Import translated manuals from JM CVS Repository.

[linuxjm/jm.git] / manual / tcpdump / draft / man1 / tcpdump.1

.\" @(#) $Header: /tcpdump/master/tcpdump/tcpdump.1,v 1.72.2.3 2000/07/13 05:53:47 guy Exp $ (LBL)
.\"
.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
.\"     The Regents of the University of California.  All rights reserved.
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that: (1) source code distributions
.\" retain the above copyright notice and this paragraph in its entirety, (2)
.\" distributions including binary code include the above copyright notice and
.\" this paragraph in its entirety in the documentation or other materials
.\" provided with the distribution, and (3) all advertising materials mentioning
.\" features or use of this software display the following acknowledgement:
.\" ``This product includes software developed by the University of California,
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
.\" the University nor the names of its contributors may be used to endorse
.\" or promote products derived from this software without specific prior
.\" written permission.
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.\" Japanese Version Copyright (c) 1998
.\"           MAEHARA Kohichi
.\"                  &
.\"           HANATAKA Shinya
.\"         all rights reserved.
.\" Translated Tue Jan 6 00:00:00 JST 1998
.\"     by  MAEHARA Kouhichi <maeharak@kw.netlaputa.ne.jp>
.\"     by  HANATAKA Shinya <hanataka@abyss.rim.or.jp>
.\"
.\" Updated Fri Sep 11 00:55:00 JST 2000
.\"     by  Kentaro Shirakata <argrath@ub32.org>
.\"
.TH TCPDUMP 1  "30 June 1997"
.SH ̾Á°
tcpdump \- ¥Í¥Ã¥È¥ï¡¼¥¯¤Î¥È¥é¥Õ¥£¥Ã¥¯¤ò¥À¥ó¥×¤¹¤ë
.SH ½ñ¼°
.na
.B tcpdump
[
.B \-adeflnNOpqRStvxX
] [
.B \-c
.I count
] [
.B \-F
.I file
]
.br
.ti +8
[
.B \-i
.I interface
]
[
.B \-m
.I module
]
[
.B \-r
.I file
]
.br
.ti +8
[
.B \-s
.I snaplen
]
[
.B \-T
.I type
]
[
.B \-w
.I file
]
.br
.ti +8
[
.I expression
]
.br
.ad
.SH ÀâÌÀ
.LP
\fItcpdump\fP ¤Ï¿¿µ¶ÃͤΠ\fI¾ò·ï¼°\fP ¤Ë°ìÃפ¹¤ë¥Í¥Ã¥È¥ï¡¼¥¯¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹¾å¤Î¥Ñ¥±¥Ã¥È¤Î¥Ø¥Ã¥À¤òɽ¼¨¤¹¤ë¡£
.LP
.B nit ¤« bpf ¤òÍѤ¤¤ë SunOS¤Î¾ì¹ç:
.I tcpdump 
¤òÆ°ºî¤µ¤»¤ë¤¿¤á¤Ë¤Ï 
.I /dev/nit 
¤« 
.I /dev/bpf* 
¤ËÆɤ߹þ¤ß¸¢¸Â¤ò»ý¤Ã¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B dlpi ¤òÍøÍѤ¹¤ë Solaris ¤Î¾ì¹ç:
²¾Áۥͥåȥ¥¯¥Ç¥Ð¥¤¥¹¡¢¤¿¤È¤¨¤Ð 
.IR /dev/le
¤È¤¤¤Ã¤¿¤â¤Î¤ËÆɤ߹þ¤ß¸¢¸Â¤ò»ý¤Ã¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B dlpi ¤òÍøÍѤ¹¤ë HP-UX ¤Î¾ì¹ç:
¼Â¹Ô¼Ô¤¬ root ¤Ç¤¢¤ë¤«¡¢¤Þ¤¿¤Ï root ¤Ë setuid ¤·¤Æ¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ì¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B snoop ¤òÍѤ¤¤ë IRIX ¤Î¾ì¹ç:
¼Â¹Ô¼Ô¤¬ root ¤Ç¤¢¤ë¤«¡¢¤Þ¤¿¤Ï root ¤Ë setuid ¤·¤Æ¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ì¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B Linux ¤Î¾ì¹ç:
¼Â¹Ô¼Ô¤¬ root ¤Ç¤¢¤ë¤«¡¢¤Þ¤¿¤Ï root ¤Ë setuid ¤·¤Æ¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ì¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B Ultrix ¤ª¤è¤Ó Digital UNIX ¤Î¾ì¹ç:
¤Þ¤º¡¢¥¹¡¼¥Ñ¡¼¥æ¡¼¥¶¤¬ 
.IR pfconfig(8) 
¤òÍѤ¤¤Æ̵º¹ÊÌÆ©²á¥â¡¼¥É(promicuous-mode)¤òÍ­¸ú¤Ë¤¹¤ëɬÍפ¬¤¢¤ë¡£
¤½¤Î¸å¤Ï°ìÈ̥桼¥¶¤¬ 
.BR tcpdump 
¤ò¼Â¹Ô²Äǽ¤Ç¤¢¤ë¡£
.B BSD ¤Î¾ì¹ç: 
.IR /dev/bpf* 
¤ËÂФ¹¤ëÆɤ߹þ¤ß¸¢¸Â¤¬É¬Íס£
.SH ¥ª¥×¥·¥ç¥ó
.TP
.B \-a
¥Í¥Ã¥È¥ï¡¼¥¯¤È¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¥¢¥É¥ì¥¹¤ò DNS ̾¤ËÊÑ´¹¤¹¤ë¡£
.TP
.B \-c
\fIcount\fP ¸Ä¤Î¥Ñ¥±¥Ã¥È¤ò¼õ¿®¤·¤¿¤Î¤Á¤Ë½ªÎ»¤¹¤ë¡£
.TP
.B \-d
¥³¥ó¥Ñ¥¤¥ë¤µ¤ì¤¿¥Ñ¥±¥Ã¥È¥Þ¥Ã¥Á¥ó¥°¥³¡¼¥É¤ò¿Í´Ö¤¬Æɤá¤ë·Á¼°¤Çɸ½à½ÐÎϤ˥À¥ó¥×¤·¡¢½ªÎ»¤¹¤ë¡£
.TP
.B \-dd
¥Ñ¥±¥Ã¥È¥Þ¥Ã¥Á¥ó¥°¥³¡¼¥É¤ò 
.B C
¸À¸ì¤Î°ìÉô¤È¤·¤ÆÍøÍѲÄǽ¤Ê¤«¤¿¤Á¤Ç¥À¥ó¥×¤¹¤ë¡£
.TP
.B \-ddd
¥Ñ¥±¥Ã¥È¥Þ¥Ã¥Á¥ó¥°¥³¡¼¥É¤ò ½½¿Ê¿ô¤Ç¥À¥ó¥×¤¹¤ë(count ¤¬Àè¹Ô¤¹¤ë)¡£
.TP
.B \-e
³Æ¥À¥ó¥×¹Ô¤Ë¥ê¥ó¥¯¥ì¥Ù¥ë¥Ø¥Ã¥À¤òɽ¼¨¤¹¤ë¡£
.TP
.B \-f
¡Ö³°Éô¤Î¡×¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤ò¥·¥ó¥Ü¥ë¤Ç¤Ï¤Ê¤¯¤Æ¿ôÃͤÇɽ¼¨¤¹¤ë
(¤³¤Î¥ª¥×¥·¥ç¥ó¤ÏÇϼ¯¤Ê Sun ¤Î yp ¥µ¡¼¥Ó¥¹¤ò±ª²ó¤¹¤ë¤³¤È¤ò°Õ¿Þ¤·¤Æ¤¤¤ë 
\(em Sun ¤Î yp ¥µ¡¼¥Ó¥¹¤Ï¥í¡¼¥«¥ë¤Ç¤Ï¤Ê¤¤¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤òÊÑ´¹¤·¤è¤¦¤È¤¹¤ë¤È
±Êµ×¤ËÆ°ºî¤¬Ää»ß¤·¤Æ¤·¤Þ¤¦¥Ð¥°¤¬¤¢¤ë)¡£
.TP
.B \-F
¥Õ¥£¥ë¥¿¡¼¾ò·ï¼°¤Î»Ø¼¨ÆþÎϤȤ·¤Æ \fIfile\fP ¤òÍѤ¤¤ë¡£
¤³¤Î¸å¤í¤Ë¥³¥Þ¥ó¥É¥é¥¤¥ó¤Ç¾ò·ï¼°¤Ë¤è¤ë»Ø¼¨¤¬Í¿¤¨¤é¤ì¤Æ¤â̵»ë¤¹¤ë¡£
.TP
.B \-i
\fIinterface\fP ¤ò´Æ»ë¤¹¤ë¡£
»Ø¼¨¤Î¤Ê¤¤¾ì¹ç¤Ï tcpdump ¤Ï¥·¥¹¥Æ¥à¤Î¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹¤Î¥ê¥¹¥È¤«¤é
ºÇ¤â¾®¤µ¤¤ÈÖ¹æ¤ÇÍ­¸ú¤Ë¤Ê¤Ã¤Æ¤¤¤ë¤â¤Î(⤷¥ë¡¼¥×¥Ð¥Ã¥¯¤Ï½ü¤¯)¤òõ¤·½Ð¤¹¡£
»Ø¼¨¤µ¤ì¤¿¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹¤¬Â¸ºß¤·¤Ê¤¤¾ì¹ç¤Ï¤â¤Ã¤È¤â¶á¤¤¤â¤Î¤¬ÁªÂò¤µ¤ì¤ë¡£
.TP
.B \-l
ɸ½à½ÐÎϤò¥Ð¥Ã¥Õ¥¡¥ê¥ó¥°¤¹¤ë¡£¥Ç¡¼¥¿¤òÃßÀѤ·¤Ê¤¬¤é´Æ»ë¤¹¤ë¾ì¹ç¤ËÍ­¸ú¤Ç
¤¢¤ë¡£»ÈÍÑÎã:
.br
``tcpdump\ \ \-l\ \ |\ \ tee dat'' or
``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''.
.TP
.B \-n
¥¢¥É¥ì¥¹(¥Û¥¹¥È¥¢¥É¥ì¥¹¡¢¥Ý¡¼¥ÈÈÖ¹æ¤Ê¤É)¤ò̾Á°¤ËÊÑ´¹¤·¤Ê¤¤¡£
.TP
.B \-N
¥Û¥¹¥È¤Î¥É¥á¥¤¥ó̾¤òɽ¼¨¤·¤Ê¤¤¡£
¤Ä¤Þ¤ê¤³¤ì¤ò»ÈÍѤ·¤¿¾ì¹ç \fItcpdump\fP ¤Ï``nic.ddn.mil'' ¤Èɽ¼¨¤¹¤ë¤«¤ï¤ê¤Ë ``nic'' ¤Èɽ¼¨¤¹¤ë¡£
.TP
.B \-m
.\"O Load SMI MIB module definitions from file \fImodule\fR. This option 
.\"O can be used several times to load several MIB modules into tcpdump.
SMI MIB ¥â¥¸¥å¡¼¥ë¤ò¥Õ¥¡¥¤¥ë \fImodule\fR ¤«¤éÆɤ߹þ¤à¡£
Ê£¿ô¤Î MIB ¥â¥¸¥å¡¼¥ë¤òÆɤ߹þ¤àÌÜŪ¤Ç¡¢
¤³¤Î¥ª¥×¥·¥ç¥ó¤òÊ£¿ô²ó»ÈÍѤ¹¤ë¤³¤È¤â½ÐÍè¤ë¡£
.TP
.B \-O
¥Ñ¥±¥Ã¥È¥Þ¥Ã¥Á¥ó¥°¥³¡¼¥É¥ª¥×¥Æ¥£¥Þ¥¤¥¶¤òÄä»ß¤¹¤ë¡£
¤³¤ì¤Ï¥ª¥×¥Æ¥£¥Þ¥¤¥¶¤Î¥Ð¥°¤òµ¿¤Ã¤Æ¤¤¤ë¾ì¹ç¤Ë¤Î¤ßÍ­±×¤Ç¤¢¤ë¡£
.TP
.B \-p
̵º¹ÊÌÆ©²á¥â¡¼¥É¤ò \fIÍøÍѤ·¤Ê¤¤\fP¡£¤·¤«¤·¤Ê¤¬¤é¡¢Â¾¤ÎÍýͳ¤Ç¥¤¥ó¥¿¡¼
¥Õ¥§¥¤¥¹¤¬Ìµº¹ÊÌÆ©²á¥â¡¼¥É¤Ë¤Ê¤Ã¤Æ¤·¤Þ¤¦¤³¤È¤â¤¢¤ë¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
¤³¤Î¤¿¤á `-p' ¥ª¥×¥·¥ç¥ó¤Ï `ether host {loca-lw-addr} or ether broadcast' 
¤Î¾Êά·Á¤È¤·¤Æ¤Ï»ÈÍѤǤ­¤Ê¤¤¡£
.TP
.B \-q
¤¹¤Ð¤ä¤¤(¤È¤¤¤¦¤«ÀŤ«¤Ê)½ÐÎÏ¡£¸ÂÄꤵ¤ì¤¿¥×¥í¥È¥³¥ë¤Î¾ðÊó¤·¤«½ÐÎϤ·¤Ê¤¤¤Î¤Ç¡¢½ÐÎϹԤÏû¤¤¤â¤Î¤È¤Ê¤ë¡£
.TP
.B \-r
¥Ñ¥±¥Ã¥È¤ò(-w ¥ª¥×¥·¥ç¥ó¤ÇºîÀ®¤·¤¿)\fIfile\fR¤«¤éÆɤ߹þ¤à¡£
\fIfile\fR¤È¤·¤Æ ``-'' ¤ò»ØÄꤷ¤¿¾ì¹ç¤Ë¤Ïɸ½àÆþÎϤ¬ÍøÍѤµ¤ì¤ë¡£
.TP
.B \-s
¥Ç¥Õ¥©¥ë¥È¤Î 68 ¥Ð¥¤¥È(SunOS ¤Î NIT ¤Ç¤ÏºÇ¾®¤Ï¼ÂºÝ¤Ë¤Ï 96 ¥Ð¥¤¥È)¤ËÂå¤ï¤Ã¤Æ \fIsnaplen\fP ¥Ð¥¤¥È¤ò¤ª¤Î¤ª¤Î¤Î¥Ñ¥±¥Ã¥È¤«¤é¼è¤ê½Ð¤·ÍøÍѤ¹¤ë¡£
IP, ICMP, TCP, UDP ¤Ë¤Ä¤¤¤Æ¤Ï 68 ¥Ð¥¤¥È¤¢¤ì¤Ð½½Ê¬¤À¤¬¡¢¥Í¡¼¥à¥µ¡¼¥Ð¤ä NFS ¤Î¾ðÊó¤Ë¤Ï­¤ê¤Ê¤¤¤«¤â¤·¤ì¤Ê¤¤(¸å½Ò)¡£

snapshot À©¸Â¤Î¤¿¤á¤Ë¸å¤í¤¬ÀÚ¤ê¼Î¤Æ¤é¤ì¤¿¥Ñ¥±¥Ã¥È¤Ï½ÐÎÏ»þ¤Ë``[|\fIproto\fP]'' ¤Î·Á¼°¤Ç¼¨¤µ¤ì¤ë¡£
¤³¤³¤Ç \fIproto\fP ¤ÏÀÚ¤ê¼Î¤Æ¤ÎÀ¸¤¸¤¿¥ì¥Ù¥ë¤ËÂбþ¤¹¤ë¥×¥í¥È¥³¥ë¤Î̾Á°¤Ç¤¢¤ë¡£
Â礭¤Ê snapshot ¤ò¼è¤í¤¦¤È¤¹¤ë¤È¥Ñ¥±¥Ã¥È¤ò½èÍý¤¹¤ë»þ´Ö¤ÏÁý²Ã¤·¡¢¤Þ¤¿¤³¤Á¤é¤Î¤Û¤¦¤¬½ÅÍפÀ¤¬¡¢¥Ð¥Ã¥Õ¥¡¤Ëί¤á¤ë¤³¤È¤¬¤Ç¤­¤ëÎ̤¬¸º¾¯¤·¤Æ¤·¤Þ¤¦ÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£
¤¹¤Ê¤ï¤Á¥Ñ¥±¥Ã¥È¤¬¼º¤Ê¤ï¤ì¤ë²ÄǽÀ­¤â¤¢¤ë¡£¥×¥í¥È¥³¥ë¤Î¾ðÊó¤¬ÆÀ¤é¤ì¤ëɬÍ׺Ǿ®¸Â¤Î \fIsnaplen\fP ¤È¤¹¤ë¤³¤È¡£
.TP
.B \-T
"\fIexpression\fP"(¾ò·ï¼°) ¤ÇÁªÂò¤µ¤ì¤¿¥Ñ¥±¥Ã¥È¤Ë»Ø¼¨¤µ¤ì¤¿ \fItype\fR ¤Ç¤ÎËÝÌõ¤ò»Ø¼¨¤¹¤ë¡£¸½ºßÍ­¸ú¤Ê type ¤Ï 
\fBrpc\fR (Remote Procedure Call)¡¢
\fBrtp\fR (Real-Time Applications protocol)¡¢
\fBrtcp\fR (Real-Time Applications control protocol)¡¢
\fBsnmp\fR (Simple Network Management Protocol),
\fBvat\fR (Visual Audio Tool)¡¢
\fBwb\fR (distributed White Board)¡£
.TP
.B \-R
.\"O Assume ESP/AH packets to be based on old specification (RFC1825 to RFC1829).
.\"O If specified, \fItcpdump\fP will not print replay prevention field.
.\"O Since there is no protocol version field in ESP/AH specification,
.\"O \fItcpdump\fP cannot deduce the version of ESP/AH protocol.
ESP/AH ¥Ñ¥±¥Ã¥È¤¬¸Å¤¤ÄêµÁ(RFC1825 ¡Á RFC1829)¤Ë½¾¤Ã¤Æ¤¤¤ë¤È²¾Äꤹ¤ë¡£
¤³¤Î¥ª¥×¥·¥ç¥ó¤¬»ØÄꤵ¤ì¤ë¤È¡¢\fItcpdump\fP ¤Ï relplay prevention ¥Õ¥£¡¼¥ë¥É¤òɽ¼¨¤·¤Ê¤¤¡£
ESP/AH ¤ÎÄêµÁ¤Ë¤Ï¥×¥í¥È¥³¥ë¥Ð¡¼¥¸¥ç¥ó¥Õ¥£¡¼¥ë¥É¤¬¤Ê¤¤¤Î¤Ç¡¢
\fItcpdump\fP ¤Ï ESP/AH ¥×¥í¥È¥³¥ë¤Î¥Ð¡¼¥¸¥ç¥ó¤ò¿äÏÀ¤¹¤ë¤³¤È¤¬½ÐÍè¤Ê¤¤¡£
.TP
.B \-S
TCP ¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤òÁêÂÐÃͤǤϤʤ¯¤ÆÀäÂÐÃͤÇɽ¼¨¤¹¤ë¡£
.TP
.B \-t
¥À¥ó¥×¹Ô¤Ë»þ´Ö¾ðÊó¤òɽ¼¨\fI¤·¤Ê¤¤\fP¡£
.TP
.B \-tt
¥À¥ó¥×¹Ô¤Ëɽ¼¨¤¹¤ë»þ´Ö¾ðÊó¤òÀ°·Á¤·¤Ê¤¤¡£
.TP
.B \-v
(¤Á¤ç¤Ã¤È¤À¤±)¾ÜºÙ¤Ê½ÐÎÏ¡£IP ¥Ñ¥±¥Ã¥È¤Ë¤ª¤±¤ë À¸Â¸»þ´Ö(TTL) ¤ä¥µ¡¼¥Ó¥¹¤Î¼ïÎà¤Î¾ðÊó¤Ê¤É¤òɽ¼¨¤¹¤ë¡£
.TP
.B \-vv
¤â¤Ã¤È¾ÜºÙ¤Ê½ÐÎÏ¡£NFS±þÅú¥Ñ¥±¥Ã¥È¤Ë¤ª¤±¤ëÉղåե£¡¼¥ë¥É¤Ê¤É¤òɽ¼¨¤¹¤ë¡£
.TP
.B \-vvv
.\"O Even more verbose output.  For example,
.\"O telnet \fBSB\fP ... \fBSE\fP options
.\"O are printed in full.  With
.\"O .B \-X
.\"O telnet options are printed in hex as well.
