1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
.TH tcpsnoop 1m "$Date:: 2007-10-04 #$" "USER COMMANDS"
.SH NAME
tcpsnoop \- snoop TCP network packets by process. Uses DTrace.
.SH SYNOPSIS
.B tcpsnoop
[\-a|hjsvZ] [\-n name] [\-p pid]
.SH DESCRIPTION
This analyses TCP network packets and prints the responsible PID and UID,
plus standard details such as IP address and port. This captures traffic
of newly created TCP connections that were established while this program
was running. It can help identify which processes is causing TCP traffic.
Since this uses DTrace, only the root user or users with the
dtrace_kernel privilege can run this command.
.SH OS
Solaris Nevada / OpenSolaris, circa late 2007
.SH STABILITY
unstable - this script uses fbt provider probes which may change for
future updates of the OS, invalidating this script. Please read
Docs/Notes/ALLfbt_notes.txt for further details about these fbt scripts.
.SH OPTIONS
.TP
\-a
print all data
.TP
\-j
print project ID
.TP
\-s
print time, us
.TP
\-v
print time, string
.TP
\-Z
print zone ID
.TP
\-n name
command name to snoop
.TP
\-p PID
process ID to snoop
.PP
.SH EXAMPLES
.TP
Default output, snoop TCP network packets with details,
#
.B tcpsnoop
.TP
Print human readable timestamps,
#
.B tcpsnoop
\-v
.TP
Print zonename,
#
.B tcpsnoop
\-Z
.TP
Print sshd traffic only,
#
.B tcpsnoop
\-n sshd
.PP
.SH FIELDS
.TP
UID
user ID
.TP
PID
process ID
.TP
CMD
command name
.TP
LADDR
local IP address
.TP
RADDR
remote IP address
.TP
LPORT
local port number
.TP
RPORT
remote port number
.TP
DR
direction
.TP
SIZE
packet size, bytes
.TP
TIME
timestamp, us
.TP
STRTIME
human readable timestamp, string
.TP
ZONE
zone ID
.TP
PROJ
project ID
.PP
.SH DOCUMENTATION
See the DTraceToolkit for further documentation under the
Docs directory. The DTraceToolkit docs may include full worked
examples with verbose descriptions explaining the output.
.SH EXIT
tcpsnoop will print traffic until Ctrl\-C is hit.
.SH AUTHOR
Brendan Gregg
[Sydney, Australia]
.SH SEE ALSO
tcptop(1M), dtrace(1M)
|
