TCPLOGGER(8)

NAME
tcplogger - Log TCP connection requests.

SYNONPSIS
tcplogger [-i if] [-a|-b] [-f file] [-n] [-p]

DESCRIPTION

Tcplogger is used to log the TCP connection requests that traverse a network. This is accomplished by putting the network interface into promiscuous mode and reading all TCP connect request packets. Tcplogger currently only runs on SunOS 4.x/5.x machines.

  OPTIONS

-i  Specify the interface to listen for TCP connection requests on. This defaults to the first interface.

-a  Log output records in ASCII.

-b  Log output records in binary for use with the extract(8) command. The format of the record is

    	struct timeval  tm;   /* Time of request */
    	u_long ipsrcaddr;     /* IP source address */
    	u_long ipdstaddr;     /* IP destination address */
    	u_long tcpseqno;      /* TCP sequence number */
    	u_short tcpsrcport;   /* TCP source port */
    	u_short tcpdstport;   /* TCP destination port */

-f  Specify the file where output records should go. The file is opened for appending. If not specified, output goes to stdout.

-n  Don't do any hostname or port name lookups. Print out everything in decimal or dotted decimal format.

-p  Run in non-promiscuous mode. This allows one to monitor traffic to/from a single host without putting a load on the host. Note that with SunOS 4.x, you can not log traffic originating from the monitoring host, so you will only see traffic to the host.

SEE ALSO
nit(4P), nit_pf(4M), extract(8)

BUGS
On a busy network, or with a slow machine, packets may be dropped.

Doesn't process IP options. This is problematic in that the NIT packet filter doesn't allow this to be done, thus every packet would have to be read, increasing the load on the machine.