Import translated manuals from JM CVS Repository.

[linuxjm/jm.git] / manual / tcpdump / release / man1 / tcpdump.1

.\" @(#) $Header: /tcpdump/master/tcpdump/tcpdump.1,v 1.72.2.3 2000/07/13 05:53:47 guy Exp $ (LBL)
.\"
.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
.\"     The Regents of the University of California.  All rights reserved.
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that: (1) source code distributions
.\" retain the above copyright notice and this paragraph in its entirety, (2)
.\" distributions including binary code include the above copyright notice and
.\" this paragraph in its entirety in the documentation or other materials
.\" provided with the distribution, and (3) all advertising materials mentioning
.\" features or use of this software display the following acknowledgement:
.\" ``This product includes software developed by the University of California,
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
.\" the University nor the names of its contributors may be used to endorse
.\" or promote products derived from this software without specific prior
.\" written permission.
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.\" Japanese Version Copyright (c) 1998
.\"           MAEHARA Kohichi
.\"                  &
.\"           HANATAKA Shinya
.\"         all rights reserved.
.\" Translated Tue Jan 6 00:00:00 JST 1998
.\"     by  MAEHARA Kouhichi <maeharak@kw.netlaputa.ne.jp>
.\"     by  HANATAKA Shinya <hanataka@abyss.rim.or.jp>
.\"
.\" Updated Fri Sep 11 00:55:00 JST 2000
.\"     by  Kentaro Shirakata <argrath@ub32.org>
.\"
.TH TCPDUMP 1  "30 June 1997"
.SH ̾Á°
tcpdump \- ¥Í¥Ã¥È¥ï¡¼¥¯¤Î¥È¥é¥Õ¥£¥Ã¥¯¤ò¥À¥ó¥×¤¹¤ë
.SH ½ñ¼°
.na
.B tcpdump
[
.B \-adeflnNOpqRStvxX
] [
.B \-c
.I count
] [
.B \-F
.I file
]
.br
.ti +8
[
.B \-i
.I interface
]
[
.B \-m
.I module
]
[
.B \-r
.I file
]
.br
.ti +8
[
.B \-s
.I snaplen
]
[
.B \-T
.I type
]
[
.B \-w
.I file
]
.br
.ti +8
[
.I expression
]
.br
.ad
.SH ÀâÌÀ
.LP
\fItcpdump\fP ¤Ï¿¿µ¶ÃͤΠ\fI¾ò·ï¼°\fP ¤Ë°ìÃפ¹¤ë¥Í¥Ã¥È¥ï¡¼¥¯¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹¾å¤Î¥Ñ¥±¥Ã¥È¤Î¥Ø¥Ã¥À¤òɽ¼¨¤¹¤ë¡£
.LP
.B nit ¤« bpf ¤òÍѤ¤¤ë SunOS¤Î¾ì¹ç:
.I tcpdump 
¤òÆ°ºî¤µ¤»¤ë¤¿¤á¤Ë¤Ï 
.I /dev/nit 
¤« 
.I /dev/bpf* 
¤ËÆɤ߹þ¤ß¸¢¸Â¤ò»ý¤Ã¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B dlpi ¤òÍøÍѤ¹¤ë Solaris ¤Î¾ì¹ç:
²¾Áۥͥåȥ¥¯¥Ç¥Ð¥¤¥¹¡¢¤¿¤È¤¨¤Ð 
.IR /dev/le
¤È¤¤¤Ã¤¿¤â¤Î¤ËÆɤ߹þ¤ß¸¢¸Â¤ò»ý¤Ã¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B dlpi ¤òÍøÍѤ¹¤ë HP-UX ¤Î¾ì¹ç:
¼Â¹Ô¼Ô¤¬ root ¤Ç¤¢¤ë¤«¡¢¤Þ¤¿¤Ï root ¤Ë setuid ¤·¤Æ¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ì¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B snoop ¤òÍѤ¤¤ë IRIX ¤Î¾ì¹ç:
¼Â¹Ô¼Ô¤¬ root ¤Ç¤¢¤ë¤«¡¢¤Þ¤¿¤Ï root ¤Ë setuid ¤·¤Æ¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ì¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B Linux ¤Î¾ì¹ç:
¼Â¹Ô¼Ô¤¬ root ¤Ç¤¢¤ë¤«¡¢¤Þ¤¿¤Ï root ¤Ë setuid ¤·¤Æ¥¤¥ó¥¹¥È¡¼¥ë¤µ¤ì¤Æ¤¤¤ëɬÍפ¬¤¢¤ë¡£
.B Ultrix ¤ª¤è¤Ó Digital UNIX ¤Î¾ì¹ç:
¤Þ¤º¡¢¥¹¡¼¥Ñ¡¼¥æ¡¼¥¶¤¬ 
.IR pfconfig(8) 
¤òÍѤ¤¤Æ̵º¹ÊÌÆ©²á¥â¡¼¥É(promicuous-mode)¤òÍ­¸ú¤Ë¤¹¤ëɬÍפ¬¤¢¤ë¡£
¤½¤Î¸å¤Ï°ìÈ̥桼¥¶¤¬ 
.BR tcpdump 
¤ò¼Â¹Ô²Äǽ¤Ç¤¢¤ë¡£
.B BSD ¤Î¾ì¹ç: 
.IR /dev/bpf* 
¤ËÂФ¹¤ëÆɤ߹þ¤ß¸¢¸Â¤¬É¬Íס£
.SH ¥ª¥×¥·¥ç¥ó
.TP
.B \-a
¥Í¥Ã¥È¥ï¡¼¥¯¤È¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¥¢¥É¥ì¥¹¤ò DNS ̾¤ËÊÑ´¹¤¹¤ë¡£
.TP
.B \-c
\fIcount\fP ¸Ä¤Î¥Ñ¥±¥Ã¥È¤ò¼õ¿®¤·¤¿¤Î¤Á¤Ë½ªÎ»¤¹¤ë¡£
.TP
.B \-d
¥³¥ó¥Ñ¥¤¥ë¤µ¤ì¤¿¥Ñ¥±¥Ã¥È¥Þ¥Ã¥Á¥ó¥°¥³¡¼¥É¤ò¿Í´Ö¤¬Æɤá¤ë·Á¼°¤Çɸ½à½ÐÎϤ˥À¥ó¥×¤·¡¢½ªÎ»¤¹¤ë¡£
.TP
.B \-dd
¥Ñ¥±¥Ã¥È¥Þ¥Ã¥Á¥ó¥°¥³¡¼¥É¤ò 
.B C
¸À¸ì¤Î°ìÉô¤È¤·¤ÆÍøÍѲÄǽ¤Ê¤«¤¿¤Á¤Ç¥À¥ó¥×¤¹¤ë¡£
.TP
.B \-ddd
¥Ñ¥±¥Ã¥È¥Þ¥Ã¥Á¥ó¥°¥³¡¼¥É¤ò ½½¿Ê¿ô¤Ç¥À¥ó¥×¤¹¤ë(count ¤¬Àè¹Ô¤¹¤ë)¡£
.TP
.B \-e
³Æ¥À¥ó¥×¹Ô¤Ë¥ê¥ó¥¯¥ì¥Ù¥ë¥Ø¥Ã¥À¤òɽ¼¨¤¹¤ë¡£
.TP
.B \-f
¡Ö³°Éô¤Î¡×¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤ò¥·¥ó¥Ü¥ë¤Ç¤Ï¤Ê¤¯¤Æ¿ôÃͤÇɽ¼¨¤¹¤ë
(¤³¤Î¥ª¥×¥·¥ç¥ó¤ÏÇϼ¯¤Ê Sun ¤Î yp ¥µ¡¼¥Ó¥¹¤ò±ª²ó¤¹¤ë¤³¤È¤ò°Õ¿Þ¤·¤Æ¤¤¤ë 
\(em Sun ¤Î yp ¥µ¡¼¥Ó¥¹¤Ï¥í¡¼¥«¥ë¤Ç¤Ï¤Ê¤¤¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤òÊÑ´¹¤·¤è¤¦¤È¤¹¤ë¤È
±Êµ×¤ËÆ°ºî¤¬Ää»ß¤·¤Æ¤·¤Þ¤¦¥Ð¥°¤¬¤¢¤ë)¡£
.TP
.B \-F
¥Õ¥£¥ë¥¿¡¼¾ò·ï¼°¤Î»Ø¼¨ÆþÎϤȤ·¤Æ \fIfile\fP ¤òÍѤ¤¤ë¡£
¤³¤Î¸å¤í¤Ë¥³¥Þ¥ó¥É¥é¥¤¥ó¤Ç¾ò·ï¼°¤Ë¤è¤ë»Ø¼¨¤¬Í¿¤¨¤é¤ì¤Æ¤â̵»ë¤¹¤ë¡£
.TP
.B \-i
\fIinterface\fP ¤ò´Æ»ë¤¹¤ë¡£
»Ø¼¨¤Î¤Ê¤¤¾ì¹ç¤Ï tcpdump ¤Ï¥·¥¹¥Æ¥à¤Î¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹¤Î¥ê¥¹¥È¤«¤é
ºÇ¤â¾®¤µ¤¤ÈÖ¹æ¤ÇÍ­¸ú¤Ë¤Ê¤Ã¤Æ¤¤¤ë¤â¤Î(⤷¥ë¡¼¥×¥Ð¥Ã¥¯¤Ï½ü¤¯)¤òõ¤·½Ð¤¹¡£
»Ø¼¨¤µ¤ì¤¿¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹¤¬Â¸ºß¤·¤Ê¤¤¾ì¹ç¤Ï¤â¤Ã¤È¤â¶á¤¤¤â¤Î¤¬ÁªÂò¤µ¤ì¤ë¡£
.TP
.B \-l
ɸ½à½ÐÎϤò¥Ð¥Ã¥Õ¥¡¥ê¥ó¥°¤¹¤ë¡£¥Ç¡¼¥¿¤òÃßÀѤ·¤Ê¤¬¤é´Æ»ë¤¹¤ë¾ì¹ç¤ËÍ­¸ú¤Ç
¤¢¤ë¡£»ÈÍÑÎã:
.br
``tcpdump\ \ \-l\ \ |\ \ tee dat'' or
``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''.
.TP
.B \-n
¥¢¥É¥ì¥¹(¥Û¥¹¥È¥¢¥É¥ì¥¹¡¢¥Ý¡¼¥ÈÈÖ¹æ¤Ê¤É)¤ò̾Á°¤ËÊÑ´¹¤·¤Ê¤¤¡£
.TP
.B \-N
¥Û¥¹¥È¤Î¥É¥á¥¤¥ó̾¤òɽ¼¨¤·¤Ê¤¤¡£
¤Ä¤Þ¤ê¤³¤ì¤ò»ÈÍѤ·¤¿¾ì¹ç \fItcpdump\fP ¤Ï``nic.ddn.mil'' ¤Èɽ¼¨¤¹¤ë¤«¤ï¤ê¤Ë ``nic'' ¤Èɽ¼¨¤¹¤ë¡£
.TP
.B \-m
SMI MIB ¥â¥¸¥å¡¼¥ë¤ò¥Õ¥¡¥¤¥ë \fImodule\fR ¤«¤éÆɤ߹þ¤à¡£
Ê£¿ô¤Î MIB ¥â¥¸¥å¡¼¥ë¤òÆɤ߹þ¤àÌÜŪ¤Ç¡¢
¤³¤Î¥ª¥×¥·¥ç¥ó¤òÊ£¿ô²ó»ÈÍѤ¹¤ë¤³¤È¤â½ÐÍè¤ë¡£
.TP
.B \-O
¥Ñ¥±¥Ã¥È¥Þ¥Ã¥Á¥ó¥°¥³¡¼¥É¥ª¥×¥Æ¥£¥Þ¥¤¥¶¤òÄä»ß¤¹¤ë¡£
¤³¤ì¤Ï¥ª¥×¥Æ¥£¥Þ¥¤¥¶¤Î¥Ð¥°¤òµ¿¤Ã¤Æ¤¤¤ë¾ì¹ç¤Ë¤Î¤ßÍ­±×¤Ç¤¢¤ë¡£
.TP
.B \-p
̵º¹ÊÌÆ©²á¥â¡¼¥É¤ò \fIÍøÍѤ·¤Ê¤¤\fP¡£¤·¤«¤·¤Ê¤¬¤é¡¢Â¾¤ÎÍýͳ¤Ç¥¤¥ó¥¿¡¼
¥Õ¥§¥¤¥¹¤¬Ìµº¹ÊÌÆ©²á¥â¡¼¥É¤Ë¤Ê¤Ã¤Æ¤·¤Þ¤¦¤³¤È¤â¤¢¤ë¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
¤³¤Î¤¿¤á `-p' ¥ª¥×¥·¥ç¥ó¤Ï `ether host {loca-lw-addr} or ether broadcast' 
¤Î¾Êά·Á¤È¤·¤Æ¤Ï»ÈÍѤǤ­¤Ê¤¤¡£
.TP
.B \-q
¤¹¤Ð¤ä¤¤(¤È¤¤¤¦¤«ÀŤ«¤Ê)½ÐÎÏ¡£¸ÂÄꤵ¤ì¤¿¥×¥í¥È¥³¥ë¤Î¾ðÊó¤·¤«½ÐÎϤ·¤Ê¤¤¤Î¤Ç¡¢½ÐÎϹԤÏû¤¤¤â¤Î¤È¤Ê¤ë¡£
.TP
.B \-r
¥Ñ¥±¥Ã¥È¤ò(-w ¥ª¥×¥·¥ç¥ó¤ÇºîÀ®¤·¤¿)\fIfile\fR¤«¤éÆɤ߹þ¤à¡£
\fIfile\fR¤È¤·¤Æ ``-'' ¤ò»ØÄꤷ¤¿¾ì¹ç¤Ë¤Ïɸ½àÆþÎϤ¬ÍøÍѤµ¤ì¤ë¡£
.TP
.B \-s
¥Ç¥Õ¥©¥ë¥È¤Î 68 ¥Ð¥¤¥È(SunOS ¤Î NIT ¤Ç¤ÏºÇ¾®¤Ï¼ÂºÝ¤Ë¤Ï 96 ¥Ð¥¤¥È)¤ËÂå¤ï¤Ã¤Æ \fIsnaplen\fP ¥Ð¥¤¥È¤ò¤ª¤Î¤ª¤Î¤Î¥Ñ¥±¥Ã¥È¤«¤é¼è¤ê½Ð¤·ÍøÍѤ¹¤ë¡£
IP, ICMP, TCP, UDP ¤Ë¤Ä¤¤¤Æ¤Ï 68 ¥Ð¥¤¥È¤¢¤ì¤Ð½½Ê¬¤À¤¬¡¢¥Í¡¼¥à¥µ¡¼¥Ð¤ä NFS ¤Î¾ðÊó¤Ë¤Ï­¤ê¤Ê¤¤¤«¤â¤·¤ì¤Ê¤¤(¸å½Ò)¡£

