SNIFFIT(5)

💖 SNIFFIT 💖 — the config file page (section 5, file formats, bestie)

okay so this is sniffit(5), the config file page, and the config file name is arbitrary — call it whatever you want, she doesn't care. ✨

---

🎀 DESCRIPTION 🎀

So basically: this page explains the format for the config file for sniffit (peep sniffit(8) if you wanna meet the actual program). This file is where you get to be super specific about which packets should be processed by sniffit — like, down to the details, no cap. It also controls (or, quote unquote, will control) some functions for the continuous logging (-L option). 👑

A sniffit config file might look like this — and bestie, be sure to end it with a BLANK line:

# Sniffit Sample Config file -- Brecht Claerhout

logfile /var/log/sniffit.today.log

# First select all packets!
select both mhosts 1
select both mhosts 2

# Now deselect all packets from/to those damn 'surfers'
deselect both port 80
deselect both port 8001

So what this file is telling sniffit: process all packets on the subnet, except the ones FROM/TO ports 80 and 8001. Because we do not want logs of those mass WWW connections that turn our logs completely unreadable. it's giving ✨unhinged log energy✨ and we're not here for it 🫶

---

🌈 GLOBAL FORMAT 🌈

The file is made of lines. Lines are made of fields. Fields are separated with SPACES — and I need you to hear me on this one — NO TABS. 🚨

Unix comment lines (the ones starting with #) are allowed, slay.

So it gives us:

<field1> <field2> <field3> <field4> <field5>

---

🦋 FIELD FORMAT 🦋

<field1>

• select — Sniffit will look for packets that match the description coming up in the other fields 💅
• deselect — Sniffit will ignore packets that match the description
• logfile — change the logfile name to <field2> instead of the default sniffit.log

<field2>

• from — packets FROM the host matching the description after it are considered
• to — same vibe, but packets TO the...
• both — same vibe again, packets FROM or TO the...
• a filename — this one shows up as an argument of logfile in <field1>

<field3>

• host — the (de)selection criteria involves a hostname
• port — similar, but it's a portnumber
• mhosts — the (de)selection criteria involves multiple-hosts, like with the wildcards in 0.3.0, but without the x

<field4>

Either a hostname, a portnumber, a service name, or a number-dot partial notation indicating multiple hosts — which one depends on <field3>. And heads up: service names like ftp are resolved as the services available on the host that runs Sniffit, and translated into a port nr. 🧚

<field5>

A portnumber, if <field3> was host or mhosts. It's optional — if you don't fill it in, all ports are going to be (de)selected.

---

🔥 FILE INTERPRETING 🔥

The config file is interpreted SEQUENTIAL — meaning in order, top to bottom, bestie. So watch it, don't mix lines up in a file. Example:

select both mhosts 100.100.12.
deselect both port 80
select both host 100.100.12.2

This file will get you the packets:

1. Sent by hosts 100.100.12.*
2. EXCEPT the WWW packets
3. BUT showing the WWW packets concerning 100.100.12.2

Now watch what happens if you flip the order:

select both mhosts 100.100.12.
select both host 100.100.12.2
deselect both port 80

Will give you the packets (and probably an unwanted result 😭):

1. Sent by hosts 100.100.12.*
2. Sent from/to 100.100.12.2 (useless line, ngl)
3. deselecting all WWW packets on the subnet

bestie the order is the whole plot. sequencing is not a suggestion, it's a lifestyle. 💀

---

💜 AUTHOR 💜

Brecht Claerhout <coder@reptile.rug.ac.be>

---

👑 SEE ALSO 👑

sniffit(8)

---

okay that's the whole page!! go off and write the most iconic config file of all time 🌸🦋✨

and a lil sign-off from me to you: this was SNIFFIT(5), living in the File Formats Manual — mwah, periodt 💅💖