SNIFFIT(8)

📦 version 0.7, in arch rolling, debian bookworm, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 SNIFFIT — ok bestie, section 8, let's GO 💖

So this is the manual page for sniffit, and it lives in section 8 of the system manager's manual. Pull up a chair, grab a boba, we're doing networking forensics together 🫶

✨ NAME ✨

sniffit — packet sniffer and monitoring tool

Yeah. It sniffs packets. It monitors. It's that girl. 👑

🌸 SYNOPSIS 🌸

sniffit [-xdabvnN] [-P proto ] [-A char ] [-p port ] [(-r|-R) recordfile
] [-l sniflen ] [-L logparam ] [-F snifdevice ] [-D tty ] [-M plugin ]
[(-t Target-IP | -s Source-IP ) | (-i|-I) | -c config-file ]

Okay so that's a lot of brackets and I know it's giving "math homework" energy but it's literally just flags, I promise. We'll go through every single one below, no skips, no cap 💅

🦋 DESCRIPTION 🦋

sniffit is a packet sniffer for TCP/UDP/ICMP packets. Not only that, but it will hand you very detailed technical info on those packets — we're talking SEQ, ACK, TTL, Window, the whole ~aesthetic~ — plus the actual packet contents in different formats (hex, plain text, you name it, she serves it).

By default sniffit can handle ethernet and PPP devices, but it can easily be forced into using other devices too. (Go read the README.FIRST and sn_config.h files on this subject, bestie, they're important!)

The sniffer can easily be configured so it will 'filter' the incoming packets — which makes your sniffing results so much easier to study. The config file (see sniffit(5)) lets you be extremely specific about which packets get processed. Very picky. Very demure. ✨

sniffit also has an interactive mode for active monitoring, and it can be used for continuous monitoring on different levels too. Multi-talented fr fr 🌈

🎀 NOTE 🎀

This man page is supposed to be a reference manual. So please read README.FIRST first, and use this one only for better understanding, or for a quick check on how to use sniffit.

Like, genuinely read README.FIRST first. This page is the cheat sheet, not the tutorial, iykyk 🙈

💜 OPTIONS 💜

  • -v — Shows the version of sniffit you're running and then exits. It overrides all the other options, she's the main character, she does not share the spotlight.
  • -t Target-IP — Only process packets TO Target-IP. If Target-IP is in dot-nr notation, ´x' is allowed as a wildcard. (e.g. -t 157.193.x, -t x, ...) (NOT compatible with: -s -i -I -c -v -L)
  • -s Source-IP — Same vibe as -t, except it only processes packets FROM Source-IP. (NOT compatible with: -t -i -I -c -v -L)
  • -b — ´both' mode: together with -s or -t, it only processes packets FROM/TO the IP specified by -s or -t. (NOT compatible with: -t -i -I -c -v -L)
  • -c config-file — Use config-file for the packet filtering. This lets you be very specific about which packets get processed (see sniffit(5) for details on the format). (NOT compatible with: -t -s -i -I -v -L)
  • -i — Launches the ncurses interface for active monitoring (the 'interactive mode'). (NOT available if you compiled without INTERACTIVE support — see sn_config.h and README.FIRST) (one of the options -t -s -i -I -c is required) (NOT compatible with: -t -s -c -v -L)
  • -I — Same as -i, but gives you more information. More info, more chaos, more fun 🫶 (one of the options -t -s -i -I -c is required) (NOT compatible with: -t -s -c -v -L)
  • -R <file> — Record all traffic into <file>. That file can then be fed to Sniffit with the -r option. (Needs a selection parameter like -c -t -s) (NOT compatible with -i -I -v -L -r)
  • -r <file> — This option feeds the recorded <file> to sniffit. It requires the -F option with the correct device. Say you log a file on a machine with eth0 — when you feed that logged file back to sniffit, you'll need to add -F eth0 or -F eth to the command line. It also doesn't need much explanation that using -i or -I together with -r makes no sense (at this moment). (requires -F, NOT compatible with -R -i -I)
  • -n — Turn off IP checksum checking. This can show you bogus packets. (mind you, ARP, RARP and other non-IP packets will show up bogus too) (compatible with ALL options)
  • -N — Don't perform any of the built-in Sniffit functions. Useful for only running a Plugin. (compatible with ALL options)
  • -x — Prints extended info on TCP packets to stdout (SEQ, ACK, Flags, etc...). Interesting when you're tracing spoofs, packet loss and other real net debugging/checking tasks. (if you want to log this, pipe stdout to a file) (NOT compatible with: -i I -v)
  • -d — ´dump mode': shows the packets on the screen (stdout) instead of logging into files (which is the default). Data is printed in bytes (hex). (NOT compatible with: -i I -v -L)
  • -a — ´dump mode', same as -d but outputs ASCII. Non printable chars are replaced by .. (-d and -a mix without any problem) (NOT compatible with: -i -I -v -L)
  • -P proto — Specify the protocols that should be processed (default is TCP). Possible options currently are: IP, TCP, ICMP, UDP. They can be combined. IP, ICMP and UDP info is dumped to stdout. IP gives ADDITIONAL info on the IP wrapping around other packets — it is not needed to specify IP for TCP packet logging. IP and ICMP packets are not filtered (UDP packets are as of 0.3.4). (NOT compatible with: -i -I -v -L)
  • -A char — When in 'normal mode' (not -d, -a, -i, -I, -L), all non-printable chars will be replaced by char. (NOT compatible with: -a -d -i -I -v -L)
  • -p port — Only checks packets going TO (!!) port port. 0 means all ports, and the default is 0 (all). (NOT compatible with: -c -i -I -v -L)
  • -l sniflen — Amount of data to log (default 300 bytes) in 'normal mode'. The first sniflen bytes of every connection are logged. Length 0 means everything is logged. (look out with diskspace!) (NOT compatible with: -i -I -v -L)
  • -F snifdevice — Force sniffit to use a certain network device. snifdevice can be found with ifconfig (see ifconfig(8)). sniffit supports ethernet and PPP by default. Read README.FIRST for info on forcing the use of other devices. (compatible with ALL options)
  • -D tty — All logging output will be sent to that device. (ONLY works with -i and -I)
  • -M plugin — Activate Plugin nr. Plugin. For a list of all plugins compiled into your version, just type sniffit ´. Read all about Plugins in the PLUGIN-HOWTO (READ IT!) (NOT compatible with: -i -I -v)
  • -L logparam — Use sniffit as a monitoring tool and enable different logging modes (logparam). The file for logging can be specified in the config file (see sniffit(5)) but is sniffit.log by default. Different logparam can be combined. (ONLY works with -c)