snapshot À©¸Â¤Î¤¿¤á¤Ë¸å¤í¤¬ÀÚ¤ê¼Î¤Æ¤é¤ì¤¿¥Ñ¥±¥Ã¥È¤Ï½ÐÎÏ»þ¤Ë``[|\fIproto\fP]'' ¤Î·Á¼°¤Ç¼¨¤µ¤ì¤ë¡£
¤³¤³¤Ç \fIproto\fP ¤ÏÀÚ¤ê¼Î¤Æ¤ÎÀ¸¤¸¤¿¥ì¥Ù¥ë¤ËÂбþ¤¹¤ë¥×¥í¥È¥³¥ë¤Î̾Á°¤Ç¤¢¤ë¡£
Â礭¤Ê snapshot ¤ò¼è¤í¤¦¤È¤¹¤ë¤È¥Ñ¥±¥Ã¥È¤ò½èÍý¤¹¤ë»þ´Ö¤ÏÁý²Ã¤·¡¢¤Þ¤¿¤³¤Á¤é¤Î¤Û¤¦¤¬½ÅÍפÀ¤¬¡¢¥Ð¥Ã¥Õ¥¡¤Ëί¤á¤ë¤³¤È¤¬¤Ç¤­¤ëÎ̤¬¸º¾¯¤·¤Æ¤·¤Þ¤¦ÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£
¤¹¤Ê¤ï¤Á¥Ñ¥±¥Ã¥È¤¬¼º¤Ê¤ï¤ì¤ë²ÄǽÀ­¤â¤¢¤ë¡£¥×¥í¥È¥³¥ë¤Î¾ðÊó¤¬ÆÀ¤é¤ì¤ëɬÍ׺Ǿ®¸Â¤Î \fIsnaplen\fP ¤È¤¹¤ë¤³¤È¡£
.TP
.B \-T
"\fIexpression\fP"(¾ò·ï¼°) ¤ÇÁªÂò¤µ¤ì¤¿¥Ñ¥±¥Ã¥È¤Ë»Ø¼¨¤µ¤ì¤¿ \fItype\fR ¤Ç¤ÎËÝÌõ¤ò»Ø¼¨¤¹¤ë¡£¸½ºßÍ­¸ú¤Ê type ¤Ï 
\fBrpc\fR (Remote Procedure Call)¡¢
\fBrtp\fR (Real-Time Applications protocol)¡¢
\fBrtcp\fR (Real-Time Applications control protocol)¡¢
\fBsnmp\fR (Simple Network Management Protocol),
\fBvat\fR (Visual Audio Tool)¡¢
\fBwb\fR (distributed White Board)¡£
.TP
.B \-R
ESP/AH ¥Ñ¥±¥Ã¥È¤¬¸Å¤¤ÄêµÁ(RFC1825 ¡Á RFC1829)¤Ë½¾¤Ã¤Æ¤¤¤ë¤È²¾Äꤹ¤ë¡£
¤³¤Î¥ª¥×¥·¥ç¥ó¤¬»ØÄꤵ¤ì¤ë¤È¡¢\fItcpdump\fP ¤Ï relplay prevention ¥Õ¥£¡¼¥ë¥É¤òɽ¼¨¤·¤Ê¤¤¡£
ESP/AH ¤ÎÄêµÁ¤Ë¤Ï¥×¥í¥È¥³¥ë¥Ð¡¼¥¸¥ç¥ó¥Õ¥£¡¼¥ë¥É¤¬¤Ê¤¤¤Î¤Ç¡¢
\fItcpdump\fP ¤Ï ESP/AH ¥×¥í¥È¥³¥ë¤Î¥Ð¡¼¥¸¥ç¥ó¤ò¿äÏÀ¤¹¤ë¤³¤È¤¬½ÐÍè¤Ê¤¤¡£
.TP
.B \-S
TCP ¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤òÁêÂÐÃͤǤϤʤ¯¤ÆÀäÂÐÃͤÇɽ¼¨¤¹¤ë¡£
.TP
.B \-t
¥À¥ó¥×¹Ô¤Ë»þ´Ö¾ðÊó¤òɽ¼¨\fI¤·¤Ê¤¤\fP¡£
.TP
.B \-tt
¥À¥ó¥×¹Ô¤Ëɽ¼¨¤¹¤ë»þ´Ö¾ðÊó¤òÀ°·Á¤·¤Ê¤¤¡£
.TP
.B \-v
(¤Á¤ç¤Ã¤È¤À¤±)¾ÜºÙ¤Ê½ÐÎÏ¡£IP ¥Ñ¥±¥Ã¥È¤Ë¤ª¤±¤ë À¸Â¸»þ´Ö(TTL) ¤ä¥µ¡¼¥Ó¥¹¤Î¼ïÎà¤Î¾ðÊó¤Ê¤É¤òɽ¼¨¤¹¤ë¡£
.TP
.B \-vv
¤â¤Ã¤È¾ÜºÙ¤Ê½ÐÎÏ¡£NFS±þÅú¥Ñ¥±¥Ã¥È¤Ë¤ª¤±¤ëÉղåե£¡¼¥ë¥É¤Ê¤É¤òɽ¼¨¤¹¤ë¡£
.TP
.B \-vvv
¤µ¤é¤Ë¾ÜºÙ¤Ê½ÐÎÏ¡£
Î㤨¤Ð¡¢telnet \fBSB\fP ... \fBSE\fP ¥ª¥×¥·¥ç¥ó¤ÏÁ´¤Æɽ¼¨¤µ¤ì¤ë¡£
.B \-X
¥ª¥×¥·¥ç¥ó¤â»ØÄꤵ¤ì¤ë¤È¡¢telnet ¥ª¥×¥·¥ç¥ó¤Ï 16 ¿Êɽ¼¨¤Ç¤âɽ¼¨¤µ¤ì¤ë¡£
.TP
.B \-w
¥Ñ¥±¥Ã¥È¤ò²òÀÏ¡¢É½¼¨¤¹¤ë¤«¤ï¤ê¤ËÀ¸¤Î¤Þ¤Þ \fIfile\fR ¤Ë½ñ¤­½Ð¤¹¡£
¤³¤Î¥Õ¥¡¥¤¥ë¤Ï¤¢¤È¤Ç \-r ¥ª¥×¥·¥ç¥ó¤òÍѤ¤¤ì¤Ðɽ¼¨¤¹¤ë¤³¤È¤¬¤Ç¤­¤ë¡£
\fIfile\fR ¤È¤·¤Æ `-' ¤ò»Ø¼¨¤¹¤ë¤Èɸ½à½ÐÎϤòÍѤ¤¤ë¡£
.TP
.B \-x
(¥ê¥ó¥¯¥ì¥Ù¥ë¥Ø¥Ã¥À¤ò½ü¤¯)¤¹¤Ù¤Æ¤Î¥Ñ¥±¥Ã¥È¤ò 16 ¿Ê¤Çɽ¼¨¤¹¤ë¡£¥Ñ¥±¥Ã¥ÈÁ´ÂÎ¤È 
.I snaplen 
¥Ð¥¤¥È¤Î¾®¤µ¤¤Êý¤À¤±¤òɽ¼¨¤¹¤ë¡£
.TP
.B \-X
16 ¿Êɽ¼¨¤µ¤ì¤ë¤È¤­¤Ë¡¢ ASCII ʸ»ú¤âɽ¼¨¤¹¤ë¡£
½¾¤Ã¤Æ¡¢
.B \-x
¥ª¥×¥·¥ç¥ó¤â¥»¥Ã¥È¤µ¤ì¤ë¤È¡¢¥Ñ¥±¥Ã¥È¤Ï 16 ¿Ê¤È ASCII ʸ»ú¤ÎξÊý¤Çɽ¼¨¤µ¤ì¤ë¡£
¤³¤ì¤Ï¿·¤·¤¤¥×¥í¥È¥³¥ë¤ò²òÀϤ¹¤ë¤È¤­¤ËÈó¾ï¤ËÊØÍø¤Ç¤¢¤ë¡£
.B \-x
¥ª¥×¥·¥ç¥ó¤¬ÀßÄꤵ¤ì¤Æ¤¤¤Ê¤¯¤Æ¤â¡¢
¥Ñ¥±¥Ã¥È¤ÎÉôʬ¤Ë¤è¤Ã¤Æ¤Ï 16 ¿Ê¤È ASCII ʸ»ú¤ÎξÊý¤Çɽ¼¨¤µ¤ì¤ë¤³¤È¤â¤¢¤ë¡£
.IP "\fI expression(¾ò·ï¼°)\fP"
.RS
¥À¥ó¥×¤¹¤ë¥Ñ¥±¥Ã¥È¤Î¼ïÎà¤òÁªÂò¤¹¤ë¡£
\fIexpression\fP ¤¬Í¿¤¨¤é¤ì¤Ê¤¤¤È¤­¤Ï¡¢¥Í¥Ã¥È¥ï¡¼¥¯¾å¤Î¤¹¤Ù¤Æ¤Î¥Ñ¥±¥Ã¥È¤ò¥À¥ó¥×¤¹¤ë¡£
¤½¤¦¤Ç¤Ê¤±¤ì¤Ð¡¢\fIexpression\fP ¤¬`true'(¿¿) ¤È¤Ê¤ë¥Ñ¥±¥Ã¥È¤À¤±¤ò¥À¥ó¥×¤¹¤ë¡£
.LP
\fIexpression\fP¤Ï°ì¤Ä°Ê¾å¤Î
.IR primitive (Í×ÁÇ)
¤«¤éÀ®¤ë¡£Í×ÁǤϰì¤Ä°Ê¾å¤Î½¤¾þ»Ò¤òÀè¹Ô¤¹¤ë°ì¸Ä¤Î 
.I id
(̾Á°¤Ç¤âÈÖ¹æ¤Ç¤â¤è¤¤)¤Ç¤¢¤ë¡£½¤¾þ»Ò¤Ë¤Ï»°¤Ä¤Î¼ïÎब¤¢¤ë:
.IP \fItype\fP
½¤¾þ»Ò¤Ï id̾¤Þ¤¿¤Ï id Èֹ椬»Ø¤¹¤â¤Î¤Î¼ïÎà¤ò¼¨¤¹¡£ÍøÍѲÄǽ¤Ê¤â¤Î¤Ï 
.BR host ,
.BR net ,
.B port 
¤Ç¤¢¤ë¡£Îã: `host foo'¡¢`net 128.3'¡¢`port 20'¡£
type ½¤¾þ»Ò¤¬Ìµ¤¤¾ì¹ç¤Ï¡¢
.B host 
¤¬»Ø¼¨¤µ¤ì¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤¹¡£
.IP \fIdir\fP
½¤¾þ»Ò¤Ï 
.I id 
¤Ë¸þ¤±¤Æ¡¢¤Þ¤¿¤Ï 
.I id 
¤Ø¡¢¤Î¤É¤Á¤é¤«¤¢¤ë¤¤¤ÏξÊý¤ÎÄÌ¿®Êý¸þ¤òÆÃÄꤹ¤ë¡£Êý¸þ¤È¤·¤Æ»Ø¼¨¤Ç¤­¤ë¤Î¤Ï 
.BR src ,
.BR dst ,
.BR "src or dst" ,
.B "src and dst"
¤Ç¤¢¤ë¡£Îã¡¢ `src foo'¡¢`dst net 128.3'¡¢`src or dst port ftp-data'¡£
dir ½¤¾þ»Ò¤¬»ØÄꤵ¤ì¤Ê¤¤¾ì¹ç¤Ï 
.B "src or dst"
¤¬»Ø¼¨¤µ¤ì¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤¹¡£`null' ¥ê¥ó¥¯ÁØ(¤¹¤Ê¤ï¤Á slip ¤Î¤è¤¦
¤Ê¥Ý¥¤¥ó¥È¥Ä¡¼¥Ý¥¤¥ó¥È¥×¥í¥È¥³¥ë)¤Ë¤ª¤¤¤Æ¤Ï¡¢Êý¸þ¤ò»ØÄꤹ¤ë½¤¾þ»Ò¤È¤·¤Æ
.B inbound
¤È 
.B outbound 
¤âÍøÍѲÄǽ¤Ç¤¢¤ë¡£
.IP \fIproto\fP
½¤¾þ»Ò¤Ï°ìÃפ¹¤ëÆÃÄê¤Î¥×¥í¥È¥³¥ë¤ËÀ©¸Â¤¹¤ë¡£ÍøÍѲÄǽ¤Ê¥×¥í¥È¥³¥ë¤Ï°Ê²¼¤ÎÄ̤ê:
.BR ether ,
.BR fddi ,
.BR mopdl ,
.BR ip ,
.BR ip6 ,
.BR arp ,
.BR rarp ,
.BR decnet ,
.BR lat ,
.BR sca ,
.BR moprc ,
.BR mopdl ,
.BR icmp ,
.BR icmp6 ,
.BR tcp ,
.BR udp ¡£
Îã: `ether src foor'¡¢`arp net 128.3'¡¢`tcp port 21'¡£
proto ½¤¾þ»Ò¤¬»Ø¼¨¤µ¤ì¤Ê¤¤¾ì¹ç¤Ï type ¤ÈÌ·½â¤·¤Ê¤¤ÈϰϤÇÁ´¤Æ¤Î¥×¥í¥È¥³
¥ë¤¬»Ø¼¨¤µ¤ì¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤¹¡£
Îã: `src foo' ¤Ï `(ip or arp or rarp) src foo' 
(¤³¤Î¤è¤¦¤Ê½ñ¤­Êý¤Ïʸˡ¤¢¤ä¤Þ¤ê¤À¤¬)¤ò°ÕÌ£¤·¡¢
`net bar' ¤Ï `(ip or arp or rarp) net bar' ¤ò°ÕÌ£¤·¡¢
¤Þ¤¿ `port 53' ¤Ï `(tcp or udp) port 53' ¤ò°ÕÌ£¤¹¤ë¡£
.LP
[`fddi'¤Ï¼ÂºÝ¤Ë¤Ï `ether' ¤ÎÊÌ̾¤Ç¤¢¤ë;²òÀÏ»þ¤Ë``ÆÃÄê¤Î¥Í¥Ã¥È¥ï¡¼
¥¯¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹¤¬ÍøÍѤ¹¤ë¥Ç¡¼¥¿¥ê¥ó¥¯ÁØ''¤È¤·¤Æ°·¤ï¤ì¤ë¡£FDDI ¥Ø¥Ã
¥À¡¼¤Ï¥¤¡¼¥µ¥Í¥Ã¥ÈŪ¤Ê¥½¡¼¥¹¤ª¤è¤Ó¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤ò´Þ¤ß¡¢¤Þ
¤¿¥¤¡¼¥µ¥Í¥Ã¥ÈŪ¤Ê¥Ñ¥±¥Ã¥È¥¿¥¤¥×¤â´Þ¤à¤Î¤Ç¡¢¤³¤ì¤é¤Î FDDI ¥Õ¥£¡¼¥ë¥É¤ò 
¥¤¡¼¥µ¥Í¥Ã¥È¤ÎƱÎà¤È¤·¤ÆÁªÊ̤Ǥ­¤ë¡£FDDI ¥Ø¥Ã¥À¤Ë¤Ï¤½¤Î¾¤Î¥Õ¥£¡¼¥ë¥É
¤â´Þ¤Þ¤ì¤ë¤¬¡¢¤³¤ì¤Ë¤Ä¤¤¤Æ¤Ï¥Õ¥£¥ë¥¿¤Î¾ò·ï¼°¤ÇÌÀ¼¨Åª¤Ë»Ø¼¨¤¹¤ë¤³¤È¤Ï¤Ç
¤­¤Ê¤¤¡£]
.LP
¾åµ­¤Ë²Ã¤¨¤Æ¡¢ÆÃÊ̤Ê`Í×ÁÇ'¤ò¼¨¤¹¥­¡¼¥ï¡¼¥É¤¬¤¢¤ë¡£
.BR gateway ,
.BR broadcast ,
.BR less ,
.B greater
¤Èarithmtic expression(¿ôÃͤˤè¤ë¾ò·ï¼°)¤Ç¤¢¤ë¡£¤³¤ì¤é¤Ë¤Ä¤¤¤Æ¤Ï¤³¤Î¤¢¤È¤Çµ­½Ò¤¹¤ë¡£
.LP
¤â¤Ã¤ÈÊ£»¨¤Ê¥Õ¥£¥ë¥¿¾ò·ï¼°¤Ï 
.BR and ,
.BR or ,
.B not 
¤È³ÆÍ×ÁǤÎÁȹ礻¤Çɽ¸½¤Ç¤­¤ë¡£
Îã:`host foo and not port ftp and not port ftp-data'¡£
ÌÀ¼¨Åª¤Ê½¤¾þ»Ò¤Ï¾Êά¤·¤Æ¥¿¥¤¥×¿ô¤ò¸º¤é¤¹¤³¤È¤¬¤Ç¤­¤ë¡£
Îã:`tcp dst port ftp or ftp-data or domain' ¤Ï
`tcp dst prot ftp or tcp dst port ftp-data or tcp dst prot domain'¤ÈÁ´¤¯Æ±¤¸°ÕÌ£¤Ç¤¢¤ë¡£
.LP
µöÍƤµ¤ì¤ëÍ×ÁǤÎÁȤ߹ç¤ï¤»¤Ï°Ê²¼¤ÎÄ̤ꡣ
.IP "\fBdst host \fIhost\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥Õ¥£¡¼¥ë¥É¤¬ \fIhost\fP ¤Ç¤¢¤ë¤È¤­¿¿¡£¥¢¥É¥ì¥¹¤Ç¤â̾Á°¤Ç¤â¤è¤¤
.IP "\fBsrc host \fIhost\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥½¡¼¥¹¥Õ¥£¡¼¥ë¥É¤¬ \fIhost\fP ¤Ç¤¢¤ë¤È¤­¿¿¡£
.IP "\fBhost \fIhost\fP
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥½¡¼¥¹¤Þ¤¿¤Ï IP/v4/v6 ¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥Õ¥£¡¼¥ë¥É¤¬ \fIhost\fP ¤Ç¤¢¤ë¤È¤­¿¿¡£
¾åµ­¤Î³Æ host ¤ò¼¨¤¹¾ò·ï¼°¤Ë¤Ï \fBip\fP¡¢\fBarp\fP¡¢\fBrarp\fP¡¢\fBip6\fP ¤Î¤¤¤º¤ì¤«¤òÉղ䷤Ƥâ¤è¤¤¡£
.in +.5i
.nf
\fBip host \fIhost\fR
.fi
.in -.5i
¤Ï²¼µ­¤ÈƱ¤¸¡£
.in +.5i
.nf
\fBether proto \fI\\ip\fB and host \fIhost\fR
