Winamp command line options Winamp Technical Support The free customizable Winamp media player that plays mp3 + other audio files, syncs your iPod, subscribes to Podcasts and more. DOSAMP 0.8 - Before Winamp. It was the first freeware command line media player and probably the first MP3 player for DOS. Download and play! Winamp Web Interface A web interface plugin to control winamp from anywhere. A web interface plugin to control winamp from anywhere. A nice and simple web server so you can control winamp from anywhere. Control playback, view playlists, add files from your music collection and let people see what you're listening to.
NAME
tcpdump - dump traffic on a networkSYNOPSIS
tcpdump[-AdDeflLnNOpqRStuUvxX] [-ccount][-Cfile_size] [-Ffile]
[-iinterface][-mmodule][-M
secret][-rfile][-ssnaplen][-Ttype][-wfile]
[-Wfilecount]
[-Espi@ipaddr algo:secret,...]
[-ydatalinktype][-Zuser]
[expression]
DESCRIPTION
Tcpdump prints out a description of the contents of packets on anetwork interface that match the boolean expression. It can alsobe run with the-wflag, which causes it to save the packet data to a file for lateranalysis, and/or with the-rflag, which causes it to read from a saved packet file rather than toread packets from a network interface. In all cases, only packets thatmatchexpressionwill be processed bytcpdump.
Tcpdumpwill, if not run with the-cflag, continue capturing packets until it is interrupted by a SIGINTsignal (generated, for example, by typing your interrupt character,typically control-C) or a SIGTERM signal (typically generated with thekill(1)command); if run with the-cflag, it will capture packets until it is interrupted by a SIGINT orSIGTERM signal or the specified number of packets have been processed.
Whentcpdumpfinishes capturing packets, it will report counts of:
- tcpdumphas received and processed);
- packets ``received by filter' (the meaning of this depends on the OS onwhich you're runningtcpdump,and possibly on the way the OS was configured - if a filter wasspecified on the command line, on some OSes it counts packets regardlessof whether they were matched by the filter expression and, even if theywere matched by the filter expression, regardless of whethertcpdumphas read and processed them yet, on other OSes it counts only packets that werematched by the filter expression regardless of whethertcpdumphas read and processed them yet, and on other OSes it counts onlypackets that were matched by the filter expression and were processed bytcpdump);
- packets ``dropped by kernel' (this is the number of packets that weredropped, due to a lack of buffer space, by the packet capture mechanismin the OS on whichtcpdumpis running, if the OS reports that information to applications; if not,it will be reported as 0).
On platforms that support the SIGINFO signal, such as most BSDs(including Mac OS X) and Digital/Tru64 UNIX, it will report those countswhen it receives a SIGINFO signal (generated, for example, by typingyour ``status' character, typically control-T, although on someplatforms, such as Mac OS X, the ``status' character is not set bydefault, so you must set it withstty(1)in order to use it) and will continue capturing packets.
Reading packets from a network interface may require that you havespecial privileges:
- Under HP-UX with DLPI:
- You must be root ortcpdumpmust be installed setuid to root.
- Under IRIX with snoop:
- You must be root ortcpdumpmust be installed setuid to root.
- Under Linux:
- You must be root ortcpdumpmust be installed setuid to root (unless your distribution has a kernelthat supports capability bits such as CAP_NET_RAW and code to allowthose capability bits to be given to particular accounts and to causethose bits to be set on a user's initial processes when they log in, inwhich case you must have CAP_NET_RAW in order to capture andCAP_NET_ADMIN to enumerate network devices with, for example, the-Dflag).
- Under ULTRIX and Digital UNIX/Tru64 UNIX:
- Any user may capture network traffic withtcpdump.However, no user (not even the super-user) can capture in promiscuousmode on an interface unless the super-user has enabled promiscuous-modeoperation on that interface usingpfconfig(8),and no user (not even the super-user) can capture unicast trafficreceived by or sent by the machine on an interface unless the super-userhas enabled copy-all-mode operation on that interface usingpfconfig,sousefulpacket capture on an interface probably requires that eitherpromiscuous-mode or copy-all-mode operation, or both modes ofoperation, be enabled on that interface.
- Under BSD (this includes Mac OS X):
- You must have read access to/dev/bpf*.On BSDs with a devfs (this includes Mac OS X), this might involve morethan just having somebody with super-user access setting the ownershipor permissions on the BPF devices - it might involve configuring devfsto set the ownership or permissions every time the system is booted,if the system even supports that; if it doesn't support that, you mighthave to find some other way to make that happen at boot time.
Reading a saved packet file doesn't require special privileges.
OPTIONS
``tcpdump -l | tee dat' or``tcpdump -l > dat & tail -f dat'.
The expression consists of one or moreprimitives.Primitives usually consist of anid(name or number) preceded by one or more qualifiers.There are threedifferent kinds of qualifier:
- hostis assumed.
- dir
- qualifiers specify a particular transfer direction to and/or fromid.Possible directions aresrc,dst,src or dstandsrc anddst.E.g., `src foo', `dst net 128.3', `src or dst port ftp-data'.Ifthere is no dir qualifier,src or dstis assumed.For some link layers, such as SLIP and the ``cooked' Linux capture modeused for the ``any' device and for some other device types, theinboundandoutboundqualifiers can be used to specify a desired direction.