¤µ¤é¤Ë¾ÜºÙ¤Ê½ÐÎÏ¡£
Î㤨¤Ð¡¢telnet \fBSB\fP ... \fBSE\fP ¥ª¥×¥·¥ç¥ó¤ÏÁ´¤Æɽ¼¨¤µ¤ì¤ë¡£
.B \-X
¥ª¥×¥·¥ç¥ó¤â»ØÄꤵ¤ì¤ë¤È¡¢telnet ¥ª¥×¥·¥ç¥ó¤Ï 16 ¿Êɽ¼¨¤Ç¤âɽ¼¨¤µ¤ì¤ë¡£
.TP
.B \-w
¥Ñ¥±¥Ã¥È¤ò²òÀÏ¡¢É½¼¨¤¹¤ë¤«¤ï¤ê¤ËÀ¸¤Î¤Þ¤Þ \fIfile\fR ¤Ë½ñ¤­½Ð¤¹¡£
¤³¤Î¥Õ¥¡¥¤¥ë¤Ï¤¢¤È¤Ç \-r ¥ª¥×¥·¥ç¥ó¤òÍѤ¤¤ì¤Ðɽ¼¨¤¹¤ë¤³¤È¤¬¤Ç¤­¤ë¡£
\fIfile\fR ¤È¤·¤Æ `-' ¤ò»Ø¼¨¤¹¤ë¤Èɸ½à½ÐÎϤòÍѤ¤¤ë¡£
.TP
.B \-x
(¥ê¥ó¥¯¥ì¥Ù¥ë¥Ø¥Ã¥À¤ò½ü¤¯)¤¹¤Ù¤Æ¤Î¥Ñ¥±¥Ã¥È¤ò 16 ¿Ê¤Çɽ¼¨¤¹¤ë¡£¥Ñ¥±¥Ã¥ÈÁ´ÂÎ¤È 
.I snaplen 
¥Ð¥¤¥È¤Î¾®¤µ¤¤Êý¤À¤±¤òɽ¼¨¤¹¤ë¡£
.TP
.B \-X
.\"O When printing hex, print ascii too.  Thus if
.\"O .B \-x
.\"O is also set, the packet is printed in hex/ascii.
.\"O This is very handy for analysing new protocols.
16 ¿Êɽ¼¨¤µ¤ì¤ë¤È¤­¤Ë¡¢ ASCII ʸ»ú¤âɽ¼¨¤¹¤ë¡£
½¾¤Ã¤Æ¡¢
.B \-x
¥ª¥×¥·¥ç¥ó¤â¥»¥Ã¥È¤µ¤ì¤ë¤È¡¢¥Ñ¥±¥Ã¥È¤Ï 16 ¿Ê¤È ASCII ʸ»ú¤ÎξÊý¤Çɽ¼¨¤µ¤ì¤ë¡£
¤³¤ì¤Ï¿·¤·¤¤¥×¥í¥È¥³¥ë¤ò²òÀϤ¹¤ë¤È¤­¤ËÈó¾ï¤ËÊØÍø¤Ç¤¢¤ë¡£
.\"O Even if
.\"O .B \-x
.\"O is not also set, some parts of some packets may be printed
.\"O in hex/ascii.
.B \-x
¥ª¥×¥·¥ç¥ó¤¬ÀßÄꤵ¤ì¤Æ¤¤¤Ê¤¯¤Æ¤â¡¢
¥Ñ¥±¥Ã¥È¤ÎÉôʬ¤Ë¤è¤Ã¤Æ¤Ï 16 ¿Ê¤È ASCII ʸ»ú¤ÎξÊý¤Çɽ¼¨¤µ¤ì¤ë¤³¤È¤â¤¢¤ë¡£
.IP "\fI expression(¾ò·ï¼°)\fP"
.RS
¥À¥ó¥×¤¹¤ë¥Ñ¥±¥Ã¥È¤Î¼ïÎà¤òÁªÂò¤¹¤ë¡£
\fIexpression\fP ¤¬Í¿¤¨¤é¤ì¤Ê¤¤¤È¤­¤Ï¡¢¥Í¥Ã¥È¥ï¡¼¥¯¾å¤Î¤¹¤Ù¤Æ¤Î¥Ñ¥±¥Ã¥È¤ò¥À¥ó¥×¤¹¤ë¡£
¤½¤¦¤Ç¤Ê¤±¤ì¤Ð¡¢\fIexpression\fP ¤¬`true'(¿¿) ¤È¤Ê¤ë¥Ñ¥±¥Ã¥È¤À¤±¤ò¥À¥ó¥×¤¹¤ë¡£
.LP
\fIexpression\fP¤Ï°ì¤Ä°Ê¾å¤Î
.IR primitive (Í×ÁÇ)
¤«¤éÀ®¤ë¡£Í×ÁǤϰì¤Ä°Ê¾å¤Î½¤¾þ»Ò¤òÀè¹Ô¤¹¤ë°ì¸Ä¤Î 
.I id
(̾Á°¤Ç¤âÈÖ¹æ¤Ç¤â¤è¤¤)¤Ç¤¢¤ë¡£½¤¾þ»Ò¤Ë¤Ï»°¤Ä¤Î¼ïÎब¤¢¤ë:
.IP \fItype\fP
½¤¾þ»Ò¤Ï id̾¤Þ¤¿¤Ï id Èֹ椬»Ø¤¹¤â¤Î¤Î¼ïÎà¤ò¼¨¤¹¡£ÍøÍѲÄǽ¤Ê¤â¤Î¤Ï 
.BR host ,
.BR net ,
.B port 
¤Ç¤¢¤ë¡£Îã: `host foo'¡¢`net 128.3'¡¢`port 20'¡£
type ½¤¾þ»Ò¤¬Ìµ¤¤¾ì¹ç¤Ï¡¢
.B host 
¤¬»Ø¼¨¤µ¤ì¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤¹¡£
.IP \fIdir\fP
½¤¾þ»Ò¤Ï 
.I id 
¤Ë¸þ¤±¤Æ¡¢¤Þ¤¿¤Ï 
.I id 
¤Ø¡¢¤Î¤É¤Á¤é¤«¤¢¤ë¤¤¤ÏξÊý¤ÎÄÌ¿®Êý¸þ¤òÆÃÄꤹ¤ë¡£Êý¸þ¤È¤·¤Æ»Ø¼¨¤Ç¤­¤ë¤Î¤Ï 
.BR src ,
.BR dst ,
.BR "src or dst" ,
.B "src and dst"
¤Ç¤¢¤ë¡£Îã¡¢ `src foo'¡¢`dst net 128.3'¡¢`src or dst port ftp-data'¡£
dir ½¤¾þ»Ò¤¬»ØÄꤵ¤ì¤Ê¤¤¾ì¹ç¤Ï 
.B "src or dst"
¤¬»Ø¼¨¤µ¤ì¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤¹¡£`null' ¥ê¥ó¥¯ÁØ(¤¹¤Ê¤ï¤Á slip ¤Î¤è¤¦
¤Ê¥Ý¥¤¥ó¥È¥Ä¡¼¥Ý¥¤¥ó¥È¥×¥í¥È¥³¥ë)¤Ë¤ª¤¤¤Æ¤Ï¡¢Êý¸þ¤ò»ØÄꤹ¤ë½¤¾þ»Ò¤È¤·¤Æ
.B inbound
¤È 
.B outbound 
¤âÍøÍѲÄǽ¤Ç¤¢¤ë¡£
.IP \fIproto\fP
½¤¾þ»Ò¤Ï°ìÃפ¹¤ëÆÃÄê¤Î¥×¥í¥È¥³¥ë¤ËÀ©¸Â¤¹¤ë¡£ÍøÍѲÄǽ¤Ê¥×¥í¥È¥³¥ë¤Ï°Ê²¼¤ÎÄ̤ê:
.BR ether ,
.BR fddi ,
.BR mopdl ,
.BR ip ,
.BR ip6 ,
.BR arp ,
.BR rarp ,
.BR decnet ,
.BR lat ,
.BR sca ,
.BR moprc ,
.BR mopdl ,
.BR icmp ,
.BR icmp6 ,
.BR tcp ,
.BR udp ¡£
Îã: `ether src foor'¡¢`arp net 128.3'¡¢`tcp port 21'¡£
proto ½¤¾þ»Ò¤¬»Ø¼¨¤µ¤ì¤Ê¤¤¾ì¹ç¤Ï type ¤ÈÌ·½â¤·¤Ê¤¤ÈϰϤÇÁ´¤Æ¤Î¥×¥í¥È¥³
¥ë¤¬»Ø¼¨¤µ¤ì¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤¹¡£
Îã: `src foo' ¤Ï `(ip or arp or rarp) src foo' 
(¤³¤Î¤è¤¦¤Ê½ñ¤­Êý¤Ïʸˡ¤¢¤ä¤Þ¤ê¤À¤¬)¤ò°ÕÌ£¤·¡¢
`net bar' ¤Ï `(ip or arp or rarp) net bar' ¤ò°ÕÌ£¤·¡¢
¤Þ¤¿ `port 53' ¤Ï `(tcp or udp) port 53' ¤ò°ÕÌ£¤¹¤ë¡£
.LP
[`fddi'¤Ï¼ÂºÝ¤Ë¤Ï `ether' ¤ÎÊÌ̾¤Ç¤¢¤ë;²òÀÏ»þ¤Ë``ÆÃÄê¤Î¥Í¥Ã¥È¥ï¡¼
¥¯¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹¤¬ÍøÍѤ¹¤ë¥Ç¡¼¥¿¥ê¥ó¥¯ÁØ''¤È¤·¤Æ°·¤ï¤ì¤ë¡£FDDI ¥Ø¥Ã
¥À¡¼¤Ï¥¤¡¼¥µ¥Í¥Ã¥ÈŪ¤Ê¥½¡¼¥¹¤ª¤è¤Ó¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤ò´Þ¤ß¡¢¤Þ
¤¿¥¤¡¼¥µ¥Í¥Ã¥ÈŪ¤Ê¥Ñ¥±¥Ã¥È¥¿¥¤¥×¤â´Þ¤à¤Î¤Ç¡¢¤³¤ì¤é¤Î FDDI ¥Õ¥£¡¼¥ë¥É¤ò 
¥¤¡¼¥µ¥Í¥Ã¥È¤ÎƱÎà¤È¤·¤ÆÁªÊ̤Ǥ­¤ë¡£FDDI ¥Ø¥Ã¥À¤Ë¤Ï¤½¤Î¾¤Î¥Õ¥£¡¼¥ë¥É
¤â´Þ¤Þ¤ì¤ë¤¬¡¢¤³¤ì¤Ë¤Ä¤¤¤Æ¤Ï¥Õ¥£¥ë¥¿¤Î¾ò·ï¼°¤ÇÌÀ¼¨Åª¤Ë»Ø¼¨¤¹¤ë¤³¤È¤Ï¤Ç
¤­¤Ê¤¤¡£]
.LP
¾åµ­¤Ë²Ã¤¨¤Æ¡¢ÆÃÊ̤Ê`Í×ÁÇ'¤ò¼¨¤¹¥­¡¼¥ï¡¼¥É¤¬¤¢¤ë¡£
.BR gateway ,
.BR broadcast ,
.BR less ,
.B greater
¤Èarithmtic expression(¿ôÃͤˤè¤ë¾ò·ï¼°)¤Ç¤¢¤ë¡£¤³¤ì¤é¤Ë¤Ä¤¤¤Æ¤Ï¤³¤Î¤¢¤È¤Çµ­½Ò¤¹¤ë¡£
.LP
¤â¤Ã¤ÈÊ£»¨¤Ê¥Õ¥£¥ë¥¿¾ò·ï¼°¤Ï 
.BR and ,
.BR or ,
.B not 
¤È³ÆÍ×ÁǤÎÁȹ礻¤Çɽ¸½¤Ç¤­¤ë¡£
Îã:`host foo and not port ftp and not port ftp-data'¡£
ÌÀ¼¨Åª¤Ê½¤¾þ»Ò¤Ï¾Êά¤·¤Æ¥¿¥¤¥×¿ô¤ò¸º¤é¤¹¤³¤È¤¬¤Ç¤­¤ë¡£
Îã:`tcp dst port ftp or ftp-data or domain' ¤Ï
`tcp dst prot ftp or tcp dst port ftp-data or tcp dst prot domain'¤ÈÁ´¤¯Æ±¤¸°ÕÌ£¤Ç¤¢¤ë¡£
.LP
µöÍƤµ¤ì¤ëÍ×ÁǤÎÁȤ߹ç¤ï¤»¤Ï°Ê²¼¤ÎÄ̤ꡣ
.IP "\fBdst host \fIhost\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥Õ¥£¡¼¥ë¥É¤¬ \fIhost\fP ¤Ç¤¢¤ë¤È¤­¿¿¡£¥¢¥É¥ì¥¹¤Ç¤â̾Á°¤Ç¤â¤è¤¤
.IP "\fBsrc host \fIhost\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥½¡¼¥¹¥Õ¥£¡¼¥ë¥É¤¬ \fIhost\fP ¤Ç¤¢¤ë¤È¤­¿¿¡£
.IP "\fBhost \fIhost\fP
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥½¡¼¥¹¤Þ¤¿¤Ï IP/v4/v6 ¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥Õ¥£¡¼¥ë¥É¤¬ \fIhost\fP ¤Ç¤¢¤ë¤È¤­¿¿¡£
¾åµ­¤Î³Æ host ¤ò¼¨¤¹¾ò·ï¼°¤Ë¤Ï \fBip\fP¡¢\fBarp\fP¡¢\fBrarp\fP¡¢\fBip6\fP ¤Î¤¤¤º¤ì¤«¤òÉղ䷤Ƥâ¤è¤¤¡£
.in +.5i
.nf
\fBip host \fIhost\fR
.fi
.in -.5i
¤Ï²¼µ­¤ÈƱ¤¸¡£
.in +.5i
.nf
\fBether proto \fI\\ip\fB and host \fIhost\fR
.fi
.in -.5i
¤â¤· \fIhost\fP ¤Î̾Á°¤¬Ê£¿ô¤Î IP ¥¢¥É¥ì¥¹¤ò»ý¤Ä»þ¤Ï¤½¤ì¤¾¤ì¤Î¥¢¥É¥ì¥¹¤Ë°ìÃפ¹¤ë¡£
.IP "\fBether dst \fIehost\fP
¥¤¡¼¥µ¥Í¥Ã¥È¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ \fIehost\fP ¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
\fIehost\fP ¤Ï /etc/ethers ¤«¿ôÃͤǤ¢¤ë(¿ôÃͤΥե©¡¼¥Þ¥Ã¥È¤Ë¤Ä¤¤¤Æ¤Ï 
.IR ethers (3N)
¤ò»²¾È¤Î¤³¤È)¡£
.IP "\fBether src \fIehost\fP
¥¤¡¼¥µ¥Í¥Ã¥È¥½¡¼¥¹¥¢¥É¥ì¥¹¤¬ \fIehost\fP ¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBether host \fIehost\fP
¥¤¡¼¥µ¥Í¥Ã¥È¥½¡¼¥¹¥¢¥É¥ì¥¹¤«¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ \fIehost\fP ¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBgateway\fP \fIhost\fP
¥Ñ¥±¥Ã¥È¤¬ \fIhost\fP ¤ò¥²¡¼¥È¥¦¥§¥¤¤È¤·¤Æ¤¤¤ë¤È¤­¤Ë¿¿¡£
¤¹¤Ê¤ï¤Á¡¢¥¤¡¼¥µ¥Í¥Ã¥È¥½¡¼¥¹/¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤Ï \fIhost\fP ¤Ç¤¢¤ë¤¬¡¢
IP ¥½¡¼¥¹/¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤Ï \fIhost\fP ¤Ç¤Ï¤Ê¤¤¤È¤­¤Î¤³¤È¡£
\fPhost\fP ¤Ï̾Á°¤Ç¤¢¤ê¡¢¤Þ¤¿ /etc/hosts ¤È /etc/ethers ¤ÎξÊý¤Ëµ­ºÜ¤µ¤ì¤Æ¤¤¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤
(¤³¤Î¾ò·ï¼°¤Ï \fIhost / ehost\fP ¤½¤ì¤¾¤ì¤ò̾Á°¤«ÈÖ¹æ¤Çµ­½Ò¤¹¤ë
.in +.5i
.nf
\fBether host \fIehost \fBand not host \fIhost\fR
.fi
.in -.5i
¤ÈƱÅù¤Ç¤¢¤ë)¡£
.\"O This syntax does not work in IPv6-enabled configuration at this moment.
¤³¤Îʸˡ¤Ïº£¤Î¤È¤³¤í IPv6 ¤òÍ­¸ú¤Ë¤·¤¿ÀßÄê¤Ç¤ÏÀµ¤·¤¯Æ°ºî¤·¤Ê¤¤¡£
.IP "\fBdst net \fInet\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ \fInet\fP ¥Í¥Ã¥È¥ï¡¼¥¯¤ò
´Þ¤ó¤Ç¤¤¤ë¤È¤­¤Ë¿¿¡£\fInet\fP ¤Ï/etc/networks ¤Ëµ­ºÜ¤µ¤ì¤ë̾Á°¤«¥Í¥Ã¥È
¥ï¡¼¥¯ÈÖ¹æ¤Ç¤¢¤ë( \fInetworks(4)\fP ¤ò»²¾È)¡£
.IP "\fBsrc net \fInet\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥½¡¼¥¹¥¢¥É¥ì¥¹¤¬ \fInet\fP ¥Í¥Ã¥È¥ï¡¼¥¯¤Î¤â¤Î¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBnet \fInet\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥½¡¼¥¹/¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ \fInet\fP ¥Í¥Ã¥È¥ï¡¼¥¯¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBnet \fInet\fR \fBmask \fImask\fR"
IP ¥¢¥É¥ì¥¹¤¬ netmask ¤Ç¥Þ¥¹¥¯¤·¤Æ \fInet\fR ¤Ë°ìÃפ¹¤ë¤È¤­¤Ë¿¿¡£\fBsrc\fR ¤« \fBdst\fR ¤Ç½¤¾þ¤·¤Æ¤â¤è¤¤¡£
.\"O Note that this syntax is not valid for IPv6 \fInet\fR.
