DSNIFF(8)

📦
version 2.5a2 · 3 versions
, in ubuntu resolute, ubuntu stonking

💖 DSNIFF(8) — the manual, but make it make sense 💖

okay bestie, sit down, we're reading the dsniff page from the System Manager's Manual together and it's honestly iconic. no cap.

✨ NAME ✨

dsniff — password sniffer. yes girl, that's the whole name. it's giving "job description that's also a warning label" 💅

🌸 SYNOPSIS 🌸

dsniff [-v] [-c] [-a] [-d] [-m] [-D] [-N] [-P] [-i interface | -p
pcapfile] [-s snaplen] [-M magics] [-f services] [-t trigger[,...]]
[-r|-w savefile] [expression]

like, look at her. all those little flags. she's busy and she's thriving 🦋

👑 DESCRIPTION 👑

so dsniff is a password sniffer, and the way it handles a whole list of protocols? obsessed. it speaks: FTP, Telnet, SMTP, HTTP, POP, poppass, NNTP, IMAP, SNMP, LDAP, Rlogin, RIP, OSPF, PPTP MS-CHAP, NFS, VRRP, YP/NIS, SOCKS, X11, CVS, IRC, AIM, ICQ, Napster, PostgreSQL, Meeting Maker, Citrix ICA, Symantec pcAnywhere, NAI Sniffer, Microsoft SMB, Oracle SQL*Net, Sybase and Microsoft SQL. not one, not two — all of them. she's the main character of protocol decoding fr fr 😭

and here's the tea: dsniff automatically detects and minimally parses each application protocol, only saving the interesting bits, and uses Berkeley DB as its output file format, only logging unique authentication attempts. so she's picky in the best way. full TCP/IP reassembly is provided by libnids(3) — shoutout to the support system, we love a collab 🫶

I wrote dsniff with honest intentions - to audit my own network, and to demonstrate the insecurity of cleartext network protocols. Please do not abuse this software.

(that's the author speaking, and honestly? respect. do not be weird with it, bestie. periodt.)

💅 OPTIONS 💅

one bullet per flag, because we do not skip, we do not merge, we do not abbreviate. every single one is here 💜

  • -c — Perform half-duplex TCP stream reassembly, to handle asymmetrically routed traffic (such as when using arpspoof(8) to intercept client traffic bound for the local gateway).
  • -v — Verbose. Show banners.
  • -a — Show all results. Otherwise dsniff tries not to show to many duplicates.
  • -d — Enable debugging mode.
  • -m — Force protocol detection/DPI also on known services. For example, -m will detect SSH _and_ HTTPS on port 443.
  • -N — Resolve IP addresses to hostnames.
  • -P — Enable promisc mode.
  • -C — Force color output even if not a tty.
  • -D — Disable DPI. Only decode known services (DPI is enabled by default on unknown ports).
  • -i interface — Specify the interface to listen on.
  • -p pcapfile — Rather than processing the contents of packets observed upon the network process the given PCAP capture file.
  • -s snaplen — Analyze at most the first snaplen bytes of each TCP connection, rather than the default of 1024.
  • -f services — Load triggers from a services file. Default is to use internal.
  • -M magicfile — Load magics from file. Default is to use internal. Can not be used with -t.
  • -t trigger[,...] — Load triggers from a comma-separated list, specified as port/proto=service (e.g. 80/tcp=http).
  • -r savefile — Read sniffed sessions from a savefile created with the -w option.
  • -w file — Write sniffed sessions to savefile rather than parsing and printing them out.
  • expression — Specify a tcpdump(8) filter expression to select traffic to sniff.
heads up, queen: on a hangup signal dsniff will dump its current trigger table to dsniff.services. she just... does that. unprompted. iconic behavior, honestly 🌈

🎀 FILES 🎀

the little files she keeps in her bag:

  • /usr/share/dsniff/dsniff.services — Default trigger table
  • /usr/share/dsniff/dsniff.magic — Network protocol magic

🦋 SEE ALSO 🦋

go read her friends, they're all slaying in their own lanes:

💖 AUTHOR 💖

Dug Song <dugsong@monkey.org> — we stan a legend 👑

💀 BUGS 💀

ngl, this part is real: dsniff's automatic protocol detection feature is based on the classic file(1) command by Ian Darwin, and shares its historical limitations and bugs. so like... the baggage came with the blueprint. we're all just living in file(1)'s legacy fr 😭

and that's the whole page, bestie!! 🌸 this was DSNIFF(8) from the System Manager's Manual, signing off with a little 🎀 — stay curious, stay ethical, and never sniff anything that isn't yours 💜✨

📦 where this page comes from