Linux in a Nutshell, Fifth Edition

464

|

Chapter 3: Linux Commands

This is the Title of the Book, eMatter Edition

Copyright © 2006 O’Reilly & Associates, Inc. All rights reserved.

tcpd

tcpd

TCP/IP command. Monitor incoming TCP/IP requests (such as

those for telnet, ftp, finger, exec, rlogin). Provide checking and

logging services; then pass the request to the appropriate daemon.

tcpdump

tcpdump [options] [expression]

System administration command. Dump headers and packets of

network traffic that match expression. The command continues to

capture packets until it receives a SIGTERM or SIGINT signal

(usually generated by typing the interrupt character control-C).

When finished, it will generate a report on traffic captured,

received, or dropped by the kernel.

Expressions

Create matching expressions using the following primitives

followed by an ID or name.

direction

A qualifier indicating whether to match source or destination

information. Accepted values are src, dst, src or dst, and src

and dst. When not specified, the expression will match either

source or destination traffic.

protocol

A qualifier restricting matches to a particular kind of packet.

Accepted values are: ether, fddi, tr, wlan, ip, ip6, arp, rarp,

decnet, tcp, and udp. If not specified, the match defaults to

any appropriate protocol matching type.

type

A qualifier indicating what kind of thing the ID or name refer-

ences, such as a part of a hostname (host), IP address (net)or

port ...