.fi
.in -.5i
¤â¤· \fIhost\fP ¤Î̾Á°¤¬Ê£¿ô¤Î IP ¥¢¥É¥ì¥¹¤ò»ý¤Ä»þ¤Ï¤½¤ì¤¾¤ì¤Î¥¢¥É¥ì¥¹¤Ë°ìÃפ¹¤ë¡£
.IP "\fBether dst \fIehost\fP
¥¤¡¼¥µ¥Í¥Ã¥È¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ \fIehost\fP ¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
\fIehost\fP ¤Ï /etc/ethers ¤«¿ôÃͤǤ¢¤ë(¿ôÃͤΥե©¡¼¥Þ¥Ã¥È¤Ë¤Ä¤¤¤Æ¤Ï 
.IR ethers (3N)
¤ò»²¾È¤Î¤³¤È)¡£
.IP "\fBether src \fIehost\fP
¥¤¡¼¥µ¥Í¥Ã¥È¥½¡¼¥¹¥¢¥É¥ì¥¹¤¬ \fIehost\fP ¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBether host \fIehost\fP
¥¤¡¼¥µ¥Í¥Ã¥È¥½¡¼¥¹¥¢¥É¥ì¥¹¤«¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ \fIehost\fP ¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBgateway\fP \fIhost\fP
¥Ñ¥±¥Ã¥È¤¬ \fIhost\fP ¤ò¥²¡¼¥È¥¦¥§¥¤¤È¤·¤Æ¤¤¤ë¤È¤­¤Ë¿¿¡£
¤¹¤Ê¤ï¤Á¡¢¥¤¡¼¥µ¥Í¥Ã¥È¥½¡¼¥¹/¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤Ï \fIhost\fP ¤Ç¤¢¤ë¤¬¡¢
IP ¥½¡¼¥¹/¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤Ï \fIhost\fP ¤Ç¤Ï¤Ê¤¤¤È¤­¤Î¤³¤È¡£
\fPhost\fP ¤Ï̾Á°¤Ç¤¢¤ê¡¢¤Þ¤¿ /etc/hosts ¤È /etc/ethers ¤ÎξÊý¤Ëµ­ºÜ¤µ¤ì¤Æ¤¤¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤
(¤³¤Î¾ò·ï¼°¤Ï \fIhost / ehost\fP ¤½¤ì¤¾¤ì¤ò̾Á°¤«ÈÖ¹æ¤Çµ­½Ò¤¹¤ë
.in +.5i
.nf
\fBether host \fIehost \fBand not host \fIhost\fR
.fi
.in -.5i
¤ÈƱÅù¤Ç¤¢¤ë)¡£
¤³¤Îʸˡ¤Ïº£¤Î¤È¤³¤í IPv6 ¤òÍ­¸ú¤Ë¤·¤¿ÀßÄê¤Ç¤ÏÀµ¤·¤¯Æ°ºî¤·¤Ê¤¤¡£
.IP "\fBdst net \fInet\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ \fInet\fP ¥Í¥Ã¥È¥ï¡¼¥¯¤ò
´Þ¤ó¤Ç¤¤¤ë¤È¤­¤Ë¿¿¡£\fInet\fP ¤Ï/etc/networks ¤Ëµ­ºÜ¤µ¤ì¤ë̾Á°¤«¥Í¥Ã¥È
¥ï¡¼¥¯ÈÖ¹æ¤Ç¤¢¤ë( \fInetworks(4)\fP ¤ò»²¾È)¡£
.IP "\fBsrc net \fInet\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥½¡¼¥¹¥¢¥É¥ì¥¹¤¬ \fInet\fP ¥Í¥Ã¥È¥ï¡¼¥¯¤Î¤â¤Î¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBnet \fInet\fR"
¥Ñ¥±¥Ã¥È¤Î IPv4/v6 ¥½¡¼¥¹/¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ \fInet\fP ¥Í¥Ã¥È¥ï¡¼¥¯¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBnet \fInet\fR \fBmask \fImask\fR"
IP ¥¢¥É¥ì¥¹¤¬ netmask ¤Ç¥Þ¥¹¥¯¤·¤Æ \fInet\fR ¤Ë°ìÃפ¹¤ë¤È¤­¤Ë¿¿¡£\fBsrc\fR ¤« \fBdst\fR ¤Ç½¤¾þ¤·¤Æ¤â¤è¤¤¡£
¤³¤Îʸˡ¤Ï \fInet\fR ¤¬ IPv6 ¤Î¤È¤­¤Ë¤ÏÉÔÀµ¤Ç¤¢¤ë¤³¤È¤ËÃí°Õ¡£
.IP "\fBnet \fInet\fR/\fIlen\fR"
IPv4/v6 ¥¢¥É¥ì¥¹¤¬ \fIlen\fR ¥Ó¥Ã¥È¤Înetmask ¤Ç¥Þ¥¹¥¯¤·¤Æ \fInet\fR ¤Ë°ìÃפ¹¤ë¤È¤­¤Ë¿¿¡£\fBsrc\fR ¤« \fBdst\fR ¤Ç½¤¾þ¤·¤Æ¤â¤è¤¤¡£
.IP "\fBdst port \fIport\fR"
¥Ñ¥±¥Ã¥È¤¬ ip/tcp ¤« ip/udp ¤« ipv6/tcp ¤« ipv6/udp ¤Ç¤¢¤ë¾ì¹ç¤Ç¡¢
¹Ô¤­Àè¤Î port Èֹ椬 \fIport\fP ¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
\fIPort\fP ¤ÏÈÖ¹æ¤Î¿ôÃͤ« /etc/services ¤Ë¤è¤ë̾Á°¤òÍøÍѤǤ­¤ë(
.IR tcp (4P)
¤È 
.IR udp (4P)
¤ò»²¾È¤Î¤³¤È)¡£Ì¾Á°¤¬ÍøÍѤµ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ï port ÈÖ¹æ¤È protocol ¤ÎξÊý¤Ç¾È¹ç¤µ¤ì¤ë¡£
Èֹ椫¿½Å¤ËÄêµÁ¤µ¤ì¤Æ¤¤¤ë̾Á°¤¬ÍøÍѤµ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ï port ÈÖ¹æ¤À¤±¤¬¾È¹ç¤µ¤ì¤ë
(Îã: \fBdst port  513\fR ¤Ï tcp/login ¤È udp/who ¤ÎξÊý¤ÎÄÌ¿®¤òɽ¼¨¤¹¤ë¤·¡¢
\fBport domain\fR ¤Ï tcp/domain ¤È udp/domain ¤ÎξÊý¤òɽ¼¨¤¹¤ë)¡£
.IP "\fBsrc port \fIport\fR"
¥Ñ¥±¥Ã¥È¤¬ \fIport\fP ÈÖ¹æ¤Î¥Ý¡¼¥È¤ò¥½¡¼¥¹¤Ë¤·¤Æ¤¤¤ë¤È¤­¿¿¡£
.IP "\fBport \fIport\fR"
¥Ñ¥±¥Ã¥È¤Î¥½¡¼¥¹¤«¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥Ý¡¼¥È¤¬ \fIport\fP ¤Ç¤¢¤ë¤È¤­¿¿¡£
¤³¤Î port ¤ò»ØÄꤹ¤ë¾ò·ï¼°¤Ï \fBtcp\fP ¤È \fBudp\fP ¤Î¥­¡¼¥ï¡¼¥É¤òÉղ䷤Ƥâ¤è¤¤:
.in +.5i
.nf
\fBtcp src port \fIport\fR
.fi
.in -.5i
¤Ï \fIport\fP ¤ò¥½¡¼¥¹¤È¤¹¤ë tcp ¤Î¥Ñ¥±¥Ã¥È¤Î¤ß¤Ë°ìÃפ¹¤ë¡£
.IP "\fBless \fIlength\fR"
¥Ñ¥±¥Ã¥È¤¬ \fIlength\fP °Ê²¼¤Î¤È¤­¤Ë¿¿¡£
¤³¤ì¤Ï²¼µ­¤ÈƱ¤¸:
.in +.5i
.nf
\fBlen <= \fIlength\fP.
.fi
.in -.5i
.IP "\fBgreater \fIlength\fR"
¥Ñ¥±¥Ã¥È¤¬ \fIlength\fP °Ê¾å¤Î¤È¤­¤Ë¿¿¡£
¤³¤ì¤Ï²¼µ­¤ÈƱ¤¸:
.in +.5i
.nf
\fBlen >= \fIlength\fP.
.fi
.in -.5i
.IP "\fBip proto \fIprotocol\fR"
¥Ñ¥±¥Ã¥È¤¬ \fIprotocol\fP ·¿¤Î¥×¥í¥È¥³¥ë¤Î IP ¥Ñ¥±¥Ã¥È( 
.IR ip (4P)
¤ò»²¾È)¤Î¤â¤Î¤Ç¤¢¤ë¤È¤­¿¿¡£
\fIprotocol\fP ¤È¤·¤ÆÍøÍѤǤ­¤ë¤Î¤Ï¿ôÃÍ¤È \fIicmp\fP¡¢
\fIigrp\fP¡¢\fIudp\fP¡¢\fInd\fP¡¢\fItcp\fP ¤Ç¤¢¤ë¡£\fItcp\fP¡¢\fIudp\fP¡¢
\fIicmp\fP ¤Ï¥­¡¼¥ï¡¼¥É¤Ç¤â¤¢¤ë¤Î¤Ç¡¢¥Ð¥Ã¥¯¥¹¥é¥Ã¥·¥å(\\)¤Ç¥­¡¼¥ï¡¼¥É
¤È¤·¤Æ²ò¼á¤µ¤ì¤ë¤Î¤ò²óÈò¤¹¤ëɬÍפ¬¤¢¤ë¡£C-Shell ¤Ç¤Ï \\\\ ¤ò»È¤¦¡£
¤³¤ÎÍ×ÁǤϥץí¥È¥³¥ë¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤òÄÉÀפ·¤Ê¤¤¤³¤È¤ËÃí°Õ¡£
.IP "\fBip6 proto \fIprotocol\fR"
¥Ñ¥±¥Ã¥È¤¬\fIprotocol\fP·¿¤Î IPv6 ¥Ñ¥±¥Ã¥È¤Ç¤¢¤ë¤È¤­¤Ë¿¿¡£
¤³¤ÎÍ×ÁǤϥץí¥È¥³¥ë¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤òÄÉÀפ·¤Ê¤¤¤³¤È¤ËÃí°Õ¡£
.IP "\fBip6 protochain \fIprotocol\fR"
¥Ñ¥±¥Ã¥È¤¬ IPv6 ¥Ñ¥±¥Ã¥È¤Ç¤¢¤ê¡¢
¤½¤Î¥×¥í¥È¥³¥ë¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤ÎÃæ¤Ë\fIprotocol\fR·¿¤Î¥×¥í¥È¥³¥ë¥Ø¥Ã¥À¤¬¤¢¤ë¾ì¹ç¤Ë¿¿¡£
Î㤨¤Ð¡¢
.in +.5i
.nf
.\fBip6 protochain 6\fR
.fi
.in -.5i
¤Ï ¥×¥í¥È¥³¥ë¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤Ë TCP ¥×¥í¥È¥³¥ë¤ò»ý¤Ä IPv6 ¥Ñ¥±¥Ã¥È¤Ë°ìÃפ¹¤ë¡£
¥Ñ¥±¥Ã¥È¤Ë¤Ï¡¢Î㤨¤Ðǧ¾Ú¥Ø¥Ã¥À¡¢¥ë¡¼¥Æ¥£¥ó¥°¥Ø¥Ã¥À¡¢
hop-by-hop¥Ø¥Ã¥À¤Ê¤É¤¬IPv6 ¥Ø¥Ã¥À¤È TCP ¥Ø¥Ã¥À¤Î´Ö¤Ë´Þ¤Þ¤ì¤ë¤«¤â¤·¤ì¤Ê¤¤¡£
¤³¤ÎÍ×ÁǤ¬ºî¤ê½Ð¤¹ BPF ¥³¡¼¥É¤ÏÊ£»¨¤Ç¡¢
\fItcpdump\fP¤Î BPF ºÇŬ²½¥³¡¼¥É¤ÇºÇŬ²½¤Ç¤­¤Ê¤¤¡£
¤½¤Î¤¿¤á¡¢¾¯¤·ÃÙ¤¤¤«¤â¤·¤ì¤Ê¤¤¡£
.IP "\fBip protochain \fIprotocol\fR"
\fBip6 protochain \fIprotocol\fR ¤ÈƱÍͤÀ¤¬¡¢¤³¤ì¤Ï IPv4 ¤Î¤¿¤á¤Î¤â¤Î¤Ç¤¢¤ë¡£
.IP "\fBether broadcast\fR"
¥Ñ¥±¥Ã¥È¤¬¥¤¡¼¥µ¥Í¥Ã¥È¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤Ç¤¢¤ë¤È¤­¿¿¡£\fIether\fP ¤Ï¤Ê¤¯¤Æ¤â¤è¤¤¡£
.IP "\fBip broadcast\fR"
¥Ñ¥±¥Ã¥È¤¬ IP ¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¥Ñ¥±¥Ã¥È¤Ç¤¢¤ë¤È¤­¿¿¡£¤³¤ì¤ÏÁ´¤Æ 0 ¤È Á´¤Æ 1 ¤ÎξÊý¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È·Á¼°¤ËÂбþ¤·¡¢¤µ¤é¤Ë¥µ¥Ö¥Í¥Ã¥È¥Þ¥¹¥¯¤Ë¤âÂбþ¤·¤Æ¤¤¤ë¡£
.IP "\fBether multicast\fR"
¥Ñ¥±¥Ã¥È¤¬¥¤¡¼¥µ¥Í¥Ã¥È¤Î¥Þ¥ë¥Á¥­¥ã¥¹¥È¤Ç¤¢¤ë¤È¤­¿¿¡£\fIether\fP ¤Ï¤Ê¤¯¤Æ
¤â¤è¤¤¡£¤³¤ì¤Ï `\fBether[0] & 1 != 0\fP'¤Î¾Êάµ­Ë¡¤Ç¤¢¤ë¡£
.IP "\fBip multicast\fR"
¥Ñ¥±¥Ã¥È¤¬ IP ¤Î¥Þ¥ë¥Á¥­¥ã¥¹¥È¤Ç¤¢¤ë¤È¤­¿¿¡£
.IP "\fBip6 multicast\fR"
¥Ñ¥±¥Ã¥È¤¬ IPv6 ¥Þ¥ë¥Á¥­¥ã¥¹¥È¥Ñ¥±¥Ã¥È¤Ç¤¢¤ë¤È¤­¿¿¡£
.IP  "\fBether proto \fIprotocol\fR"
¥Ñ¥±¥Ã¥È¤¬ ether ¤Î \fIprotocol\fR ·¿¤Î¤â¤Î¤Ç¤¢¤ë¤È¤­¿¿¡£
\fIprotocol\fP ¤Ë¤ÏÈֹ椫 \fIip\fP¡¢\fIip6\fP¡¢\fIarp\fP¡¢\fIrarp\fP ¤Î̾Á°¤¬Íø
ÍѲÄǽ¡£¤³¤ì¤é¤Î¼±Ê̻Ҥϥ­¡¼¥ï¡¼¥É¤Ç¤â¤¢¤ë¤Î¤Ç¡¢¥Ð¥Ã¥¯¥¹¥é¥Ã¥·¥å(\\)¤Ç