- proto
- qualifiers restrict the match to a particular protocol.Possibleprotos are:ether,fddi,tr,wlan,ip,ip6,arp,rarp,decnet,tcpandudp.E.g., `ether src foo', `arp net 128.3', `tcp port 21', `udp portrange7000-7009'.If there isno proto qualifier, all protocols consistent with the type areassumed.E.g., `src foo' means `(ip or arp or rarp) src foo'(except the latter is not legal syntax), `net bar' means `(ip orarp or rarp) net bar' and `port 53' means `(tcp or udp) port 53'.
[`fddi' is actually an alias for `ether'; the parser treats themidentically as meaning ``the data link level used on the specifiednetwork interface.' FDDI headers contain Ethernet-like sourceand destination addresses, and often contain Ethernet-like packettypes, so you can filter on these FDDI fields just as with theanalogous Ethernet fields.FDDI headers also contain other fields,but you cannot name them explicitly in a filter expression.
Similarly, `tr' and `wlan' are aliases for `ether'; the previousparagraph's statements about FDDI headers also apply to Token Ringand 802.11 wireless LAN headers. For 802.11 headers, the destinationaddress is the DA field and the source address is the SA field; theBSSID, RA, and TA fields aren't tested.]
In addition to the above, there are some special `primitive' keywordsthat don't follow the pattern:gateway,broadcast,less,greaterand arithmetic expressions.All of these are described below.
More complex filter expressions are built up by using the wordsand,orandnotto combine primitives.E.g., `host foo and not port ftp and not port ftp-data'.To save typing, identical qualifier lists can be omitted.E.g.,`tcp dst port ftp or ftp-data or domain' is exactly the same as`tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'.
Allowable primitives are:
- iso
- tcpdump checks the DSAP (Destination Service Access Point) andSSAP (Source Service Access Point) fields of the LLC header;
- stp and netbeui
- tcpdump checks the DSAP of the LLC header;
- atalk
- tcpdump checks for a SNAP-format packet with an OUI of 0x080007and the AppleTalk etype.
- iso, stp, and netbeui
- tcpdump checks for an 802.3 frame and then checks the LLC header asit does for FDDI, Token Ring, and 802.11;
- atalk
- tcpdump checks both for the AppleTalk etype in an Ethernet frame andfor a SNAP-format packet as it does for FDDI, Token Ring, and 802.11;
- aarp
- tcpdump checks for the AppleTalk ARP etype in either an Ethernetframe or an 802.2 SNAP frame with an OUI of 0x000000;
- ipx
- tcpdump checks for the IPX etype in an Ethernet frame, the IPXDSAP in the LLC header, the 802.3-with-no-LLC-header encapsulation ofIPX, and the IPX etype in a SNAP frame.
For example, `ether[0] & 1 != 0' catches all multicast traffic.The expression `ip[0] & 0xf != 5'catches all IPv4 packets with options.The expression`ip[6:2] & 0x1fff = 0'catches only unfragmented IPv4 datagrams and frag zero of fragmentedIPv4 datagrams.This check is implicitly applied to the tcp and udpindex operations.For instance, tcp[0] always means the firstbyte of the TCP header, and never means the first byte of anintervening fragment.
Some offsets and field values may be expressed as names rather thanas numeric values.The following protocol header field offsets areavailable: icmptype (ICMP type field), icmpcode (ICMPcode field), and tcpflags (TCP flags field).
The following ICMP type field values are available: icmp-echoreply,icmp-unreach, icmp-sourcequench, icmp-redirect,icmp-echo, icmp-routeradvert, icmp-routersolicit,icmp-timxceed, icmp-paramprob, icmp-tstamp,icmp-tstampreply, icmp-ireq, icmp-ireqreply,icmp-maskreq, icmp-maskreply.
The following TCP flags field values are available: tcp-fin,tcp-syn, tcp-rst, tcp-push,tcp-ack, tcp-urg.
Primitives may be combined using:
- not').
- Concatenation (`&&' or `and').
- Alternation (`||' or `or').
Negation has highest precedence.Alternation and concatenation have equal precedence and associateleft to right.Note that explicit and tokens, not juxtaposition,are now required for concatenation.
If an identifier is given without a keyword, the most recent keywordis assumed.For example,is short forwhich should not be confused with
Expression arguments can be passed to tcpdump as either a singleargument or as multiple arguments, whichever is more convenient.Generally, if the expression contains Shell metacharacters, it iseasier to pass it as a single, quoted argument.Multiple arguments are concatenated with spaces before being parsed.
EXAMPLES
To print all packets arriving at or departing from sundown:
To print traffic between helios and either hot or ace:
To print all IP packets between ace and any host except helios:
To print all traffic between local hosts and hosts at Berkeley:
To print all ftp traffic through internet gateway snup:(note that the expression is quoted to prevent the shell from(mis-)interpreting the parentheses):
To print traffic neither sourced from nor destined for local hosts(if you gateway to one other net, this stuff should never make itonto your local net).
To print the start and end packets (the SYN and FIN packets) of eachTCP conversation that involves a non-local host.
To print all IPv4 HTTP packets to and from port 80, i.e. print onlypackets that contain data, not, for example, SYN and FIN packets andACK-only packets. (IPv6 is left as an exercise for the reader.)
