List the code generated from the filter expression for either the kernel packet filter, or snoop's own filter.

Display number of packets dropped during capture on the summary line.

Create an IP address-to-name file from a capture file. This must be set together with the -i option that names a capture file. The address-to-name file has the same name as the capture file with .names appended. This file records the IP address to hostname mapping at the capture site and increases the portability of the capture file. Generate a .names file if the capture file is to be analyzed elsewhere. Packets are not displayed when this flag is used.

Capture IP packets from the network using the IP interface specified by interface, for example, lo0. The ifconfig(8) command can be used to list available IP interfaces. The -I and -d options are mutually exclusive.

Capture packets in non-promiscuous mode. Only broadcast, multicast, or packets addressed to the host machine will be seen.

Display size of the entire link layer frame in bytes on the summary line.

Verbose summary mode. This is halfway between summary mode and verbose mode in degree of verbosity. Instead of displaying just the summary line for the highest level protocol in a packet, it displays a summary line for each protocol layer in the packet. For instance, for an NFS packet it will display a line each for the ETHER, IP, UDP, RPC and NFS layers. Verbose summary mode output may be easily piped through grep to extract packets of interest. For example, to view only RPC summary lines, enter the following: example# snoop -i rpc.cap -V | grep RPC

Listen to packets on /dev/audio (warning: can be noisy).

Quit after capturing maxcount packets. Otherwise keep capturing until there is no disk space left or until interrupted with Control-C.

Capture link-layer packets from the network using the DLPI datalink specified by datalink, for example, bge0 or net0. The dladm(8) show-link subcommand can be used to list available datalinks. The -d and -I options are mutually exclusive.

Ignore any errors when enabling promiscuous mode. Normally any error when enabling promiscuous mode on a datalink or IP interface is fatal and causes snoop to exit.

Display packets previously captured in filename. Without this option, snoop reads packets from the network interface. If a filename.names file is present, it is automatically loaded into the snoop IP address-to-name mapping table (See -N flag).

Use filename as an IP address-to-name mapping table. This file must have the same format as the /etc/hosts file (IP address followed by the hostname).

Save captured packets in filename as they are captured. (This filename is referred to as the "capture file".) The format of the capture file is RFC 1761-compliant. During packet capture, a count of the number of packets saved in the file is displayed. If you wish just to count packets without saving to a file, name the file /dev/null.

Save captured packets in count rotating output files named prefix-??.snoop with just over size data in each. The count must be in [1-100]. Size value may end with suffix k, m or g to specify kilobytes, megabytes or gigabytes. This option is useful when you want to keep only the most recent part of a capture (sometimes called a "rolling" capture), where you're watching for some event that's difficult to reproduce, and will stop the capture just after the event happens. For example, to make snoop keep the last 200 megabytes stored in 20 files named test1-??.snoop, run:

Select one or more packets to be displayed from a capture file. The first packet in the file is packet number 1.

When capturing network packets into a file, do not display the packet count. This can improve packet capturing performance.

Do not resolve the IP address to the symbolic name. This prevents snoop from generating network traffic while capturing and displaying packets. However, if the -n option is used, and an address is found in the mapping file, its corresponding name will be used.

Truncate each packet after snaplen bytes. Usually the whole packet is captured. This option is useful if only certain packet header information is required. The packet truncation is done within the kernel giving better utilization of the streams packet buffer. This means less chance of dropped packets due to buffer overflow during periods of high traffic. It also saves disk space when capturing large traces to a capture file. To capture only IP headers (no options) use a snaplen of 34. For UDP use 42, and for TCP use 54. You can capture RPC headers with a snaplen of 80 bytes. NFS headers can be captured in 120 bytes.

Time-stamp presentation. Time-stamps are accurate to within 4 microseconds. The default is for times to be presented in d (delta) format (the time since receiving the previous packet). Option a (absolute) gives wall-clock time. Option r (relative) gives time relative to the first packet displayed. This can be used with the -p option to display time relative to any selected packet.

Verbose mode. Print packet headers in lots of detail. This display consumes many lines per packet and should be used only on selected packets.

Display packet data in hexadecimal and ASCII format. The offset and length values select a portion of the packet to be displayed. To display the whole packet, use an offset of 0. If a length value is not provided, the rest of the packet is displayed.

Select packets either from the network or from a capture file. Only packets for which the expression is true will be selected. If no expression is provided it is assumed to be true. Given a filter expression, snoop generates code for either the kernel packet filter or for its own internal filter. If capturing packets with the network interface, code for the kernel packet filter is generated. This filter is implemented as a streams module, upstream of the buffer module. The buffer module accumulates packets until it becomes full and passes the packets on to snoop. The kernel packet filter is very efficient, since it rejects unwanted packets in the kernel before they reach the packet buffer or snoop. The kernel packet filter has some limitations in its implementation; it is possible to construct filter expressions that it cannot handle. In this event, snoop tries to split the filter and do as much filtering in the kernel as possible. The remaining filtering is done by the packet filter for snoop. The -C flag can be used to view generated code for either the packet filter for the kernel or the packet filter for snoop. If packets are read from a capture file using the -i option, only the packet filter for snoop is used. A filter expression consists of a series of one or more boolean primitives that may be combined with boolean operators (AND, OR, and NOT). Normal precedence rules for boolean operators apply. Order of evaluation of these operators may be controlled with parentheses. Since parentheses and other filter expression characters are known to the shell, it is often necessary to enclose the filter expression in quotes. Refer to for information about setting up more efficient filters. The primitives are: host hostname

base[expr [: size ] ]

ether[0] & 1 = 1

ether[2:4] = 0xffffffff

ip[ip[0] & 0xf * 4 : 2] = 2049

ip[0] & 0xf > 5

ip[6:2] & 0x1fff = 0

udp and ip[6:2]&0x1fff = 0 and udp[6:2] != 0

Successful completion.

An error occurred.

Symbolic link to the system's primary audio device.

The null file.

Host name database.

RPC program number data base.

Internet services and aliases.