¥­¡¼¥ï¡¼¥É¤È¤·¤Æ²ò¼á¤µ¤ì¤ë¤Î¤ò²óÈò¤¹¤ëɬÍפ¬¤¢¤ë¡£
[ FDDI (¤¿¤È¤¨¤Ð `\fBfddi protocol arp\fR')¤Î¾ì¹ç¡¢¥×¥í¥È¥³¥ë¤Î¼±ÊÌÊýË¡¤Ï
802.2 Logical Link Control (LLC) ¥Ø¥Ã¥À¡¼¤Ë¤è¤ë¡£¤½¤ì¤ÏÄ̾ï¤Ï
FDDI ¥Ø¥Ã¥À¡¼¤ÎÀèƬ¤ËÃÖ¤«¤ì¤Æ¤¤¤ë¡£\fItcpdump\fP ¤Ï ¥×¥í¥È¥³¥ë¼±Ê̻ҤÇ
¥Õ¥£¥ë¥¿¡¼¤¹¤ë¾ì¹ç¤Ë¡¢Á´¤Æ¤Î FDDI ¥Ñ¥±¥Ã¥È¤Ï LLC ¥Ø¥Ã¥À¡¼¤ò»ý¤Ã¤Æ¤¤¤Æ¡¢
¤½¤Î LLC ¥Ø¥Ã¥À¡¼¤Ï SNAP ¤È¸Æ¤Ð¤ì¤ë·Á¼°¤Ë¤Ê¤Ã¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤¹¡£ ]
.IP "\fBdecnet src \fIhost\fR"
DECNET ¤Ë¤ª¤¤¤Æ¥½¡¼¥¹¥¢¥É¥ì¥¹¤¬``10.123''¤Î¤è¤¦¤Ê¥¢¥É¥ì¥¹¤ä DECNET¤Î¥Û
¥¹¥È¥Í¡¼¥à¤Î·Á¼°¤Ç»Ø¼¨¤µ¤ì¤ë 
.I host 
¤È°ìÃפ¹¤ë¤È¤­¿¿¡£[DECNET¤Î¥Û¥¹¥È¥Í¡¼¥à·Á¼°¤Ï DECNET¤ËÀܳ¤µ¤ì¤¿ 
ultrix ¥·¥¹¥Æ¥à¤Ë¤ª¤¤¤Æ¤Î¤ßÍøÍѲÄǽ¤Ç¤¢¤ë¡£]
.IP "\fBdecnet dst \fIhost\fR"
DECNET¤Ë¤ª¤¤¤Æ¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ 
.I host 
¤Ë°ìÃפ¹¤ë¤È¤­¿¿¡£
.IP "\fBdecnet host \fIhost\fR"
DECNET¤Ë¤ª¤¤¤Æ¡¢¥½¡¼¥¹¤Þ¤¿¤Ï¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤¬ 
.I host 
¤Ë°ìÃפ¹¤ë¤È¤­¤Ë¿¿¡£
.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBdecnet\fR"
²¼µ­¤Ë¤ª¤¤¤Æ:
.in +.5i
.nf
\fBether proto \fIp\fR
.fi
.in -.5i
\fIp\fR ¤ò¤½¤Î¤¤¤º¤ì¤«¤Î¥×¥í¥È¥³¥ë¤È¤¹¤ë¤Î¤ÈƱÅù¤Ç¤¢¤ë¡£
.IP "\fBlat\fR, \fBmoprc\fR, \fBmopdl\fR"
²¼µ­¤Ë¤ª¤¤¤Æ:
.in +.5i
.nf
\fBether proto \fIp\fR
.fi
.in -.5i
\fIp\fR ¤ò¤½¤Î¤¤¤º¤ì¤«¤Î¥×¥í¥È¥³¥ë¤È¤¹¤ë¤Î¤ÈƱÅù¤Ç¤¢¤ë¡£
\fItcpdump\fP ¤Ï¤³¤ì¤é¤Î¥×¥í¥È¥³¥ë¤Î²òÀÏÊýË¡¤ÏÀµ³Î¤Ë¤ÏÃΤé¤Ê¤¤ÅÀ¤ËÃí°Õ
¤¹¤ë¤³¤È¡£
.IP  "\fBtcp\fR, \fBudp\fR, \fBicmp\fR"
²¼µ­¤Ë¤ª¤¤¤Æ:
.in +.5i
.nf
\fBip proto \fIp\fR\fBip6 proto \fIp\fR
.fi
.in -.5i
\fIp\fR ¤ò¤½¤Î¤¤¤º¤ì¤«¤Î¥×¥í¥È¥³¥ë¤È¤¹¤ë¤Î¤ÈƱÅù¤Ç¤¢¤ë¡£
.IP  "\fIexpr relop expr\fR"
´Ø·¸¼°¤¬À®¤êΩ¤Æ¤Ð¿¿¡£\fIrelop\fR(±é»»»Ò)¤Ï >¡¢<¡¢>=¡¢<=¡¢=¡¢!= ¤Î¤¤¤º
¤ì¤«°ì¤Ä¤Ç¤¢¤ê¡¢\fIexpr\fR(ɽ¸½) ¤ÏÀ°Äê¿ô¤Ë¤è¤ë¿ôÃÍɽ¸½ (ɽ¸½ÊýË¡¤Ïɸ½à
Ū¤Ê C ¤Îʸˡ¤Ë¤·¤¿¤¬¤¦)¡¢É¸½àŪ¤ÊÆó¹à±é»»»Ò[+¡¢-¡¢*¡¢/¡¢&¡¢|]¡¢Ä¹¤µ±é»»»Ò¡¢¥Ñ
¥±¥Ã¥È¥Ç¡¼¥¿¥¢¥¯¥»¥¹±é»»»Ò¤Î¤¤¤º¤ì¤«¡£¥Ñ¥±¥Ã¥ÈÆâ¤Î¥Ç¡¼¥¿¤ËÂФ·¤ÆŬÍѤ¹¤ë¤Ë¤Ï¤³¤Î¤è¤¦¤Ëµ­½Ò¤¹¤ë:
.in +.5i
.nf
\fIproto\fB [ \fIexpr\fB : \fIsize\fB ]\fR
.fi
.in -.5i
\fIproto\fR ¤Ï \fBether¡¢fddi¡¢ip¡¢arp¡¢rarp¡¢tcp¡¢udp¡¢icmp¡¢ip6\fR ¤Î¤¤¤º¤ì¤«¤Ç
ÁàºîÂоݤΥץí¥È¥³¥ëÁؤò»Ø¼¨¤¹¤ë¡£
\fItcp, udp\fR ¤È¤½¤Î¾¤Î¾å°Ì¥×¥í¥È¥³¥ëÁØ¤Ï IPv4 ¤Ç¤Î¤ßÍøÍѤǤ­¡¢
IPv6¤Ç¤ÏÍøÍѤǤ­¤Ê¤¤¤³¤È¤ËÃí°Õ¡£(¤³¤ì¤Ï¾­Í轤Àµ¤µ¤ì¤ë¤À¤í¤¦)
»Ø¼¨¤µ¤ì¤¿¥×¥í¥È¥³¥ëÁؤˤĤ¤¤Æ¤Î¥Ð¥¤¥È¥ª¥Õ¥»¥Ã¥È¤Ï \fIexpr\fR ¤Ç»ØÄꤹ¤ë¡£
\fIsize\fR ¤ò»Ø¼¨¤¹¤ë¾ì¹ç¤ÏÃíÌܤ¹¤ë¥Õ¥£¡¼¥ë¥É¤Ç¤Î¥Ð¥¤¥È¿ô¤Ç»Ø¼¨¤¹¤ë¤¬¡¢
¤½¤ì¤Ï one¡¢two ¤Þ¤¿ four ¤Î¤¤¤º¤ì¤«¤òÍѤ¤¤ë¡£»Ø¼¨¤Î¤Ê¤¤¾ì¹ç¤Ï one ¤Ç
¤¢¤ë¤È¤ß¤Ê¤¹¡£Ä¹¤µ±é»»»Ò¤Ï¥­¡¼¥ï¡¼¥É \fBlen\fP ¤Ç¼¨¤µ¤ì¡¢¥Ñ¥±¥Ã¥ÈŤòÍ¿¤¨¤ë¡£
¤¿¤È¤¨¤Ð¡¢`\fBether[0] & 1 != 0\fP'¤È¤¤¤¦¾ò·ï¼°¤Ï¤¹¤Ù¤Æ¤Î¥Þ¥ë¥Á¥­¥ã¥¹¥È
¤Ë¤è¤ëÄÌ¿®¤ò¤È¤é¤¨¤ë¡£`\fBip[0] & 0xf != 5\fP' ¤È¤¤¤¦¾ò·ï¼°¤Ï¤¹¤Ù¤Æ¤Î¥ª
¥×¥·¥ç¥óÉÕ¤­¤Î IP ¥Ñ¥±¥Ã¥È¤ò¤È¤é¤¨¤ë¡£`\fBip[6:2] & 0x1fff = 0\fP'¤Ï¥Õ¥é
¥°¥á¥ó¥È²½¤µ¤ì¤Æ¤¤¤Ê¤¤¥Ç¡¼¥¿¥°¥é¥à¤« 0 ÈÖ¤Î(ºÇ½é¤Î)¥Õ¥é¥°¥á¥ó¥È¤À¤±¤òɽ¼¨¤¹¤ë¡£
¤Ê¤ª¡¢¤³¤Î¾ò·ï¤Ï \fBtcp\fP ¤È \fBudp\fP ¤Ø¤ÎŬÍѤò°Å¼¨¤·¤Æ¤¤¤ë¡£¤µ¤é
¤Ë \fBtcp[0]\fP ¤Ï TCP \fI¥Ø¥Ã¥À\fP ¤ÎºÇ½é¤Î¥Ð¥¤¥È¤ò°ÕÌ£¤¹¤ë¤¬¡¢¥Õ¥é
¥°¥á¥ó¥È¤ÎÀèƬ¤Î¥Ð¥¤¥È¤Ç¤Ï¤¢¤ê¤¨¤Ê¤¤¡£
.LP
Í×ÁǤòÊ£¹ç¤µ¤»¤ÆÍѤ¤¤ë¾ì¹ç:
.IP
³ç¸Ì¤Ç¥°¥ë¡¼¥×ʬ¤±¤¹¤ëÍ×ÁǤȱ黻»Ò(³ç¸Ì¤Ï¥·¥§¥ë¤Ë¤È¤Ã¤Æ¤âÆÃÊ̤ʰÕÌ£¤ò»ý¤Ä¤Î¤Ç¤¿¤Ö¤ó¥¨¥¹¥±¡¼¥×¤·¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤¤À¤í¤¦)¡£
.IP
ÈÝÄê (`\fB!\fP' or `\fBnot\fP').
.IP
·ë¹ç (`\fB&&\fP' or `\fBand\fP').
.IP
Âò°ì (`\fB||\fP' or `\fBor\fP').
.LP
ÈÝÄê¤Ï¤â¤Ã¤È¤â¹â¤¤Í¥ÀèÅÙ¤ò¤â¤Ä¡£Âò°ì¤È·ë¹ç¤ÏƱÅù¤ÎÍ¥ÀèÅÙ¤ò»ý¤Á¡¢
º¸¤«¤é±¦¤Øɾ²Á¤µ¤ì¤ë¡£
·ë¹ç¤ÏÊ»µ­¤¹¤ë¤À¤±¤Ç¤Ê¤¯ÌÀ¼¨Åª¤Ê \fBand\fR ¥È¡¼¥¯¥ó¤¬É¬Íפʤ³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
.LP
¥­¡¼¥ï¡¼¥É¤Ê¤·¤Ç¼±Ê̻Ҥ¬¤¢¤é¤ï¤ì¤¿¾ì¹ç¡¢Ä¾Á°¤Ë¤¢¤é¤ï¤ì¤¿¥­¡¼¥ï¡¼¥É¤ò
ȼ¤Ã¤Æ¤¤¤ë¤È¤ß¤Ê¤µ¤ì¤ë¡£
¤¿¤È¤¨¤Ð¡¢
.in +.5i
.nf
\fBnot host vs and ace\fR
.fi
.in -.5i
¤Ï
.in +.5i
.nf
\fBnot host vs and host ace\fR
.fi
.in -.5i
¤Î¾Êά¤Ç¤¢¤ê¡¢¤³¤ì¤Ï
.in +.5i
.nf
\fBnot ( host vs or ace )\fR
.fi
.in -.5i
¤È¤Ï°ã¤¦¡£
.LP
tcpdump ¤ËÅϤ¹¾ò·ï¼°¤ÏÅÔ¹ç¤Î¤è¤¤¤è¤¦¤Ë¡¢Ã±°ì¤È¤·¤Æ¤âÊ£¿ô¤È¤·¤Æ¤â¤è¤¤¡£
°ìÈ̤˥·¥§¥ë¤Î¥á¥¿¥­¥ã¥é¥¯¥¿¤ò´Þ¤à¤è¤¦¤Ê¾ò·ï¼°¤Î¾ì¹ç¤Ïñ°ì¤Î¥¯¥ª¡¼¥È¤·¤¿°ú¿ô¤È¤·¤ÆÅϤ¹¤Î¤¬¤è¤¤¡£
Ê£¿ô¤Î°ú¿ô¤Ïɾ²Á¤ÎľÁ°¤Ë¶õÇò¤Ç·ë¹ç¤µ¤ì¤ë¡£
.SH Îã
.LP
¥Û¥¹¥È \fIsundown\fP ¤Ë¤«¤«¤ï¤ëÁ´¤Æ¤ÎÆþ½ÐÎϥѥ±¥Ã¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
\fBtcpdump host sundown\fP
.fi
.RE
.LP
¥Û¥¹¥È \fIhelios\fR ¤È \fIhot\fR ¤¢¤ë¤¤¤Ï \fIace\fR ¤È¤ÎÄÌ¿®¤òɽ¼¨¤¹¤ë:
.RS
.nf
\fBtcpdump host helios and \\( hot or ace \\)\fP
.fi
.RE
.LP
¥Û¥¹¥È \fIace\fR ¤È \fIhelios\fR ¤ò½ü¤¯Á´¤Æ¤Î¥Û¥¹¥È¤È¤ÎIP¥Ñ¥±¥Ã¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
\fBtcpdump ip host ace and not helios\fP
.fi
.RE
.LP
¥í¡¼¥«¥ë¥Í¥Ã¥È¤Î¥Û¥¹¥È·²¤È¥Í¥Ã¥È¥ï¡¼¥¯ Berkeley ¤Î¥Û¥¹¥È·²¤È¤ÎÄÌ¿®¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump net ucb-ether
.fi
.RE
.LP
¥¤¥ó¥¿¡¼¥Í¥Ã¥È¤Ø¤Î¥²¡¼¥È¥¦¥§¥¤¤Î \fIsnup\fP ¤òÄ̲᤹¤ëÁ´¤Æ¤Î ftp ÄÌ¿®¤òɽ¼¨¤¹¤ë(¾ò·ï¼°¤Ï¥·¥§¥ë¤¬³ç¸Ì¤ò(¸í¤Ã¤Æ)²ò¼á¤¹¤ë¤Î¤òÈò¤±¤ë¤¿¤á¤Ë¥¯¥ª¡¼¥È¤µ¤ì¤Æ¤¤¤ëÅÀ¤ËÃí°Õ¤»¤è):
.RS
.nf
.B
tcpdump 'gateway snup and (port ftp or ftp-data)'
.fi
.RE
.LP
¥í¡¼¥«¥ë¥Û¥¹¥È¤Ø¤ÎÆþ½ÐÎϤÎÄÌ¿®¤ò½ü³°¤·¤Æɽ¼¨¤¹¤ë(¾¤Î¥Í¥Ã¥È¥ï¡¼¥¯¤Ø¤Î¥²¡¼¥È¥¦¥§¥¤¤Ç¤¢¤ë¤È¤·¤Æ¡¢¥í¡¼¥«¥ë¥Í¥Ã¥È¥ï¡¼¥¯¤ò½ü³°¤¹¤ëÎã):
.RS
.nf
.B
tcpdump ip and not net \fIlocalnet\fP
.fi
.RE
.LP
¥í¡¼¥«¥ë¥Û¥¹¥È°Ê³°¤¬´Ø¤ï¤ë TCP ÄÌ¿®¤Î TCP ¥¹¥¿¡¼¥È¤È¥¨¥ó¥É¤Î¥Ñ¥±¥Ã¥È(SYN ¤È FIN ¤Î¥Ñ¥±¥Ã¥È)¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump 'tcp[13] & 3 != 0 and not src and dst net \fIlocalnet\fP'
.fi
.RE
.LP
¥²¡¼¥È¥¦¥§¥¤ \fIsnup\fP ¤òÄ̲᤹¤ë 576 ¥Ð¥¤¥È°Ê¾å¤Î IP ¥Ñ¥±¥Ã¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump 'gateway snup and ip[2:2] > 576'
.fi
.RE
.LP
¥¤¡¼¥µ¥Í¥Ã¥È¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤Þ¤¿¤Ï¥Þ¥ë¥Á¥­¥ã¥¹¥È¤ò
.I ɬÍפȤ·¤Ê¤¤
IP ¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤Þ¤¿¤Ï¥Þ¥ë¥Á¥­¥ã¥¹¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump 'ether[0] & 1 = 0 and ip[16] >= 224'
.fi
.RE
.LP
echo Í×µá/±þÅú(¤Ä¤Þ¤ê ping ¤Î¥Ñ¥±¥Ã¥È)°Ê³°¤Î¤¹¤Ù¤Æ¤Î ICMP ¥Ñ¥±¥Ã¥È¤òɽ¼¨¤¹¤ë:
.RS
.nf
.B
tcpdump 'icmp[0] != 8 and icmp[0] != 0"
.fi
.RE
.SH ½ÐÎÏ·Á¼°
.LP
\fItcpdump\fP ¤Î½ÐÎϤϥץí¥È¥³¥ë¤Ë°Í¸¤¹¤ë¡£²¼µ­¤ÏÂçÉôʬ¤ÎÍͼ°¤Î´Êñ¤Ê²òÀâ¤ÈÎã¤Ç¤¢¤ë¡£
.de HD
.sp 1.5
.B
..