¤³¤Îʸˡ¤Ï \fInet\fR ¤¬ IPv6 ¤Î¤È¤­¤Ë¤ÏÉÔÀµ¤Ç¤¢¤ë¤³¤È¤ËÃí°Õ¡£
.IP "\fBnet \fInet\fR/\fIlen\fR"
IPv4/v6 ¥¢¥É¥ì¥¹¤¬ \fIlen\fR ¥Ó¥Ã¥È¤Înetmask ¤Ç¥Þ¥¹¥¯¤·¤Æ \fInet\fR ¤Ë°ìÃפ¹¤ë¤È¤­¤Ë¿¿¡£\fBsrc\fR ¤« \fBdst\fR ¤Ç½¤¾þ¤·¤Æ¤â¤è¤¤¡£
.IP "\fBdst port \fIport\fR"
¥Ñ¥±¥Ã¥È¤¬ ip/tcp ¤« ip/udp ¤« ipv6/tcp ¤« ipv6/udp ¤Ç¤¢¤ë¾ì¹ç¤Ç¡¢
¹Ô¤­Àè¤Î port Èֹ椬 \fIport\fP ¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
\fIPort\fP ¤ÏÈÖ¹æ¤Î¿ôÃͤ« /etc/services ¤Ë¤è¤ë̾Á°¤òÍøÍѤǤ­¤ë(
.IR tcp (4P)
¤È 
.IR udp (4P)
¤ò»²¾È¤Î¤³¤È)¡£Ì¾Á°¤¬ÍøÍѤµ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ï port ÈÖ¹æ¤È protocol ¤ÎξÊý¤Ç¾È¹ç¤µ¤ì¤ë¡£
Èֹ椫¿½Å¤ËÄêµÁ¤µ¤ì¤Æ¤¤¤ë̾Á°¤¬ÍøÍѤµ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ï port ÈÖ¹æ¤À¤±¤¬¾È¹ç¤µ¤ì¤ë
(Îã: \fBdst port  513\fR ¤Ï tcp/login ¤È udp/who ¤ÎξÊý¤ÎÄÌ¿®¤òɽ¼¨¤¹¤ë¤·¡¢
\fBport domain\fR ¤Ï tcp/domain ¤È udp/domain ¤ÎξÊý¤òɽ¼¨¤¹¤ë)¡£
.IP "\fBsrc port \fIport\fR"
¥Ñ¥±¥Ã¥È¤¬ \fIport\fP ÈÖ¹æ¤Î¥Ý¡¼¥È¤ò¥½¡¼¥¹¤Ë¤·¤Æ¤¤¤ë¤È¤­¿¿¡£
.IP "\fBport \fIport\fR"
¥Ñ¥±¥Ã¥È¤Î¥½¡¼¥¹¤«¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥Ý¡¼¥È¤¬ \fIport\fP ¤Ç¤¢¤ë¤È¤­¿¿¡£
¤³¤Î port ¤ò»ØÄꤹ¤ë¾ò·ï¼°¤Ï \fBtcp\fP ¤È \fBudp\fP ¤Î¥­¡¼¥ï¡¼¥É¤òÉղ䷤Ƥâ¤è¤¤:
.in +.5i
.nf
\fBtcp src port \fIport\fR
.fi
.in -.5i
¤Ï \fIport\fP ¤ò¥½¡¼¥¹¤È¤¹¤ë tcp ¤Î¥Ñ¥±¥Ã¥È¤Î¤ß¤Ë°ìÃפ¹¤ë¡£
.IP "\fBless \fIlength\fR"
¥Ñ¥±¥Ã¥È¤¬ \fIlength\fP °Ê²¼¤Î¤È¤­¤Ë¿¿¡£
¤³¤ì¤Ï²¼µ­¤ÈƱ¤¸:
.in +.5i
.nf
\fBlen <= \fIlength\fP.
.fi
.in -.5i
.IP "\fBgreater \fIlength\fR"
¥Ñ¥±¥Ã¥È¤¬ \fIlength\fP °Ê¾å¤Î¤È¤­¤Ë¿¿¡£
¤³¤ì¤Ï²¼µ­¤ÈƱ¤¸:
.in +.5i
.nf
\fBlen >= \fIlength\fP.
.fi
.in -.5i
.IP "\fBip proto \fIprotocol\fR"
¥Ñ¥±¥Ã¥È¤¬ \fIprotocol\fP ·¿¤Î¥×¥í¥È¥³¥ë¤Î IP ¥Ñ¥±¥Ã¥È( 
.IR ip (4P)
¤ò»²¾È)¤Î¤â¤Î¤Ç¤¢¤ë¤È¤­¿¿¡£
\fIprotocol\fP ¤È¤·¤ÆÍøÍѤǤ­¤ë¤Î¤Ï¿ôÃÍ¤È \fIicmp\fP¡¢
\fIigrp\fP¡¢\fIudp\fP¡¢\fInd\fP¡¢\fItcp\fP ¤Ç¤¢¤ë¡£\fItcp\fP¡¢\fIudp\fP¡¢
\fIicmp\fP ¤Ï¥­¡¼¥ï¡¼¥É¤Ç¤â¤¢¤ë¤Î¤Ç¡¢¥Ð¥Ã¥¯¥¹¥é¥Ã¥·¥å(\\)¤Ç¥­¡¼¥ï¡¼¥É
¤È¤·¤Æ²ò¼á¤µ¤ì¤ë¤Î¤ò²óÈò¤¹¤ëɬÍפ¬¤¢¤ë¡£C-Shell ¤Ç¤Ï \\\\ ¤ò»È¤¦¡£
.\"O Note that this primitive does not chase protocol header chain.
¤³¤ÎÍ×ÁǤϥץí¥È¥³¥ë¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤òÄÉÀפ·¤Ê¤¤¤³¤È¤ËÃí°Õ¡£
.IP "\fBip6 proto \fIprotocol\fR"
.\"O True if the packet is an IPv6 packet of protocol type \fIprotocol\fP.
¥Ñ¥±¥Ã¥È¤¬\fIprotocol\fP·¿¤Î IPv6 ¥Ñ¥±¥Ã¥È¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.\"O Note that this primitive does not chase protocol header chain.
¤³¤ÎÍ×ÁǤϥץí¥È¥³¥ë¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤òÄÉÀפ·¤Ê¤¤¤³¤È¤ËÃí°Õ¡£
.IP "\fBip6 protochain \fIprotocol\fR"
.\"O True if the packet is IPv6 packet,
.\"O and contains protocol header with type \fIprotocol\fR
.\"O in its protocol header chain.
¥Ñ¥±¥Ã¥È¤¬ IPv6 ¥Ñ¥±¥Ã¥È¤Ç¤¢¤ê¡¢
¤½¤Î¥×¥í¥È¥³¥ë¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤ÎÃæ¤Ë\fIprotocol\fR·¿¤Î¥×¥í¥È¥³¥ë¥Ø¥Ã¥À¤¬¤¢¤ë¾ì¹ç¤Ë¿¿¡£
.\"O For example,
Î㤨¤Ð¡¢
.in +.5i
.nf
.\fBip6 protochain 6\fR
.fi
.in -.5i
.\"O matches any IPv6 packet with TCP protocol header in the protocol header chain.
¤Ï ¥×¥í¥È¥³¥ë¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤Ë TCP ¥×¥í¥È¥³¥ë¤ò»ý¤Ä IPv6 ¥Ñ¥±¥Ã¥È¤Ë°ìÃפ¹¤ë¡£
.\"O The packet may contain, for example,
.\"O authentication header, routing header, or hop-by-hop option header,
.\"O between IPv6 header and TCP header.
¥Ñ¥±¥Ã¥È¤Ë¤Ï¡¢Î㤨¤Ðǧ¾Ú¥Ø¥Ã¥À¡¢¥ë¡¼¥Æ¥£¥ó¥°¥Ø¥Ã¥À¡¢
hop-by-hop¥Ø¥Ã¥À¤Ê¤É¤¬IPv6 ¥Ø¥Ã¥À¤È TCP ¥Ø¥Ã¥À¤Î´Ö¤Ë´Þ¤Þ¤ì¤ë¤«¤â¤·¤ì¤Ê¤¤¡£
.\"O The BPF code emitted by this primitive is complex and
.\"O cannot be optimized by BPF optimizer code in \fItcpdump\fP,
.\"O so this can be somewhat slow.
¤³¤ÎÍ×ÁǤ¬ºî¤ê½Ð¤¹ BPF ¥³¡¼¥É¤ÏÊ£»¨¤Ç¡¢
\fItcpdump\fP¤Î BPF ºÇŬ²½¥³¡¼¥É¤ÇºÇŬ²½¤Ç¤­¤Ê¤¤¡£
¤½¤Î¤¿¤á¡¢¾¯¤·ÃÙ¤¤¤«¤â¤·¤ì¤Ê¤¤¡£
.IP "\fBip protochain \fIprotocol\fR"
.\"O Equivalent to \fBip6 protochain \fIprotocol\fR, but this is for IPv4.
\fBip6 protochain \fIprotocol\fR ¤ÈƱÍͤÀ¤¬¡¢¤³¤ì¤Ï IPv4 ¤Î¤¿¤á¤Î¤â¤Î¤Ç¤¢¤ë¡£
.IP "\fBether broadcast\fR"
¥Ñ¥±¥Ã¥È¤¬¥¤¡¼¥µ¥Í¥Ã¥È¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤Ç¤¢¤ë¤È¤­¿¿¡£\fIether\fP ¤Ï¤Ê¤¯¤Æ¤â¤è¤¤¡£
.IP "\fBip broadcast\fR"
¥Ñ¥±¥Ã¥È¤¬ IP ¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¥Ñ¥±¥Ã¥È¤Ç¤¢¤ë¤È¤­¿¿¡£¤³¤ì¤ÏÁ´¤Æ 0 ¤È Á´¤Æ 1 ¤ÎξÊý¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È·Á¼°¤ËÂбþ¤·¡¢¤µ¤é¤Ë¥µ¥Ö¥Í¥Ã¥È¥Þ¥¹¥¯¤Ë¤âÂбþ¤·¤Æ¤¤¤ë¡£
.IP "\fBether multicast\fR"
¥Ñ¥±¥Ã¥È¤¬¥¤¡¼¥µ¥Í¥Ã¥È¤Î¥Þ¥ë¥Á¥­¥ã¥¹¥È¤Ç¤¢¤ë¤È¤­¿¿¡£\fIether\fP ¤Ï¤Ê¤¯¤Æ
¤â¤è¤¤¡£¤³¤ì¤Ï `\fBether[0] & 1 != 0\fP'¤Î¾Êάµ­Ë¡¤Ç¤¢¤ë¡£
.IP "\fBip multicast\fR"
¥Ñ¥±¥Ã¥È¤¬ IP ¤Î¥Þ¥ë¥Á¥­¥ã¥¹¥È¤Ç¤¢¤ë¤È¤­¿¿¡£
.IP "\fBip6 multicast\fR"
.\"O True if the packet is an IPv6 multicast packet.
¥Ñ¥±¥Ã¥È¤¬ IPv6 ¥Þ¥ë¥Á¥­¥ã¥¹¥È¥Ñ¥±¥Ã¥È¤Ç¤¢¤ë¤È¤­¿¿¡£
.IP  "\fBether proto \fIprotocol\fR"
¥Ñ¥±¥Ã¥È¤¬ ether ¤Î \fIprotocol\fR ·¿¤Î¤â¤Î¤Ç¤¢¤ë¤È¤­¿¿¡£
\fIprotocol\fP ¤Ë¤ÏÈֹ椫 \fIip\fP¡¢\fIip6\fP¡¢\fIarp\fP¡¢\fIrarp\fP ¤Î̾Á°¤¬Íø
ÍѲÄǽ¡£¤³¤ì¤é¤Î¼±Ê̻Ҥϥ­¡¼¥ï¡¼¥É¤Ç¤â¤¢¤ë¤Î¤Ç¡¢¥Ð¥Ã¥¯¥¹¥é¥Ã¥·¥å(\\)¤Ç
¥­¡¼¥ï¡¼¥É¤È¤·¤Æ²ò¼á¤µ¤ì¤ë¤Î¤ò²óÈò¤¹¤ëɬÍפ¬¤¢¤ë¡£
[ FDDI (¤¿¤È¤¨¤Ð `\fBfddi protocol arp\fR')¤Î¾ì¹ç¡¢¥×¥í¥È¥³¥ë¤Î¼±ÊÌÊýË¡¤Ï
802.2 Logical Link Control (LLC) ¥Ø¥Ã¥À¡¼¤Ë¤è¤ë¡£¤½¤ì¤ÏÄ̾ï¤Ï
FDDI ¥Ø¥Ã¥À¡¼¤ÎÀèƬ¤ËÃÖ¤«¤ì¤Æ¤¤¤ë¡£\fItcpdump\fP ¤Ï ¥×¥í¥È¥³¥ë¼±Ê̻ҤÇ
¥Õ¥£¥ë¥¿¡¼¤¹¤ë¾ì¹ç¤Ë¡¢Á´¤Æ¤Î FDDI ¥Ñ¥±¥Ã¥È¤Ï LLC ¥Ø¥Ã¥À¡¼¤ò»ý¤Ã¤Æ¤¤¤Æ¡¢
¤½¤Î LLC ¥Ø¥Ã¥À¡¼¤Ï SNAP ¤È¸Æ¤Ð¤ì¤ë·Á¼°¤Ë¤Ê¤Ã¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤¹¡£ ]
.IP "\fBdecnet src \fIhost\fR"
DECNET ¤Ë¤ª¤¤¤Æ¥½¡¼¥¹¥¢¥É¥ì¥¹¤¬``10.123''¤Î¤è¤¦¤Ê¥¢¥É¥ì¥¹¤ä DECNET¤Î¥Û
¥¹¥È¥Í¡¼¥à¤Î·Á¼°¤Ç»Ø¼¨¤µ¤ì¤ë 
.I host 
¤È°ìÃפ¹¤ë¤È¤­¿¿¡£[DECNET¤Î¥Û¥¹¥È¥Í¡¼¥à·Á¼°¤Ï DECNET¤ËÀܳ¤µ¤ì¤¿ 
ultrix ¥·¥¹¥Æ¥à¤Ë¤ª¤¤¤Æ¤Î¤ßÍøÍѲÄǽ¤Ç¤¢¤ë¡£]
.IP "\fBdecnet dst \fIhost\fR"
DECNET¤Ë¤ª¤¤¤Æ¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ 
.I host 
¤Ë°ìÃפ¹¤ë¤È¤­¿¿¡£
.IP "\fBdecnet host \fIhost\fR"
DECNET¤Ë¤ª¤¤¤Æ¡¢¥½¡¼¥¹¤Þ¤¿¤Ï¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ 
.I host 
¤Ë°ìÃפ¹¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBdecnet\fR"
²¼µ­¤Ë¤ª¤¤¤Æ:
.in +.5i
.nf
\fBether proto \fIp\fR
.fi
.in -.5i
\fIp\fR ¤ò¤½¤Î¤¤¤º¤ì¤«¤Î¥×¥í¥È¥³¥ë¤È¤¹¤ë¤Î¤ÈƱÅù¤Ç¤¢¤ë¡£
.IP "\fBlat\fR, \fBmoprc\fR, \fBmopdl\fR"
²¼µ­¤Ë¤ª¤¤¤Æ:
.in +.5i
.nf
\fBether proto \fIp\fR
.fi
.in -.5i
\fIp\fR ¤ò¤½¤Î¤¤¤º¤ì¤«¤Î¥×¥í¥È¥³¥ë¤È¤¹¤ë¤Î¤ÈƱÅù¤Ç¤¢¤ë¡£
\fItcpdump\fP ¤Ï¤³¤ì¤é¤Î¥×¥í¥È¥³¥ë¤Î²òÀÏÊýË¡¤ÏÀµ³Î¤Ë¤ÏÃΤé¤Ê¤¤ÅÀ¤ËÃí°Õ
¤¹¤ë¤³¤È¡£
.IP  "\fBtcp\fR, \fBudp\fR, \fBicmp\fR"
²¼µ­¤Ë¤ª¤¤¤Æ:
.in +.5i
.nf
\fBip proto \fIp\fR\fBip6 proto \fIp\fR
.fi
.in -.5i
\fIp\fR ¤ò¤½¤Î¤¤¤º¤ì¤«¤Î¥×¥í¥È¥³¥ë¤È¤¹¤ë¤Î¤ÈƱÅù¤Ç¤¢¤ë¡£
.IP  "\fIexpr relop expr\fR"
´Ø·¸¼°¤¬À®¤êΩ¤Æ¤Ð¿¿¡£\fIrelop\fR(±é»»»Ò)¤Ï >¡¢<¡¢>=¡¢<=¡¢=¡¢!= ¤Î¤¤¤º
¤ì¤«°ì¤Ä¤Ç¤¢¤ê¡¢\fIexpr\fR(ɽ¸½) ¤ÏÀ°Äê¿ô¤Ë¤è¤ë¿ôÃÍɽ¸½ (ɽ¸½ÊýË¡¤Ïɸ½à
Ū¤Ê C ¤Îʸˡ¤Ë¤·¤¿¤¬¤¦)¡¢É¸½àŪ¤ÊÆó¹à±é»»»Ò[+¡¢-¡¢*¡¢/¡¢&¡¢|]¡¢Ä¹¤µ±é»»»Ò¡¢¥Ñ
¥±¥Ã¥È¥Ç¡¼¥¿¥¢¥¯¥»¥¹±é»»»Ò¤Î¤¤¤º¤ì¤«¡£¥Ñ¥±¥Ã¥ÈÆâ¤Î¥Ç¡¼¥¿¤ËÂФ·¤ÆŬÍѤ¹¤ë¤Ë¤Ï¤³¤Î¤è¤¦¤Ëµ­½Ò¤¹¤ë:
.in +.5i
.nf
\fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
.fi
.in -.5i
\fIproto\fR ¤Ï \fBether¡¢fddi¡¢ip¡¢arp¡¢rarp¡¢tcp¡¢udp¡¢icmp¡¢ip6\fR ¤Î¤¤¤º¤ì¤«¤Ç
ÁàºîÂоݤΥץí¥È¥³¥ëÁؤò»Ø¼¨¤¹¤ë¡£
.\"O Note that \fItcp, udp\fR and other upper-layer protocol types only
.\"O apply to IPv4, not IPv6 (this will be fixed in the future).
