【IT168 服务器学院】Snoop 的使用
　　Snoop 是Solaris 系统中自带的工具， 是一个用于显示网络通讯的程序， 它
　　可捕获IP 包并将其显示或保存到指定文件. (限超级用户使用snoop)
　　Snoop 可将捕获的包以一行的形式加以总结或用多行加以详细的描述(有
　　调用不同的参数-v -V来实现). 在总结方式下(-V ) , 将仅显示最高层的相关协
　　议, 例如一个NFS 包将仅显示NFS 信息, 其低层的RPC, UDP, IP, Ethernet 帧信息将不会显示, 但是当加上相应的参数(-v ), 这些信息都能被显示出来.
　　参数简介：
　　[ -a ] # Listen to packets on audio
　　[ -d device ] # settable to le?, ie?, bf?, tr?
　　[ -s snaplen ] # Truncate packets
　　[ -c count ] # Quit after count packets
　　[ -P ] # Turn OFF promiscuous mode
　　[ -D ] # Report dropped packets
　　[ -S ] # Report packet size
　　[ -i file ] # Read previously captured packets
　　[ -o file ] # Capture packets in file
　　[ -n file ] # Load addr-to-name table from file
　　[ -N ] # Create addr-to-name table
　　[ -t r|a|d ] # Time: Relative, Absolute or Delta
　　[ -v ] # Verbose packet display
　　[ -V ] # Show all summary lines
　　[ -p first[,last] ] # Select packet(s) to display
　　[ -x offset[,length] ] # Hex dump from offset for length
　　[ -C ] # Print packet filter code
　　由于snoop 的使用非常灵活, 希望能通过下面一些例子的学习来其常见用法.
　　1. 监听所有以本机为源和目的的包并将其显示出来.
　　# snoop
　　2. 监听所有以主机A为源和目的的包并将其显示出来. ( A为主机名, 下同)
　　- 2 -
　　# snoop A
　　3. 监听所有A和B之间的包并将其保存到文件file.
　　# snoop -o file A B
　　4. 显示文件file 中指定的包(99-108)
　　# snoop - i file -p 99,108
　　99 0.0027 boutique -> sunroof NFS C GETATTR FH=8E6C
　　100 0.0046 sunroof -> boutique NFS R GETATTR OK
　　101 0.0080 boutique -> sunroof NFS C RENAME FH=8E6C MTra00192
　　to .nfs08
　　102 0.0102 marmot -> viper NFS C LOOKUP FH=561E screen.r.13.i386
　　103 0.0072 viper -> marmot NFS R LOOKUP No such file or directory
　　104 0.0085 bugbomb -> sunroof RLOGIN C PORT=1023 h
　　105 0.0005 kandinsky -> sparky RSTAT C Get Statistics
　　106 0.0004 beeblebrox -> sunroof NFS C GETATTR FH=0307
　　107 0.0021 sparky -> kandinsky RSTAT R
　　108 0.0073 office -> jeremiah NFS C READ FH=2584 at 40960 for 8192
　　5. 详细查看文件file 中第101 个包:
　　# snoop - i file - v -p101
　　ETHER: ----- Ether Header -----
　　ETHER:
　　ETHER: Packet 101 arrived at 16:09:53.59
　　ETHER: Packet size = 210 bytes
　　ETHER: Destination = 8:0:20:1:3d:94, Sun
　　ETHER: Source = 8:0:69:1:5f:e, Silicon Graphics
　　ETHER: Ethertype = 0800 (IP)
　　ETHER:
　　IP: ----- IP Header -----
　　IP:
　　IP: Version = 4, header length = 20 bytes
　　IP: Type of service = 00
　　IP: ..0. .... = routine
　　IP: ...0 .... = normal delay
　　IP: .... 0... = normal throughput
　　IP: .... .0.. = normal reliability
　　IP: Total length = 196 bytes
　　IP: Identification 19846
　　IP: Flags = 0X
　　IP: .0.. .... = may fragment
　　IP: ..0. .... = more fragments
　　?
　　- 3 -
　　?