To print IP packets longer than 576 bytes sent through gateway snup:
To print IP broadcast or multicast packets that werenotsent via Ethernet broadcast or multicast:
To print all ICMP packets that are not echo requests/replies (i.e., notping packets):
OUTPUT FORMAT
The output of tcpdump is protocol dependent.The followinggives a brief description and examples of most of the formats.
Link Level Headers
If the '-e' option is given, the link level header is printed out.On Ethernets, the source and destination addresses, protocol,and packet length are printed.
On FDDI networks, the '-e' option causes tcpdump to printthe `frame control' field, the source and destination addresses,and the packet length.(The `frame control' field governs theinterpretation of the rest of the packet.Normal packets (suchas those containing IP datagrams) are `async' packets, with a priorityvalue between 0 and 7; for example, `async4'.Such packetsare assumed to contain an 802.2 Logical Link Control (LLC) packet;the LLC header is printed if it is not an ISO datagram or aso-called SNAP packet.
On Token Ring networks, the '-e' option causes tcpdump to printthe `access control' and `frame control' fields, the source anddestination addresses, and the packet length.As on FDDI networks,packets are assumed to contain an LLC packet.Regardless of whetherthe '-e' option is specified or not, the source routing information isprinted for source-routed packets.
On 802.11 networks, the '-e' option causes tcpdump to printthe `frame control' fields, all of the addresses in the 802.11 header,and the packet length.As on FDDI networks,packets are assumed to contain an LLC packet.
(N.B.: The following description assumes familiarity withthe SLIP compression algorithm described in RFC-1144.)
On SLIP links, a direction indicator (``I' for inbound, ``O' for outbound),packet type, and compression information are printed out.The packet type is printed first.The three types are ip, utcp, and ctcp.No further link information is printed for ip packets.For TCP packets, the connection identifier is printed following the type.If the packet is compressed, its encoded header is printed out.The special cases are printed out as*S+n and *SA+n, where n is the amount by whichthe sequence number (or sequence number and ack) has changed.If it is not a special case,zero or more changes are printed.A change is indicated by U (urgent pointer), W (window), A (ack),S (sequence number), and I (packet ID), followed by a delta (+n or -n),or a new value (=n).Finally, the amount of data in the packet and compressed header lengthare printed.
For example, the following line shows an outbound compressed TCP packet,with an implicit connection identifier; the ack has changed by 6,the sequence number by 49, and the packet ID by 6; there are 3 bytes ofdata and 6 bytes of compressed header:
ARP/RARP Packets
Arp/rarp output shows the type of request and its arguments.Theformat is intended to be self explanatory.Here is a short sample taken from the start of an `rlogin' fromhost rtsg to host csam:
The first line says that rtsg sent an arp packet askingfor the Ethernet address of internet host csam.Csamreplies with its Ethernet address (in this example, Ethernet addressesare in caps and internet addresses in lower case).This would look less redundant if we had done tcpdump -n:
If we had done tcpdump -e, the fact that the first packet isbroadcast and the second is point-to-point would be visible:
For the first packet this says the Ethernet source address is RTSG, thedestination is the Ethernet broadcast address, the type fieldcontained hex 0806 (type ETHER_ARP) and the total length was 64 bytes.TCP Packets
(N.B.:The following description assumes familiarity withthe TCP protocol described in RFC-793.If you are not familiarwith the protocol, neither this description nor tcpdump willbe of much use to you.)
The general format of a tcp protocol line is:
Src and dst are the source and destination IPaddresses and ports.Flags are some combination of S (SYN),F (FIN), P (PUSH), R (RST), W (ECN CWR) or E (ECN-Echo), or a single`.' (no flags).Data-seqno describes the portion of sequence space coveredby the data in this packet (see example below).Ack is sequence number of the next data expected the otherdirection on this connection.Window is the number of bytes of receive buffer space availablethe other direction on this connection.Urg indicates there is `urgent' data in the packet.Options are tcp options enclosed in angle brackets (e.g., <mss 1024>).Src, dst and flags are always present.The other fieldsdepend on the contents of the packet's tcp protocol header andare output only if appropriate.
Here is the opening portion of an rlogin from host rtsg tohost csam.
The first line says that tcp port 1023 on rtsg sent a packetto port loginon csam.The S indicates that the SYN flag was set.The packet sequence number was 768512 and it contained no data.(The notation is `first:last(nbytes)' which means `sequencenumbers firstup to but not including last which is nbytes bytes of user data'.)There was no piggy-backed ack, the available receive window was 4096bytes and there was a max-segment-size option requesting an mss of1024 bytes.Csam replies with a similar packet except it includes a piggy-backedack for rtsg's SYN.Rtsg then acks csam's SYN.The `.' means noflags were set.The packet contained no data so there is no data sequence number.Note that the ack sequencenumber is a small integer (1).The first time tcpdump sees atcp `conversation', it prints the sequence number from the packet.On subsequent packets of the conversation, the difference betweenthe current packet's sequence number and this initial sequence numberis printed.This means that sequence numbers after thefirst can be interpretedas relative byte positions in the conversation's data stream (with thefirst data byte each direction being `1').`-S' will override thisfeature, causing the original sequence numbers to be output.
