect the order
of evaluation.
.PP
The Examples section contains some sample rules which further demonstrate how
they are constructed.

.SH "EXIT STATUS"
.TP
0
The daemon was successfully started
.TP
>0
An error occurred

.SH SIGNALS
.TP
.I TERM
Shut down at most
.I interval
milliseconds from now.
.TP
.I INT
(Debugging mode only) Handled identically to
.IR TERM .
.PP
All other signals retain their default behaviour, which is documented in
.BR signal (7).

.SH EXAMPLES
.TP
tcpspy \-e 'user "joe" and rport "ssh"'
Log connections made by user "joe" for the service "ssh".
.TP
tcpspy \-e 'not raddr 10.0.0.0/255.0.0.0 and rport 25 and (user "bob" or user "joe")'
Log connections made by users "bob" and "joe" to remote port 25 on machines
not on a fictional "intranet".
.TP
tcpspy \-e 'exe "/usr/bin/irc"'
Log connections made by /usr/bin/irc (probably ircII).

.SH BUGS
Empty rule files cause
.B tcpspy
to log no connections instead of all connections.

.SH AUTHOR
Tim J. Robbins <tim@robbins.dropbear.id.au>

.SH SEE ALSO
.BR glob (7),
.BR proc (5),
.BR services (5),
.BR signal (7),
.BR syslog (3),
.BR syslog.conf (5),
.BR tcpspy.rules (5)