Filter
Top Products
IFTRACE IFTRACE ( 1M )
–d Allows internal debug tracing to be enabled.
keywords
Allows packets to be filtered based upon specific fields within a packet.
The keywords ip, ipx, and apple are required to filter packets for either
DOD IP Internet or Novell IPX or AppleTalk datagrams, repectively. Only
one datagram type can be specified at a time. Once a datagram type has
been selected, the remaining keywords src, dst, sport, and dport can then be
selected to further filter datagrams, based upon specific fields within a
packet. The src and dst keywords will only capture packets whose source
and destination address fields match the addresses specified within either
an IP, IPX, or DDP datagram. The source and destination addresses for IP
datagrams can be specified in either dotted IP notation or as symbolic host
names. For AppleTalk addresses the format is network.node (e.g., 2001.147).
For IPX addresses the format is network:node:socket (e.g. 53:0000a200443d or
53:0000a200443d:ncp). The socket portion of the IPX address is optional.
However, either symbolic names or hexadecimal values can be used to
specify the socket field of an IPX address. Acceptible symbolic IPX socket
names are ncp, sap, rip, netbios, diagnostic, and nlsp. The sport and dport key-
words are only supported for IP datagrams. Any IP (i.e., TCP or UDP)
packet that contains a source port or destination port number that matches
the sport and dport keywords will be captured. All other packets will be
captured but discarded when displayed (-p).
iftrace is a tool to allow the tracing of packets at the interface level. By default, it
does not capture packets from the media that are not addressed to the interface.
The normal method for capture is to use the –g option to capture into a file and
then use the –p option to display the captured packets. This allows for the fastest
capture with a minimum of lost packets.
If fast capture is not required, the –g and –p options may be combined to display
packets as they are captured.
SEE ALSO
hosts(4), ip(7P), tcp(7P), udp(7P)
BUGS
The packets captured are only those received/transmitted at the interface. It is not
possible to use iftrace as a media monitor because promiscuous mode is not sup-
ported and enabled on the interface.
Issue 3 E-25