.HD
¥ê¥ó¥¯¥ì¥Ù¥ë¥Ø¥Ã¥À
.LP
`-e' ¥ª¥×¥·¥ç¥ó¤¬»Ø¼¨¤µ¤ì¤Æ¤¤¤ë¾ì¹ç¡¢¥ê¥ó¥¯¥ì¥Ù¥ë¥Ø¥Ã¥À¤¬É½¼¨¤µ¤ì¤ë¡£
¥¤¡¼¥µ¥Í¥Ã¥È¤Ç¤Ï¥½¡¼¥¹¤ª¤è¤Ó¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¤Î¥¢¥É¥ì¥¹¤È¥Ñ¥±¥Ã¥ÈŤ¬É½¼¨¤µ¤ì¤ë¡£
.LP
FDDI ¤Î¥Í¥Ã¥È¥ï¡¼¥¯¤Ë¤ª¤¤¤Æ¤Ï '-e' ¥ª¥×¥·¥ç¥ó¤Ë¤è¤ê \fItcpdump\fP ¤Ï¡¢¥½
¡¼¥¹¤ª¤è¤Ó¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¤Î¥¢¥É¥ì¥¹¤È¥Ñ¥±¥Ã¥ÈŤ«¤é¤Ê¤ë¥Õ¥ì¡¼¥àÀ©¸æ¥Õ¥£¡¼¥ë¥É¤òɽ¼¨¤¹¤ë¡£(¥Õ¥ì¡¼¥àÀ©¸æ¥Õ¥£¡¼¥ë¥É¤Ï¥Ñ¥±¥Ã¥È¤Î»Ä¤ê¤ÎÉôʬ¤Î²ò¼á
¤ÎÀ©¸æ¤ò¤ª¤³¤Ê¤¦)¡£(IP ¥Ç¡¼¥¿¥°¥é¥à¤ò´Þ¤à¤è¤¦¤Ê)Ä̾ï¤Î¥Ñ¥±¥Ã¥È¤ÏÍ¥ÀèÅÙ 
0 ¤«¤é 7 ¤ò»ý¤Ä`async' ¥Ñ¥±¥Ã¥È¤Ç¤¢¤ë;¤¿¤È¤¨¤Ð `\fBasync 4\fR'¡£¤³¤Î
¤è¤¦¤Ê¥Ñ¥±¥Ã¥È¤Ï 802.2 LLC ¤ò´Þ¤à¤È¤ß¤Ê¤µ¤ì¤ë¡£LLC¥Ø¥Ã¥À¤Ï¤½¤ì¤¬ ISO 
¥Ç¡¼¥¿¥°¥é¥à¤ä¤¤¤ï¤æ¤ë SNAP ¥Ñ¥±¥Ã¥È \fI¤Ç¤Ê¤¤\fR ¤Ê¤é¤Ð¡¢É½¼¨¤µ¤ì¤ë¡£
.LP
\fI(Ãí:°Ê²¼¤Îµ­½Ò¤Ï RFC-1144 ¤Ë¤è¤ë SLIP °µ½Ì¥¢¥ë¥´¥ê¥º¥à¤òÍý²ò¤·¤Æ¤¤¤ë¤â¤Î¤È
¤ß¤Ê¤·¤Æµ­½Ò¤·¤Æ¤¢¤ë)¡£\fP
.LP
SLIP Àܳ¤Ç¤Ï¡¢Êý¸þ»Ø¼¨(``I''¤¬ÆþÎÏ¡¢``O''¤¬½ÐÎÏ)¡¢¥Ñ¥±¥Ã¥È¥¿¥¤¥×¤È°µ½Ì¾ðÊó¤¬É½¼¨¤µ¤ì¤ë¡£
ºÇ½é¤Ë¥Ñ¥±¥Ã¥È¥¿¥¤¥×¤¬É½¼¨¤µ¤ì¤ë¡£
¥¿¥¤¥×¤Ë¤Ï \fIip\fP¡¢\fIutcp\fP¡¢\fIctcp\fP ¤Î»°¼ïÎब¤¢¤ë¡£
\fIip\fR ¥Ñ¥±¥Ã¥È¤Ë¤Ä¤¤¤Æ¤³¤ì°Ê¾å¤Î¥ê¥ó¥¯¾ðÊó¤Ïɽ¼¨¤µ¤ì¤Ê¤¤¡£
TCP¥Ñ¥±¥Ã¥È¤ÏÀܳ¼±Ê̻Ҥ¬¼¡¤Ëɽ¼¨¤µ¤ì¤ë¡£
¥Ñ¥±¥Ã¥È¤¬°µ½Ì¤µ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ï¤½¤ÎÉä¹æ²½¤µ¤ì¤¿¥Ø¥Ã¥À¤¬É½¼¨¤µ¤ì¤ë¡£
\fB*S+\fIn\fR¡¢\fB*SA+\fIn\fR 
¤Èɽ¼¨¤µ¤ì¤ëÆÃÊ̤ʾõÂ֤⤢¤ë¡£¤³¤³¤Ç \fIn\fR ¤Ï¥·¡¼¥±¥ó¥¹ÈÖ¹æ(¤Þ¤¿¤Ï¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤È ack)¤¬²¿²óÊѹ¹¤µ¤ì¤¿¤«¤ò¼¨¤¹¡£
ÆÃÊ̤ʾì¹ç¤Ç¤Ê¤±¤ì¤Ð¡¢¥¼¥í¤«¤Þ¤¿¤ÏÊѹ¹¤Î²ó¿ô¤¬½ÐÎϤµ¤ì¤ë¡£
Êѹ¹¤Ï U(urgent pointer)¡¢W(windows)¡¢A(ack)¡¢S(sequence number)¡¢I(packet ID)¤Ëº¹Ê¬(+n ¤« -n)¤Þ¤¿¤Ï¿·¤·¤¤ÃÍ(=n)¤ÎÁȹ礻¤Ç¼¨¤µ¤ì¤ë¡£
ºÇ¸å¤Ë¥Ñ¥±¥Ã¥È¤Î¥Ç¡¼¥¿¤¹¤Ù¤Æ¤È°µ½Ì¤µ¤ì¤¿¥Ø¥Ã¥À¤ÎŤµ¤¬É½¼¨¤µ¤ì¤ë¡£
.LP
¤³¤ÎÎã¤ÏÌÀ¼¨¤µ¤ì¤¿Àܳ¼±Ê̻Ҥò¤â¤Ä½ÐÎϤµ¤ì¤ë°µ½ÌTCP¥Ñ¥±¥Ã¥È¤ò¼¨¤¹¡£
ack ¤Ï 6²ó¹¹¿·¤µ¤ì¡¢¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ï 49¤Ç¤¢¤ê ¥Ñ¥±¥Ã¥È¤Î ID¤Ï 6¤Ç¤¢¤ë;
3¥Ð¥¤¥È¤Î¥Ç¡¼¥¿¤È6¥Ð¥¤¥È¤Î°µ½Ì¥Ø¥Ã¥À¤ò»ý¤Ä
.RS
.nf
\fBO ctcp * A+6 S+49 I+6 3 (6)\fP
.fi
.RE
.HD
ARP/RARP ¥Ñ¥±¥Ã¥È
.LP
arp/rarp ½ÐÎϤÏÍ×µá¤Î¥¿¥¤¥×¤È¤½¤Î°ú¿ô¤òɽ¼¨¤¹¤ë¡£¥Õ¥©¡¼¥Þ¥Ã¥È¤½¤ì¼«ÂÎ
¤¬¼«¿È¤ÎÆâÍƤÎÀâÌÀ¤È¤Ê¤ë¡£¤³¤Îû¤¤Îã¤Ï¥Û¥¹¥È \fIrtsg\fP ¤«¤é \fIcsam\fP ¤Ø¤Î `rlogin' ¤Î³«»Ï»þ¤Î¤â¤Î¤Ç¤¢¤ë¡£
.RS
.nf
.sp .5
\f(CWarp who-has csam tell rtsg
arp reply csam is-at CSAM\fR
.sp .5
.fi
.RE
°ì¹ÔÌÜ¤Ï rtsg ¤¬ ¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥Û¥¹¥È csam ¤Î¥¤¡¼¥µ¥Í¥Ã¥È¥¢¥É¥ì¥¹¤ò¿Ò¤Í¤ë arp ¥Ñ¥±¥Ã¥È¤òÁ÷¿®¤·¤¿Íͻҡ£csam ¤Ï¥¤¡¼¥µ¥Í¥Ã¥È¥¢¥É¥ì¥¹¤òÊÖ¿®¤·¤Æ¤¤¤ë(¤³¤ÎÎã¤Ç¥¤¡¼¥µ¥Í¥Ã¥È¥¢¥É¥ì¥¹¤ÏÂçʸ»ú¤Ç¡¢¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤Ï¾®Ê¸»ú¤Çɽ¼¨¤µ¤ì¤Æ¤¤¤ë)¡£
.LP
¤³¤ÎÎã¤Ï \fBtcpdump \-n\fP ¤Ç¼Â¹Ô¤¹¤ë¤È¤³¤Î¤è¤¦¤Ë´Êά²½¤µ¤ì¤ë:
.RS
.nf
.sp .5
\f(CWarp who-has 128.3.254.6 tell 128.3.254.68
arp reply 128.3.254.6 is-at 02:07:01:00:01:c4\fP
.fi
.RE
.LP
\fBTcpdump \-e\fP ¤Ç¼Â¹Ô¤¹¤ë¤ÈºÇ½é¤Î¥Ñ¥±¥Ã¥È¤¬¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤ÇÆóÈÖÌÜ¤Ï point-to-point ¤Ç¤¢¤ë¤³¤È¤¬¸«¤Æ¤È¤ì¤ë:
.RS
.nf
.sp .5
\f(CWRTSG Broadcast 0806  64: arp who-has csam tell rtsg
CSAM RTSG 0806  64: arp reply csam is-at CSAM\fR
.sp .5
.fi
.RE
ºÇ½é¤Î¥Ñ¥±¥Ã¥È¤Ï source ¤Î¥¤¡¼¥µ¥Í¥Ã¥È¥¢¥É¥ì¥¹¤¬ RTSG ¤Ç¡¢
¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¤¬¥¤¡¼¥µ¥Í¥Ã¥È¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤Ç¤¢¤ê¡¢
¥¿¥¤¥×¥Õ¥£¡¼¥ë¥É¤Ï 16 ¿Ê¤Î 0806(ETHER_ARP)¡¢Á´Ä¹¤¬ 64 ¥Ð¥¤¥È¤Ç¤¢¤ë¤³¤È¤¬¤ï¤«¤ë¡£
.HD
TCP ¥Ñ¥±¥Ã¥È
.LP
\fI(Ãí: °Ê²¼¤Ï RFC-793 ¤Çµ­½Ò¤µ¤ì¤ë TCP¥×¥í¥È¥³¥ë¤òÍý²ò¤·¤Æ¤¤¤ë¤â¤Î¤È
¤ß¤Ê¤·¤Æµ­½Ò¤·¤Æ¤¢¤ë¡£¤â¤·¤³¤Î¥×¥í¥È¥³¥ë¤ËÄ̤¸¤Æ¤¤¤Ê¤¤¤è¤¦¤Ê¤é¡¢¤³¤Îµ­
½Ò¤À¤±¤Ç¤Ê¤¯¡¢tcpdump ¤½¤Î¤â¤Î¤âÌò¤ËΩ¤¿¤Ê¤¤¤À¤í¤¦¤¬¡£)\fP
.LP
°ìÈÌŪ¤Ê¥Õ¥©¡¼¥Þ¥Ã¥È¤Ï²¼µ­¤ÎÄ̤ê:
.RS
.nf
.sp .5
\fIsrc > dst: flags data-seqno ack window urgent options\fP
.sp .5
.fi
.RE
\fIsrc\fP ¤È \fIdst\fP ¤Ï ¥½¡¼¥¹¤È¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¤È¤Ê¤ë IP¥¢¥É¥ì¥¹¤È¥Ý¡¼¥ÈÈÖ¹æ¤Ç¤¢¤ë¡£
\fIflags\fP ¤Ï S(SYN)¡¢F(FIN)¡¢P(PUSH)¤« R(RST) ¤ÎÁȹ礻¤«°ì¤Ä¤Î `.'(¥Õ¥é¥°¤Ê¤·)¤Ç¤¢¤ë¡£
\fIdata-seqno\fP ¤Ï¤³¤Î¥Ñ¥±¥Ã¥È¤Ë´Þ¤Þ¤ì¤ë¥Ç¡¼¥¿¤Î¥·¡¼¥±¥ó¥¹¶õ´Ö¤Î°ìÉô¤ò¼¨¤¹(²¼µ­¤ÎÎã¤ò»²¾È)¡£
\fIack\fP ¤Ï¤³¤ÎÀܳ¤Ë¤ª¤±¤ë¼¡¤Î´üÂÔ¤µ¤ì¤ë±þÅú¥Ç¡¼¥¿¤Î¥·¡¼¥±¥ó¥¹Èֹ档
\fIwindow\fP ¤Ï¤³¤ÎÀܳ¤Ë¤ª¤±¤ë±þÅú¤ËÂФ·¤ÆÍÑ°Õ¤µ¤ì¤Æ¤¤¤ë¥Ð¥Ã¥Õ¥¡¶õ´Ö¤Î¥Ð¥¤¥È¿ô¡£
\fIurg\fP ¤Ï¤³¤Î¥Ñ¥±¥Ã¥È¤Ë `urgent' ¥Ç¡¼¥¿¤¬´Þ¤Þ¤ì¤ë¤³¤È¤ò¼¨¤¹¡£
\fIoptions\fP ¤Ï tcp ¤Î¥ª¥×¥·¥ç¥ó¤Ç <>¤Ç°Ï¤Þ¤ì¤ë(Îã<mss 1024>)¡£
.LP
\fIsrc¡¢dst\fP ¤È \fIflags\fP ¤Ï¤«¤Ê¤é¤ºÉ½¼¨¤µ¤ì¤ë¡£Â¾¤Î¥Õ¥£¡¼¥ë¥É¤Ï¥Ñ¥±¥Ã¥È¤Î TCP ¥×¥í¥È¥³¥ë¥Ø¥Ã¥À¤Ë°Í¸¤¹¤ë¤Î¤ÇɬÍפʾì¹ç¤Î¤ßɽ¼¨¤µ¤ì¤ë¡£
.LP
¤³¤ì¤Ï¥Û¥¹¥È \fIrtsg\fP ¤«¤é \fIcsam\fP ¤Ø¤Îrlogin ¤Î³«»Ï»þ¤Î°ìÉô¡£
.RS
.nf
.sp .5
\s-2\f(CWrtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024>
csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024>
rtsg.1023 > csam.login: . ack 1 win 4096
rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096
csam.login > rtsg.1023: . ack 2 win 4096
rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096
csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077
csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1
csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1\fR\s+2
.sp .5
.fi
.RE
°ì¹ÔÌÜ¤Ï rtsg ¤Î TCP ¥Ý¡¼¥ÈÈÖ¹æ 1023 ¤«¤é csam ¤Î \fIlogin\fP ¥Ý¡¼¥È¤Ø
¤ÎÁ÷¿®¥Ñ¥±¥Ã¥È¤Îɽ¼¨¤Ç¤¢¤ë¡£\fBS\fP ¤Ï \fISYN\fP ¥Õ¥é¥°¤¬¥»¥Ã¥È¤µ¤ì¤Æ¤¤¤ë¤³
¤È¤ò¼¨¤¹¡£¥Ñ¥±¥Ã¥È¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ï 768512 ¤Ç¤³¤Î¥Ñ¥±¥Ã¥È¤Ï¥Ç¡¼¥¿¤ò