\fItcp, udp\fR ¤È¤½¤Î¾¤Î¾å°Ì¥×¥í¥È¥³¥ëÁØ¤Ï IPv4 ¤Ç¤Î¤ßÍøÍѤǤ­¡¢
IPv6¤Ç¤ÏÍøÍѤǤ­¤Ê¤¤¤³¤È¤ËÃí°Õ¡£(¤³¤ì¤Ï¾­Í轤Àµ¤µ¤ì¤ë¤À¤í¤¦)
»Ø¼¨¤µ¤ì¤¿¥×¥í¥È¥³¥ëÁؤˤĤ¤¤Æ¤Î¥Ð¥¤¥È¥ª¥Õ¥»¥Ã¥È¤Ï \fIexpr\fR ¤Ç»ØÄꤹ¤ë¡£
\fIsize\fR ¤ò»Ø¼¨¤¹¤ë¾ì¹ç¤ÏÃíÌܤ¹¤ë¥Õ¥£¡¼¥ë¥É¤Ç¤Î¥Ð¥¤¥È¿ô¤Ç»Ø¼¨¤¹¤ë¤¬¡¢
¤½¤ì¤Ï one¡¢two ¤Þ¤¿ four ¤Î¤¤¤º¤ì¤«¤òÍѤ¤¤ë¡£»Ø¼¨¤Î¤Ê¤¤¾ì¹ç¤Ï one ¤Ç
¤¢¤ë¤È¤ß¤Ê¤¹¡£Ä¹¤µ±é»»»Ò¤Ï¥­¡¼¥ï¡¼¥É \fBlen\fP ¤Ç¼¨¤µ¤ì¡¢¥Ñ¥±¥Ã¥ÈŤòÍ¿¤¨¤ë¡£
¤¿¤È¤¨¤Ð¡¢`\fBether[0] & 1 != 0\fP'¤È¤¤¤¦¾ò·ï¼°¤Ï¤¹¤Ù¤Æ¤Î¥Þ¥ë¥Á¥­¥ã¥¹¥È
¤Ë¤è¤ëÄÌ¿®¤ò¤È¤é¤¨¤ë¡£`\fBip[0] & 0xf != 5\fP' ¤È¤¤¤¦¾ò·ï¼°¤Ï¤¹¤Ù¤Æ¤Î¥ª
¥×¥·¥ç¥óÉÕ¤­¤Î IP ¥Ñ¥±¥Ã¥È¤ò¤È¤é¤¨¤ë¡£`\fBip[6:2] & 0x1fff = 0\fP'¤Ï¥Õ¥é
¥°¥á¥ó¥È²½¤µ¤ì¤Æ¤¤¤Ê¤¤¥Ç¡¼¥¿¥°¥é¥à¤« 0 ÈÖ¤Î(ºÇ½é¤Î)¥Õ¥é¥°¥á¥ó¥È¤À¤±¤òɽ¼¨¤¹¤ë¡£
¤Ê¤ª¡¢¤³¤Î¾ò·ï¤Ï \fBtcp\fP ¤È \fBudp\fP ¤Ø¤ÎŬÍѤò°Å¼¨¤·¤Æ¤¤¤ë¡£¤µ¤é
¤Ë \fBtcp[0]\fP ¤Ï TCP \fI¥Ø¥Ã¥À\fP ¤ÎºÇ½é¤Î¥Ð¥¤¥È¤ò°ÕÌ£¤¹¤ë¤¬¡¢¥Õ¥é
¥°¥á¥ó¥È¤ÎÀèƬ¤Î¥Ð¥¤¥È¤Ç¤Ï¤¢¤ê¤¨¤Ê¤¤¡£
.LP
Í×ÁǤòÊ£¹ç¤µ¤»¤ÆÍѤ¤¤ë¾ì¹ç:
.IP
³ç¸Ì¤Ç¥°¥ë¡¼¥×ʬ¤±¤¹¤ëÍ×ÁǤȱ黻»Ò(³ç¸Ì¤Ï¥·¥§¥ë¤Ë¤È¤Ã¤Æ¤âÆÃÊ̤ʰÕÌ£¤ò»ý¤Ä¤Î¤Ç¤¿¤Ö¤ó¥¨¥¹¥±¡¼¥×¤·¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¤À¤í¤¦)¡£
.IP
ÈÝÄê (`\fB!\fP' or `\fBnot\fP').
.IP
·ë¹ç (`\fB&&\fP' or `\fBand\fP').
.IP
Âò°ì (`\fB||\fP' or `\fBor\fP').
.LP
ÈÝÄê¤Ï¤â¤Ã¤È¤â¹â¤¤Í¥ÀèÅÙ¤ò¤â¤Ä¡£Âò°ì¤È·ë¹ç¤ÏƱÅù¤ÎÍ¥ÀèÅÙ¤ò»ý¤Á¡¢
º¸¤«¤é±¦¤Øɾ²Á¤µ¤ì¤ë¡£
·ë¹ç¤ÏÊ»µ­¤¹¤ë¤À¤±¤Ç¤Ê¤¯ÌÀ¼¨Åª¤Ê \fBand\fR ¥È¡¼¥¯¥ó¤¬É¬Íפʤ³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
.LP
¥­¡¼¥ï¡¼¥É¤Ê¤·¤Ç¼±Ê̻Ҥ¬¤¢¤é¤ï¤ì¤¿¾ì¹ç¡¢Ä¾Á°¤Ë¤¢¤é¤ï¤ì¤¿¥­¡¼¥ï¡¼¥É¤ò
ȼ¤Ã¤Æ¤¤¤ë¤È¤ß¤Ê¤µ¤ì¤ë¡£
¤¿¤È¤¨¤Ð¡¢
.in +.5i
.nf
\fBnot host vs and ace\fR
.fi
.in -.5i
¤Ï
.in +.5i
.nf
\fBnot host vs and host ace\fR
.fi
.in -.5i
¤Î¾Êά¤Ç¤¢¤ê¡¢¤³¤ì¤Ï
.in +.5i
.nf
\fBnot ( host vs or ace )\fR
.fi
.in -.5i
¤È¤Ï°ã¤¦¡£
.LP
tcpdump ¤ËÅϤ¹¾ò·ï¼°¤ÏÅÔ¹ç¤Î¤è¤¤¤è¤¦¤Ë¡¢Ã±°ì¤È¤·¤Æ¤âÊ£¿ô¤È¤·¤Æ¤â¤è¤¤¡£
°ìÈ̤˥·¥§¥ë¤Î¥á¥¿¥­¥ã¥é¥¯¥¿¤ò´Þ¤à¤è¤¦¤Ê¾ò·ï¼°¤Î¾ì¹ç¤Ïñ°ì¤Î¥¯¥ª¡¼¥È¤·¤¿°ú¿ô¤È¤·¤ÆÅϤ¹¤Î¤¬¤è¤¤¡£
Ê£¿ô¤Î°ú¿ô¤Ïɾ²Á¤ÎľÁ°¤Ë¶õÇò¤Ç·ë¹ç¤µ¤ì¤ë¡£
.SH Îã
.LP
¥Û¥¹¥È \fIsundown\fP ¤Ë¤«¤«¤ï¤ëÁ´¤Æ¤ÎÆþ½ÐÎϥѥ±¥Ã¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
\fBtcpdump host sundown\fP
.fi
.RE
.LP
¥Û¥¹¥È \fIhelios\fR ¤È \fIhot\fR ¤¢¤ë¤¤¤Ï \fIace\fR ¤È¤ÎÄÌ¿®¤òɽ¼¨¤¹¤ë:
.RS
.nf
\fBtcpdump host helios and \\( hot or ace \\)\fP
.fi
.RE
.LP
¥Û¥¹¥È \fIace\fR ¤È \fIhelios\fR ¤ò½ü¤¯Á´¤Æ¤Î¥Û¥¹¥È¤È¤ÎIP¥Ñ¥±¥Ã¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
\fBtcpdump ip host ace and not helios\fP
.fi
.RE
.LP
¥í¡¼¥«¥ë¥Í¥Ã¥È¤Î¥Û¥¹¥È·²¤È¥Í¥Ã¥È¥ï¡¼¥¯ Berkeley ¤Î¥Û¥¹¥È·²¤È¤ÎÄÌ¿®¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump net ucb-ether
.fi
.RE
.LP
¥¤¥ó¥¿¡¼¥Í¥Ã¥È¤Ø¤Î¥²¡¼¥È¥¦¥§¥¤¤Î \fIsnup\fP ¤òÄ̲᤹¤ëÁ´¤Æ¤Î ftp ÄÌ¿®¤òɽ¼¨¤¹¤ë(¾ò·ï¼°¤Ï¥·¥§¥ë¤¬³ç¸Ì¤ò(¸í¤Ã¤Æ)²ò¼á¤¹¤ë¤Î¤òÈò¤±¤ë¤¿¤á¤Ë¥¯¥ª¡¼¥È¤µ¤ì¤Æ¤¤¤ëÅÀ¤ËÃí°Õ¤»¤è):
.RS
.nf
.B
tcpdump 'gateway snup and (port ftp or ftp-data)'
.fi
.RE
.LP
¥í¡¼¥«¥ë¥Û¥¹¥È¤Ø¤ÎÆþ½ÐÎϤÎÄÌ¿®¤ò½ü³°¤·¤Æɽ¼¨¤¹¤ë(¾¤Î¥Í¥Ã¥È¥ï¡¼¥¯¤Ø¤Î¥²¡¼¥È¥¦¥§¥¤¤Ç¤¢¤ë¤È¤·¤Æ¡¢¥í¡¼¥«¥ë¥Í¥Ã¥È¥ï¡¼¥¯¤ò½ü³°¤¹¤ëÎã):
.RS
.nf
.B
tcpdump ip and not net \fIlocalnet\fP
.fi
.RE
.LP
¥í¡¼¥«¥ë¥Û¥¹¥È°Ê³°¤¬´Ø¤ï¤ë TCP ÄÌ¿®¤Î TCP ¥¹¥¿¡¼¥È¤È¥¨¥ó¥É¤Î¥Ñ¥±¥Ã¥È(SYN ¤È FIN ¤Î¥Ñ¥±¥Ã¥È)¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump 'tcp[13] & 3 != 0 and not src and dst net \fIlocalnet\fP'
.fi
.RE
.LP
¥²¡¼¥È¥¦¥§¥¤ \fIsnup\fP ¤òÄ̲᤹¤ë 576 ¥Ð¥¤¥È°Ê¾å¤Î IP ¥Ñ¥±¥Ã¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump 'gateway snup and ip[2:2] > 576'
.fi
.RE
.LP
¥¤¡¼¥µ¥Í¥Ã¥È¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤Þ¤¿¤Ï¥Þ¥ë¥Á¥­¥ã¥¹¥È¤ò
.I ɬÍפȤ·¤Ê¤¤
IP ¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤Þ¤¿¤Ï¥Þ¥ë¥Á¥­¥ã¥¹¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
.fi
.RE
.LP
echo Í×µá/±þÅú(¤Ä¤Þ¤ê ping ¤Î¥Ñ¥±¥Ã¥È)°Ê³°¤Î¤¹¤Ù¤Æ¤Î ICMP ¥Ñ¥±¥Ã¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump 'icmp[0] != 8 and icmp[0] != 0"
.fi
.RE
.SH ½ÐÎÏ·Á¼°
.LP
\fItcpdump\fP ¤Î½ÐÎϤϥץí¥È¥³¥ë¤Ë°Í¸¤¹¤ë¡£²¼µ­¤ÏÂçÉôʬ¤ÎÍͼ°¤Î´Êñ¤Ê²òÀâ¤ÈÎã¤Ç¤¢¤ë¡£
.de HD
.sp 1.5
.B
..
.HD
¥ê¥ó¥¯¥ì¥Ù¥ë¥Ø¥Ã¥À
.LP
`-e' ¥ª¥×¥·¥ç¥ó¤¬»Ø¼¨¤µ¤ì¤Æ¤¤¤ë¾ì¹ç¡¢¥ê¥ó¥¯¥ì¥Ù¥ë¥Ø¥Ã¥À¤¬É½¼¨¤µ¤ì¤ë¡£
¥¤¡¼¥µ¥Í¥Ã¥È¤Ç¤Ï¥½¡¼¥¹¤ª¤è¤Ó¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¤Î¥¢¥É¥ì¥¹¤È¥Ñ¥±¥Ã¥ÈŤ¬É½¼¨¤µ¤ì¤ë¡£
.LP
FDDI ¤Î¥Í¥Ã¥È¥ï¡¼¥¯¤Ë¤ª¤¤¤Æ¤Ï '-e' ¥ª¥×¥·¥ç¥ó¤Ë¤è¤ê \fItcpdump\fP ¤Ï¡¢¥½
¡¼¥¹¤ª¤è¤Ó¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¤Î¥¢¥É¥ì¥¹¤È¥Ñ¥±¥Ã¥ÈŤ«¤é¤Ê¤ë¥Õ¥ì¡¼¥àÀ©¸æ¥Õ¥£¡¼¥ë¥É¤òɽ¼¨¤¹¤ë¡£(¥Õ¥ì¡¼¥àÀ©¸æ¥Õ¥£¡¼¥ë¥É¤Ï¥Ñ¥±¥Ã¥È¤Î»Ä¤ê¤ÎÉôʬ¤Î²ò¼á
¤ÎÀ©¸æ¤ò¤ª¤³¤Ê¤¦)¡£(IP ¥Ç¡¼¥¿¥°¥é¥à¤ò´Þ¤à¤è¤¦¤Ê)Ä̾ï¤Î¥Ñ¥±¥Ã¥È¤ÏÍ¥ÀèÅÙ 
0 ¤«¤é 7 ¤ò»ý¤Ä`async' ¥Ñ¥±¥Ã¥È¤Ç¤¢¤ë;¤¿¤È¤¨¤Ð `\fBasync 4\fR'¡£¤³¤Î
¤è¤¦¤Ê¥Ñ¥±¥Ã¥È¤Ï 802.2 LLC ¤ò´Þ¤à¤È¤ß¤Ê¤µ¤ì¤ë¡£LLC¥Ø¥Ã¥À¤Ï¤½¤ì¤¬ ISO 
¥Ç¡¼¥¿¥°¥é¥à¤ä¤¤¤ï¤æ¤ë SNAP ¥Ñ¥±¥Ã¥È \fI¤Ç¤Ê¤¤\fR ¤Ê¤é¤Ð¡¢É½¼¨¤µ¤ì¤ë¡£
.LP
\fI(Ãí:°Ê²¼¤Îµ­½Ò¤Ï RFC-1144 ¤Ë¤è¤ë SLIP °µ½Ì¥¢¥ë¥´¥ê¥º¥à¤òÍý²ò¤·¤Æ¤¤¤ë¤â¤Î¤È
¤ß¤Ê¤·¤Æµ­½Ò¤·¤Æ¤¢¤ë)¡£\fP
.LP
SLIP Àܳ¤Ç¤Ï¡¢Êý¸þ»Ø¼¨(``I''¤¬ÆþÎÏ¡¢``O''¤¬½ÐÎÏ)¡¢¥Ñ¥±¥Ã¥È¥¿¥¤¥×¤È°µ½Ì¾ðÊó¤¬É½¼¨¤µ¤ì¤ë¡£
ºÇ½é¤Ë¥Ñ¥±¥Ã¥È¥¿¥¤¥×¤¬É½¼¨¤µ¤ì¤ë¡£
¥¿¥¤¥×¤Ë¤Ï \fIip\fP¡¢\fIutcp\fP¡¢\fIctcp\fP ¤Î»°¼ïÎब¤¢¤ë¡£
\fIip\fR ¥Ñ¥±¥Ã¥È¤Ë¤Ä¤¤¤Æ¤³¤ì°Ê¾å¤Î¥ê¥ó¥¯¾ðÊó¤Ïɽ¼¨¤µ¤ì¤Ê¤¤¡£
TCP¥Ñ¥±¥Ã¥È¤ÏÀܳ¼±Ê̻Ҥ¬¼¡¤Ëɽ¼¨¤µ¤ì¤ë¡£
¥Ñ¥±¥Ã¥È¤¬°µ½Ì¤µ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ï¤½¤ÎÉä¹æ²½¤µ¤ì¤¿¥Ø¥Ã¥À¤¬É½¼¨¤µ¤ì¤ë¡£
\fB*S+\fIn\fR¡¢\fB*SA+\fIn\fR 
¤Èɽ¼¨¤µ¤ì¤ëÆÃÊ̤ʾõÂ֤⤢¤ë¡£¤³¤³¤Ç \fIn\fR ¤Ï¥·¡¼¥±¥ó¥¹ÈÖ¹æ(¤Þ¤¿¤Ï¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤È ack)¤¬²¿²óÊѹ¹¤µ¤ì¤¿¤«¤ò¼¨¤¹¡£
ÆÃÊ̤ʾì¹ç¤Ç¤Ê¤±¤ì¤Ð¡¢¥¼¥í¤«¤Þ¤¿¤ÏÊѹ¹¤Î²ó¿ô¤¬½ÐÎϤµ¤ì¤ë¡£
Êѹ¹¤Ï U(urgent pointer)¡¢W(windows)¡¢A(ack)¡¢S(sequence number)¡¢I(packet ID)¤Ëº¹Ê¬(+n ¤« -n)¤Þ¤¿¤Ï¿·¤·¤¤ÃÍ(=n)¤ÎÁȹ礻¤Ç¼¨¤µ¤ì¤ë¡£
ºÇ¸å¤Ë¥Ñ¥±¥Ã¥È¤Î¥Ç¡¼¥¿¤¹¤Ù¤Æ¤È°µ½Ì¤µ¤ì¤¿¥Ø¥Ã¥À¤ÎŤµ¤¬É½¼¨¤µ¤ì¤ë¡£
.LP
¤³¤ÎÎã¤ÏÌÀ¼¨¤µ¤ì¤¿Àܳ¼±Ê̻Ҥò¤â¤Ä½ÐÎϤµ¤ì¤ë°µ½ÌTCP¥Ñ¥±¥Ã¥È¤ò¼¨¤¹¡£
ack ¤Ï 6²ó¹¹¿·¤µ¤ì¡¢¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ï 49¤Ç¤¢¤ê ¥Ñ¥±¥Ã¥È¤Î ID¤Ï 6¤Ç¤¢¤ë;
3¥Ð¥¤¥È¤Î¥Ç¡¼¥¿¤È6¥Ð¥¤¥È¤Î°µ½Ì¥Ø¥Ã¥À¤ò»ý¤Ä
.RS
.nf
\fBO ctcp * A+6 S+49 I+6 3 (6)\fP
.fi
.RE
.HD
ARP/RARP ¥Ñ¥±¥Ã¥È
.LP
arp/rarp ½ÐÎϤÏÍ×µá¤Î¥¿¥¤¥×¤È¤½¤Î°ú¿ô¤òɽ¼¨¤¹¤ë¡£¥Õ¥©¡¼¥Þ¥Ã¥È¤½¤ì¼«ÂÎ
¤¬¼«¿È¤ÎÆâÍƤÎÀâÌÀ¤È¤Ê¤ë¡£¤³¤Îû¤¤Îã¤Ï¥Û¥¹¥È \fIrtsg\fP ¤«¤é \fIcsam\fP ¤Ø¤Î `rlogin' ¤Î³«»Ï»þ¤Î¤â¤Î¤Ç¤¢¤ë¡£
.RS
.nf
.sp .5
\f(CWarp who-has csam tell rtsg
arp reply csam is-at CSAM\fR
.sp .5
.fi
.RE
°ì¹ÔÌÜ¤Ï rtsg ¤¬ ¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥Û¥¹¥È csam ¤Î¥¤¡¼¥µ¥Í¥Ã¥È¥¢¥É¥ì¥¹¤ò¿Ò¤Í¤ë arp ¥Ñ¥±¥Ã¥È¤òÁ÷¿®¤·¤¿Íͻҡ£csam ¤Ï¥¤¡¼¥µ¥Í¥Ã¥È¥¢¥É¥ì¥¹¤òÊÖ¿®¤·¤Æ¤¤¤ë(¤³¤ÎÎã¤Ç¥¤¡¼¥µ¥Í¥Ã¥È¥¢¥É¥ì¥¹¤ÏÂçʸ»ú¤Ç¡¢¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤Ï¾®Ê¸»ú¤Çɽ¼¨¤µ¤ì¤Æ¤¤¤ë)¡£
.LP
¤³¤ÎÎã¤Ï \fBtcpdump \-n\fP ¤Ç¼Â¹Ô¤¹¤ë¤È¤³¤Î¤è¤¦¤Ë´Êά²½¤µ¤ì¤ë:
.RS
.nf
.sp .5
\f(CWarp who-has 128.3.254.6 tell 128.3.254.68
arp reply 128.3.254.6 is-at 02:07:01:00:01:c4\fP
.fi
.RE
.LP
\fBTcpdump \-e\fP ¤Ç¼Â¹Ô¤¹¤ë¤ÈºÇ½é¤Î¥Ñ¥±¥Ã¥È¤¬¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤ÇÆóÈÖÌÜ¤Ï point-to-point ¤Ç¤¢¤ë¤³¤È¤¬¸«¤Æ¤È¤ì¤ë:
.RS
.nf
.sp .5
\f(CWRTSG Broadcast 0806  64: arp who-has csam tell rtsg
CSAM RTSG 0806  64: arp reply csam is-at CSAM\fR
.sp .5
.fi
.RE
ºÇ½é¤Î¥Ñ¥±¥Ã¥È¤Ï source ¤Î¥¤¡¼¥µ¥Í¥Ã¥È¥¢¥É¥ì¥¹¤¬ RTSG ¤Ç¡¢
¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¤¬¥¤¡¼¥µ¥Í¥Ã¥È¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤Ç¤¢¤ê¡¢
