TCPSPY(8)

🌸 TCPSPY(8) — the tea on tcpspy 🌸

okay bestie, sit down, hydrate, because this is the manual page for tcpspy — a TCP/IP Connection Monitor — and honestly? it's giving quiet-overachiever. it just... watches your TCP/IP connections and writes everything down. no cap.

---

✨ NAME ✨

tcpspy — TCP/IP Connection Monitor 👀

---

🎀 SYNOPSIS 🎀

tcpspy [-dp] [-e rule]...  [-f rulefile]...  [-F facility] [-I interval]
       [-U user] [-G group]

---

💖 DESCRIPTION 💖

so what does she do? tcpspy logs info about selected incoming and outgoing TCP/IP connections to syslog. that's the whole vibe. here's what gets logged:

• username
• local address and port
• remote address, port
• and optionally, the filename of the executable

---

🌈 Options 🌈

• -e 'rule' — only log connections that match rule. the rule syntax is spelled out below (keep scrolling bestie). if you pass this option more than once, connections matching any of the rules you gave get logged. and yes, you should quote the rule like shown above. do it. 💅
• -f rulefile — read rules from rulefile. one rule per line, okay? the # character starts a comment; everything from that # to the end of the line is ignored. 🫶

the -e and -f options may be used together. bestie behaviour, honestly.

• -F facility — log to syslog facility facility instead of the compile-time default setting. want the list of facilities? go check the syslog.conf(5) manual page. ✨
• -I interval — update the internal state every interval milliseconds, instead of the default of 1000 ms. ⚠️ heads up: connections that last less than interval milliseconds may be missed. so you should experiment to find a value small enough that it catches most connections, but not so small that it makes tcpspy eat too much CPU time. it's a whole balancing act, she's doing her best. 😭
• -U user — switch to the specified user after startup. user may be a numeric user id or a user name from the system password file. 👑
• -G group — switch to the specified group after startup. group may be a numeric group id or a group name from the system group file. and here's the cute part: if you specify a username to switch to with the -U option but you omit -G, then tcpspy will switch to that specified user's primary group. no extra work required. 💖
• -d — debugging mode. if this is specified, tcpspy will not detach from the console after initialisation, and will log connections to standard output instead of syslog. lowkey handy.
• -p — log the filename of the executable that created/accepted the connection. 🕵️ ngl you may require superuser privileges to obtain this information for processes you do not own (this is a kernel limitation, not a personality flaw).

this option can greatly increase the amount of CPU time required to process each connection/disconnection. she's thorough but she's not free.

---

🦋 Rule Syntax 🦋

a rule may be specified with the -e option to log information about connections matching this rule, overriding the default of logging all connections. main character move.

the following comparison operations are defined:

• user uid — true if the local user initiating or accepting the connection has the effective user id uid.
• user "username" — same as above, but using a username instead of a user id.
• ip — true if the connection is IPv4.
• ip6 — true if the connection is IPv6.
• lport port — true if the local end of the connection has port number port.
• lport [low] - [high] — true if the local end of the connection has a port number greater than or equal to low and less than or equal to high. if the form low- is used, high is assumed to be 65535. if the form -high is used, low is assumed to be 0. ⚠️ it is an error to omit both low and high. don't do it bestie.
• lport "service" — same as above, but using a service name from /etc/services instead of a port number.
• rport — same as lport but compares the port number of the remote end of the connection.
• laddr n.n.n.n[/m.m.m.m]
• laddr n.n.n.n/m
• laddr ip6-addr[/m]

interpreted as a "net/mask" expression; true if "net" is equal to the bitwise AND of the local address of the connection and "mask". if no mask is specified, a default mask with all bits set (255.255.255.255) is used. the CIDR type netmask is also possible. with IPv6 only a prefix length netmask is allowed, and the length defaults to 128. depending on the address family, these rules contain an implicit match condition ip or ip6, respectively. ✨

• raddr — same as laddr but compares the remote address.
• exe "pattern" — true if the full filename (including directory) of the executable that created/accepted the connection matches pattern, a glob(7)-style wildcard pattern.

the pattern "" (an empty string) matches connections created/accepted by processes whose executable filename is unknown.

if the -p option is not specified, a warning message will be printed, and the result of this comparison will always be true. yes, always. even if it's lying. 💀

expressions (including the comparisons listed above) may be joined together with the following logical operations:

• expr1 or expr2 — true if either of expr1 or expr2 are true (logical OR).
• expr1 and expr2 — true if both expr1 and expr2 are true (logical AND).
• not expr — true if expr is false (logical NOT).

rules are evaluated from left to right. whitespace (space, tab and newline) characters are ignored between "words". rules consisting of only whitespace match no connections, but do not cause an error. parentheses, ( and ), may be placed around expressions to affect the order of evaluation. slay. 🎀

the Examples section contains some sample rules which further demonstrate how they are constructed. (go look, they're cute.)

---

💅 EXIT STATUS 💅

• 0 — the daemon was successfully started 🎉
• >0 — an error occurred 😭

---

⭐ SIGNALS ⭐

• TERM — shut down at most interval milliseconds from now.
• INT — (debugging mode only) handled identically to TERM.

all other signals retain their default behaviour, which is documented in signal(7).

---

🔥 EXAMPLES 🔥

• tcpspy -e 'user "joe" and rport "ssh"'

log connections made by user "joe" for the service "ssh".

• tcpspy -e 'not raddr 10.0.0.0/255.0.0.0 and rport 25 and (user "bob" or user "joe")'

log connections made by users "bob" and "joe" to remote port 25 on machines not on a fictional "intranet".

• tcpspy -e 'exe "/usr/bin/irc"'

log connections made by /usr/bin/irc (probably ircII).

---

🙈 BUGS 🙈

empty rule files cause tcpspy to log no connections instead of all connections. yeah. it's giving chaos. 💀

---

👑 AUTHOR 👑

Tim J. Robbins <tim@robbins.dropbear.id.au> — king behaviour honestly.

---

🌸 SEE ALSO 🌸

glob(7), proc(5), services(5), signal(7), syslog(3), syslog.conf(5), tcpspy.rules(5)

---

okay that's the whole page, you read it all, I'm so proud of you 🫶 this was tcpspy version 1.7, dated May 2001, and yes bestie, the original footer credits TJR too. go forth and monitor some connections. periodt. 💖✨🌈