On the 6th line, rtsg sends csam 19 bytes of data (bytes 2 through 20in the rtsg -> csam side of the conversation).The PUSH flag is set in the packet.On the 7th line, csam says it's received data sent by rtsg up tobut not including byte 21.Most of this data is apparently sitting in thesocket buffer since csam's receive window has gotten 19 bytes smaller.Csam also sends one byte of data to rtsg in this packet.On the 8th and 9th lines,csam sends two bytes of urgent, pushed data to rtsg.
If the snapshot was small enough that tcpdump didn't capturethe full TCP header, it interprets as much of the header as it canand then reports ``[|tcp]' to indicate the remainder could notbe interpreted.If the header contains a bogus option (one with a lengththat's either too small or beyond the end of the header), tcpdumpreports it as ``[bad opt]' and does not interpret any furtheroptions (since it's impossible to tell where they start).If the headerlength indicates options are present but the IP datagram length is notlong enough for the options to actually be there, tcpdump reportsit as ``[bad hdr length]'.
Capturing TCP packets with particular flag combinations (SYN-ACK, URG-ACK, etc.)
There are 8 bits in the control bits section of the TCP header:
- 2) Recipient responds with SYN, ACK
- tcpdump -i xl0 tcp[13] 2
tcpdump -i xl0 'tcp[13] & 2 2'- ftp://ftp.ee.lbl.gov/tcpdump.tar.Z
- patches@tcpdump.org
- capturing on some PPP devices won't work correctly.
- tcpdump.
Recall the structure of a TCP header without options:
A TCP header usually holds 20 octets of data, unless options arepresent.The first line of the graph contains octets 0 - 3, thesecond line shows octets 4 - 7 etc.
Starting to count with 0, the relevant TCP control bits are containedin octet 13:
Let's have a closer look at octet no. 13:
These are the TCP control bits we are interestedin.We have numbered the bits in this octet from 0 to 7, right toleft, so the PSH bit is bit number 3, while the URG bit is number 5.
Recall that we want to capture packets with only SYN set.Let's see what happens to octet 13 if a TCP datagram arriveswith the SYN bit set in its header:
Looking at thecontrol bits section we see that only bit number 1 (SYN) is set.
Assuming that octet number 13 is an 8-bit unsigned integer innetwork byte order, the binary value of this octet is
This relationship can be expressed as
The expression says 'let the 13th octet of a TCP datagram havethe decimal value 2', which is exactly what we want.
Now, let's assume that we need to capture SYN packets, but wedon't care if ACK or any other TCP control bit is set at thesame time.Let's see what happens to octet 13 when a TCP datagramwith SYN-ACK set arrives:
Now bits 1 and 4 are set in the 13th octet.The binary value ofoctet 13 is
- tcpdump filterexpression, because that would select only those packets that haveSYN-ACK set, but not those with only SYN set.Remember that we don't careif ACK or any other control bit is set as long as SYN is set.
In order to achieve our goal, we need to logically AND thebinary value of octet 13 with some other value to preservethe SYN bit.We know that we want SYN to be set in any case,so we'll logically AND the value in the 13th octet withthe binary value of a SYN:
We see that this AND operation delivers the same resultregardless whether ACK or another TCP control bit is set.The decimal representation of the AND value as well asthe result of this operation is 2 (binary 00000010),so we know that for packets with SYN set the followingrelation must hold true:
Note that you should use single quotes or a backslashin the expression to hide the AND ('&') special characterfrom the shell.
UDP Packets
UDP format is illustrated by this rwho packet:
This says that port who on host actinide sent a udpdatagram to port who on host broadcast, the Internetbroadcast address.The packet contained 84 bytes of user data.Some UDP services are recognized (from the source or destinationport number) and the higher level protocol information printed.In particular, Domain Name service requests (RFC-1034/1035) and SunRPC calls (RFC-1050) to NFS.
UDP Name Server Requests
(N.B.:The following description assumes familiarity withthe Domain Service protocol described in RFC-1035.If you are not familiarwith the protocol, the following description will appear to be writtenin greek.)
Name server requests are formatted as
Host h2opolo asked the domain server on helios for anaddress record (qtype=A) associated with the name ucbvax.berkeley.edu.The query id was `3'.The `+' indicates the recursion desired flagwas set.The query length was 37 bytes, not including the UDP andIP protocol headers.The query operation was the normal one, Query,so the op field was omitted.If the op had been anything else, it wouldhave been printed between the `3' and the `+'.Similarly, the qclass was the normal one,C_IN, and omitted.Any other qclass would have been printedimmediately after the `A'.A few anomalies are checked and may result in extra fields enclosed insquare brackets: If a query contains an answer, authority records oradditional records section,ancount,nscount,orarcountare printed as `[na]', `[nn]' or `[nau]' where nis the appropriate count.If any of the response bits are set (AA, RA or rcode) or any of the`must be zero' bits are set in bytes two and three, `[b2&3=x]'is printed, where x is the hex value of header bytes two and three.
UDP Name Server Responses
Name server responses are formatted as
In the first example, helios responds to query id 3 from h2opolo
with 3 answer records, 3 name server records and 7 additional records.The first answer record is type A (address) and its data is internetaddress 128.32.137.3.The total size of the response was 273 bytes,excluding UDP and IP headers.The op (Query) and response code(NoError) were omitted, as was the class (C_IN) of the A record.In the second example, helios responds to query 2 with aresponse code of non-existent domain (NXDomain) with no answers,one name server and no authority records.The `*' indicates thatthe authoritative answer bit was set.Since there were noanswers, no type, class or data were printed.
