etherape(1)

💖 etherape(1) — the manual, but make it make sense 💖

okay bestie, pull up a chair, because this is etherape from the General Commands Manual and it's genuinely iconic. no cap. 🦋

---

✨ NAME ✨

etherape — a graphical network traffic browser 👑 like, it watches your network and draws it pretty, fr fr.

---

🌸 SYNOPSIS 🌸

etherape [ -d ] [ -f filter ] [ --final-export outfile ] [ --glade-file
interfacefile ] [ -i interface ] [ -l maxnodes ] [ -m operating mode ] [
--max-delay delay ] [ --min-delay delay ] [ -n ] [ -P column file ] [ -q
] [ -r inputfile ] [ -s ] [ --signal-export outfile ] [ -Z user ]

that's the whole vibe in one code block, bestie. every flag accounted for. 💅

---

🫶 DESCRIPTION 🫶

So. EtherApe is a network traffic browser — it shows you what's happening on your network, but like, graphically. Visual. Aesthetic. ✨

It uses GNOME libraries for its user interface (that's the whole look, the whole lewk 💅), and libpcap, which is the packet capture and filtering library doing the actual heavy lifting behind the scenes. she's got range.

---

💖 OPTIONS 💖

These options can be supplied to the command — here's every single one, no skips, no skimming, we're doing this properly:

• -d, --diagram-only — don't display any node text identification. just the shapes, just the diagram, minimalism era 🎀
• -f, --filter <capture filter> — set the capture filter
• --final-export <export file name> — when you're replaying, export to the named file at the end of the replay
• --glade-file <file name> — loads interface definitions from the GtkBuilder file you specify instead of the default one
• -i, --interface <interface name> — set the interface to listen to
• -l, --node-limit <number> — sets the maximum number of node visible (yes, that's exactly what it says, we're keeping it)
• -m, --mode <link|ip|tcp> — set mode of operation. default is ip, so if you don't pick, ip is what you get 💜
• --max-delay <delay in ms> — caps timestamps to the delay you provide, when replaying a capture file
• --min-delay <delay in ms> — provides a minimum to inter-packet delay when replaying a capture file
• -n, --numeric — don't convert addresses to names; this disables name resolution
• --no-display — calculate statistics, but don't display nodes. if you're replaying, it exits at the end. it's the quick way to calculate statistics, export data, or generate a report 🧚
• -P, --position <file name with list of nodes and columns> — activate column positioning with the named file. you manually position nodes in virtual columns using the named file's content. see Column Positioning below 👇
• -q,--quiet — disables informational messages. silence, but make it intentional 🤫
• -r, --replay-file <file name> — sets the input file to replay
• -s — Don't move nodes around. Doesn't work very well with changing nodes, so it will be removed in a future release. Deprecated. ⚠️ like, it's on the way out, bestie, don't build your whole life around it
• --signal-export <export file name> — if specified, enables signal USR1 handling. On receiving USR1, EtherApe will dump its state to the named XML or JSON file. the Export file format is selected in the Preferences dialog.

Beware! the file will be overwritten without asking! 😭 she does NOT check with you first

• -Z, --relinquish-privileges <user> — run everything but privileged packet-capture operations under the user ID and group ID of the given user 🔐
• -?, --help — show a brief help message

---

🌈 COLUMN POSITIONING 🌈

With option -P|--position EtherApe reads a file specifying positions of some nodes. The input file takes the format of:

node.mydomain.com        1
router1.mydomain.com     2
router2.mydomain.com     2
172.16.2.[0-9]*          1
.*.mydomain.com          1
ff02:.*                  2
fe80:.*                  1

The first column is a regex of either the FQDN or the IP address.

The second column is a number indicating the "column" that the node will be positioned in the display, with column 1 being on the far left. Up to 1000 columns are permitted. yes, a thousand. go off. 👑

Instead of being arranged in a circle, the nodes are displayed in columns. This is quite useful for arranging nodes so that you can see nodes on the "inside" of your network on the left and the public internet nodes (anything not specified in the config file) on the right. it's giving... topology glow-up ✨

The input file above will cause 3 columns to display. Nodes with FQDN containing mydomain.com, those in the 172.16.2.0/24 subnet, and link local IPv6 addresses will be in the left column. 2 "routers", and IPv6 multicast will be in the center column and everything else will be in the right column.

Column locations are determined by the first match while searching from the top of the input. Overlapping regex's can be used with the understanding that the first match will determine the location. The broadest regex's should be near the bottom of the position specification. order matters, bestie, top-down, first one wins, no takebacks 💅

---

🎀 SIGNALS 🎀

• USR1 — on receipt of signal USR1, and if enabled with --signal-export, EtherApe will dump its state to the chosen XML or JSON file.

Beware! the file will be overwritten without asking! 🫠 same warning, same chaos, same energy

---

🦋 ENVIRONMENT VARIABLES 🦋

• APE_DEBUG=normal|info|debug — controls debug output verbosity. Debug information are printed on standard output.

---

⭐ FILES ⭐

Etherape will use /etc/ethers if there is one to convert MAC addresses to names, and /etc/services to associate TCP/UDP port numbers to protocol names. she reads the classics. 📖

---

💜 SEE ALSO 💜

...and that's it, bestie. the SEE ALSO section is literally empty in the original, so there is nothing to send you to. iconic of her, honestly. 🙈

---

kisses, this was etherape(1) from the General Commands Manual — go capture some packets and slay 💅✨