´Þ¤Þ¤Ê¤¤¡£(¤³¤Î¤è¤¦¤Ë \fInbytes\fP ¥Ð¥¤¥È¤Î¥æ¡¼¥¶¥Ç¡¼¥¿¤ò´Þ¤à¥·¡¼¥±
¥ó¥¹ÈÖ¹æ \fIfirst\fP ¤«¤é¡¢\fIlast\fP (last ¤Ï´Þ¤Þ¤ì¤Ê¤¤)¤ò¼¨¤¹¤¿¤á¤Ë 
`first:last(nbytes)'¤Èɽµ­¤¹¤ë)¡£¤Þ¤¿¤³¤Î¥Ñ¥±¥Ã¥È¤Ë¤Ï ack ¤ÏÀßÄꤵ¤ì¤Æ
¤ª¤é¤º¡¢¼õ¿® window ¤Ï 4096 ¥Ð¥¤¥È¡¢ºÇÂ祻¥°¥á¥ó¥È¥µ¥¤¥º(mss)¥ª¥×¥·¥ç
¥ó ¤¬ 1024 ¥Ð¥¤¥È¤ËÀßÄꤵ¤ì¤Æ¤¤¤¿¡£
.LP
¤³¤ì¤ËÂФ·¤Æ¡¢csam ¤Ï rtsg ¤Î SYN ¤ËÂФ¹¤ë ack ¤ò´Þ¤à¾¤ÏƱÅù¤ÎÆâÍƤΥѥ±¥Ã¥È¤òÊÖ¤·¤Æ¤¤¤ë¡£
¤½¤³¤Ç¡¢rtsg ¤Ï csam ¤Î SYN ¤Ë ack ±þÅú¤òÊÖ¤¹¡£`.' ¤Ï¥Õ¥é¥°¤¬¥»¥Ã¥È¤µ¤ì¤Æ¤¤¤Ê¤¤¤³¤È¤ò¼¨¤¹¡£
¤³¤Î¥Ñ¥±¥Ã¥È¤Ë¤Ï¥Ç¡¼¥¿¤¬´Þ¤Þ¤ì¤Ê¤¤¤Î¤Ç¡¢¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤â¤Ê¤¤¡£ack ±þÅú¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ï¾®¤µ¤ÊÀ°¿ô 1 ¤Ç¤¢¤ëÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£
ºÇ½é¤Ë tcp ¤Î¡Ö²ñÏáפò¸«¤¤¤À¤¹¤È¡¢\fBtcpdump\fP ¤Ï¤½¤Î¥Ñ¥±¥Ã¥È¤Î¥·¡¼
¥±¥ó¥¹ÈÖ¹æ¤ò½ÐÎϤ¹¤ë¡£¤½¤Î²ñÏäΥѥ±¥Ã¥È¤«¤é¤Ï¡¢¤½¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤È
½é´ü²½¤µ¤ì¤¿¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤È¤Îº¹°Û¤¬É½¼¨¤µ¤ì¤ë¡£
¤³¤ì¤ÏºÇ½é°Ê³°¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ï¤½¤Î²ñÏäΥǡ¼¥¿¥°¥é¥à¤Ë¤ª¤±¤ëÁêÂÐŪ¤Ê
¥Ð¥¤¥È°ÌÃ֤Ȥ·¤Æ²ò¼á¤Ç¤­¤ë¤³¤È¤ò°ÕÌ£¤¹¤ë (³Æ¥Ç¡¼¥¿¥°¥é¥à¤Ï 1 ¤«¤é»Ï¤Þ
¤ë)¡£ '-S' ¥ª¥×¥·¥ç¥ó¤Ï¤³¤Îµ¡Ç½¤ò̵»ë¤·¤Æ¡¢ËÜÍè¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤ò½ÐÎϤ¹¤ë¡£
.LP
6 ¹ÔÌÜ¤Ç rtsg ¤Ï scam ¤Ø 19 ¥Ð¥¤¥È(rtsg ¤«¤é csam ¤ÎÊý¸þ¤Ø¡¢2 ¥Ð¥¤¥ÈÌÜ
¤«¤é 20 ¥Ð¥¤¥ÈÌܤޤÇ)
¤Î¥Ç¡¼¥¿¤òÁ÷¤ë¡£¤³¤Î¥Ñ¥±¥Ã¥È¤Ë¤Ï PUSH ¥Õ¥é¥°¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¡£7 ¹ÔÌܤǡ¢
csam ¤Ï rtsg ¤¬Á÷¿®¤·¤¿¥Ç¡¼¥¿¤ò¼õ¿®¤·¤¿¡¢¤È¸À¤Ã¤Æ¤¤¤ë¤¬¡¢¤³¤ì¤Ë¤Ï 21 
¥Ð¥¤¥ÈÌܤϴޤޤì¤Ê¤¤¡£csam ¤Î¼õ¿® window ¤¬ 19 ¥Ð¥¤¥È¾®¤µ¤¯¤Ê¤Ã¤Æ¤¤¤ë¤³¤È¤«
¤é¡¢¤³¤Î¥Ç¡¼¥¿¤Ï¥½¥±¥Ã¥È¥Ð¥Ã¥Õ¥¡¤Ëα¤Þ¤Ã¤Æ¤¤¤ë¤È¿ä¬¤µ¤ì¤ë¡£csam ¤Ï¤Þ
¤¿ 1¥Ð¥¤¥È¤Î¥Ç¡¼¥¿¤ò rtsg ¤ËÁ÷¿®¤¹¤ë¡£8 ¹ÔÌÜ¤È 9 ¹ÔÌÜ¤È¤Ç csam ¤Ï 
urgent ¤ª¤è¤Ó pushed ÉÕ¤­¤Î¥Ñ¥±¥Ã¥È 2¥Ð¥¤¥È ¤òrtsg ¤ØÁ÷¿®¤·¤Æ¤¤¤ë¡£
.LP
¤â¤·¡¢snapshot ¤¬¾®¤µ¤¹¤®¤Æ \fBtcpdump\fP ¤¬ TCP ¥Ø¥Ã¥À¤ÎÁ´¤Æ¤òª¤¨¤é¤ì¤Ê¤«¤Ã¤¿¾ì¹ç¤Ï¡¢¤Ç¤­¤ë¤À¤±
¤Î²ò¼á¤ò¤·¤Æ¡¢¤½¤Î»Ä¤ê¤Ë¤Ï²ò¼áÉÔǽ¤À¤Ã¤¿¤â¤Î¤¬¤¢¤ë¤³¤È¤ò¼¨¤¹¤¿¤á¤Ë
``[|\fItcp\fP]''¤Èɽ¼¨¤¹¤ë¡£¥Ø¥Ã¥À¤Ë°ÕÌ£ÉÔÌÀ¤Ê¥ª¥×¥·¥ç¥ó(¤¿¤È¤¨¤Ð¡¢¾®
¤µ¤¹¤®¤¿¤ê¡¢¥Ø¥Ã¥À¤è¤ê¤âŤ«¤Ã¤¿¤ê¤¹¤ë length ¤È¤«)¤¬ÀßÄꤵ¤ì¤Æ¤¤¤¿¾ì
¹ç¤Ï¡¢tcpdump ¤Ï ``[\fIbad opt\fP]''¤Èɽ¼¨¤·¡¢¤½¤ì°Ê¾å¤Î¥ª¥×¥·¥ç¥ó²òÀÏ
¤òÃæ»ß¤¹¤ë(¤½¤ì¤¬¤É¤³¤«¤é»Ï¤á¤é¤ì¤ë¤«¤ï¤«¤é¤Ê¤¤¤Î¤Ç)¡£
¥Ø¥Ã¥ÀŤ¬¥ª¥×¥·¥ç¥ó¤òÁ÷¿®¤·¤¿¤³¤È¤ò¼¨¤·¤Æ¤¤¤ë¤Î¤Ë¡¢
IP ¥Ç¡¼¥¿¥°¥é¥àĹ¤Ï¤½¤³¤Ë¥ª¥×¥·¥ç¥ó¤ò´Þ¤á¤é¤ì¤Ê¤¤¤³¤È¤ò¼¨¤¹¾ì¹ç¤Ï tcpdump ¤Ï ``[bad hdr length]''¤Èɽ¼¨¤¹¤ë¡£
.HD
.B
UDP ¥Ñ¥±¥Ã¥È
.LP
UDP ¤Ï¤³¤Î rwho ¤Î¥Ñ¥±¥Ã¥È¤ÇÀâÌÀ¤¹¤ë:
.RS
.nf
.sp .5
\f(CWactinide.who > broadcast.who: udp 84\fP
.sp .5
.fi
.RE
¤³¤ì¤Ï¥Û¥¹¥È \fIactinide\fP ¤Î \fIwho\fP ¤Î¥Ý¡¼¥È¤«¤é UDP ¥Ç¡¼¥¿¥°¥é¥à¤¬
¥Û¥¹¥È \fIbroadcast\fP ¤¹¤Ê¤ï¤Á¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¥¢¥É¥ì¥¹¤Î
\fIwho\fP ¤Î¥Ý¡¼¥È¤ØÁ÷¤é¤ì¤¿¤³¤È¤òɽ¼¨¤·¤Æ¤¤¤ë¡£
¥Ñ¥±¥Ã¥È¤Ï¥æ¡¼¥¶¥Ç¡¼¥¿ 84 ¥Ð¥¤¥È¤ò´Þ¤ó¤Ç¤¤¤ë¡£
.LP
¤¤¤¯¤Ä¤Î¤«¤Î UDP ¥µ¡¼¥Ó¥¹¤Ë´Ø¤·¤Æ¤Ï(¤½¤Î¥½¡¼¥¹¤Þ¤¿¤Ï¥Ç¥£¥¹¥Í¡¼¥·¥ç¥ó
¤Î¥Ý¡¼¥ÈÈÖ¹æ¤è¤ê)²ò¼á¤¹¤ë¤³¤È¤¬¤Ç¤­¡¢¤è¤ê¾å°Ì¤ÎÁؤˤª¤±¤ë¥×¥í¥È¥³¥ë
¾ðÊó¤òɽ¼¨¤¹¤ë¡£Æä˥ɥᥤ¥ó¥Í¡¼¥à¥µ¡¼¥Ó¥¹Í×µá(RFC-1034/1035)¤ä
NFS ¤Ë¤Ä¤¤¤Æ¤Î Sun RPC (RFC-1050)¤Ë¤Ä¤¤¤Æ½ÐÎϤµ¤ì¤ë¡£
.HD
UDP ¥Í¡¼¥à¥µ¡¼¥Ó¥¹Í×µá
.LP
\fI(Ãí:°Ê²¼¤Ï RFC-1035 ¤Çµ­½Ò¤µ¤ì¤ë ¥É¥á¥¤¥ó¥Í¡¼¥à¥µ¡¼¥Ó¥¹¥×¥í¥È¥³¥ë¤ò
Íý²ò¤·¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤·¤Æµ­½Ò¤·¤Æ¤¤¤ë¡£
¤â¤·¤³¤Î¥×¥í¥È¥³¥ë¤ËÄ̤¸¤Æ¤¤¤Ê¤¤¤è¤¦¤Ê¤é¡¢°Ê²¼¤Îµ­½Ò¤Ï¤Á¤ó¤×¤ó¤«¤ó¤×¤ó¤«¤â¤·¤ì¤Ê¤¤¡£)
.LP
¥Í¡¼¥à¥µ¡¼¥Ð¤ÎÍ×µá¤Ï¡¢
.RS
.nf
.sp .5
\fIsrc > dst: id op? flags qtype qclass name (len)\fP
.sp .5
\f(CWh2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37)\fR
.sp .5
.fi
¤Î¤è¤¦¤Ê·Á¼°¤Ç¤¢¤ë¡£
.RE
¥Û¥¹¥È \fIh2opolo\fP ¤Ï \fIhelios\fP ¤Î¥É¥á¥¤¥ó¥Í¡¼¥à¥µ¡¼¥Ð¤ËÂФ·¤Æ¡¢
\fIucb-bax.berkeley.edu.\fP ¤È¤¤¤¦Ì¾Á°¤Ë¤Ä¤¤¤Æ¤Î¥¢¥É¥ì¥¹¥ì¥³¡¼¥É(qtype=A)¤ò¿Ò¤Í¤ë¡£
Ì䤤¹ç¤ï¤»¤Î id ¤Ï `3'¡£`+'¤ÏºÆµ¢²Äǽ(\fIrecursion desired\fP)¥Õ¥é¥°¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¤³¤È¤ò¼¨¤¹¡£
Ì䤤¹ç¤ï¤»¤Ï UDP ¤È IP ¤Î¥Ø¥Ã¥À¤Ï´Þ¤Þ¤á¤º¤Ë 37¥Ð¥¤¥È¤¢¤ë¡£
Ìä¹ç¤»¤Ïɸ½àŪ¤Ê \fIQuery\fP ¤Ê¤Î¤Ç op ¥Õ¥£¡¼¥ë¥É¤Ï¾Êά¤µ¤ì¤Æ¤¤¤ë¡£
¤â¤·¡¢op ¥Õ¥£¡¼¥ë¥É¤ò»ý¤Ä¤Ê¤é¡¢¤½¤ì¤¬¤Ê¤ó¤Ç¤¢¤ì¡¢`3' ¤È `+' ¤Î´Ö¤Ëɽ¼¨¤¹¤ë¡£
¤Þ¤¿Æ±Íͤˡ¢Ìä¹ç¤»¥¯¥é¥¹(qclass)¤âɸ½àŪ¤Ê \fIC_IN\fP ¤Ê¤Î¤Ç¡¢¾Êά¤µ¤ì¤Æ¤¤¤ë¡£
¤Û¤«¤ÎÌä¹ç¤»¥¯¥é¥¹¤Î¾ì¹ç¤Ï `A' ¤Ë³¤¤¤Æɽ¼¨¤¹¤ë¡£
.LP
Î㳰Ū¤Ê¤â¤Î¤ò¸¡½Ð¤·¤¿¾ì¹ç¡¢ÄɲäΥե£¡¼¥ë¥É¤ò[ ] ¤Ç°Ï¤ó¤Çɽ¼¨¤¹¤ë¤À¤í
¤¦:¤â¤·Ìä¹ç¤»(query)¤Ë²óÅú¡¢¥Í¡¼¥à¥µ¡¼¥Ð¡¢¸¢°Ò¥»¥¯¥·¥ç¥ó¤¬´Þ¤Þ¤ì¤ë¾ì¹ç¡¢
.IR ancount ,
.IR nscount ,
.I arcount
¤Ï¤½¤ì¤¾¤ì\fIn\fP ¤ò¥«¥¦¥ó¥È¿ô¤È¤·¤Æ¡¢
`[\fIn\fPa]'¡¢`[\fIn\fPn]' ¤« `[\fIn\fPau]' ¤Î¤è¤¦¤Ëɽ¼¨¤µ¤ì¤ë¡£
¤â¤·¡¢ÂèÆ󤪤è¤ÓÂè»°¥Ð¥¤¥È¤Ë¤¤¤¯¤Ä¤«¤Î±þÅúbit¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë(AA¡¢RA ¤«
¤Þ¤¿¤Ï rcode)¾ì¹ç¤«¡¢`must be zero' ¥Ó¥Ã¥È¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¾ì¹ç¤Ï
`[b2&3=\fIx\fP]'¤Èɽ¼¨¤¹¤ë¡£¤³¤³¤Ç \fIx\fP ¤Ï¥Ø¥Ã¥À¤ÎÂèÆ󤪤è¤ÓÂè»°¥Ð¥¤¥È¤Î 16 ¿Êɽ¸½¤Ç¤¢¤ë¡£
.HD
UDP ¥Í¡¼¥à¥µ¡¼¥Ð±þÅú
.LP
¥Í¡¼¥à¥µ¡¼¥Ð¤«¤é¤Î±þÅú¤Ï¡¢
.RS
.nf
.sp .5
\fIsrc > dst:  id op rcode flags a/n/au type class data (len)\fP
.sp .5
\f(CWhelios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273)
helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97)\fR
.sp .5
.fi
¤Î¤è¤¦¤Ê·Á¼°¤Ç¤¢¤ë¡£
.RE
ºÇ½é¤ÎÎã¤Ç¤Ï¡¢\fIhelios\fP ¤Ï \fIh2opolo\fP ¤Î id 3 ¤ÎÍ×µá¤Ë»°¸Ä¤Î²óÅú
¥ì¥³¡¼¥É¡¢»°¸Ä¤Î¥Í¡¼¥à¥µ¡¼¥Ð¥ì¥³¡¼¥É¤È¼·¸Ä¤Î¸¢°Ò¥ì¥³¡¼¥É¤òÊÖÅú¤·¤Æ¤¤¤ë¡£
ºÇ½é¤Î²óÅú¤Ï A ¥ì¥³¡¼¥É¤Ç¡¢¤³¤Î¥Ç¡¼¥¿¤Ï¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥¢¥É¥ì¥¹¤Î 128.32.137.3 ¤Ç¤¢¤ë¡£