Other flag characters that might appear are `-' (recursion available,RA, not set) and `|' (truncated message, TC, set).If the`question' section doesn't contain exactly one entry, `[nq]'is printed.
Note that name server requests and responses tend to be large and thedefault snaplen of 68 bytes may not capture enough of the packetto print.Use the -s flag to increase the snaplen if youneed to seriously investigate name server traffic.`-s 128'has worked well for me.
SMB/CIFS decoding
tcpdump now includes fairly extensive SMB/CIFS/NBT decoding for dataon UDP/137, UDP/138 and TCP/139.Some primitive decoding of IPX andNetBEUI SMB data is also done.
By default a fairly minimal decode is done, with a much more detaileddecode done if -v is used.Be warned that with -v a single SMB packetmay take up a page or more, so only use -v if you really want all thegory details.
For information on SMB packet formats and what all te fields mean seewww.cifs.org or the pub/samba/specs/ directory on your favoritesamba.org mirror site.The SMB patches were written by Andrew Tridgell(tridge@samba.org).
NFS Requests and Replies
Sun NFS (Network File System) requests and replies are printed as:
In the first line, host sushi sends a transaction with id 6709to wrl (note that the number following the src host is atransaction id, not the source port).The request was 112 bytes,excluding the UDP and IP headers.The operation was a readlink(read symbolic link) on file handle (fh) 21,24/10.731657119.(If one is lucky, as in this case, the file handle can be interpretedas a major,minor device number pair, followed by the inode number andgeneration number.)Wrl replies `ok' with the contents of the link.Winamp Line In Command
In the third line, sushi asks wrl to lookup the name`xcolors' in directory file 9,74/4096.6878.Note that the data printeddepends on the operation type.The format is intended to be selfexplanatory if read in conjunction withan NFS protocol spec.
If the -v (verbose) flag is given, additional information is printed.For example:
(-v also prints the IP header TTL, ID, length, and fragmentation fields,which have been omitted from this example.) In the first line,sushi asks wrl to read 8192 bytes from file 21,11/12.195,at byte offset 24576.Wrl replies `ok'; the packet shown on thesecond line is the first fragment of the reply, and hence is only 1472bytes long (the other bytes will follow in subsequent fragments, butthese fragments do not have NFS or even UDP headers and so might not beprinted, depending on the filter expression used).Because the -v flagis given, some of the file attributes (which are returned in additionto the file data) are printed: the file type (``REG', for regular file),the file mode (in octal), the uid and gid, and the file size.If the -v flag is given more than once, even more details are printed.
Note that NFS requests are very large and much of the detail won't be printedunless snaplen is increased.Try using `-s 192' to watchNFS traffic.
NFS reply packets do not explicitly identify the RPC operation.Instead,tcpdump keeps track of ``recent' requests, and matches them to thereplies using the transaction ID.If a reply does not closely follow thecorresponding request, it might not be parsable.
AFS Requests and Replies
Transarc AFS (Andrew File System) requests and replies are printedas:
In the first line, host elvis sends a RX packet to pike.This wasa RX data packet to the fs (fileserver) service, and is the start ofan RPC call.The RPC call was a rename, with the old directory file idof 536876964/1/1 and an old filename of `.newsrc.new', and a new directoryfile id of 536876964/1/1 and a new filename of `.newsrc'.The host pikeresponds with a RPC reply to the rename call (which was successful, becauseit was a data packet and not an abort packet).In general, all AFS RPCs are decoded at least by RPC call name.MostAFS RPCs have at least some of the arguments decoded (generally onlythe `interesting' arguments, for some definition of interesting).
The format is intended to be self-describing, but it will probablynot be useful to people who are not familiar with the workings ofAFS and RX.
If the -v (verbose) flag is given twice, acknowledgement packets andadditional header information is printed, such as the the RX call ID,call number, sequence number, serial number, and the RX packet flags.
If the -v flag is given twice, additional information is printed,such as the the RX call ID, serial number, and the RX packet flags.The MTU negotiation information is also printed from RX ack packets.
If the -v flag is given three times, the security index and service idare printed.
Error codes are printed for abort packets, with the exception of Ubikbeacon packets (because abort packets are used to signify a yes votefor the Ubik protocol).
Note that AFS requests are very large and many of the arguments won'tbe printed unless snaplen is increased.Try using `-s 256'to watch AFS traffic.
AFS reply packets do not explicitly identify the RPC operation.Instead,tcpdump keeps track of ``recent' requests, and matches them to thereplies using the call number and service ID.If a reply does not closelyfollow thecorresponding request, it might not be parsable.
