UDPLOGGER(8)

NAME
udplogger - Log start of UDP sessions

SYNONPSIS
udplogger [-i if] [-a|-b] [-f file] [-n] [-t ###] [-p]

DESCRIPTION

Udplogger is the UDP equivalent to tcplogger(8). It is used to log the UDP sessions that traverse a network. This is accomplished by putting the network interface into promiscuous mode and reading all UDP packets. A table is maintained of all "active" UDP sessions. Only new sessions are logged. Udplogger currently only runs on SunOS 4.x/5.x machines.

  OPTIONS

-i  Specify the interface to listen for UDP packets on. This defaults to the first interface.

-a  Log output records in ASCII.

-b  Log output records in binary for use with the extract(8) command. The format of the record is

    	struct timeval  tm;   /* Time of request */
    	u_long ipsrcaddr;     /* IP source address */
    	u_long ipdstaddr;     /* IP destination address */
    	u_long seqno;         /* Always zero */
    	u_short udpsrcport;   /* UDP source port */
    	u_short udpdstport;   /* UDP destination port */

-f  Specify the file where output records should go. The file is opened for appending. If not specified, output goes to stdout.

-n  Don't do any hostname or port name lookups. Print out everything in decimal or dotted decimal format.

-t  Specify the timeout period for idle UDP sessions. If a packet for a session is not received in this amount of time, it is assumed that the session has terminated. The default is 300 seconds.

-p  Run in non-promiscuous mode. This allows one to monitor traffic to/from a single host without putting a load on the host. Note that with SunOS 4.x, you can not log traffic originating from the monitoring host, so you will only see traffic to the host.

SEE ALSO
nit(4P), nit_pf(4M), extract(8), tcplogger(8)

BUGS
On a busy network, or with a slow machine, packets may be dropped.