Monitoring Packet Transfers With the snoop Command
You can use the snoop command to monitor the state of data transfers.
snoop captures network packets and displays their contents in the format that you
specify. Packets can be displayed as soon as they are received, or saved
to a file. When snoop writes to an intermediate file, packet loss
under busy trace conditions is unlikely. snoop itself is then used to
interpret the file.
To capture packets to and from the default interface in promiscuous mode, you
must assume the Network Management role or become superuser. In summary form, snoop
displays only the data that pertains to the highest-level protocol. For example, an
NFS packet only displays NFS information. The underlying RPC, UDP, IP, and Ethernet
frame information is suppressed but can be displayed if either of the verbose
options is chosen.
Use snoop frequently and consistently to become familiar with normal system behavior. For
assistance in analyzing packets, look for a recent white paper and RFC, and
seek the advice of an expert in a particular area, such as NFS
or NIS. For details on using snoop and its options, refer to the
snoop(1M) man page.
How to Check Packets From All Interfaces
- On the local host, assume the Network Management role or become superuser.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.
- Print information about the interfaces that are attached to the system.
# ifconfig -a
The snoop command normally uses the first non-loopback device, typically the primary network
interface.
- Begin packet capture by typing snoop without arguments, as shown in Example 8-19
- Use Control-C to halt the process.
Example 8-19 Output From the snoop Command
The basic snoop command returns output that resembles the following, for a dual-stack
host.
% snoop
Using device /dev/hme (promiscuous mode)
farhost.remote.com -> myhost RLOGIN C port=993
myhost -> farhost.remote.com RLOGIN R port=993 Using device /dev/hme
router5.local.com -> router5.local.com ARP R 10.0.0.13, router5.local.com is
0:10:7b:31:37:80
router5.local.com -> BROADCAST TFTP Read "network-confg" (octet)
myhost -> DNSserver.local.com DNS C 192.168.10.10.in-addr.arpa. Internet PTR ?
DNSserver.local.com myhost DNS R 192.168.10.10.in-addr.arpa. Internet PTR niserve2.
.
.
farhost.remote.com-> myhost RLOGIN C port=993
myhost -> farhost.remote.com RLOGIN R port=993 fe80::a00:20ff:febb:
.
fe80::a00:20ff:febb:e09 -> ff02::9 RIPng R (5 destinations)The packets that are captured in this output show a remote login
section, including lookups to the NIS and DNS servers for address resolution. Also included
are periodic ARP packets from the local router and advertisements of the IPv6
link-local address to in.ripngd.
How to Capture snoop Output Into a File
- On the local host, assume the Network Management role or become superuser.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.
- Capture a snoop session into a file.
# snoop -o filename
For example:
# snoop /tmp/cap
Using device /dev/eri (promiscuous mode)
30 snoop: 30 packets captured
In the example, 30 packets have been captured in a file named
/tmp/cap. The file can be in any directory with enough disk space.
The number of packets that are captured is displayed on the command line,
enabling you to press Control-C to abort at any time.
snoop creates a noticeable networking load on the host machine, which can distort
the results. To see the actual results, run snoop from a third system.
- Inspect the snoop output captures file.
# snoop -i filename
Example 8-20 Contents of a
snoop Output Captures File
The following output shows a variety of captures such as you might
receive as output from the snoop -i command.
# snoop -i /tmp/cap
1 0.00000 fe80::a00:20ff:fee9:2d27 -> fe80::a00:20ff:fecd:4375
ICMPv6 Neighbor advertisement
2 0.16198 farhost.com -> myhost RLOGIN C port=985
3 0.00008 myhost -> farhost.com RLOGIN R port=985
10 0.91493 10.0.0.40 -> (broadcast) ARP C Who is 10.0.0.40, 10.0.0.40 ?
34 0.43690 nearserver.here.com -> 224.0.1.1 IP D=224.0.1.1 S=10.0.0.40 LEN=28,
ID=47453, TO =0x0, TTL=1
35 0.00034 10.0.0.40 -> 224.0.1.1 IP D=224.0.1.1 S=10.0.0.40 LEN=28, ID=57376,
TOS=0x0, TTL=47
How to Check Packets Between an IPv4 Server and a Client
- Establish a snoop system off a hub that is connected to either the
client or the server.
The third system (the snoop system) checks all the intervening traffic, so the snoop
trace reflects what is actually happening on the wire.
- On the snoop system, assume the Network Management role or become superuser.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.
- Type snoop with options and save the output to a file.
- Inspect and interpret the output.
Refer to RFC 1761, Snoop Version 2 Packet Capture File Format for details of the snoop capture file.
How to Monitor IPv6 Network Traffic
You can use the snoop command to display only IPv6 packets.
- On the local node, assume the Network Management role or become superuser.
Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.
- Capture IPv6 packets.
# snoop ip6
For more information on the snoop command, see the snoop(1M) man page.
Example 8-21 Displaying Only IPv6 Network Traffic
The following example shows typical output such as you might receive from running
the snoop ip6 command on a node.
# snoop ip6
fe80::a00:20ff:fecd:4374 -> ff02::1:ffe9:2d27 ICMPv6 Neighbor solicitation
fe80::a00:20ff:fee9:2d27 -> fe80::a00:20ff:fecd:4375 ICMPv6 Neighbor
solicitation
fe80::a00:20ff:fee9:2d27 -> fe80::a00:20ff:fecd:4375 ICMPv6 Neighbor
solicitation
fe80::a00:20ff:febb:e09 -> ff02::9 RIPng R (11 destinations)
fe80::a00:20ff:fee9:2d27 -> ff02::1:ffcd:4375 ICMPv6 Neighbor solicitation