KIP AppleTalk (DDP in UDP)
AppleTalk DDP packets encapsulated in UDP datagrams are de-encapsulatedand dumped as DDP packets (i.e., all the UDP header information isdiscarded).The file/etc/atalk.namesis used to translate AppleTalk net and node numbers to names.Lines in this file have the form
The first two lines give the names of AppleTalk networks.The thirdline gives the name of a particular host (a host is distinguishedfrom a net by the 3rd octet in the number -a net number must have two octets and a host number musthave three octets.) The number and name should be separated bywhitespace (blanks or tabs).The/etc/atalk.namesfile may contain blank lines or comment lines (lines starting witha `#').AppleTalk addresses are printed in the form
(If the/etc/atalk.namesdoesn't exist or doesn't contain an entry for some AppleTalkhost/net number, addresses are printed in numeric form.)In the first example, NBP (DDP port 2) on net 144.1 node 209is sending to whatever is listening on port 220 of net icsd node 112.The second line is the same except the full name of the source nodeis known (`office').The third line is a send from port 235 onnet jssmag node 149 to broadcast on the icsd-net NBP port (note thatthe broadcast address (255) is indicated by a net name with no hostnumber - for this reason it's a good idea to keep node names andnet names distinct in /etc/atalk.names).NBP (name binding protocol) and ATP (AppleTalk transaction protocol)packets have their contents interpreted.Other protocols just dumpthe protocol name (or number if no name is registered for theprotocol) and packet size.
NBP packets are formatted like the following examples:
The first line is a name lookup request for laserwriters sent by net icsd host112 and broadcast on net jssmag.The nbp id for the lookup is 190.The second line shows a reply for this request (note that it has thesame id) from host jssmag.209 saying that it has a laserwriterresource named 'RM1140' registered on port 250.The third line isanother reply to the same request saying host techpit has laserwriter'techpit' registered on port 186.ATP packet formatting is demonstrated by the following example:
Jssmag.209 initiates transaction id 12266 with host helios by requestingup to 8 packets (the `<0-7>').The hex number at the end of the lineis the value of the `userdata' field in the request.Helios responds with 8 512-byte packets.The `:digit' following thetransaction id gives the packet sequence number in the transactionand the number in parens is the amount of data in the packet,excluding the atp header.The `*' on packet 7 indicates that theEOM bit was set.
Jssmag.209 then requests that packets 3 & 5 be retransmitted.Heliosresends them then jssmag.209 releases the transaction.Finally,jssmag.209 initiates the next request.The `*' on the requestindicates that XO (`exactly once') was not set.
IP Fragmentation
Fragmented Internet datagrams are printed as
(The first form indicates there are more fragments.The secondindicates this is the last fragment.)Winamp Command Line
Id is the fragment id.Size is the fragmentsize (in bytes) excluding the IP header.Offset is thisfragment's offset (in bytes) in the original datagram.
The fragment information is output for each fragment.The firstfragment contains the higher level protocol header and the fraginfo is printed after the protocol info.Fragmentsafter the first contain no higher level protocol header and thefrag info is printed after the source and destination addresses.For example, here is part of an ftp from arizona.edu to lbl-rtsg.arpaover a CSNET connection that doesn't appear to handle 576 byte datagrams:
There are a couple of things to note here: First, addresses in the2nd line don't include port numbers.This is because the TCPprotocol information is all in the first fragment and we have no ideawhat the port or sequence numbers are when we print the later fragments.Second, the tcp sequence information in the first line is printed as if therewere 308 bytes of user data when, in fact, there are 512 bytes (308 inthe first frag and 204 in the second).If you are looking for holesin the sequence space or trying to match up ackswith packets, this can fool you.A packet with the IP don't fragment flag is marked with atrailing (DF).
Timestamps
By default, all output lines are preceded by a timestamp.The timestampis the current clock time in the form
and is as accurate as the kernel's clock.The timestamp reflects the time the kernel first saw the packet.No attemptis made to account for the time lag between when theEthernet interface removed the packet from the wire and when the kernelserviced the `new packet' interrupt.AUTHORS
The original authors are:Van Jacobson,Craig Leres andSteven McCanne, all of theLawrence Berkeley National Laboratory, University of California, Berkeley, CA.
It is currently being maintained by tcpdump.org.
The current version is available via http:
IPv6/IPsec support is added by WIDE/KAME project.This program uses Eric Young's SSLeay library, under specific configuration.
BUGS
Please send problems, bugs, questions, desirable enhancements, etc. to:NIT doesn't let you watch your own outbound traffic, BPF will.We recommend that you use the latter.
On Linux systems with 2.0[.x] kernels:
- tcpdump);
We recommend that you upgrade to a 2.2 or later kernel.
Some attempt should be made to reassemble IP fragments or, at leastto compute the right length for the higher level protocol.
Name server inverse queries are not dumped correctly: the (empty)question section is printed rather than real query in the answersection.Some believe that inverse queries are themselves a bug andprefer to fix the program generating them rather than tcpdump.
A packet trace that crosses a daylight savings time change will giveskewed time stamps (the time change is ignored).
Filter expressions on fields other than those in Token Ring headers willnot correctly handle source-routed Token Ring packets.
Filter expressions on fields other than those in 802.11 headers will notcorrectly handle 802.11 data packets with both To DS and From DS set.
ip6 protoshould chase header chain, but at this moment it does not.ip6 protochainis supplied for this behavior.
Arithmetic expression against transport layer headers, like tcp[0],does not work against IPv6 packets.It only looks at IPv4 packets.
This document was created byman2html,using the manual pages.Time: 02:59:27 GMT, December 01, 2006
License: All 1 2 | Free
The Audio Player for those who have passion with PCs and Music. It uses the BASS API by un4seen.com. It's Main features Are: 1 . Excellent Playback Quality. 2 . Skin Support. It also supports Winamp Skins !!! 3 . Equalizer with visual effects. 4 . Playlist Editor. 5 . Freedb Support + Freedb Local Database...