±þÅú¤Î¥µ¥¤¥º¤Ï UDP ¤È IP ¤Î¥Ø¥Ã¥À¤Ï´Þ¤Þ¤º¤Ë 273 ¥Ð¥¤¥È¤Ç¤¢¤ë¡£
(query¤Î) op ¤È response code(¤³¤Î¾ì¹ç¤Ï NoError)¤Ï¡¢A ¥ì¥³¡¼¥É¤Î¥¯¥é
¥¹(C_IN)¤ÈƱÍͤ˾Êά¤µ¤ì¤Æ¤¤¤ë¡£
.LP
¼¡¤ÎÎã¤Ï \fIhelios\fP ¤Ï¥É¥á¥¤¥ó¤¬Â¸ºß¤·¤Ê¤¤¡¢¤È¤¤¤¦ response code
(NXDomain) ¤Ç²óÅú¤Ï¤Ê¤·¡¢¥Í¡¼¥à¥µ¡¼¥Ð¤Ï°ì¸Ä¡¢¸¢°Ò¥ì¥³¡¼¥É¤â¤Ê¤·¡¢¤È¤¤¤¦ÊÖÅú¤ò¤·¤Æ¤¤¤ë¡£
`*' ¤Ï \fIauthoritative answer\fP ¥Ó¥Ã¥È¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¤³¤È¤ò¼¨¤¹¡£
²óÅú¤¬¤Ê¤¤¤Î¤Ç¡¢ type ¤È¥¯¥é¥¹¤ª¤è¤Ó¥Ç¡¼¥¿¤Ïɽ¼¨¤µ¤ì¤Ê¤¤¡£ 
.LP
¤Û¤«¤Î¥Õ¥é¥°¤Ï`\-'(RA(ºÆµ¢²Ä)¤¬ÀßÄꤵ¤ì¤Æ\fI¤¤¤Ê¤¤\fP)¡¢`|'TC(¤Þ¤ë¤á¤é
¤ì¤¿¥á¥Ã¥»¡¼¥¸)¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¡£`question' ¥»¥¯¥·¥ç¥ó¤¬°ì¤Ä¤Ç¤Ê¤¤¾ì¹ç
¤Ë¤Ï¡¢`[\fIn\fPq]'¤È½ÐÎϤ¹¤ë¡£
.LP
¥Í¡¼¥à¥µ¡¼¥Ð¤Î±þÅú¤Ï¥Ç¥Õ¥©¥ë¥È¤Î \fIsnaplen\fP ¤Ç¤¢¤ë 68 ¥Ð¥¤¥È¤è¤ê¤âÂ礭¤¯¤Ê¤ê¤¬¤Á¤Ê¤Î¤Ç¡¢
¤½¤Î¥Ñ¥±¥Ã¥È¤òɽ¼¨¤¹¤ë¤Î¤Ë½½Ê¬¤Ê¤À¤±¤Î¾ðÊó¤òª¤¨¤­¤ì¤Ê¤¤¤³¤È¤¬¤¢¤ë¡£
¥Í¡¼¥à¥µ¡¼¥Ó¥¹¤ÎÄÌ¿®¤ò¸·Ì©¤Ë²òÀϤ·¤¿¤¤¤È¤­¤Ï¡¢\fB\-s\fP ¥Õ¥é¥°¤òÍøÍѤ·¤Æ snaplen ¤ò³ÈÄ¥¤¹¤ë¤Ù¤­¤Ç¤¢¤ë¡£
\fB\`-s 128\fP'¤¯¤é¤¤¤¬ÂÅÅö¤Ç¤¢¤í¤¦¡£

.HD
SMB/CIFS Ÿ³«
.LP
tcpdump ¤Ï UDP/137, UDP/138, TCP/139 ¤ËÂФ¹¤ëÈæ³ÓŪÂ絬ÌÏ¤Ê SMB/CIFS/NBT ¥Ç¥³¡¼¥Éµ¡Ç½¤ò»ý¤Ä¡£
IPX ¤È NetBEUI SMB ¤ò¥Ç¥³¡¼¥É¤¹¤ëÍ×ÁǤ⤢¤ë¡£

¥Ç¥Õ¥©¥ë¥È¤Ç¤ÏÈæ³ÓŪ¾®µ¬ÌϤʥǥ³¡¼¥É¤¬¹Ô¤ï¤ì¡¢
-v ¥ª¥×¥·¥ç¥ó¤òÍѤ¤¤ë¤ÈÍÚ¤«¤Ë¾ÜºÙ¤Ê¥Ç¥³¡¼¥É¤¬¹Ô¤ï¤ì¤ë¡£
-v ¥ª¥×¥·¥ç¥óÉÕ¤­¤Î¾ì¹ç¡¢¤Ò¤È¤Ä¤Î SMB ¥Ñ¥±¥Ã¥È¤¬ 1 ²èḬ̀ʾå¤Î¾ðÊó¤ò½Ð¤¹¾ì¹ç¤â¤¢¤ë¤Î¤Ç¡¢
ËÜÅö¤ËɬÍפʾì¹ç¤Î¤ß -v ¥ª¥×¥·¥ç¥ó¤ò¤Ä¤±¤ë¤³¤È¡£

UNICODE ʸ»úÎó¤ò´Þ¤à SMB ¥»¥Ã¥·¥ç¥ó¤ò¥Ç¥³¡¼¥É¤¹¤ë¾ì¹ç¤Ï¡¢
´Ä¶­ÊÑ¿ô USE_UNICODE ¤Ë 1 ¤ò¥»¥Ã¥È¤·¤¿¤Û¤¦¤¬¤¤¤¤¤«¤â¤·¤ì¤Ê¤¤¡£
UNICODE ʸ»úÎó¤ò¼«Æ°¸¡½Ð¤¹¤ë¥Ñ¥Ã¥Á¤Ï´¿·Þ¤¹¤ë¡£

SMB ¥Ñ¥±¥Ã¥È¤Î·Á¼°¤ä all te¥Õ¥£¡¼¥ë¥É¤¬²¿¤ò°ÕÌ£¤¹¤ë¤«¤Î¾ðÊó¤Ï¡¢
www.cifs.org ¤« samba.org ¥ß¥é¡¼¥µ¥¤¥È¤Î pub/samba/specs/ ¥Ç¥£¥ì¥¯¥È¥ê¤ò»²¾È¤Î¤³¤È¡£
SMB ¥Ñ¥Ã¥Á¤Ï Andrew Tridgell (tridge@samba.org) ¤¬½ñ¤¤¤¿¡£

.HD
NFS Í×µá¤È²óÅú
.LP
Sun NFS(Network File System)¤ÎÍ×µá¤È±þÅú¤Ï¼¡¤Î¤è¤¦¤Ë½ÐÎϤµ¤ì¤ë:
.RS
.nf
.sp .5
\fIsrc.xid > dst.nfs: len op args\fP
\fIsrc.nfs > dst.xid: reply stat len op results\fP
.sp .5
\f(CW
sushi.6709 > wrl.nfs: 112 readlink fh 21,24/10.73165
wrl.nfs > sushi.6709: reply ok 40 readlink "../var"
sushi.201b > wrl.nfs:
        144 lookup fh 9,74/4096.6878 "xcolors"
wrl.nfs > sushi.201b:
        reply ok 128 lookup fh 9,74/4134.3150
\fR
.sp .5
.fi
.RE
°ì¹ÔÌܤϥۥ¹¥È \fIsushi\fP ¤¬ id \fI6709\fP ¤Ç¥È¥é¥ó¥¶¥¯¥·¥ç¥óÍ×µá¤ò \fIwrl\fP ¤ËÁ÷¿®¤·¤Æ¤¤¤ë (src ¥Û¥¹¥È¤Ë³¤¯¿ô»ú¤Ï port ÈÖ¹æ \fI¤Ç¤Ï¤Ê¤¯¤Æ\fP ¥È¥é¥ó¥¶¥¯¥·¥ç¥ó id ¤Ç¤¢¤ëÅÀ¤ËÃí°Õ¤»¤è)¡£
Í×µá¤Ï UDP ¤È IP ¤Î¥Ø¥Ã¥À¤ò½ü¤¤¤Æ 112 ¥Ð¥¤¥È¤Ç¤¢¤ë¡£Æ°ºîÍ×µá¤Ï¥Õ¥¡¥¤¥ë¥Ï¥ó¥É¥ë(\fIfh\fP) 21,24/10.731657119 ¤ËÂФ¹¤ë \fIreadlink\fP (¥·¥ó¥Ü¥ê¥Ã¥¯¥ê¥ó¥¯¤ÎÃͤòÆɤà)¤Ç¤¢¤ë¡£
(¤³¤ÎÎã¤Ç¤Ï¡¢¹¬±¿¤Ê¤³¤È¤Ë¡¢¥Ç¥Ð¥¤¥¹¤Î major ¤ª¤è¤Ó minor ÈÖ¹æ¤ÎÂÐ¤È 
inode Èֹ桢generation Èֹ椬¥Õ¥¡¥¤¥ë¥Ï¥ó¥É¥ë¤«¤éÃê½Ð¤Ç¤­¤Æ¤¤¤ë)
\fIWrl\fP ¤Ï¥ê¥ó¥¯¤ÎÆâÍÆ¤È `ok' ¤òÊÖÅú¤·¤Æ¤¤¤ë¡£
.LP
»°¹ÔÌÜ¤Ç¤Ï \fIsushi\fP ¤Ï \fIwrl\fP ¤ËÂФ· ¥Ç¥£¥ì¥¯¥È¥ê¥Õ¥¡¥¤¥ë 9,74/4096.8678 ¤«¤é 
`\fIxcolors\fP' ¤òõ¤·½Ð¤¹¤è¤¦¤ËÍ׵ᤷ¤Æ¤¤¤ë¡£
½ÐÎϤµ¤ì¤ë¥Ç¡¼¥¿¤ÏÁàºî¤Î¼ïÎà¤Ë¤è¤Ã¤Æ°Í¸¤·¤Æ¤¤¤ë¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
¤³¤Î½ÐÎÏ·Á¼°¤Ï NFS ¥×¥í¥È¥³¥ë»ÅÍͤȤȤâ¤ËÆɤó¤À¾ì¹ç¤Ë¼«¸ÊÀâÌÀ¤Ë¤Ê¤ë¤è¤¦°Õ¿Þ¤µ¤ì¤¿·Á¼°¤Ç¤¢¤ë¡£
.LP
-v(verbose) ¥Õ¥é¥°¤¬Í¿¤¨¤é¤ì¤Æ¤¤¤ë¾ì¹ç¡¢ÄɲäξðÊó¤â½ÐÎϤµ¤ì¤ë¡£Îã:
.RS
.nf
.sp .5
\f(CW
sushi.1372a > wrl.nfs:
        148 read fh 21,11/12.195 8192 bytes @ 24576
wrl.nfs > sushi.1372a:
        reply ok 1472 read REG 100664 ids 417/0 sz 29388
\fP
.sp .5
.fi
.RE
(\-v ¤Ï IP ¥Ø¥Ã¥À¤Î TTL ¤È ID¡¢¥Õ¥é¥°¥á¥ó¥Æ¡¼¥·¥ç¥ó¥Õ¥£¡¼¥ë¥É¤âɽ¼¨¤¹¤ë
¤¬¡¢¤³¤ÎÎã¤Ç¤Ï¾Êά¤·¤Æ¤¤¤ë)¡£°ì¹ÔÌܤǤϡ¢\fIsushi\fP ¤Ï \fIwrl\fP ¤ËÂФ·¤Æ¡¢ file 21,11/12.195 ¤Î¥Ð¥¤¥È¥ª¥Õ¥»¥Ã¥È 24576 ¤«¤é 8192 ¥Ð¥¤¥ÈÆɤ߽Ф·Í×µá¤ò½Ð
¤·¤Æ¤¤¤ë¡£\fIWrl\fP ¤Ï `ok' ¤òÊÖ¤·¤Æ¤¤¤ë; Æó¹ÔÌܤËɽ¼¨¤µ¤ì¤Æ¤¤¤ë¤³¤Î¥Ñ
¥±¥Ã¥È¤Ï¥Õ¥é¥°¥á¥ó¥È²½¤µ¤ì¤¿ÊÖÅú¤Î°ìÈÖÌܤΥѥ±¥Ã¥È¤Ç¤¢¤ë¤¿¤á¡¢1472 ¥Ð
¥¤¥È¤Î¤ß¤Ç¤¢¤ë(»Ä¤ê¤Î¥Ð¥¤¥È¤Ï¤½¤Î¸å¤Î¥Õ¥é¥°¥á¥ó¥È¤È¤·¤Æ³¤¯¤¬¡¢¤½¤ì¤é
¤Î¥Õ¥é¥°¥á¥ó¥È¤Ï NFS ¥Ø¥Ã¥À¤â UDP ¥Ø¥Ã¥À¤â»ý¤¿¤Ê¤¤¤Î¤Ç¡¢¥Õ¥£¥ë¥¿¾ò·ï¼°¤Î»ØÄ꼡Âè¤Çɽ¼¨¤µ¤ì¤Ê¤¤¤³¤È¤¬¤¢¤ë)¡£
¤Þ¤¿ \-v ¥Õ¥é¥°¤¬¤¢¤¿¤¨¤é¤ì¤Æ¤¤¤ë¤³¤È¤Ë¤è¤ê¡¢¤¤¤¯¤Ä¤«¤Î¥Õ¥¡¥¤¥ë¤Î°À­
¤âɽ¼¨¤µ¤ì¤ë(¥Õ¥¡¥¤¥ë¥Ç¡¼¥¿¤ËÉղä·¤ÆÊÖÅú¤µ¤ì¤ë): ¥Õ¥¡¥¤¥ë¤Î¥¿¥¤¥×
(``REG'' ¤ÏÉáÄ̤Υե¡¥¤¥ë)¡¢¥Õ¥¡¥¤¥ë¤Î¥â¡¼¥É(Ȭ¿Ê¤Ç)¡¢uid ¤È gid¡¢¤Þ¤¿¥Õ¥¡¥¤¥ë¤Î¥µ¥¤¥º¤Ê¤É¡£
.LP
\-v ¥Õ¥é¥°¤¬Ê£¿ôÍ¿¤¨¤é¤ì¤ë¤È(\-vv¤Î¤³¤È)¤â¤Ã¤È¾ÜºÙ¤Ê¾ðÊ󤬽ÐÎϤµ¤ì¤ë¡£
.LP
NFS ¤ÎÍ×µá¤Ï¤È¤Æ¤âÂ礭¤¤¤Î¤Ç¡¢snaplen ¤òÁý²Ã¤·¤Ê¤¤¤È½½Ê¬¤Ê¾ðÊó¤¬É½¼¨¤Ç
¤­¤Ê¤¤¤«¤â¤·¤ì¤Ê¤¤¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
NFS ¤ÎÄÌ¿®¤ò´Æ»ë¤¹¤ë¾ì¹ç¤Ï `\fB\-s 192\fP' ¤ò»î¤·¤Æ¤ß¤ë¤È¤è¤¤¡£
.LP
NFS¤ÎÊÖÅú¥Ñ¥±¥Ã¥È¤Ï RPCÁàºî¤Ë¤è¤Ã¤Æ¼±Ê̤¹¤ë¤³¤È¤¬¤Ç¤­¤Ê¤¤¡£¤·¤«¤·¤Ê¤¬
¤é¡¢\fItcpdump\fP ¤Ï ``ºÇ¶á¤Î''Í×µá¤ò³Ð¤¨¤Æ¤ª¤¤¤Æ¡¢ÊÖÅú¤¬¤½¤Î¥È¥é¥ó¥¶
¥¯¥·¥ç¥ó ID¤Ë°ìÃפ¹¤ë¤«Ä´¤Ù¤ë¡£±þÅú¤¬Âбþ¤¹¤ëÍ×µá¤Î¶á¤¯¤ËÄÌ¿®¤µ¤ì¤Æ¤¤¤Ê¤¤¾ì¹ç¤Ï¤­¤Á¤ó¤È²òÀϤǤ­¤Ê¤¤¤«¤â¤·¤ì¤Ê¤¤¡£
.HD
AFS Í×µá¤È±þÅú
.LP
Transarc AFS (Andrew File System) Í×µá¤È±þÅú¤Ï°Ê²¼¤Î¤è¤¦¤Ëɽ¼¨¤µ¤ì¤ë¡£
.HD
.RS
.nf
.sp .5
\fIsrc.sport > dst.dport: rx packet-type\fP
\fIsrc.sport > dst.dport: rx packet-type service call call-name args\fP
\fIsrc.sport > dst.dport: rx packet-type service reply call-name args\fP
.sp .5
\f(CW
elvis.7001 > pike.afsfs:
        rx data fs call rename old fid 536876964/1/1 ".newsrc.new"
        new fid 536876964/1/1 ".newsrc"
pike.afsfs > elvis.7001: rx data fs reply rename
\fR
.sp .5
.fi
.RE
ºÇ½é¤Î¹Ô¤Ç¡¢¥Û¥¹¥È elvis ¤Ï RX ¥Ñ¥±¥Ã¥È¤ò pike ¤ËÁ÷¿®¤·¤Æ¤¤¤ë¡£
