issniff(8)

NAME
issniff - Internet Session SNIFFer

SYNOPSIS
issniff [options] [+]port [[+]port ...]

DESCRIPTION
issniff switches the selected (or auto-detected) network interface into "promiscuous" mode and monitors the network traffic visible to that interface, collecting data on TCP-protocol network connections to the destination port(s) selected on the command line. Alternatively, packets may be read from a local packet-dump file created by 'tcpdump', or from a pipe from 'tcpdump'.

At least one port must be specified. A '+' prefix on a port number means to monitor traffic in both directions on connections to that port.

When a new network connection to a selected port is detected (a SYN packet), issniff starts collecting data for that connection. Once the connection terminates (a FIN or RST packet), or times out or exceeds the maximum data collection threshold, the data collected during the duration of the connection is printed to stdout, together with the connection's relevant statistics: hosts and ports involved, time-stamps, packet counts, bytes, and the reason for data-collection termination.

OPTIONS

-a  Track all connections--even those for which no SYN packet was seen--allowing monitoring of already-established connections. (Doesn't work correctly yet; still a semi-functional--and buggy--"stub.")

-c cache_increment
    The number of connection entries to expand the data cache by when an expansion is required. (Default is 16, an arbitrary value.)

    Higher values should result in an infinitesimal speed improvement, but will also cause issniff to use more memory.

-d max_data
    The maximum amount of data, in bytes, to collect for a connection before dumping its data/statistics and discontinuing data-collection. (Default is 16k, an arbitrary value.) Note that, due to gratuitous inefficiency, each collected byte takes up a two bytes of internal storage.

-i interface
    The network interface to monitor. (Default is the first auto-detected interface of a known type, using the following priority scheme for Linux: Ethernet, PPP, SLIP, loopback, and dummy. Ethernet is the only interface supported on non-Linux systems at this time.)

-n  No local packets/connections. Only packets/connections originating from other systems will be passed through to the packet-filtering layer, i.e. locally originated packets/connections will be "lost." (Default is to pass/process all packets/connections on OS's that support it, currently Linux.)

-o filename
    Send output to filename. Verbose commentary messages--normally sent to standard error--will not be written to this file. (See also -O.)

-O filename
    Send output to both filename and standard output. Verbose commentary messages--normally sent to standard error--will not be written to this file. (See also -o.)

-r  "Real-time" mode. Sniffer detaches from tty and uses shared memory to communicate with an interactive ncurses-based front-end. (Not yet implemented! Probably won't ever be implemented! So there!)

-s  "Squash" output. Consecutive carriage-returns/newlines in the collected data will be replaced by a single newline in the printed output.

-t timeout
    The maximum idle time, in seconds between successive packets, allowed for a connection before dumping its data/statistics and discontinuing data-collection. (Default is 3600; one hour.)

    A timeout value of 0 disables the timeout feature. This is not recommended usage: issniff could eventually malloc() all computer storage.

    Due to the timeout algorithm used, some connections may not time out until their idle time has significantly exceeded this threshold value. This is not a bug.

-v  Verbose mode. Output one-line descriptions of new connections to stderr each time one is detected.

-w filename
    Take packet input from a packet-dump file written by 'tcpdump -w', vice from a "real-time" network interface. (Still under development; only works under Linux so far.)

    A filename of - means to read input from stdin, as via a pipe from a 'tcpdump -w -' command.

-B  Use BPF code paths. (Linux only--not yet implemented.)

-C  Colorize output, with color selection based on the travel direction of the packets--useful when monitoring traffic in both directions on a port. Session headers, statistics, etc., are uncolorized.

    The color numbers are the same as for Linux's color-capable 'ls' program:

    30 black
    31 red
    32 green
    33 yellow
    34 blue
    35 magenta
    36 cyan
    37 white

    You must have a color-capable terminal, such as the Linux console or an xterm with colorization extensions, to use this option effectively.

-F color
    Color number to use for output of data traveling from a monitored port ("backwards"). Implies -C. (Default is 34; blue).

-T color
    Color number to use for output of data traveling to a monitored port. Implies -C. (Default is 31; red.)

SIGNALS

USR1
    Causes issniff to output its current state information to stderr.

USR2
    Causes issniff to output a summary list of the currently active network connections it is collecting data for to stderr.

HUP Display full output for all currently active connections, then resume monitoring.

INT Exit with full output for all currently active connections. Turns off promiscuous mode.

QUIT
    Exit immediately, with no output. Turns off promiscuous mode.

TERM
    Exit immediately, with no output. Turns off promiscuous mode.

KILL
    Do not send a SIGKILL to issniff; doing so will leave the network interface it was monitoring in promiscuous mode on some OS's. issniff exits cleanly on: SIGINT, SIGQUIT, and SIGTERM. (In fact, these are the only exit methods supported.)

BUGS
Tcpdump "interface" still buggy and under development.

NOTES
Some features and/or options have not yet been implemented. issniff has been tested under:

Linux: 1.2.13, 1.3.45, 1.99.x., 2.0.x., 2.1.x, 2.2.x, 2.6.x, 3.10.0

Linux is the only OS under active development; all others have been deprecated. All SunOS, Solaris, and OSF/1 code was removed during various code refactorings.

AUTHOR
This code and documentation is Copyright (C) 1996-1999, 2004-2005, 2008-2010, 2012-2013, 2015 Jeffrey A. Uphoff <juphoff@kjsl.com>.

All rights reserved.