🌈 NORMAL MODE 🌈

A bunch of sniflen initial bytes (default 300) of each connection is logged into a file named x.x.x.x.p-y.y.y.y.o — where x.x.x.x is the sending host (port p) and y.y.y.y is the receiving host (port o).

🍓 DUMP MODE (-d and/or -a) 🍓

Output is dumped to stdout, and the packet contents are shown in their unwrapped form (that's the complete IP packet, bestie).

🧚 INTERACTIVE MODE (-i or -I) 🧚

Keys available in interactive mode:

  • UP or 'k' — self explanatory
  • DOWN or j' — self explanatory
  • F1 or '1' — Enter a host (enter all for no mask) for packet filtering (host that sends the packets)
  • F2 or '2' — Enter a host (enter all for no mask) for packet filtering. (host that receives the packets)
  • F3 or '3' — Enter a port (enter 0 for no mask) for packet filtering. (host that sends the packets)
  • F4 or '4' — Enter a port (enter 0 for no mask) for packet filtering. (host that receives the packets)
  • F5 or '5' — Start a program sniffit_key5 with arguments <from IP> <from port> <to IP> <to port>. If the program doesn't exist, nothing is done. Sniffit should be in the same path as sniffit was STARTED FROM (not necessarily the path sniffit is stored in). This function is useful for interactive connection killing or extra monitoring. A little shell script can always transform the arguments given and pass them on to other programs.
  • F6 or '6' — Same as F5 or '5', but with program sniffit_key6
  • F7 or '7' — Same as F5 or '5', but with program sniffit_key7
  • F8 or '8' — Same as F5 or '5', but with program sniffit_key8
  • ENTER — a window will pop up and log the connection, or the connection output will be sent to a chosen device if you used the -D option.
  • 'q' — When in logging mode, stop logging. Otherwise, quit.
  • 'n' — Toggle netstatistics. These are sampled at 3 secs, look in the sn_config.h file to change this.
  • 'g' — Sniffit is now able to generate some traffic load. Currently this is an 'underdevelloped' feature with very few options, but it will be expanded a lot. Currently only UDP packets are generated. When pressing 'g' you will be asked the source/dest IP/port and how many packets need to be transmitted. Packets contain the line: "This Packet was fired with Sniffit!
  • 'r' — Reset... clears all current connections from memory and restarts.

👑 LOGGING MODE (-L) 👑

Output is saved to sniffit.log, unless you have specified some other name in the config file (see sniffit(5)).

  • raw — Log all SYN, FIN, RST packets. This will give you an overview of all network (TCP) trafic in a 'RAW' way (a connection starting could give you at least 2 SYN packets, etc...).
  • norm — Same as raw, but a bit more intelligent. Unless packets are transmitted multiple times because of packet loss, you will only get 1 notice of a connection starting or ending. (the packet id will give you the host that initiated the connection first)
  • telnet — Sniffit will try to catch login and passwords for this application. (see telnet(1))
  • ftp — Sniffit will try to catch login and passwords for this application. (see ftp(1))
  • mail — Sniffit will try to identify all mail that was logged.

💀 IP ICMP UDP LOGGING 💀

Information on these packets is dumped to stdout. Packet Filtering options only refer to TCP and UDP packets. The contents of UDP packets is only shown when enabling -a or -d.

⭐ AUTHOR ⭐

Brecht Claerhout <coder@reptile.rug.ac.be>

Legend behavior honestly 💜

🌸 SEE ALSO 🌸

sniffit(5)

Okay that's the whole thing bestie, you're officially certified 🎓💅 Go read README.FIRST, go read the PLUGIN-HOWTO, and go be careful with your diskspace (-l 0 logs everything, no cap 😭).

This page came to you from the System Manager's Manual — it's SNIFFIT(8), periodt. 🎀✨🦋

📦 where this page comes from