0205 UNIX 027. snoop 을 이용하여 네트웍 패킷분석하기

# snoop -o cap funky pinky

funky 와 pinky 는 hostname 이다

# snoop -i cap -t r | more

  1   0.00000 172.23.19.247 -> tfiweb      HTTP C port=3405

  2   0.00004      tfiweb -> 172.23.19.247 HTTP R port=3405

  3   2.99471 172.23.19.247 -> tfiweb      HTTP C port=3405

  4   2.99476      tfiweb -> 172.23.19.247 HTTP R port=3405

  5   3.50360      tfiweb -> 172.23.19.247 HTTP R port=3405

  6   9.01387 172.23.19.247 -> tfiweb      HTTP C port=3405

  7   9.01392      tfiweb -> 172.23.19.247 HTTP R port=3405

  8  10.40366      tfiweb -> 172.23.19.247 HTTP R port=3405

  9  24.10355      tfiweb -> 172.23.19.247 HTTP R port=3405

 

example# snoop -i cap -p 99,108

      99   0.0027   boutique -> sunroof     NFS C GETATTR FH=8E6C

     100   0.0046   sunroof -> boutique     NFS R GETATTR OK

     101   0.0080   boutique -> sunroof     NFS C RENAME FH=8E6C MTra00192 to .nfs08

     102   0.0102   marmot -> viper          NFS C LOOKUP FH=561E screen.r.13.i386

     103   0.0072   viper -> marmot          NFS R LOOKUP No such file or directory

     104   0.0085   bugbomb -> sunroof    RLOGIN C PORT=1023 h

     105   0.0005   kandinsky -> sparky    RSTAT C Get Statistics

     106   0.0004   beeblebrox -> sunroof  NFS C GETATTR FH=0307

     107   0.0021   sparky -> kandinsky    RSTAT R

     108   0.0073   office -> jeremiah        NFS C READ FH=2584 at 40960 for 8192

# snoop -i cap -v -p3