Category: Audio
Publisher: George Boudouris, License: Freeware, Price: USD $0.00, File Size: 2.2 MB
Platform: Windows
Visually edit MP3 audio without decoding and quality loss on a 3D sample display. Encode, re-encode, convert to WAV/WMA or any other command line encoder, record MP3/WMA/Flac streams, burn AudioCD or MP3 CD/DVD compilations, professional ID3v2 Tag editor, CD ripper with cddb/freedb support. Note: Unregistered version is fully functional, the only limitation is that you have to register if you...
Category: Audio
Publisher: 3delite, License: Shareware, Price: USD $30.00, File Size: 8.8 MB
Platform: Windows
KMPLAYER is a korean movie and audio player that supports a wide range of codecs and file formats, It has full VCD/DVD playback functionality. KMPlayer is a program that allows you to play audio and video files. Here are some key features of 'KMPlayer': Supported Files or Devices · HTTP Streaming(AVI etc including none-streaming media) · Directshow playback (avi, mkv...
Category: DVD & Video / Multimedia Player
Publisher: KMPlayer.com, License: Freeware, Price: USD $0.00, File Size: 16.0 MB
Platform: Windows, All
Winamp Essentials Pack is a small package of WinampPlugins you can't live without. Winamp Essentials Pack is must-have plug-in pack compiled by Winamp staff and contributors.
Category: Audio / Utilities & Plug-Ins
Publisher: AOL/Nullsoft, License: Freeware, Price: USD $0.00, File Size: 335.0 KB
Platform: Windows, All
Visualization plugin for Winamp. Laser effect It is possible to look at it as look at fire. A dance it not a set of poses. A music it not a set of sounds. Moreover, color music it not conformity to each sound of the certain color. I think it is conformity of change of image to music. SoundGraffiti is an attempt to bring the visualization closer to the human perception of music.
Category: Audio
Publisher: SoundGraffiti, License: Freeware, Price: USD $0.00, File Size: 662.6 KB
Platform: Windows
you can run any windows sound application or DVD Player software above the Equalizer. The Equalizer will correct the audio stream automatic and will include the Limiter and the compressor to be sure, that the audio signal is not to loud or not to low. If you load a wav file or a mp3 file you can hear the different and the effect of the Equalizer. You will be very impressed...
Category: Audio / Audio Players
Publisher: PAS-Products, License: Shareware, Price: USD $49.00, File Size: 25.7 MB
Platform: Windows
As I said in one of my previous reviews, we like Winamp. It's one of the most popular audio players in the world, with a really big community, which keeps designing new skins, adding new Plugins, and thinking about implementing new functionality and different ways to use this great program.
Well, here I have found another little piece of software, very simple, very...
Category: Audio / Audio Players
Publisher: Cubeactive, License: Freeware, Price: USD $0.00, File Size: 1015.8 KB
Platform: Windows
Chipamp is a free bundle of existing Plugins for Winamp that lets you play a variety of chiptune and tracker formats, including music from classic game consoles like the NES, SNES, Sega Genesis, Gameboy, and Playstation. Essentially, Chipamp itself is just a delivery mechanism for existing WinampPlugins.
Category: Audio / Utilities & Plug-Ins
Publisher: OverClocked ReMix, License: Freeware, Price: USD $0.00, File Size: 3.4 MB
Platform: Windows
Developed under license from Solid State Logic, The SSL 4000 Collection includes four meticulously modeled Plugins based on the legendary SSL 4000 Series: the SSL E-Channel, the SSL G-Master Buss Compressor, the SSL G-Equalizer and the all-new G-Channel. These Plugins sound so close to the original consoles, even experts who work with SSL boards day in and day out...
Category: Audio / Utilities & Plug-Ins
Publisher: Waves, License: Demo, Price: USD $0.00, File Size: 2.6 MB
Platform: Windows
With Xor Midi Control you can control many Winamp functions such as play/stop, volume, balance, Equalizer... via MIDI controller or keyboard.You need .NET Framework 3.5 to run program. Features:
- Fixed some bugs
- More I/O controls (for playlist, system ...)
- Changed application design
- Languages
Category: Audio / Utilities & Plug-Ins
Publisher: Marek L edivA?, License: Freeware, Price: USD $0.00, File Size: 102.6 KB
Platform: Windows
Winamp was born as a very basic media player and has slowly but consistently improving for many years. Its main purpose was to be completely customizable and through the years, many people have contributed to a library that now consists of over 20,000 skins and loads of plug-ins. When Winamp version 5 was released, Nullsoft redeemed themselves in the public's eyes after...
Category: Audio / Audio Players
Publisher: Pad Submitter, License: Freeware, Price: USD $0.00, File Size: 344.0 KB
Platform: Windows
you can run any windows sound application or DVD Player software thru the Equalizer. The Equalizer will correct the audio stream automatic and will include the Limiter and the compressor to be sure, that the audio signal is not to loud or not to low. If you load a wav file or a mp3 file you can hear the different and the effect of the Equalizer. You will be very impressed...
Category: Audio
Publisher: PAS-Products, License: Shareware, Price: USD $49.00, EUR39, File Size: 6.7 MB
Platform: Windows
Actual Transparent Windows lets you apply transparency effect to any window in Windows 2000/XP. The transparency effect looks very impressive and may be useful with such objects as Windows Taskbar, Winamp, drop-down menus and other windows. The transparent Taskbar doesn't hide any part of your desktop wallpaper. The transparent Winamp looks stylish and impressive. The...