¥¿¥¤¥×¥Õ¥£¡¼¥ë¥É¤Ï 16 ¿Ê¤Î 0806(ETHER_ARP)¡¢Á´Ä¹¤¬ 64 ¥Ð¥¤¥È¤Ç¤¢¤ë¤³¤È¤¬¤ï¤«¤ë¡£
.HD
TCP ¥Ñ¥±¥Ã¥È
.LP
\fI(Ãí: °Ê²¼¤Ï RFC-793 ¤Çµ­½Ò¤µ¤ì¤ë TCP¥×¥í¥È¥³¥ë¤òÍý²ò¤·¤Æ¤¤¤ë¤â¤Î¤È
¤ß¤Ê¤·¤Æµ­½Ò¤·¤Æ¤¢¤ë¡£¤â¤·¤³¤Î¥×¥í¥È¥³¥ë¤ËÄ̤¸¤Æ¤¤¤Ê¤¤¤è¤¦¤Ê¤é¡¢¤³¤Îµ­
½Ò¤À¤±¤Ç¤Ê¤¯¡¢tcpdump ¤½¤Î¤â¤Î¤âÌò¤ËΩ¤¿¤Ê¤¤¤À¤í¤¦¤¬¡£)\fP
.LP
°ìÈÌŪ¤Ê¥Õ¥©¡¼¥Þ¥Ã¥È¤Ï²¼µ­¤ÎÄ̤ê:
.RS
.nf
.sp .5
\fIsrc > dst: flags data-seqno ack window urgent options\fP
.sp .5
.fi
.RE
\fIsrc\fP ¤È \fIdst\fP ¤Ï ¥½¡¼¥¹¤È¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¤È¤Ê¤ë IP¥¢¥É¥ì¥¹¤È¥Ý¡¼¥ÈÈÖ¹æ¤Ç¤¢¤ë¡£
\fIflags\fP ¤Ï S(SYN)¡¢F(FIN)¡¢P(PUSH)¤« R(RST) ¤ÎÁȹ礻¤«°ì¤Ä¤Î `.'(¥Õ¥é¥°¤Ê¤·)¤Ç¤¢¤ë¡£
\fIdata-seqno\fP ¤Ï¤³¤Î¥Ñ¥±¥Ã¥È¤Ë´Þ¤Þ¤ì¤ë¥Ç¡¼¥¿¤Î¥·¡¼¥±¥ó¥¹¶õ´Ö¤Î°ìÉô¤ò¼¨¤¹(²¼µ­¤ÎÎã¤ò»²¾È)¡£
\fIack\fP ¤Ï¤³¤ÎÀܳ¤Ë¤ª¤±¤ë¼¡¤Î´üÂÔ¤µ¤ì¤ë±þÅú¥Ç¡¼¥¿¤Î¥·¡¼¥±¥ó¥¹Èֹ档
\fIwindow\fP ¤Ï¤³¤ÎÀܳ¤Ë¤ª¤±¤ë±þÅú¤ËÂФ·¤ÆÍÑ°Õ¤µ¤ì¤Æ¤¤¤ë¥Ð¥Ã¥Õ¥¡¶õ´Ö¤Î¥Ð¥¤¥È¿ô¡£
\fIurg\fP ¤Ï¤³¤Î¥Ñ¥±¥Ã¥È¤Ë `urgent' ¥Ç¡¼¥¿¤¬´Þ¤Þ¤ì¤ë¤³¤È¤ò¼¨¤¹¡£
\fIoptions\fP ¤Ï tcp ¤Î¥ª¥×¥·¥ç¥ó¤Ç <>¤Ç°Ï¤Þ¤ì¤ë(Îã<mss 1024>)¡£
.LP
\fIsrc¡¢dst\fP ¤È \fIflags\fP ¤Ï¤«¤Ê¤é¤ºÉ½¼¨¤µ¤ì¤ë¡£Â¾¤Î¥Õ¥£¡¼¥ë¥É¤Ï¥Ñ¥±¥Ã¥È¤Î TCP ¥×¥í¥È¥³¥ë¥Ø¥Ã¥À¤Ë°Í¸¤¹¤ë¤Î¤ÇɬÍפʾì¹ç¤Î¤ßɽ¼¨¤µ¤ì¤ë¡£
.LP
¤³¤ì¤Ï¥Û¥¹¥È \fIrtsg\fP ¤«¤é \fIcsam\fP ¤Ø¤Îrlogin ¤Î³«»Ï»þ¤Î°ìÉô¡£
.RS
.nf
.sp .5
\s-2\f(CWrtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024>
csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024>
rtsg.1023 > csam.login: . ack 1 win 4096
rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096
csam.login > rtsg.1023: . ack 2 win 4096
rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096
csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077
csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1
csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1\fR\s+2
.sp .5
.fi
.RE
°ì¹ÔÌÜ¤Ï rtsg ¤Î TCP ¥Ý¡¼¥ÈÈÖ¹æ 1023 ¤«¤é csam ¤Î \fIlogin\fP ¥Ý¡¼¥È¤Ø
¤ÎÁ÷¿®¥Ñ¥±¥Ã¥È¤Îɽ¼¨¤Ç¤¢¤ë¡£\fBS\fP ¤Ï \fISYN\fP ¥Õ¥é¥°¤¬¥»¥Ã¥È¤µ¤ì¤Æ¤¤¤ë¤³
¤È¤ò¼¨¤¹¡£¥Ñ¥±¥Ã¥È¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ï 768512 ¤Ç¤³¤Î¥Ñ¥±¥Ã¥È¤Ï¥Ç¡¼¥¿¤ò
´Þ¤Þ¤Ê¤¤¡£(¤³¤Î¤è¤¦¤Ë \fInbytes\fP ¥Ð¥¤¥È¤Î¥æ¡¼¥¶¥Ç¡¼¥¿¤ò´Þ¤à¥·¡¼¥±
¥ó¥¹ÈÖ¹æ \fIfirst\fP ¤«¤é¡¢\fIlast\fP (last ¤Ï´Þ¤Þ¤ì¤Ê¤¤)¤ò¼¨¤¹¤¿¤á¤Ë 
`first:last(nbytes)'¤Èɽµ­¤¹¤ë)¡£¤Þ¤¿¤³¤Î¥Ñ¥±¥Ã¥È¤Ë¤Ï ack ¤ÏÀßÄꤵ¤ì¤Æ
¤ª¤é¤º¡¢¼õ¿® window ¤Ï 4096 ¥Ð¥¤¥È¡¢ºÇÂ祻¥°¥á¥ó¥È¥µ¥¤¥º(mss)¥ª¥×¥·¥ç
¥ó ¤¬ 1024 ¥Ð¥¤¥È¤ËÀßÄꤵ¤ì¤Æ¤¤¤¿¡£
.LP
¤³¤ì¤ËÂФ·¤Æ¡¢csam ¤Ï rtsg ¤Î SYN ¤ËÂФ¹¤ë ack ¤ò´Þ¤à¾¤ÏƱÅù¤ÎÆâÍƤΥѥ±¥Ã¥È¤òÊÖ¤·¤Æ¤¤¤ë¡£
¤½¤³¤Ç¡¢rtsg ¤Ï csam ¤Î SYN ¤Ë ack ±þÅú¤òÊÖ¤¹¡£`.' ¤Ï¥Õ¥é¥°¤¬¥»¥Ã¥È¤µ¤ì¤Æ¤¤¤Ê¤¤¤³¤È¤ò¼¨¤¹¡£
¤³¤Î¥Ñ¥±¥Ã¥È¤Ë¤Ï¥Ç¡¼¥¿¤¬´Þ¤Þ¤ì¤Ê¤¤¤Î¤Ç¡¢¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤â¤Ê¤¤¡£ack ±þÅú¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ï¾®¤µ¤ÊÀ°¿ô 1 ¤Ç¤¢¤ëÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£
ºÇ½é¤Ë tcp ¤Î¡Ö²ñÏáפò¸«¤¤¤À¤¹¤È¡¢\fBtcpdump\fP ¤Ï¤½¤Î¥Ñ¥±¥Ã¥È¤Î¥·¡¼
¥±¥ó¥¹ÈÖ¹æ¤ò½ÐÎϤ¹¤ë¡£¤½¤Î²ñÏäΥѥ±¥Ã¥È¤«¤é¤Ï¡¢¤½¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤È
½é´ü²½¤µ¤ì¤¿¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤È¤Îº¹°Û¤¬É½¼¨¤µ¤ì¤ë¡£
¤³¤ì¤ÏºÇ½é°Ê³°¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ï¤½¤Î²ñÏäΥǡ¼¥¿¥°¥é¥à¤Ë¤ª¤±¤ëÁêÂÐŪ¤Ê
¥Ð¥¤¥È°ÌÃ֤Ȥ·¤Æ²ò¼á¤Ç¤­¤ë¤³¤È¤ò°ÕÌ£¤¹¤ë (³Æ¥Ç¡¼¥¿¥°¥é¥à¤Ï 1 ¤«¤é»Ï¤Þ
¤ë)¡£ '-S' ¥ª¥×¥·¥ç¥ó¤Ï¤³¤Îµ¡Ç½¤ò̵»ë¤·¤Æ¡¢ËÜÍè¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤ò½ÐÎϤ¹¤ë¡£
.LP
6 ¹ÔÌÜ¤Ç rtsg ¤Ï scam ¤Ø 19 ¥Ð¥¤¥È(rtsg ¤«¤é csam ¤ÎÊý¸þ¤Ø¡¢2 ¥Ð¥¤¥ÈÌÜ
¤«¤é 20 ¥Ð¥¤¥ÈÌܤޤÇ)
¤Î¥Ç¡¼¥¿¤òÁ÷¤ë¡£¤³¤Î¥Ñ¥±¥Ã¥È¤Ë¤Ï PUSH ¥Õ¥é¥°¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¡£7 ¹ÔÌܤǡ¢
csam ¤Ï rtsg ¤¬Á÷¿®¤·¤¿¥Ç¡¼¥¿¤ò¼õ¿®¤·¤¿¡¢¤È¸À¤Ã¤Æ¤¤¤ë¤¬¡¢¤³¤ì¤Ë¤Ï 21 
¥Ð¥¤¥ÈÌܤϴޤޤì¤Ê¤¤¡£csam ¤Î¼õ¿® window ¤¬ 19 ¥Ð¥¤¥È¾®¤µ¤¯¤Ê¤Ã¤Æ¤¤¤ë¤³¤È¤«
¤é¡¢¤³¤Î¥Ç¡¼¥¿¤Ï¥½¥±¥Ã¥È¥Ð¥Ã¥Õ¥¡¤Ëα¤Þ¤Ã¤Æ¤¤¤ë¤È¿ä¬¤µ¤ì¤ë¡£csam ¤Ï¤Þ
¤¿ 1¥Ð¥¤¥È¤Î¥Ç¡¼¥¿¤ò rtsg ¤ËÁ÷¿®¤¹¤ë¡£8 ¹ÔÌÜ¤È 9 ¹ÔÌÜ¤È¤Ç csam ¤Ï 
urgent ¤ª¤è¤Ó pushed ÉÕ¤­¤Î¥Ñ¥±¥Ã¥È 2¥Ð¥¤¥È ¤òrtsg ¤ØÁ÷¿®¤·¤Æ¤¤¤ë¡£
.LP
¤â¤·¡¢snapshot ¤¬¾®¤µ¤¹¤®¤Æ \fBtcpdump\fP ¤¬ TCP ¥Ø¥Ã¥À¤ÎÁ´¤Æ¤òª¤¨¤é¤ì¤Ê¤«¤Ã¤¿¾ì¹ç¤Ï¡¢¤Ç¤­¤ë¤À¤±
¤Î²ò¼á¤ò¤·¤Æ¡¢¤½¤Î»Ä¤ê¤Ë¤Ï²ò¼áÉÔǽ¤À¤Ã¤¿¤â¤Î¤¬¤¢¤ë¤³¤È¤ò¼¨¤¹¤¿¤á¤Ë
``[|\fItcp\fP]''¤Èɽ¼¨¤¹¤ë¡£¥Ø¥Ã¥À¤Ë°ÕÌ£ÉÔÌÀ¤Ê¥ª¥×¥·¥ç¥ó(¤¿¤È¤¨¤Ð¡¢¾®
¤µ¤¹¤®¤¿¤ê¡¢¥Ø¥Ã¥À¤è¤ê¤âŤ«¤Ã¤¿¤ê¤¹¤ë length ¤È¤«)¤¬ÀßÄꤵ¤ì¤Æ¤¤¤¿¾ì
¹ç¤Ï¡¢tcpdump ¤Ï ``[\fIbad opt\fP]''¤Èɽ¼¨¤·¡¢¤½¤ì°Ê¾å¤Î¥ª¥×¥·¥ç¥ó²òÀÏ
¤òÃæ»ß¤¹¤ë(¤½¤ì¤¬¤É¤³¤«¤é»Ï¤á¤é¤ì¤ë¤«¤ï¤«¤é¤Ê¤¤¤Î¤Ç)¡£
¥Ø¥Ã¥ÀŤ¬¥ª¥×¥·¥ç¥ó¤òÁ÷¿®¤·¤¿¤³¤È¤ò¼¨¤·¤Æ¤¤¤ë¤Î¤Ë¡¢
IP ¥Ç¡¼¥¿¥°¥é¥àĹ¤Ï¤½¤³¤Ë¥ª¥×¥·¥ç¥ó¤ò´Þ¤á¤é¤ì¤Ê¤¤¤³¤È¤ò¼¨¤¹¾ì¹ç¤Ï tcpdump ¤Ï ``[bad hdr length]''¤Èɽ¼¨¤¹¤ë¡£
.HD
.B
UDP ¥Ñ¥±¥Ã¥È
.LP
UDP ¤Ï¤³¤Î rwho ¤Î¥Ñ¥±¥Ã¥È¤ÇÀâÌÀ¤¹¤ë:
.RS
.nf
.sp .5
\f(CWactinide.who > broadcast.who: udp 84\fP
.sp .5
.fi
.RE
¤³¤ì¤Ï¥Û¥¹¥È \fIactinide\fP ¤Î \fIwho\fP ¤Î¥Ý¡¼¥È¤«¤é UDP ¥Ç¡¼¥¿¥°¥é¥à¤¬
¥Û¥¹¥È \fIbroadcast\fP ¤¹¤Ê¤ï¤Á¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¥¢¥É¥ì¥¹¤Î
\fIwho\fP ¤Î¥Ý¡¼¥È¤ØÁ÷¤é¤ì¤¿¤³¤È¤òɽ¼¨¤·¤Æ¤¤¤ë¡£
¥Ñ¥±¥Ã¥È¤Ï¥æ¡¼¥¶¥Ç¡¼¥¿ 84 ¥Ð¥¤¥È¤ò´Þ¤ó¤Ç¤¤¤ë¡£
.LP
¤¤¤¯¤Ä¤Î¤«¤Î UDP ¥µ¡¼¥Ó¥¹¤Ë´Ø¤·¤Æ¤Ï(¤½¤Î¥½¡¼¥¹¤Þ¤¿¤Ï¥Ç¥£¥¹¥Í¡¼¥·¥ç¥ó
¤Î¥Ý¡¼¥ÈÈÖ¹æ¤è¤ê)²ò¼á¤¹¤ë¤³¤È¤¬¤Ç¤­¡¢¤è¤ê¾å°Ì¤ÎÁؤˤª¤±¤ë¥×¥í¥È¥³¥ë
¾ðÊó¤òɽ¼¨¤¹¤ë¡£Æä˥ɥᥤ¥ó¥Í¡¼¥à¥µ¡¼¥Ó¥¹Í×µá(RFC-1034/1035)¤ä
NFS ¤Ë¤Ä¤¤¤Æ¤Î Sun RPC (RFC-1050)¤Ë¤Ä¤¤¤Æ½ÐÎϤµ¤ì¤ë¡£
.HD
UDP ¥Í¡¼¥à¥µ¡¼¥Ó¥¹Í×µá
.LP
\fI(Ãí:°Ê²¼¤Ï RFC-1035 ¤Çµ­½Ò¤µ¤ì¤ë ¥É¥á¥¤¥ó¥Í¡¼¥à¥µ¡¼¥Ó¥¹¥×¥í¥È¥³¥ë¤ò
Íý²ò¤·¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤·¤Æµ­½Ò¤·¤Æ¤¤¤ë¡£
¤â¤·¤³¤Î¥×¥í¥È¥³¥ë¤ËÄ̤¸¤Æ¤¤¤Ê¤¤¤è¤¦¤Ê¤é¡¢°Ê²¼¤Îµ­½Ò¤Ï¤Á¤ó¤×¤ó¤«¤ó¤×¤ó¤«¤â¤·¤ì¤Ê¤¤¡£)
.LP
¥Í¡¼¥à¥µ¡¼¥Ð¤ÎÍ×µá¤Ï¡¢
.RS
.nf
.sp .5
\fIsrc > dst: id op? flags qtype qclass name (len)\fP
.sp .5
\f(CWh2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37)\fR
.sp .5
.fi
¤Î¤è¤¦¤Ê·Á¼°¤Ç¤¢¤ë¡£
.RE
¥Û¥¹¥È \fIh2opolo\fP ¤Ï \fIhelios\fP ¤Î¥É¥á¥¤¥ó¥Í¡¼¥à¥µ¡¼¥Ð¤ËÂФ·¤Æ¡¢
\fIucb-bax.berkeley.edu.\fP ¤È¤¤¤¦Ì¾Á°¤Ë¤Ä¤¤¤Æ¤Î¥¢¥É¥ì¥¹¥ì¥³¡¼¥É(qtype=A)¤ò¿Ò¤Í¤ë¡£
Ì䤤¹ç¤ï¤»¤Î id ¤Ï `3'¡£`+'¤ÏºÆµ¢²Äǽ(\fIrecursion desired\fP)¥Õ¥é¥°¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¤³¤È¤ò¼¨¤¹¡£
Ì䤤¹ç¤ï¤»¤Ï UDP ¤È IP ¤Î¥Ø¥Ã¥À¤Ï´Þ¤Þ¤á¤º¤Ë 37¥Ð¥¤¥È¤¢¤ë¡£
Ìä¹ç¤»¤Ïɸ½àŪ¤Ê \fIQuery\fP ¤Ê¤Î¤Ç op ¥Õ¥£¡¼¥ë¥É¤Ï¾Êά¤µ¤ì¤Æ¤¤¤ë¡£
¤â¤·¡¢op ¥Õ¥£¡¼¥ë¥É¤ò»ý¤Ä¤Ê¤é¡¢¤½¤ì¤¬¤Ê¤ó¤Ç¤¢¤ì¡¢`3' ¤È `+' ¤Î´Ö¤Ëɽ¼¨¤¹¤ë¡£
¤Þ¤¿Æ±Íͤˡ¢Ìä¹ç¤»¥¯¥é¥¹(qclass)¤âɸ½àŪ¤Ê \fIC_IN\fP ¤Ê¤Î¤Ç¡¢¾Êά¤µ¤ì¤Æ¤¤¤ë¡£
¤Û¤«¤ÎÌä¹ç¤»¥¯¥é¥¹¤Î¾ì¹ç¤Ï `A' ¤Ë³¤¤¤Æɽ¼¨¤¹¤ë¡£
.LP
Î㳰Ū¤Ê¤â¤Î¤ò¸¡½Ð¤·¤¿¾ì¹ç¡¢ÄɲäΥե£¡¼¥ë¥É¤ò[ ] ¤Ç°Ï¤ó¤Çɽ¼¨¤¹¤ë¤À¤í
¤¦:¤â¤·Ìä¹ç¤»(query)¤Ë²óÅú¡¢¥Í¡¼¥à¥µ¡¼¥Ð¡¢¸¢°Ò¥»¥¯¥·¥ç¥ó¤¬´Þ¤Þ¤ì¤ë¾ì¹ç¡¢
.IR ancount ,
.IR nscount ,
.I arcount
¤Ï¤½¤ì¤¾¤ì\fIn\fP ¤ò¥«¥¦¥ó¥È¿ô¤È¤·¤Æ¡¢
`[\fIn\fPa]'¡¢`[\fIn\fPn]' ¤« `[\fIn\fPau]' ¤Î¤è¤¦¤Ëɽ¼¨¤µ¤ì¤ë¡£
¤â¤·¡¢ÂèÆ󤪤è¤ÓÂè»°¥Ð¥¤¥È¤Ë¤¤¤¯¤Ä¤«¤Î±þÅúbit¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë(AA¡¢RA ¤«
¤Þ¤¿¤Ï rcode)¾ì¹ç¤«¡¢`must be zero' ¥Ó¥Ã¥È¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ï
`[b2&3=\fIx\fP]'¤Èɽ¼¨¤¹¤ë¡£¤³¤³¤Ç \fIx\fP ¤Ï¥Ø¥Ã¥À¤ÎÂèÆ󤪤è¤ÓÂè»°¥Ð¥¤¥È¤Î 16 ¿Êɽ¸½¤Ç¤¢¤ë¡£
.HD
UDP ¥Í¡¼¥à¥µ¡¼¥Ð±þÅú
.LP
¥Í¡¼¥à¥µ¡¼¥Ð¤«¤é¤Î±þÅú¤Ï¡¢
.RS
.nf
.sp .5
\fIsrc > dst:  id op rcode flags a/n/au type class data (len)\fP
.sp .5
\f(CWhelios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273)
helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97)\fR
.sp .5
.fi
¤Î¤è¤¦¤Ê·Á¼°¤Ç¤¢¤ë¡£
.RE
ºÇ½é¤ÎÎã¤Ç¤Ï¡¢\fIhelios\fP ¤Ï \fIh2opolo\fP ¤Î id 3 ¤ÎÍ×µá¤Ë»°¸Ä¤Î²óÅú
¥ì¥³¡¼¥É¡¢»°¸Ä¤Î¥Í¡¼¥à¥µ¡¼¥Ð¥ì¥³¡¼¥É¤È¼·¸Ä¤Î¸¢°Ò¥ì¥³¡¼¥É¤òÊÖÅú¤·¤Æ¤¤¤ë¡£
ºÇ½é¤Î²óÅú¤Ï A ¥ì¥³¡¼¥É¤Ç¡¢¤³¤Î¥Ç¡¼¥¿¤Ï¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤Î 128.32.137.3 ¤Ç¤¢¤ë¡£
±þÅú¤Î¥µ¥¤¥º¤Ï UDP ¤È IP ¤Î¥Ø¥Ã¥À¤Ï´Þ¤Þ¤º¤Ë 273 ¥Ð¥¤¥È¤Ç¤¢¤ë¡£
(query¤Î) op ¤È response code(¤³¤Î¾ì¹ç¤Ï NoError)¤Ï¡¢A ¥ì¥³¡¼¥É¤Î¥¯¥é
¥¹(C_IN)¤ÈƱÍͤ˾Êά¤µ¤ì¤Æ¤¤¤ë¡£
.LP
¼¡¤ÎÎã¤Ï \fIhelios\fP ¤Ï¥É¥á¥¤¥ó¤¬Â¸ºß¤·¤Ê¤¤¡¢¤È¤¤¤¦ response code
(NXDomain) ¤Ç²óÅú¤Ï¤Ê¤·¡¢¥Í¡¼¥à¥µ¡¼¥Ð¤Ï°ì¸Ä¡¢¸¢°Ò¥ì¥³¡¼¥É¤â¤Ê¤·¡¢¤È¤¤¤¦ÊÖÅú¤ò¤·¤Æ¤¤¤ë¡£
`*' ¤Ï \fIauthoritative answer\fP ¥Ó¥Ã¥È¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¤³¤È¤ò¼¨¤¹¡£
²óÅú¤¬¤Ê¤¤¤Î¤Ç¡¢ type ¤È¥¯¥é¥¹¤ª¤è¤Ó¥Ç¡¼¥¿¤Ïɽ¼¨¤µ¤ì¤Ê¤¤¡£ 
.LP
¤Û¤«¤Î¥Õ¥é¥°¤Ï`\-'(RA(ºÆµ¢²Ä)¤¬ÀßÄꤵ¤ì¤Æ\fI¤¤¤Ê¤¤\fP)¡¢`|'TC(¤Þ¤ë¤á¤é
¤ì¤¿¥á¥Ã¥»¡¼¥¸)¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¡£`question' ¥»¥¯¥·¥ç¥ó¤¬°ì¤Ä¤Ç¤Ê¤¤¾ì¹ç
¤Ë¤Ï¡¢`[\fIn\fPq]'¤È½ÐÎϤ¹¤ë¡£
.LP
¥Í¡¼¥à¥µ¡¼¥Ð¤Î±þÅú¤Ï¥Ç¥Õ¥©¥ë¥È¤Î \fIsnaplen\fP ¤Ç¤¢¤ë 68 ¥Ð¥¤¥È¤è¤ê¤âÂ礭¤¯¤Ê¤ê¤¬¤Á¤Ê¤Î¤Ç¡¢
¤½¤Î¥Ñ¥±¥Ã¥È¤òɽ¼¨¤¹¤ë¤Î¤Ë½½Ê¬¤Ê¤À¤±¤Î¾ðÊó¤òª¤¨¤­¤ì¤Ê¤¤¤³¤È¤¬¤¢¤ë¡£
¥Í¡¼¥à¥µ¡¼¥Ó¥¹¤ÎÄÌ¿®¤ò¸·Ì©¤Ë²òÀϤ·¤¿¤¤¤È¤­¤Ï¡¢\fB\-s\fP ¥Õ¥é¥°¤òÍøÍѤ·¤Æ snaplen ¤ò³ÈÄ¥¤¹¤ë¤Ù¤­¤Ç¤¢¤ë¡£
\fB\`-s 128\fP'¤¯¤é¤¤¤¬ÂÅÅö¤Ç¤¢¤í¤¦¡£

.HD
.\"O SMB/CIFS decoding
SMB/CIFS Ÿ³«
.LP
.\"O tcpdump now includes fairly extensive SMB/CIFS/NBT decoding for data
.\"O on UDP/137, UDP/138 and TCP/139. Some primitive decoding of IPX and
.\"O NetBEUI SMB data is also done. 
tcpdump ¤Ï UDP/137, UDP/138, TCP/139 ¤ËÂФ¹¤ëÈæ³ÓŪÂ絬ÌÏ¤Ê SMB/CIFS/NBT ¥Ç¥³¡¼¥Éµ¡Ç½¤ò»ý¤Ä¡£
IPX ¤È NetBEUI SMB ¤ò¥Ç¥³¡¼¥É¤¹¤ëÍ×ÁǤ⤢¤ë¡£

.\"O By default a fairly minimal decode is done, with a much more detailed
.\"O decode done if -v is used. Be warned that with -v a single SMB packet
.\"O may take up a page or more, so only use -v if you really want all the
.\"O gory details.
¥Ç¥Õ¥©¥ë¥È¤Ç¤ÏÈæ³ÓŪ¾®µ¬ÌϤʥǥ³¡¼¥É¤¬¹Ô¤ï¤ì¡¢
-v ¥ª¥×¥·¥ç¥ó¤òÍѤ¤¤ë¤ÈÍÚ¤«¤Ë¾ÜºÙ¤Ê¥Ç¥³¡¼¥É¤¬¹Ô¤ï¤ì¤ë¡£
-v ¥ª¥×¥·¥ç¥óÉÕ¤­¤Î¾ì¹ç¡¢¤Ò¤È¤Ä¤Î SMB ¥Ñ¥±¥Ã¥È¤¬ 1 ²èḬ̀ʾå¤Î¾ðÊó¤ò½Ð¤¹¾ì¹ç¤â¤¢¤ë¤Î¤Ç¡¢
ËÜÅö¤ËɬÍפʾì¹ç¤Î¤ß -v ¥ª¥×¥·¥ç¥ó¤ò¤Ä¤±¤ë¤³¤È¡£

.\"O If you are decoding SMB sessions containing unicode strings then you
.\"O may wish to set the environment variable USE_UNICODE to 1. A patch to
.\"O auto-detect unicode srings would be welcome.
UNICODE ʸ»úÎó¤ò´Þ¤à SMB ¥»¥Ã¥·¥ç¥ó¤ò¥Ç¥³¡¼¥É¤¹¤ë¾ì¹ç¤Ï¡¢
´Ä¶­ÊÑ¿ô USE_UNICODE ¤Ë 1 ¤ò¥»¥Ã¥È¤·¤¿¤Û¤¦¤¬¤¤¤¤¤«¤â¤·¤ì¤Ê¤¤¡£
UNICODE ʸ»úÎó¤ò¼«Æ°¸¡½Ð¤¹¤ë¥Ñ¥Ã¥Á¤Ï´¿·Þ¤¹¤ë¡£

.\"O For information on SMB packet formats and what all te fields mean see
.\"O www.cifs.org or the pub/samba/specs/ directory on your favourite
.\"O samba.org mirror site. The SMB patches were written by Andrew Tridgell
.\"O (tridge@samba.org).
SMB ¥Ñ¥±¥Ã¥È¤Î·Á¼°¤ä all te¥Õ¥£¡¼¥ë¥É¤¬²¿¤ò°ÕÌ£¤¹¤ë¤«¤Î¾ðÊó¤Ï¡¢
www.cifs.org ¤« samba.org ¥ß¥é¡¼¥µ¥¤¥È¤Î pub/samba/specs/ ¥Ç¥£¥ì¥¯¥È¥ê¤ò»²¾È¤Î¤³¤È¡£
SMB ¥Ñ¥Ã¥Á¤Ï Andrew Tridgell (tridge@samba.org) ¤¬½ñ¤¤¤¿¡£

.HD
NFS Í×µá¤È²óÅú
.LP
Sun NFS(Network File System)¤ÎÍ×µá¤È±þÅú¤Ï¼¡¤Î¤è¤¦¤Ë½ÐÎϤµ¤ì¤ë:
.RS
.nf
.sp .5
\fIsrc.xid > dst.nfs: len op args\fP
\fIsrc.nfs > dst.xid: reply stat len op results\fP
.sp .5
\f(CW
sushi.6709 > wrl.nfs: 112 readlink fh 21,24/10.73165
wrl.nfs > sushi.6709: reply ok 40 readlink "../var"
sushi.201b > wrl.nfs:
        144 lookup fh 9,74/4096.6878 "xcolors"
wrl.nfs > sushi.201b:
        reply ok 128 lookup fh 9,74/4134.3150
\fR
.sp .5
.fi
.RE
°ì¹ÔÌܤϥۥ¹¥È \fIsushi\fP ¤¬ id \fI6709\fP ¤Ç¥È¥é¥ó¥¶¥¯¥·¥ç¥óÍ×µá¤ò \fIwrl\fP ¤ËÁ÷¿®¤·¤Æ¤¤¤ë (src ¥Û¥¹¥È¤Ë³¤¯¿ô»ú¤Ï port ÈÖ¹æ \fI¤Ç¤Ï¤Ê¤¯¤Æ\fP ¥È¥é¥ó¥¶¥¯¥·¥ç¥ó id ¤Ç¤¢¤ëÅÀ¤ËÃí°Õ¤»¤è)¡£
Í×µá¤Ï UDP ¤È IP ¤Î¥Ø¥Ã¥À¤ò½ü¤¤¤Æ 112 ¥Ð¥¤¥È¤Ç¤¢¤ë¡£Æ°ºîÍ×µá¤Ï¥Õ¥¡¥¤¥ë¥Ï¥ó¥É¥ë(\fIfh\fP) 21,24/10.731657119 ¤ËÂФ¹¤ë \fIreadlink\fP (¥·¥ó¥Ü¥ê¥Ã¥¯¥ê¥ó¥¯¤ÎÃͤòÆɤà)¤Ç¤¢¤ë¡£
(¤³¤ÎÎã¤Ç¤Ï¡¢¹¬±¿¤Ê¤³¤È¤Ë¡¢¥Ç¥Ð¥¤¥¹¤Î major ¤ª¤è¤Ó minor ÈÖ¹æ¤ÎÂÐ¤È 
inode Èֹ桢generation Èֹ椬¥Õ¥¡¥¤¥ë¥Ï¥ó¥É¥ë¤«¤éÃê½Ð¤Ç¤­¤Æ¤¤¤ë)
\fIWrl\fP ¤Ï¥ê¥ó¥¯¤ÎÆâÍÆ¤È `ok' ¤òÊÖÅú¤·¤Æ¤¤¤ë¡£
.LP
»°¹ÔÌÜ¤Ç¤Ï \fIsushi\fP ¤Ï \fIwrl\fP ¤ËÂФ· ¥Ç¥£¥ì¥¯¥È¥ê¥Õ¥¡¥¤¥ë 9,74/4096.8678 ¤«¤é 
`\fIxcolors\fP' ¤òõ¤·½Ð¤¹¤è¤¦¤ËÍ׵ᤷ¤Æ¤¤¤ë¡£
½ÐÎϤµ¤ì¤ë¥Ç¡¼¥¿¤ÏÁàºî¤Î¼ïÎà¤Ë¤è¤Ã¤Æ°Í¸¤·¤Æ¤¤¤ë¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
¤³¤Î½ÐÎÏ·Á¼°¤Ï NFS ¥×¥í¥È¥³¥ë»ÅÍͤȤȤâ¤ËÆɤó¤À¾ì¹ç¤Ë¼«¸ÊÀâÌÀ¤Ë¤Ê¤ë¤è¤¦°Õ¿Þ¤µ¤ì¤¿·Á¼°¤Ç¤¢¤ë¡£
.LP
-v(verbose) ¥Õ¥é¥°¤¬Í¿¤¨¤é¤ì¤Æ¤¤¤ë¾ì¹ç¡¢ÄɲäξðÊó¤â½ÐÎϤµ¤ì¤ë¡£Îã:
.RS
.nf
.sp .5
\f(CW
sushi.1372a > wrl.nfs:
        148 read fh 21,11/12.195 8192 bytes @ 24576
wrl.nfs > sushi.1372a:
        reply ok 1472 read REG 100664 ids 417/0 sz 29388
\fP
.sp .5
.fi
.RE
(\-v ¤Ï IP ¥Ø¥Ã¥À¤Î TTL ¤È ID¡¢¥Õ¥é¥°¥á¥ó¥Æ¡¼¥·¥ç¥ó¥Õ¥£¡¼¥ë¥É¤âɽ¼¨¤¹¤ë
¤¬¡¢¤³¤ÎÎã¤Ç¤Ï¾Êά¤·¤Æ¤¤¤ë)¡£°ì¹ÔÌܤǤϡ¢\fIsushi\fP ¤Ï \fIwrl\fP ¤ËÂФ·¤Æ¡¢ file 21,11/12.195 ¤Î¥Ð¥¤¥È¥ª¥Õ¥»¥Ã¥È 24576 ¤«¤é 8192 ¥Ð¥¤¥ÈÆɤ߽Ф·Í×µá¤ò½Ð
¤·¤Æ¤¤¤ë¡£\fIWrl\fP ¤Ï `ok' ¤òÊÖ¤·¤Æ¤¤¤ë; Æó¹ÔÌܤËɽ¼¨¤µ¤ì¤Æ¤¤¤ë¤³¤Î¥Ñ
¥±¥Ã¥È¤Ï¥Õ¥é¥°¥á¥ó¥È²½¤µ¤ì¤¿ÊÖÅú¤Î°ìÈÖÌܤΥѥ±¥Ã¥È¤Ç¤¢¤ë¤¿¤á¡¢1472 ¥Ð
¥¤¥È¤Î¤ß¤Ç¤¢¤ë(»Ä¤ê¤Î¥Ð¥¤¥È¤Ï¤½¤Î¸å¤Î¥Õ¥é¥°¥á¥ó¥È¤È¤·¤Æ³¤¯¤¬¡¢¤½¤ì¤é
¤Î¥Õ¥é¥°¥á¥ó¥È¤Ï NFS ¥Ø¥Ã¥À¤â UDP ¥Ø¥Ã¥À¤â»ý¤¿¤Ê¤¤¤Î¤Ç¡¢¥Õ¥£¥ë¥¿¾ò·ï¼°¤Î»ØÄ꼡Âè¤Çɽ¼¨¤µ¤ì¤Ê¤¤¤³¤È¤¬¤¢¤ë)¡£
¤Þ¤¿ \-v ¥Õ¥é¥°¤¬¤¢¤¿¤¨¤é¤ì¤Æ¤¤¤ë¤³¤È¤Ë¤è¤ê¡¢¤¤¤¯¤Ä¤«¤Î¥Õ¥¡¥¤¥ë¤Î°À­
¤âɽ¼¨¤µ¤ì¤ë(¥Õ¥¡¥¤¥ë¥Ç¡¼¥¿¤ËÉղä·¤ÆÊÖÅú¤µ¤ì¤ë): ¥Õ¥¡¥¤¥ë¤Î¥¿¥¤¥×
(``REG'' ¤ÏÉáÄ̤Υե¡¥¤¥ë)¡¢¥Õ¥¡¥¤¥ë¤Î¥â¡¼¥É(Ȭ¿Ê¤Ç)¡¢uid ¤È gid¡¢¤Þ¤¿¥Õ¥¡¥¤¥ë¤Î¥µ¥¤¥º¤Ê¤É¡£
.LP
\-v ¥Õ¥é¥°¤¬Ê£¿ôÍ¿¤¨¤é¤ì¤ë¤È(\-vv¤Î¤³¤È)¤â¤Ã¤È¾ÜºÙ¤Ê¾ðÊ󤬽ÐÎϤµ¤ì¤ë¡£
.LP
NFS ¤ÎÍ×µá¤Ï¤È¤Æ¤âÂ礭¤¤¤Î¤Ç¡¢snaplen ¤òÁý²Ã¤·¤Ê¤¤¤È½½Ê¬¤Ê¾ðÊó¤¬É½¼¨¤Ç
¤­¤Ê¤¤¤«¤â¤·¤ì¤Ê¤¤¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
NFS ¤ÎÄÌ¿®¤ò´Æ»ë¤¹¤ë¾ì¹ç¤Ï `\fB\-s 192\fP' ¤ò»î¤·¤Æ¤ß¤ë¤È¤è¤¤¡£
.LP
NFS¤ÎÊÖÅú¥Ñ¥±¥Ã¥È¤Ï RPCÁàºî¤Ë¤è¤Ã¤Æ¼±Ê̤¹¤ë¤³¤È¤¬¤Ç¤­¤Ê¤¤¡£¤·¤«¤·¤Ê¤¬
¤é¡¢\fItcpdump\fP ¤Ï ``ºÇ¶á¤Î''Í×µá¤ò³Ð¤¨¤Æ¤ª¤¤¤Æ¡¢ÊÖÅú¤¬¤½¤Î¥È¥é¥ó¥¶
¥¯¥·¥ç¥ó ID¤Ë°ìÃפ¹¤ë¤«Ä´¤Ù¤ë¡£±þÅú¤¬Âбþ¤¹¤ëÍ×µá¤Î¶á¤¯¤ËÄÌ¿®¤µ¤ì¤Æ¤¤¤Ê¤¤¾ì¹ç¤Ï¤­¤Á¤ó¤È²òÀϤǤ­¤Ê¤¤¤«¤â¤·¤ì¤Ê¤¤¡£
.HD
.\"O AFS Requests and Replies
AFS Í×µá¤È±þÅú
.LP
.\"O Transarc AFS (Andrew File System) requests and replies are printed
.\"O as:
Transarc AFS (Andrew File System) Í×µá¤È±þÅú¤Ï°Ê²¼¤Î¤è¤¦¤Ëɽ¼¨¤µ¤ì¤ë¡£
.HD
.RS
.nf
.sp .5
\fIsrc.sport > dst.dport: rx packet-type\fP
\fIsrc.sport > dst.dport: rx packet-type service call call-name args\fP
\fIsrc.sport > dst.dport: rx packet-type service reply call-name args\fP
.sp .5
\f(CW
elvis.7001 > pike.afsfs:
        rx data fs call rename old fid 536876964/1/1 ".newsrc.new"
        new fid 536876964/1/1 ".newsrc"
pike.afsfs > elvis.7001: rx data fs reply rename
\fR
.sp .5
.fi
.RE
.\"O In the first line, host elvis sends a RX packet to pike.  This was
.\"O a RX data packet to the fs (fileserver) service, and is the start of
.\"O an RPC call.  The RPC call was a rename, with the old directory file id
.\"O of 536876964/1/1 and an old filename of `.newsrc.new', and a new directory
.\"O file id of 536876964/1/1 and a new filename of `.newsrc'.  The host pike
.\"O responds with a RPC reply to the rename call (which was successful, because
.\"O it was a data packet and not an abort packet).