　　6. 查看主机A和主机B之间的NFS 包(命令中的and 和or 为相应的逻辑运
　　算)
　　# snoop - i file rpc nfs and A and B
　　1 0.0000 A -> B NFS C GETATTR FH=8E6C
　　2 0.0046 B -> A NFS R GETATTR OK
　　3 0.0080 A -> B NFS C RENAME FH=8E6C MTra00192 to .nfs08
　　7. 将这些符合条件的包保存到另一文件file2 中:
　　# snoop - i file -o file2 rpc nfs A B
　　8. 监听主机A和主机B间所有TCP 80 端口或UDP80端口的包
　　# snoop A and B and (tcp or udp) and port 80
　　9. 监听所有的广播包
　　# snoop broadcast
　　Using device /dev/hme (promiscuous mode)
　　10.10.10.50 -> BROADCAST UDP D=177 S=2541 LEN=35
　　10.10.10.50 -> BROADCAST UDP D=177 S=2541 LEN=35
　　10.10.10.50 -> BROADCAST UDP D=177 S=2541 LEN=35
　　10. 监听所有的多播包, 并显示详细内容.
　　#snoop -v multicast
　　ETHER: ----- Ether Header -----
　　ETHER:
　　ETHER: Packet 1 arrived at 12:33:2.16
　　ETHER: Packet size = 69 bytes
　　ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
　　ETHER: Source = 0:4:76:46:8f:50,
　　ETHER: Ethertype = 0800 (IP)
　　ETHER:
　　IP: ----- IP Header -----
　　IP:
　　IP: Version = 4
　　IP: Header length = 20 bytes
　　IP: Type of service = 0x00
　　IP: xxx. .... = 0 (precedence)
　　IP: ...0 .... = normal delay
　　- 4 -
　　IP: .... 0... = normal throughput
　　IP: .... .0.. = normal reliability
　　IP: Total length = 55 bytes
　　IP: Identification = 14658
　　IP: Flags = 0x0
　　IP: .0.. .... = may fragment
　　IP: ..0. .... = last fragment
　　IP: Fragment offset = 0 bytes
　　IP: Time to live = 128 seconds/hops
　　IP: Protocol = 17 (UDP)
　　IP: Header checksum = ed38
　　IP: Source address = 10.10.10.50, 10.10.10.50
　　IP: Destination address = 255.255.255.255, BROADCAST
　　IP: No options
　　IP:
　　UDP: ----- UDP Header -----
　　UDP:
　　UDP: Source port = 2541
　　UDP: Destination port = 177
　　UDP: Length = 35
　　UDP: Checksum = 8E35
　　UDP:
　　ETHER: ----- Ether Header -----
　　ETHER:
　　ETHER: Packet 2 arrived at 12:33:12.16
　　ETHER: Packet size = 69 bytes
　　ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
　　ETHER: Source = 0:4:76:46:8f:50,
　　ETHER: Ethertype = 0800 (IP)
　　ETHER:
　　IP: ----- IP Header -----
　　IP:
　　IP: Version = 4
　　IP: Header length = 20 bytes
　　IP: Type of service = 0x00
　　IP: xxx. .... = 0 (precedence)
　　IP: ...0 .... = normal delay
　　IP: .... 0... = normal throughput
　　IP: .... .0.. = normal reliability
　　IP: Total length = 55 bytes
　　IP: Identification = 14985
　　IP: Flags = 0x0
　　IP: .0.. .... = may fragment
　　IP: ..0. .... = last fragment
　　IP: Fragment offset = 0 bytes
　　IP: Time to live = 128 seconds/hops
　　IP: Protocol = 17 (UDP)
　　IP: Header checksum = ebf1
　　IP: Source address = 10.10.10.50, 10.10.10.50
　　- 5 -
　　IP: Destination address = 255.255.255.255, BROADCAST
　　IP: No options
　　IP:
　　UDP: ----- UDP Header -----
　　UDP:
　　UDP: Source port = 2541
　　UDP: Destination port = 177
　　UDP: Length = 35
　　UDP: Checksum = 8E35
　　UDP:
　　11．监听所有的NTP 协议包
　　# snoop |grep - i NTP
　　Using device /dev/hme (promiscuous mode)
　　ts1 -> 224.0.1.1 NTP broadcast (Tue Jul 23 12:48:50 2002)
　　ts1 -> 224.0.1.1 NTP broadcast (Tue Jul 23 12:49:54 2002)
　　ts1 -> 224.0.1.1 NTP broadcast (Tue Jul 23 12:50:58 2002)
　　ts1 -> 224.0.1.1 NTP broadcast (Tue Jul 23 12:52:02 2002)
　　ts1 -> 224.0.1.1 NTP broadcast (Tue Jul 23 12:53:06 2002)
　　ts1 -> 224.0.1.1 NTP broadcast (Tue Jul 23 12:54:10 2002)
　　这里我们也可看到NTP server 每隔约一分钟即向多播地址广播一次.