How to use the command 'snoop' (with examples)

The ‘snoop’ command is a network packet sniffer that can be used to capture and analyze network packets on a Unix-like system. It provides similar functionality to ’tcpdump’ on SunOS. You can use ‘snoop’ to capture packets on a specific network interface, save captured packets in a file, display a verbose protocol layer summary of packets from a file, capture network packets using specific criteria, and capture and display a hex-dump of network packets exchanged between two IP addresses.

Use case 1: Capture packets on a specific network interface

Code:

snoop -d e1000g0

Motivation: You may want to capture packets only on a specific network interface if you are troubleshooting network connectivity issues or monitoring network traffic on a specific segment of your network.

Explanation:

• ‘snoop’: The command itself.
• ‘-d e1000g0’: The ‘-d’ option is used to specify the network interface to capture packets from. ’e1000g0’ in this example is the name of the network interface.

Example output:

• Packets captured on the ’e1000g0’ network interface will be displayed in real-time.

Use case 2: Save captured packets in a file instead of displaying them

Code:

snoop -o path/to/file

Motivation: Saving the captured packets in a file allows you to analyze them later or share them with others for further investigation. It is especially useful when you need to capture packets for a long duration or want to capture packets without cluttering the screen.

Explanation:

• ‘-o path/to/file’: The ‘-o’ option is used to specify the output file path. ‘path/to/file’ should be replaced with the actual desired file path.

Example output:

• The captured packets will be saved in the specified file path instead of being displayed on the screen.

Use case 3: Display verbose protocol layer summary of packets from a file

Code:

snoop -V -i path/to/file

Motivation: When analyzing captured packets, it is often helpful to have a detailed summary of each packet’s protocol layers. This can provide insights into the communication flow, network protocols, and possible issues.

Explanation:

• ‘-V’: The ‘-V’ option tells ‘snoop’ to provide a verbose protocol layer summary of the captured packets.
• ‘-i path/to/file’: The ‘-i’ option is used to specify the input file path. ‘path/to/file’ should be replaced with the actual file path.

Example output:

• A detailed summary of each packet’s protocol layers will be displayed, including information about the source and destination IP addresses, ports, protocol types, and more.

Use case 4: Capture network packets that come from a hostname and go to a given port

Code:

snoop to port port from host hostname

Motivation: If you want to capture network packets that are specific to a particular hostname and port combination, this command can be used. It helps in analyzing network traffic related to a specific service or application running on a particular host.

Explanation:

• ’to port port’: Specifying the ’to port’ option allows you to capture packets that are being sent to a specific port. Replace ‘port’ with the desired port number.
• ‘from host hostname’: Specifying the ‘from host’ option allows you to capture packets that are coming from a specific hostname. Replace ‘hostname’ with the desired hostname.

Example output:

• Only network packets that match the specified criteria (hostname and port) will be captured and displayed.

Use case 5: Capture and show a hex-dump of network packets exchanged between two IP addresses

Code:

snoop -x0 -p4 ip1 ip2

Motivation: Sometimes, you may need to capture and inspect the actual content of network packets exchanged between two specific IP addresses. This is especially useful when troubleshooting network communication issues or analyzing specific network protocols.

Explanation:

• ‘-x0’: The ‘-x’ option tells ‘snoop’ to display a hex-dump of the captured packets. ‘0’ specifies the number of bytes to show per line.
• ‘-p4’: The ‘-p’ option is used to specify the maximum number of packets to capture. ‘4’ in this example represents the number of packets to capture.
• ‘ip1 ip2’: Replace ‘ip1’ and ‘ip2’ with the desired IP addresses between which you want to capture the network packets.

Example output:

• ‘snoop’ will capture the network packets exchanged between the specified IP addresses and display a hex-dump of the packet contents.

Conclusion:

The ‘snoop’ command is a powerful network packet sniffer that can be used for various purposes, including troubleshooting network issues, analyzing network protocols, and monitoring network traffic. By understanding and utilizing the different use cases of the ‘snoop’ command, you can effectively capture, analyze, and interpret network packets in your Unix-like system.