ºÇ½é¤Î¹Ô¤Ç¡¢¥Û¥¹¥È elvis ¤Ï RX ¥Ñ¥±¥Ã¥È¤ò pike ¤ËÁ÷¿®¤·¤Æ¤¤¤ë¡£
¤³¤ì¤Ï fs (¥Õ¥¡¥¤¥ë¥µ¡¼¥Ð) ¥µ¡¼¥Ó¥¹¤Ø¤Î RX ¥Ç¡¼¥¿¥Ñ¥±¥Ã¥È¤Ç¡¢
RPC ¸Æ¤Ó½Ð¤·¤Î³«»Ï¤Ç¤¢¤ë¡£
RPC ¸Æ¤Ó½Ð¤·¤Ï¥ê¥Í¡¼¥à¤Ç¡¢¸Å¤¤¥Ç¥£¥ì¥¯¥È¥ê¥Õ¥¡¥¤¥ë ID ¤Ï 536876964/1/1¡¢
¸Å¤¤¥Õ¥¡¥¤¥ë̾¤Ï`.newsrc.new'¡¢
¿·¤·¤¤¥Ç¥£¥ì¥¯¥È¥ê¥Õ¥¡¥¤¥ë ID ¤Ï 536876964/1/1¡¢
¿·¤·¤¤¥Õ¥¡¥¤¥ë̾¤Ï `.newsrc' ¤Ç¤¢¤ë¡£
¥Û¥¹¥È pike ¤Ï ¥ê¥Í¡¼¥à¸Æ¤Ó½Ð¤·¤ËÂФ¹¤ë RPC ±þÅú¥Ñ¥±¥Ã¥È
(¥Ç¡¼¥¿¥Ñ¥±¥Ã¥È¤Ç¤¢¤ê¡¢ÃæÃǥѥ±¥Ã¥È¤Ç¤Ï¤Ê¤¤¤Î¤ÇÀ®¸ù¤ò°ÕÌ£¤¹¤ë)
¤òÊÖ¿®¤·¤Æ¤¤¤ë¡£
.LP
.\"O In general, all AFS RPCs are decoded at least by RPC call name.  Most
.\"O AFS RPCs have at least some of the arguments decoded (generally only
.\"O the `interesting' arguments, for some definition of interesting).
°ìÈ̤ˡ¢Á´¤Æ¤Î AFS RPC ¤Ï¾¯¤Ê¤¯¤È¤â RPC ¸Æ¤Ó½Ð¤·Ì¾¤Ï¥Ç¥³¡¼¥É¤µ¤ì¤ë¡£
¤Û¤È¤ó¤É¤Î AFC RPC ¤Ï¾¯¤Ê¤¯¤È¤â¤¤¤¯¤Ä¤«¤Î°ú¿ô¤Ï¥Ç¥³¡¼¥É¤µ¤ì¤ë
(°ìÈÌ¤Ë `¶½Ì£¿¼¤¤' °ú¿ô¤Î¤ß¤¬¥Ç¥³¡¼¥É¤µ¤ì¤ë)¡£
.LP
.\"O The format is intended to be self-describing, but it will probably
.\"O not be useful to people who are not familiar with the workings of
.\"O AFS and RX.
ɽ¼¨¥Õ¥©¡¼¥Þ¥Ã¥È¤Ï¼«¸ÊÀâÌÀŪ¤Ê¤â¤Î¤òÌܻؤ·¤Æ¤¤¤ë¤¬¡¢
AFS ¤È RX ¤ÎÆ°ºî¤Ë¾Ü¤·¤¯¤Ê¤¤¿Í¡¹¤Ë¤È¤Ã¤Æ¤Ï¤ª¤½¤é¤¯ÊØÍø¤Ç¤Ï¤Ê¤¤¤À¤í¤¦¡£
.LP
.\"O If the -v (verbose) flag is given twice, additional information is printed,
.\"O such as the the RX call ID, call number, sequence number, serial number,
.\"O and the RX packet flags.
-v (¾ÜºÙ) ¥ª¥×¥·¥ç¥ó¤¬ 2 ²ó»ØÄꤵ¤ì¤ë¤È¡¢ÄɲþðÊó¤¬É½¼¨¤µ¤ì¤ë¡£
¤³¤ì¤Ï RX ¸Æ¤Ó½Ð¤· ID¡¢¸Æ¤Ó½Ð¤·Èֹ桢¥·¡¼¥±¥ó¥¹Èֹ桢¥·¥ê¥¢¥ëÈֹ桢RX ¥Ñ¥±¥Ã¥È¥Õ¥é¥°¤Ê¤É¤Ç¤¢¤ë¡£
.LP
.\"O If the -v flag is given again, the security index and service id are printed.
¤µ¤é¤Ë -v ¥ª¥×¥·¥ç¥ó¤¬»ØÄꤵ¤ì¤ë¤È¡¢¥»¥­¥å¥ê¥Æ¥£¥¤¥ó¥Ç¥Ã¥¯¥¹¤È¥µ¡¼¥Ó¥¹ ID ¤¬É½¼¨¤µ¤ì¤ë¡£
.LP
.\"O Error codes are printed for abort packets, with the exception of Ubik
.\"O beacon packets (because abort packets are used to signify a yes vote
.\"O for the Ubik protocol).
ÃæÃǥѥ±¥Ã¥È¤Î¥¨¥é¡¼¥³¡¼¥É¤âɽ¼¨¤µ¤ì¤ë¡£
⤷¡¢Ubik ¥Ó¡¼¥³¥ó¥Ñ¥±¥Ã¥È¤ÏÎã³°¤Ç¤¢¤ë¡£
(¤Ê¤¼¤Ê¤é¡¢Ubik ¥×¥í¥È¥³¥ë¤Ë¤ª¤±¤ëÃæÃǥѥ±¥Ã¥È¤Ï»¿À®É¼¤ò°ÕÌ£¤¹¤ë¤«¤é¤Ç¤¢¤ë)¡£
.LP
.\"O Note that AFS requests are very large and many of the arguments won't
.\"O be printed unless \fIsnaplen\fP is increased.  Try using `\fB-s 256\fP'
.\"O to watch AFS traffic.
AFS Í×µá¤ÏÈó¾ï¤ËÂ礭¤¯¡¢
¿¤¯¤Î°ú¿ô¤Ï\fIsnaplen\fP¤òÁý¤ä¤µ¤Ê¤¤¤È¤ª¤½¤é¤¯É½¼¨¤µ¤ì¤Ê¤¤¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
AFS ÄÌ¿®¤ò´Æ»ë¤¹¤ë¾ì¹ç¤Ï `\fB-s 256\fP' ¤ò»î¤·¤Æ¤ß¤ë¤È¤è¤¤¡£
.LP
.\"O AFS reply packets do not explicitly identify the RPC operation.  Instead,
.\"O \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the
.\"O replies using the call number and service ID.  If a reply does not closely
.\"O follow the
.\"O corresponding request, it might not be parsable.
AFS ±þÅú¥Ñ¥±¥Ã¥È¤ÏÌÀ¼¨Åª¤Ë RPC Áàºî¤ò¼±Ê̤·¤Ê¤¤¡£
Âå¤ï¤ê¤Ë¡¢\fItcpdump\fP¤Ï``ºÇ¶á¤Î''Í×µá¤ò³Ð¤¨¤Æ¤¤¤Æ¡¢
¤½¤ì¤ò¸Æ¤Ó½Ð¤·ÈÖ¹æ¤È¥µ¡¼¥Ó¥¹ ID ¤òÍѤ¤¤Æ±þÅú¤È¾È¹ç¤µ¤»¤ë¡£
¤â¤·±þÅú¤¬Âбþ¤¹¤ëÍ×µá¤È·ë¤ÓÉÕ¤±¤é¤ì¤Ê¤«¤Ã¤¿¾ì¹ç¡¢¤½¤Î¥Ñ¥±¥Ã¥È¤Ï¥Ñ¡¼¥º¤Ç¤­¤Ê¤¤¡£

.HD
KIP Appletalk (UDP Æâ DDP)
.LP
UDP ¥Ç¡¼¥¿¥°¥é¥àÆâ¤Ë³ÊǼ¤µ¤ì¤¿¥¢¥Ã¥×¥ë¥È¡¼¥¯¤Î DDP ¥Ñ¥±¥Ã¥È¤Ï¼è¤ê½Ð¤µ¤ì¤Æ¡¢
DDP ¥Ñ¥±¥Ã¥È¤È¤·¤Æɽ¼¨¤µ¤ì¤ë(¤¹¤Ê¤ï¤Á¤¹¤Ù¤Æ¤Î UDP ¥Ø¥Ã¥À¾ðÊó¤Ï¼Î¤Æ¤é¤ì¤ë)¡£
.I /etc/atalk.names 
¥Õ¥¡¥¤¥ë¤¬ ¥¢¥Ã¥×¥ë¥È¡¼¥¯¥Í¥Ã¥È¤È¥Î¡¼¥ÉÈÖ¹æ¤ò̾Á°¤ËÊÑ´¹¤¹¤ë¤Î¤ËÍøÍѤµ¤ì¤ë¡£
¥Õ¥¡¥¤¥ë¤Î·Á¼°¤Ï²¼µ­¤ÎÄ̤ꡣ
.RS
.nf
.sp .5
\fIÈÖ¹æ         ̾Á°\fP

\f(CW1.254      ether
16.1            icsd-net
1.254.110       ace\fR
.sp .5
.fi
.RE
ºÇ½é¤ÎÆó¹Ô¤Ï¥¢¥Ã¥×¥ë¥È¡¼¥¯¥Í¥Ã¥È¥ï¡¼¥¯¤Ë̾Á°¤òÍ¿¤¨¤ë¡£»°¹ÔÌܤÏÆÃÄê¤Î¥Û¥¹¥È¤Î̾Á°¤òÍ¿¤¨¤ë(¥Û¥¹¥È¤Ï¥Í¥Ã¥È¥ï¡¼¥¯ÈÖ¹æ¤ÎÂè»°¥ª¥¯¥Æ¥Ã¥È¤Ç¼±Ê̤µ¤ì¤ë \- 
¥Í¥Ã¥È¥ï¡¼¥¯ÈÖ¹æ¤ÏÆ󥪥¯¥Æ¥Ã¥È¤Ç \fI¤Ê¤±¤ì¤Ð¤Ê¤é¤º\fP¡¢¤Þ¤¿¥Û¥¹¥ÈÈÖ
¹æ¤Ï»°¥ª¥¯¥Æ¥Ã¥È¤Ç \fI¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤\fP¡£ÈÖ¹æ¤È̾Á°¤Ï¶õÇòʸ»ú¤Ç¶èÀÚ¤é¤ì¤ë(blank ¤« tab)¡£
.I /etc/atalk.names 
¥Õ¥¡¥¤¥ë¤Ï¶õ¹Ô¤È¥³¥á¥ó¥È¹Ô(`#'¤Ç»Ï¤Þ¤ë¹Ô)¤ò´Þ¤ó¤Ç¤â¤è¤¤¡£
.LP
¥¢¥Ã¥×¥ë¥È¡¼¥¯¤Î¥¢¥É¥ì¥¹¤Ï¼¡¤Î·Á¼°¤Çɽ¼¨¤µ¤ì¤ë¡£
.RS
.nf
.sp .5
\fInet.host.port\fP

\f(CW144.1.209.2 > icsd-net.112.220
office.2 > icsd-net.112.220
jssmag.149.235 > icsd-net.2\fR
.sp .5
.fi
.RE
(
.I /etc/atalk.names
¤¬¤Ê¤¤¾ì¹ç¤Þ¤¿¤Ï¤½¤ì¤ËŬÀڤʥ¢¥Ã¥×¥ë¥È¡¼¥¯¤Î¥Í¥Ã¥ÈÈֹ桢¥Û¥¹¥ÈÈֹ椬´Þ¤Þ¤ì¤Ê¤¤¾ì¹ç¤Ï¡¢¥¢¥É¥ì¥¹¤Ï¿ô»ú¤Çɽ¼¨¤µ¤ì¤ë)¡£
ºÇ½é¤ÎÎã¤Ï ¥Í¥Ã¥È¥ï¡¼¥¯ 144.1 ¤Î¥Î¡¼¥É 209 ¤Î NBP(DDP ¤Î¥Ý¡¼¥ÈÈÖ¹æ 2 )¤«¤é¥Í¥Ã¥È¥ï¡¼¥¯ icsd ¤Î¥Î¡¼¥É 112 ¥Ý¡¼¥ÈÈÖ¹æ220 È֤ؤÎÁ÷¿®¤ò¼¨¤¹¡£
ÆóÈÖÌܤâƱÍͤÀ¤¬¡¢¥Î¡¼¥É̾(`office') ¤¬¤ï¤«¤Ã¤Æ¤¤¤ë¾ì¹ç¤ÎÎã¡£
»°¹ÔÌܤϥͥåȥ¥¯ jssmag ¤Î¥Î¡¼¥É 149 ¤Î 235 È֥ݡ¼¥È¤«¤é icsd-net ¤Î NBP¥Ý¡¼¥È¤Ø¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤ò¼¨¤¹¡£
¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¥¢¥É¥ì¥¹(255)¤Ï¥Û¥¹¥ÈÈÖ¹æ¤òȼ¤ï¤Ê¤¤¥Í¥Ã¥È¥ï¡¼¥¯Ì¾¤À¤±¤Î½Ð
ÎϤǼ±Ê̤Ǥ­¤ë¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È \- /etc/atalk.names ¤Ë¥Î¡¼¥É̾¤È¥Í¥Ã
¥È¥ï¡¼¥¯Ì¾¤òµ­½Ò¤·¤Æ¤ª¤¯¤Î¤Ï¤è¤¤¹Í¤¨¤Ç¤¢¤ë)¡£
.LP
NBP(̾Á°²ò·è¥×¥í¥È¥³¥ë)¤È ATP(¥¢¥Ã¥×¥ë¥È¡¼¥¯¥È¥é¥ó¥¶¥¯¥·¥ç¥ó¥×¥í¥È¥³¥ë)¥Ñ¥±¥Ã¥È¤Ë¤Ä¤¤¤Æ¤Ï¡¢¤½¤ÎÆâÍƤâ²òÀϤµ¤ì¤ë¡£
¤½¤Î¾¤Î¥×¥í¥È¥³¥ë¤Ï¥×¥í¥È¥³¥ë̾(̾Á°¤¬¤ï¤«¤é¤Ê¤±¤ì¤ÐÈÖ¹æ)¤È¥Ñ¥±¥Ã¥È¤Î¥µ¥¤¥º¤¬É½¼¨¤µ¤ì¤ë¤À¤±¤Ç¤¢¤ë¡£

\fBNBP ¥Ñ¥±¥Ã¥È\fP ¤Ï¼¡¤ÎÎã¤Î¤è¤¦¤Ëɽ¼¨¤µ¤ì¤ë:
.RS
.nf
.sp .5
\s-2\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"
jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250
techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fR\s+2
.sp .5
.fi
.RE
°ì¹ÔÌܤϥͥåȥ¥¯ icsd ¤Î ¥Û¥¹¥È 112 ¤«¤é ¥Í¥Ã¥È¥ï¡¼¥¯jssmag ¤Ø¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤µ¤ì¤ë¥ì¡¼¥¶¥é¥¤¥¿¤òõ¤¹Í×µáÁ÷¿®¤Ç¤¢¤ë¡£nbp ¤Î id ¤Ï 190 ¡£
Æó¹ÔÌܤϤ½¤ÎÍ×µá¤Ø¤Î¥Û¥¹¥È jssmag.209 ¤«¤é¤Î±þÅú(id Èֹ椬Ʊ¤¸¤Ç¤¢¤ë¤³¤È¤ËÃí°Õ)¤Ç¡¢``RM1140''¤È¤¤¤¦Ì¾Á°¤Î¥ì¡¼¥¶¥é¥¤¥¿¤ò 250 È֥ݡ¼¥È¤Ë»ý¤Ã¤Æ¤¤¤ë¤³¤È¤òÅú¤¨¤Æ¤¤¤ë¡£
»°¹ÔÌܤÏƱ¤¸Í×µá¤ËÂФ¹¤ëÊ̤ÎÊÖÅú¤Ç¥Û¥¹¥È techpit ¤¬186È֥ݡ¼¥È¤Ë "tecpit" ¤¬ÅÐÏ¿¤µ¤ì¤Æ¤¤¤ë¤³¤È¤òÅú¤¨¤Æ¤¤¤ë¡£

\fBATP ¥Ñ¥±¥Ã¥È\fP ¤Ï¼¡¤Î¤è¤¦¤Ëɽ¼¨¤µ¤ì¤ë:
.RS
.nf
.sp .5
\s-2\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001
helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:4 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:6 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp*12266:7 (512) 0xae040000
jssmag.209.165 > helios.132: atp-req  12266<3,5> 0xae030001
helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001
jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fR\s+2
.sp .5
.fi
.RE
jssmga.209 ¤Ï¥Û¥¹¥È helios ¤ËÂФ·¤Æ
id 12266 ¤Ç¥È¥é¥ó¥¶¥¯¥·¥ç¥ó¤ò³«»Ï¤·ºÇÂç 8¥Ñ¥±¥Ã¥È(`<0-7>'¤È¼¨¤¹)¤òÍ׵᤹¤ë¡£
¹ÔËö¤Î 16 ¿Ê¿ô»ú¤ÏÍ×µá¤Ë´Þ¤Þ¤ì¤ë `userdata'¤Î¥Õ¥£¡¼¥ë¥É¤Ç¤¢¤ë¡£
.LP
helios ¤ÏȬ¸Ä¤Î 512 ¥Ð¥¤¥È¤Î¥Ñ¥±¥Ã¥È¤òÊÖÅú¤·¤Æ¤¤¤ë¡£¥È¥é¥ó¥¶¥¯¥·¥ç¥óid 
¤Ë³¤¯ `:¿ô»ú' ɽ¸½¤Ï¥È¥é¥ó¥¶¥¯¥·¥ç¥ó¤Ë¤ª¤±¤ë¥Ñ¥±¥Ã¥È¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ç¡¢¥«¥Ã¥³¤Ë°Ï¤Þ¤ì¤¿¿ô»ú¤Ï atp ¥Ø¥Ã¥À¤ò½ü¤¤¤¿¥Ñ¥±¥Ã¥È¤Î¥Ç¡¼¥¿Î̤Ǥ¢¤ë¡£¥Ñ¥±¥Ã¥È 7 È֤Π`*' ¤Ï EOM ¥Ó¥Ã¥È¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¤³¤È¤ò¼¨¤¹¡£
.LP
jssmag.209 ¤Ï¥Ñ¥±¥Ã¥È 3 È֤ȥѥ±¥Ã¥È 5 È֤κÆÁ÷¤òÍ׵ᤷ¤Æ¤¤¤ë¡£helios 
¤Ï¤½¤ì¤é¤òºÆÁ÷¤·¡¢jssmag ¤Ï¥È¥é¥ó¥¶¥¯¥·¥ç¥ó¤ò½ªÎ»¤¹¤ë¡£¤½¤·¤Æ¡¢
jssmag.209 ¤Ï¼¡¤ÎÍ×µá¤ò³«»Ï¤¹¤ë¡£Í×µá¤Î `*' ¤Ï XO (`°ì²ó¤À¤±')¤ÏÀßÄê \fI¤µ¤ì¤Æ¤¤¤Ê¤¤\fP ¤³¤È¤ò¼¨¤¹¡£

.HD
IP ¥Õ¥é¥°¥á¥ó¥È²½(fragmentation)
.LP
¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥Ç¡¼¥¿¥°¥é¥à¤Î¥Õ¥é¥°¥á¥ó¥È²½¤µ¤ì¤¿¤â¤Î¤Ï¼¡¤Î¤è¤¦¤Ëɽ¼¨¤¹¤ë¡£
.RS
.nf
.sp .5
\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB+)\fR
\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB)\fR
.sp .5
.fi
.RE
(ºÇ½é¤Î·Á¼°¤Ï¤Þ¤À³¤¯¥Õ¥é¥°¥á¥ó¥È¤¬¤¢¤ë¤³¤È¤ò¼¨¤·¡¢ÆóÈÖÌܤηÁ¼°¤Ï¤½
¤ì¤¬ºÇ¸å¤Î¥Õ¥é¥°¥á¥ó¥È¤Ç¤¢¤ë¤³¤È¤ò¼¨¤¹)
.LP
\fIid\fP ¤Ï¥Õ¥é¥°¥á¥ó¥È¤Î id ¡£\fIsize\fP ¤Ï¥Õ¥é¥°¥á¥ó¥È¤Î IP ¥Ø¥Ã¥À¤ò½ü¤¯¥µ¥¤¥º(¥Ð¥¤¥È¤Ç)¡£\fIoffset\fP ¤Ï¥Õ¥é¥°¥á¥ó¥È¤Î¤â¤È¤â¤È¤Î¥Ç¡¼¥¿¥°¥é¥àÆâ¤Ç¤Î¥ª¥Õ¥»¥Ã¥È(¥Ð¥¤¥È¤Ç)¡£
.LP
¥Õ¥é¥°¥á¥ó¥È¤Î¾ðÊó¤Ï¥Õ¥é¥°¥á¥ó¥ÈËè¤Ëɽ¼¨¤µ¤ì¤ë¡£ºÇ½é¤Î¥Õ¥é¥°¥á¥ó¥È¤Ë¤Ï
¾å°Ì¥×¥í¥È¥³¥ë¤Î¥Ø¥Ã¥À¤ò´Þ¤ß¡¢¥Õ¥é¥°¥á¥ó¥È¾ðÊó¤Ï¥×¥í¥È¥³¥ë¾ðÊó¤Ë³¤¤¤Æ
ɽ¼¨¤µ¤ì¤ë¡£ÆóÈÖÌܰʹߤΥե饰¥á¥ó¥È¤Ë¤Ï¾å°Ì¥×¥í¥È¥³¥ë¤Î¾ðÊó¤ò´Þ¤Þ¤Ê¤¤
¤Î¤Ç¡¢¥Õ¥é¥°¥á¥ó¥È¾ðÊó¤Ï¥½¡¼¥¹¤ª¤è¤Ó¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤Ë³¤¤¤Æɽ¼¨¤µ¤ì¤ë¡£
°Ê²¼¤ÎÎã¤Ï CSNET ¤ÇÀܳ¤µ¤ì¤¿ arizona.edu ¤«¤é 
lbl-rtsg.arpa ¤Ø¤Î ftp Àܳ¤Î°ìÉô¤ò¼¨¤¹¤¬¡¢¤³¤ì¤Ë¤Ï 576 ¥Ð¥¤¥È¤Î¥Ç¡¼¥¿¥°¥é¥à¤Ï¤¢¤é¤ï¤ì¤Æ¤¤¤Ê¤¤:
.RS
.nf
.sp .5
\s-2\f(CWarizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+)
arizona > rtsg: (frag 595a:204@328)
rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560\fP\s+2
.sp .5
.fi
.RE
Æó¤Ä¤ÎÃí°ÕÅÀ¤¬¤¢¤ë: °ì¤ÄÌܤȤ·¤Æ¡¢Æó¹ÔÌܤǼ¨¤µ¤ì¤ë¥¢¥É¥ì¥¹¤Ë¤Ï¥Ý¡¼¥È
ÈÖ¹æ¤Ï´Þ¤Þ¤ì¤Æ¤¤¤Ê¤¤ÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£
TCP ¥×¥í¥È¥³¥ë¤Î¾ðÊó¤ÏºÇ½é¤Î¥Õ¥é¥°¥á¥ó¥È¤Ë´Þ¤Þ¤ì¤ë¤¿¤á¡¢
»Ä¤ê¤Î¥Õ¥é¥°¥á¥ó¥È¤«¤é¤Ïɽ¼¨¤¹¤Ù¤­¥Ý¡¼¥ÈÈÖ¹æ¤ä¥·¡¼¥±¥ó¥¹Èֹ椬¤ï¤«¤é¤Ê¤¤¤¿¤á¤Ç¤¢¤ë¡£
Æó¤ÄÌܤϡ¢°ì¹ÔÌܤΠTCP ¤Î¥·¡¼¥±¥ó¥¹¾ðÊó
¤Ë¤Ï¼ÂºÝ¤Ë¤Ï 512 ¥Ð¥¤¥È(ºÇ½é¤Î¥Õ¥é¥°¥á¥ó¥È¤Ç 308 ¥Ð¥¤¥È¡¢ÆóÈÖÌܤΥեé
¥°¥á¥ó¥È¤Ç204 ¥Ð¥¤¥È¤Î¾ì¹ç)¤Î¥æ¡¼¥¶¥Ç¡¼¥¿¤¬ 308 ¥Ð¥¤¥È¤Ç¤¢¤ë¤«¤Î¤è¤¦¤Ë
ɽ¼¨¤µ¤ì¤Æ¤¤¤ëÅÀ¤Ç¤¢¤ë¡£¥·¡¼¥±¥ó¥¹¤Îϳ¤ì¤ä¥Ñ¥±¥Ã¥È¤Î ack ¤ÎÂбþ¤òÄ´ºº
¤¹¤ë¤È¤­¡¢¤³¤³¤ËǺ¤Þ¤µ¤ì¤ë¤³¤È¤¬¤¢¤ë¤«¤â¤·¤ì¤Ê¤¤¡£
.LP
\fI¥Õ¥é¥°¥á¥ó¥È²½¶Ø»ß¥Õ¥é¥°\fP ¤ÎÀßÄꤵ¤ì¤¿¥Ñ¥±¥Ã¥È¤Î¾ì¹ç¡¢¹ÔËö¤Ë \fB(DF)\fP¤Èɽ¼¨¤¹¤ë¡£ 
.HD
»þ´Öɽ¼¨
.LP
¥Ç¥Õ¥©¥ë¥È¤Ç¤ÏÁ´¤Æ¤Î½ÐÎϹԤÎÀèƬ¤Ë¥¿¥¤¥à¥¹¥¿¥ó¥×¤¬¤Ä¤¯¡£¥¿¥¤¥à¥¹¥¿¥ó¥×¤Ï¸½ºß¤Î»þ¹ï¤ò¼¡¤Î·Á¼°¤Çɽ¼¨¤·¡¢
.RS
.nf
\fIhh:mm:ss.frac\fP
.fi
.RE
¤³¤ì¤Ï¡¢kernel ¤Î»þ´Ö¾ðÊóƱÍͤËÀµ³Î¤Ç¤¢¤ë¡£¥¿¥¤¥à¥¹¥¿¥ó¥×¤Ï kernel ¤¬
¥Ñ¥±¥Ã¥È¤ò³Îǧ¤·¤¿»þÅÀ¤Î»þ¹ï¤òÈ¿±Ç¤·¤Æ¤¤¤ë¡£¥¤¡¼¥µ¥Í¥Ã¥È¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹
¤¬²óÀþ¤«¤é¥Ñ¥±¥Ã¥È¤ò¼èÆÀ¤·¤¿»þÅÀ¤«¤é¥«¡¼¥Í¥ë¤¬ `¿·¤·¤¤¥Ñ¥±¥Ã¥È' ¤Ë¤è¤ë
³ä¤ê¹þ¤ß¤ò¼õ¤±¤ë»þÅÀ¤Þ¤Ç¤Î»þ´Öº¹¤ÏÈ¿±Ç¤µ¤ì¤Æ¤¤¤Ê¤¤¡£
.SH ´ØÏ¢¹àÌÜ
traffic(1C), nit(4P), bpf(4), pcap(3)
.SH Ãø¼Ô
.\"O The original authors are:
¸¶Ãø¼Ô¤Ï:
.LP
Van Jacobson,
Craig Leres and
Steven McCanne, all of the
Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
.LP
.\"O It is currently being maintained by tcpdump.org.
ºÇ¿·ÈÇ¤Ï tcpdump.org ¤Ë¤è¤Ã¤Æ´ÉÍý¤µ¤ì¤Æ¤¤¤ë¡£
.LP
.RS
.I http://www.tcpdump.org/
.RE
.LP
.\"O IPv6/IPsec support is added by WIDE/KAME project.
IPv6/IPsec ¤Î¥µ¥Ý¡¼¥È¤Ï WIDE/KAME ¥×¥í¥¸¥§¥¯¥È¤Ë¤è¤Ã¤ÆÄɲ䵤줿¡£
.\"O This program uses Eric Young's SSLeay library, under specific configuration.
¤³¤Î¥×¥í¥°¥é¥à¤Ï Eric Young ¤Î SSLeay ¥é¥¤¥Ö¥é¥ê¤òÆÃÄê¤ÎÀßÄê¤Î¸µ¤Ë»ÈÍѤ·¤Æ¤¤¤ë¡£
.SH ¥Ð¥°
.\"O Please send problems, bugs, questions, desirable enhancements, etc. to:
ÌäÂêÅÀ¡¢¥Ð¥°¡¢¼ÁÌä¡¢³ÈÄ¥¤Î¤ª´ê¤¤¤Ê¤É¤Ï¡¢°Ê²¼¤Î¥¢¥É¥ì¥¹¤ËÁ÷¤Ã¤Æ¤Û¤·¤¤¡£
.LP
.RS
tcpdump-workers@tcpdump.org
.RE
.LP
.\"O Please send source code contributions, etc. to:
¥½¡¼¥¹¥³¡¼¥É¤Î´ó£¤Ê¤É¤Ï°Ê²¼¤Î¥¢¥É¥ì¥¹¤ØÁ÷¤Ã¤Æ¤Û¤·¤¤¡£
.LP
.RS
patches@tcpdump.org
.RE
.LP
NIT ¤Ï³°¤Ø½Ð¤Æ¤¤¤¯ÄÌ¿®¤Ï¸«¤ë¤³¤È¤¬¤Ç¤­¤Ê¤¤¡£BPF ¤Ï¤½¤ì¤¬²Äǽ¤Ç¤¢¤ë¡£¸å¼Ô¤ÎÍøÍѤò¿ä¾©¤¹¤ë¡£
.LP
ÍÑÅӤˤè¤Ã¤Æ¤Ï¡¢IP¥Õ¥é¥°¥á¥ó¥È¤òºÆ¹½ÃÛ¤·¤¿¤ê¡¢¾å°Ì¥×¥í¥È¥³¥ë¤ÎŤµ¤ò·×»»¤¹¤ë¤¯¤é¤¤¤Î¤³¤È¤ÏɬÍפȤʤë¤À¤í¤¦¡£
.LP
¥Í¡¼¥à¥µ¡¼¥Ð¤ÎµÕ°ú¤­Í×µá¤ÏÀµ³Î¤Ëɽ¼¨¤Ç¤­¤Ê¤¤¡£(¶õ¤Î)¼ÁÌä¤Ï¤à¤·¤í²óÅú¤Î
Ãæ¤Ë´Þ¤Þ¤ì¤ëÍ×µá¤È¤·¤Æɽ¼¨¤µ¤ì¤ë¡£µÕ°ú¤­Í×µá¤Ë¤Ï¥Ð¥°¤¬¤Õ¤¯¤Þ¤ì¤Æ¤¤¤Æ¡¢
¤½¤ì¤ò½¤Àµ¤¹¤ë¤Î¤Ï tcpdump ¤Ç¤Ï¤Ê¤¯¤Æ¥Í¡¼¥à¥µ¡¼¥Ó¥¹¤ÎÊý¤Ç¤¢¤ë¤Ù¤­¤È¹Í
¤¨¤Æ¤¤¤ë¿Í¤â¤¤¤ë¡£
.LP
¥¢¥Ã¥×¥ë¤Î EtherTalk ¤Î DDP ¥Ñ¥±¥Ã¥È¤Ï KIP DDP ¥Ñ¥±¥Ã¥È¤Î¤è¤¦¤ËÍÆ°×¤Ë 
dump ¤Ç¤­¤ë¤Ï¤º¤À¤¬¡¢¹Ô¤Ê¤ï¤Ê¤¤¡£¤¿¤È¤¨ ethertalk ¤ò°·¤ª¤¦¤È¤¤¤¦µ¤¤Ë¤Ê¤Ã
¤Æ¤â(¤Ê¤Ã¤Æ¤Ê¤¤¤¬)¡¢LBL¤¬ ¥Í¥Ã¥È¥ï¡¼¥¯¾å¤Îethertalk ¤Ø¤Î¥¢¥¯¥»¥¹¤òµö¤µ
¤Ê¤¤¤Î¤Ç¡¢¥³¡¼¥É¤Î¥Æ¥¹¥È¤¬¤Ç¤­¤Ê¤¤¤Î¤À¡£
.LP
²Æ»þ´Ö¤ËÀÚ¤êÂؤï¤ë¤È¤­¤Ë¥Ñ¥±¥Ã¥È¥È¥ì¡¼¥¹¤ò¹Ô¤Ê¤Ã¤Æ¤¤¤ë¤È»þ´Ö¤¬¤º¤ì¤Æ¤·
¤Þ¤¦(»þ´Ö¤ÎÊѹ¹¤Ï̵»ë¤µ¤ì¤ë)¡£
.LP
FDDI ¥Ø¥Ã¥À¤ËÂФ¹¤ë¥Õ¥£¥ë¥¿¤Î¾ò·ï¼°¤Ï¤¹¤Ù¤Æ¤Î FDDI ¥Ñ¥±¥Ã¥È¤¬¥¤¡¼¥µ¥Í¥Ã¥È
¤Î¥Ñ¥±¥Ã¥È¤ò¥«¥×¥»¥ë²½¤·¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤·¤ÆŬÍѤµ¤ì¤ë¡£
¤³¤ì¤Ï¡¢IP,ARP ¤È DECNET PhaseIV ¤Ë¤Ä¤¤¤Æ¤ÏÀµ¤·¤¯Æ°ºî¤¹¤ë¤¬¡¢
ISO CLNS ¤Î¤è¤¦¤Ê¥×¥í¥È¥³¥ë¤Ç¤Ï¤¦¤Þ¤¯¤¤¤«¤Ê¤¤¤À¤í¤¦¡£
¤½¤ì¤æ¤¨¤Ë¥Õ¥£¥ë¥¿¡¼¤Ï¾ò·ï¼°¤Ë°ìÃפ·¤Ê¤¤¤è¤¦¤Ê¥Ñ¥±¥Ã¥È¤ò¤¢¤ä¤Þ¤Ã¤Æ
¤¢¤Ä¤«¤Ã¤Æ¤·¤Þ¤¦¤«¤â¤·¤ì¤Ê¤¤¡£
.LP
.\"O .BR "ip6 proto"
.\"O should chase header chain, but at this moment it does not.
.\"O .BR tcp
.\"O or
.\"O .BR udp
.\"O should chase header chain too.
.B "ip6 proto"
¤Ï¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤òÄÉÀפ¹¤ë¤Ù¤­¤À¤¬¡¢º£¤Î¤È¤³¤í¤½¤¦¤Ï¤Ê¤Ã¤Æ¤¤¤Ê¤¤¡£
.B tcp
¤ä
.B udp
¤â¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤òÄÉÀפ¹¤ë¤Ù¤­¤Ç¤¢¤ë¡£
.LP
.\"O Arithmetic expression against transport layer headers, like \fBtcp[0]\fP,
.\"O does not work against IPv6 packets.
.\"O It only looks at IPv4 packets.
\fBtcp[0]\fP¤Î¤è¤¦¤Ê¥È¥é¥ó¥¹¥Ý¡¼¥ÈÁإإåÀ¤ËÂФ¹¤ë»»½Ñɽ¸½¤Ï¡¢
IPv6 ¥Ñ¥±¥Ã¥È¤ËÂФ·¤Æ¤Ï¤¦¤Þ¤¯Æ¯¤«¤Ê¤¤¡£
IPv4 ¥Ñ¥±¥Ã¥È¤ËÂФ·¤Æ¤Î¤ßƯ¤¯¡£