Category: Desktop Enhancements / Skins
Publisher: Michael Tretyakov, License: Shareware, Price: USD $12.95, File Size: 1.1 MB
Platform: Unknown
Desktop clock displays the local time in the any time zone around the world. Now you don't need to update your system time or launch an internet browser when Internet is slow or unavailable to see your friends or family local time. Appointment Management system will simplify your personal time management routines. In addition to powerful Reminders List it also provides a quick-reminder function...
Category: Home & Education / Calendars & Planners
Publisher: Sergey Varnavsky, License: Shareware, Price: USD $19.95, File Size: 220.0 KB
Platform: Unknown
Astatix Launcher allows you to quick start any applications, open documents and explore folders in a single click. It allows assigning hotkeys to any actions, fulfilling several special functions: open/close CD door, run screen saver, hide task bar and others. One of additional possibilities is a control of Winamp. You can use any hotkeys and control Winamp player anytime even you...
Category: Utilities / Launchers
Publisher: Astatix Software, License: Shareware, Price: USD $19.95, File Size: 870.1 KB
Platform: Windows
Keyboard shortcut utility that lets you instantly control Winamp player, load your favorite Winamp playlists, quickly run applications, load documents, open URLs, send emails, go searching the Internet and many more with a single key press! You can customize every hotkey setting and set to load with Windows for quick access.
Category: Audio / Audio Players
Publisher: Artem Kamchiline, License: Shareware, Price: USD $19.95, File Size: 703.0 KB
Platform: Unknown
TimeLeft is a unique application that combines plenty of features and simplicity. TimeLeft features include reminder, Winamp skinnable countdown clock, alarm clock, clock, system tray clock, timer, stopwatch, desktop sticker, time synchronization, eBay auction time watch and more. Reminder: Birthday, cruise, party, retirement, baby due, graduation - any event is possible to...
Category: Home & Education / Clocks
Publisher: NesterSoft Inc., License: Freeware, Price: USD $0.00, File Size: 2.3 MB
Platform: Windows, Mac, Linux, Unix
Voice Call is an answering machine and telephone dialer with Caller ID and Speakerphone support. It will restore itself from the system tray on the ring of your phone and even can set Winamp on pause. Callers can be announced using any SAPI compliant text-to-speech engine. If the number is in the Cute Organizer database then callers name, photo and notes will be shown before you even...
Category: Internet / Communications
Publisher: NetPicker.net, License: Shareware, Price: USD $35.00, File Size: 1.8 MB
Platform: Unknown
MiniLyrics is an amazing lyrics plugin for iTunes, Winamp, Windows Media Player, etc. It will download and display lyrics automatically, you can catch every word. MiniLyrics can save lyrics in mp3 files, you can view lyrics on iPod touch or iPhone. MiniLyrics can display lyrics in Winamp, Windows Media Player, iTunes, Zune, Foobar2000, Songbird, Spotify, MediaMonkey, VLC Media...
Category: Home & Education / Teaching Tools
Publisher: Crintsoft, License: Shareware, Price: USD $14.95, File Size: 1.7 MB
Platform: Windows
Ambient Keys is one of MHC's vst Plugins with an ambient sound, playing hundreds of ambient waveforms and processing these using filters, envelopes and the effect section which has 133 different effect modes, including crossfading effects and layered effects.
Category: Audio
Publisher: MHC, License: Shareware, Price: USD $139.00, File Size: 3.9 MB
Platform: Windows
Organizer for huge MP3 collections. Play your favourite music without any effort! FAST queries, dynamic playlists, individual grading, 'Party'-mode, powerful search function. Add-on for your Winamp 2.x / 5.x player. # Display album covers # Integrated database -> Very fast queries # Static playlists # Own screensaver # Rename & move files while they are playing # ID3-tag...
Category: Audio
Publisher: FineRip Team, License: Shareware, Price: USD $12.00, File Size: 1.1 MB
Platform: Windows
Flex FX contains 7 different vst plugins, the Amplitude Modulator, Chaotic Lowpass Filter, Chaotic Highpass Filter, Ensemble effect, Stereo Feedback Delay, Ultra Feedback Flanger and Fat Resonator.
Category: Audio
Publisher: MHC, License: Demo, Price: USD $179.00, File Size: 1.9 MB
Platform: Windows
SoundGraffit - first really intellectual music light expose with DMX yield. The program convert input sound signal of microphone( line input) or Winamp to yield signal representing DMX dimmer devices (Lamps, projectors and etc)
Category: Audio
Publisher: SoundGraffiti, License: Shareware, Price: USD $99.00, File Size: 3.0 MB
Platform: Windows
The Space Effect is one of MHC's vst plugins processing audio, such as drums, guitars, external synthesizers or soft synths.
Category: Audio
Publisher: MHC, License: Shareware, Price: USD $179.00, File Size: 880.6 KB
Platform: Windows
The Space Synth is one of MHC's vst Plugins with an ambient sound. It is suitable for ambient music and electronic music which you have previously used generic Plugins for. This is one of our Plugins which is tailor made for ambient pads.
Category: Audio
Publisher: MHC, License: Shareware, Price: USD $179.00, File Size: 2.9 MB
Platform: Windows