¤³¤ì¤Ï fs (¥Õ¥¡¥¤¥ë¥µ¡¼¥Ð) ¥µ¡¼¥Ó¥¹¤Ø¤Î RX ¥Ç¡¼¥¿¥Ñ¥±¥Ã¥È¤Ç¡¢
RPC ¸Æ¤Ó½Ð¤·¤Î³«»Ï¤Ç¤¢¤ë¡£
RPC ¸Æ¤Ó½Ð¤·¤Ï¥ê¥Í¡¼¥à¤Ç¡¢¸Å¤¤¥Ç¥£¥ì¥¯¥È¥ê¥Õ¥¡¥¤¥ë ID ¤Ï 536876964/1/1¡¢
¸Å¤¤¥Õ¥¡¥¤¥ë̾¤Ï`.newsrc.new'¡¢
¿·¤·¤¤¥Ç¥£¥ì¥¯¥È¥ê¥Õ¥¡¥¤¥ë ID ¤Ï 536876964/1/1¡¢
¿·¤·¤¤¥Õ¥¡¥¤¥ë̾¤Ï `.newsrc' ¤Ç¤¢¤ë¡£
¥Û¥¹¥È pike ¤Ï ¥ê¥Í¡¼¥à¸Æ¤Ó½Ð¤·¤ËÂФ¹¤ë RPC ±þÅú¥Ñ¥±¥Ã¥È
(¥Ç¡¼¥¿¥Ñ¥±¥Ã¥È¤Ç¤¢¤ê¡¢ÃæÃǥѥ±¥Ã¥È¤Ç¤Ï¤Ê¤¤¤Î¤ÇÀ®¸ù¤ò°ÕÌ£¤¹¤ë)
¤òÊÖ¿®¤·¤Æ¤¤¤ë¡£
.LP
°ìÈ̤ˡ¢Á´¤Æ¤Î AFS RPC ¤Ï¾¯¤Ê¤¯¤È¤â RPC ¸Æ¤Ó½Ð¤·Ì¾¤Ï¥Ç¥³¡¼¥É¤µ¤ì¤ë¡£
¤Û¤È¤ó¤É¤Î AFC RPC ¤Ï¾¯¤Ê¤¯¤È¤â¤¤¤¯¤Ä¤«¤Î°ú¿ô¤Ï¥Ç¥³¡¼¥É¤µ¤ì¤ë
(°ìÈÌ¤Ë `¶½Ì£¿¼¤¤' °ú¿ô¤Î¤ß¤¬¥Ç¥³¡¼¥É¤µ¤ì¤ë)¡£
.LP
ɽ¼¨¥Õ¥©¡¼¥Þ¥Ã¥È¤Ï¼«¸ÊÀâÌÀŪ¤Ê¤â¤Î¤òÌܻؤ·¤Æ¤¤¤ë¤¬¡¢
AFS ¤È RX ¤ÎÆ°ºî¤Ë¾Ü¤·¤¯¤Ê¤¤¿Í¡¹¤Ë¤È¤Ã¤Æ¤Ï¤ª¤½¤é¤¯ÊØÍø¤Ç¤Ï¤Ê¤¤¤À¤í¤¦¡£
.LP
-v (¾ÜºÙ) ¥ª¥×¥·¥ç¥ó¤¬ 2 ²ó»ØÄꤵ¤ì¤ë¤È¡¢ÄɲþðÊó¤¬É½¼¨¤µ¤ì¤ë¡£
¤³¤ì¤Ï RX ¸Æ¤Ó½Ð¤· ID¡¢¸Æ¤Ó½Ð¤·Èֹ桢¥·¡¼¥±¥ó¥¹Èֹ桢¥·¥ê¥¢¥ëÈֹ桢RX ¥Ñ¥±¥Ã¥È¥Õ¥é¥°¤Ê¤É¤Ç¤¢¤ë¡£
.LP
¤µ¤é¤Ë -v ¥ª¥×¥·¥ç¥ó¤¬»ØÄꤵ¤ì¤ë¤È¡¢¥»¥­¥å¥ê¥Æ¥£¥¤¥ó¥Ç¥Ã¥¯¥¹¤È¥µ¡¼¥Ó¥¹ ID ¤¬É½¼¨¤µ¤ì¤ë¡£
.LP
ÃæÃǥѥ±¥Ã¥È¤Î¥¨¥é¡¼¥³¡¼¥É¤âɽ¼¨¤µ¤ì¤ë¡£
⤷¡¢Ubik ¥Ó¡¼¥³¥ó¥Ñ¥±¥Ã¥È¤ÏÎã³°¤Ç¤¢¤ë¡£
(¤Ê¤¼¤Ê¤é¡¢Ubik ¥×¥í¥È¥³¥ë¤Ë¤ª¤±¤ëÃæÃǥѥ±¥Ã¥È¤Ï»¿À®É¼¤ò°ÕÌ£¤¹¤ë¤«¤é¤Ç¤¢¤ë)¡£
.LP
AFS Í×µá¤ÏÈó¾ï¤ËÂ礭¤¯¡¢
¿¤¯¤Î°ú¿ô¤Ï\fIsnaplen\fP¤òÁý¤ä¤µ¤Ê¤¤¤È¤ª¤½¤é¤¯É½¼¨¤µ¤ì¤Ê¤¤¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È¡£
AFS ÄÌ¿®¤ò´Æ»ë¤¹¤ë¾ì¹ç¤Ï `\fB-s 256\fP' ¤ò»î¤·¤Æ¤ß¤ë¤È¤è¤¤¡£
.LP
AFS ±þÅú¥Ñ¥±¥Ã¥È¤ÏÌÀ¼¨Åª¤Ë RPC Áàºî¤ò¼±Ê̤·¤Ê¤¤¡£
Âå¤ï¤ê¤Ë¡¢\fItcpdump\fP¤Ï``ºÇ¶á¤Î''Í×µá¤ò³Ð¤¨¤Æ¤¤¤Æ¡¢
¤½¤ì¤ò¸Æ¤Ó½Ð¤·ÈÖ¹æ¤È¥µ¡¼¥Ó¥¹ ID ¤òÍѤ¤¤Æ±þÅú¤È¾È¹ç¤µ¤»¤ë¡£
¤â¤·±þÅú¤¬Âбþ¤¹¤ëÍ×µá¤È·ë¤ÓÉÕ¤±¤é¤ì¤Ê¤«¤Ã¤¿¾ì¹ç¡¢¤½¤Î¥Ñ¥±¥Ã¥È¤Ï¥Ñ¡¼¥º¤Ç¤­¤Ê¤¤¡£

.HD
KIP Appletalk (UDP Æâ DDP)
.LP
UDP ¥Ç¡¼¥¿¥°¥é¥àÆâ¤Ë³ÊǼ¤µ¤ì¤¿¥¢¥Ã¥×¥ë¥È¡¼¥¯¤Î DDP ¥Ñ¥±¥Ã¥È¤Ï¼è¤ê½Ð¤µ¤ì¤Æ¡¢
DDP ¥Ñ¥±¥Ã¥È¤È¤·¤Æɽ¼¨¤µ¤ì¤ë(¤¹¤Ê¤ï¤Á¤¹¤Ù¤Æ¤Î UDP ¥Ø¥Ã¥À¾ðÊó¤Ï¼Î¤Æ¤é¤ì¤ë)¡£
.I /etc/atalk.names 
¥Õ¥¡¥¤¥ë¤¬ ¥¢¥Ã¥×¥ë¥È¡¼¥¯¥Í¥Ã¥È¤È¥Î¡¼¥ÉÈÖ¹æ¤ò̾Á°¤ËÊÑ´¹¤¹¤ë¤Î¤ËÍøÍѤµ¤ì¤ë¡£
¥Õ¥¡¥¤¥ë¤Î·Á¼°¤Ï²¼µ­¤ÎÄ̤ꡣ
.RS
.nf
.sp .5
\fIÈÖ¹æ         ̾Á°\fP

\f(CW1.254      ether
16.1            icsd-net
1.254.110       ace\fR
.sp .5
.fi
.RE
ºÇ½é¤ÎÆó¹Ô¤Ï¥¢¥Ã¥×¥ë¥È¡¼¥¯¥Í¥Ã¥È¥ï¡¼¥¯¤Ë̾Á°¤òÍ¿¤¨¤ë¡£»°¹ÔÌܤÏÆÃÄê¤Î¥Û¥¹¥È¤Î̾Á°¤òÍ¿¤¨¤ë(¥Û¥¹¥È¤Ï¥Í¥Ã¥È¥ï¡¼¥¯ÈÖ¹æ¤ÎÂè»°¥ª¥¯¥Æ¥Ã¥È¤Ç¼±Ê̤µ¤ì¤ë \- 
¥Í¥Ã¥È¥ï¡¼¥¯ÈÖ¹æ¤ÏÆ󥪥¯¥Æ¥Ã¥È¤Ç \fI¤Ê¤±¤ì¤Ð¤Ê¤é¤º\fP¡¢¤Þ¤¿¥Û¥¹¥ÈÈÖ
¹æ¤Ï»°¥ª¥¯¥Æ¥Ã¥È¤Ç \fI¤Ê¤±¤ì¤Ð¤Ê¤é¤Ê¤¤\fP¡£ÈÖ¹æ¤È̾Á°¤Ï¶õÇòʸ»ú¤Ç¶èÀÚ¤é¤ì¤ë(blank ¤« tab)¡£
.I /etc/atalk.names 
¥Õ¥¡¥¤¥ë¤Ï¶õ¹Ô¤È¥³¥á¥ó¥È¹Ô(`#'¤Ç»Ï¤Þ¤ë¹Ô)¤ò´Þ¤ó¤Ç¤â¤è¤¤¡£
.LP
¥¢¥Ã¥×¥ë¥È¡¼¥¯¤Î¥¢¥É¥ì¥¹¤Ï¼¡¤Î·Á¼°¤Çɽ¼¨¤µ¤ì¤ë¡£
.RS
.nf
.sp .5
\fInet.host.port\fP

\f(CW144.1.209.2 > icsd-net.112.220
office.2 > icsd-net.112.220
jssmag.149.235 > icsd-net.2\fR
.sp .5
.fi
.RE
(
.I /etc/atalk.names
¤¬¤Ê¤¤¾ì¹ç¤Þ¤¿¤Ï¤½¤ì¤ËŬÀڤʥ¢¥Ã¥×¥ë¥È¡¼¥¯¤Î¥Í¥Ã¥ÈÈֹ桢¥Û¥¹¥ÈÈֹ椬´Þ¤Þ¤ì¤Ê¤¤¾ì¹ç¤Ï¡¢¥¢¥É¥ì¥¹¤Ï¿ô»ú¤Çɽ¼¨¤µ¤ì¤ë)¡£
ºÇ½é¤ÎÎã¤Ï ¥Í¥Ã¥È¥ï¡¼¥¯ 144.1 ¤Î¥Î¡¼¥É 209 ¤Î NBP(DDP ¤Î¥Ý¡¼¥ÈÈÖ¹æ 2 )¤«¤é¥Í¥Ã¥È¥ï¡¼¥¯ icsd ¤Î¥Î¡¼¥É 112 ¥Ý¡¼¥ÈÈÖ¹æ220 È֤ؤÎÁ÷¿®¤ò¼¨¤¹¡£
ÆóÈÖÌܤâƱÍͤÀ¤¬¡¢¥Î¡¼¥É̾(`office') ¤¬¤ï¤«¤Ã¤Æ¤¤¤ë¾ì¹ç¤ÎÎã¡£
»°¹ÔÌܤϥͥåȥ¥¯ jssmag ¤Î¥Î¡¼¥É 149 ¤Î 235 È֥ݡ¼¥È¤«¤é icsd-net ¤Î NBP¥Ý¡¼¥È¤Ø¤Î¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤ò¼¨¤¹¡£
¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¥¢¥É¥ì¥¹(255)¤Ï¥Û¥¹¥ÈÈÖ¹æ¤òȼ¤ï¤Ê¤¤¥Í¥Ã¥È¥ï¡¼¥¯Ì¾¤À¤±¤Î½Ð
ÎϤǼ±Ê̤Ǥ­¤ë¤³¤È¤ËÃí°Õ¤¹¤ë¤³¤È \- /etc/atalk.names ¤Ë¥Î¡¼¥É̾¤È¥Í¥Ã
¥È¥ï¡¼¥¯Ì¾¤òµ­½Ò¤·¤Æ¤ª¤¯¤Î¤Ï¤è¤¤¹Í¤¨¤Ç¤¢¤ë)¡£
.LP
NBP(̾Á°²ò·è¥×¥í¥È¥³¥ë)¤È ATP(¥¢¥Ã¥×¥ë¥È¡¼¥¯¥È¥é¥ó¥¶¥¯¥·¥ç¥ó¥×¥í¥È¥³¥ë)¥Ñ¥±¥Ã¥È¤Ë¤Ä¤¤¤Æ¤Ï¡¢¤½¤ÎÆâÍƤâ²òÀϤµ¤ì¤ë¡£
¤½¤Î¾¤Î¥×¥í¥È¥³¥ë¤Ï¥×¥í¥È¥³¥ë̾(̾Á°¤¬¤ï¤«¤é¤Ê¤±¤ì¤ÐÈÖ¹æ)¤È¥Ñ¥±¥Ã¥È¤Î¥µ¥¤¥º¤¬É½¼¨¤µ¤ì¤ë¤À¤±¤Ç¤¢¤ë¡£

\fBNBP ¥Ñ¥±¥Ã¥È\fP ¤Ï¼¡¤ÎÎã¤Î¤è¤¦¤Ëɽ¼¨¤µ¤ì¤ë:
.RS
.nf
.sp .5
\s-2\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"
jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250
techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fR\s+2
.sp .5
.fi
.RE
°ì¹ÔÌܤϥͥåȥ¥¯ icsd ¤Î ¥Û¥¹¥È 112 ¤«¤é ¥Í¥Ã¥È¥ï¡¼¥¯jssmag ¤Ø¥Ö¥í¡¼¥É¥­¥ã¥¹¥È¤µ¤ì¤ë¥ì¡¼¥¶¥é¥¤¥¿¤òõ¤¹Í×µáÁ÷¿®¤Ç¤¢¤ë¡£nbp ¤Î id ¤Ï 190 ¡£
Æó¹ÔÌܤϤ½¤ÎÍ×µá¤Ø¤Î¥Û¥¹¥È jssmag.209 ¤«¤é¤Î±þÅú(id Èֹ椬Ʊ¤¸¤Ç¤¢¤ë¤³¤È¤ËÃí°Õ)¤Ç¡¢``RM1140''¤È¤¤¤¦Ì¾Á°¤Î¥ì¡¼¥¶¥é¥¤¥¿¤ò 250 È֥ݡ¼¥È¤Ë»ý¤Ã¤Æ¤¤¤ë¤³¤È¤òÅú¤¨¤Æ¤¤¤ë¡£
»°¹ÔÌܤÏƱ¤¸Í×µá¤ËÂФ¹¤ëÊ̤ÎÊÖÅú¤Ç¥Û¥¹¥È techpit ¤¬186È֥ݡ¼¥È¤Ë "tecpit" ¤¬ÅÐÏ¿¤µ¤ì¤Æ¤¤¤ë¤³¤È¤òÅú¤¨¤Æ¤¤¤ë¡£

\fBATP ¥Ñ¥±¥Ã¥È\fP ¤Ï¼¡¤Î¤è¤¦¤Ëɽ¼¨¤µ¤ì¤ë:
.RS
.nf
.sp .5
\s-2\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001
helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:4 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:6 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp*12266:7 (512) 0xae040000
jssmag.209.165 > helios.132: atp-req  12266<3,5> 0xae030001
helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001
jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fR\s+2
.sp .5
.fi
.RE
jssmga.209 ¤Ï¥Û¥¹¥È helios ¤ËÂФ·¤Æ
id 12266 ¤Ç¥È¥é¥ó¥¶¥¯¥·¥ç¥ó¤ò³«»Ï¤·ºÇÂç 8¥Ñ¥±¥Ã¥È(`<0-7>'¤È¼¨¤¹)¤òÍ׵᤹¤ë¡£
¹ÔËö¤Î 16 ¿Ê¿ô»ú¤ÏÍ×µá¤Ë´Þ¤Þ¤ì¤ë `userdata'¤Î¥Õ¥£¡¼¥ë¥É¤Ç¤¢¤ë¡£
.LP
helios ¤ÏȬ¸Ä¤Î 512 ¥Ð¥¤¥È¤Î¥Ñ¥±¥Ã¥È¤òÊÖÅú¤·¤Æ¤¤¤ë¡£¥È¥é¥ó¥¶¥¯¥·¥ç¥óid 
¤Ë³¤¯ `:¿ô»ú' ɽ¸½¤Ï¥È¥é¥ó¥¶¥¯¥·¥ç¥ó¤Ë¤ª¤±¤ë¥Ñ¥±¥Ã¥È¤Î¥·¡¼¥±¥ó¥¹ÈÖ¹æ¤Ç¡¢¥«¥Ã¥³¤Ë°Ï¤Þ¤ì¤¿¿ô»ú¤Ï atp ¥Ø¥Ã¥À¤ò½ü¤¤¤¿¥Ñ¥±¥Ã¥È¤Î¥Ç¡¼¥¿Î̤Ǥ¢¤ë¡£¥Ñ¥±¥Ã¥È 7 È֤Π`*' ¤Ï EOM ¥Ó¥Ã¥È¤¬ÀßÄꤵ¤ì¤Æ¤¤¤ë¤³¤È¤ò¼¨¤¹¡£
.LP
jssmag.209 ¤Ï¥Ñ¥±¥Ã¥È 3 È֤ȥѥ±¥Ã¥È 5 È֤κÆÁ÷¤òÍ׵ᤷ¤Æ¤¤¤ë¡£helios 
¤Ï¤½¤ì¤é¤òºÆÁ÷¤·¡¢jssmag ¤Ï¥È¥é¥ó¥¶¥¯¥·¥ç¥ó¤ò½ªÎ»¤¹¤ë¡£¤½¤·¤Æ¡¢
jssmag.209 ¤Ï¼¡¤ÎÍ×µá¤ò³«»Ï¤¹¤ë¡£Í×µá¤Î `*' ¤Ï XO (`°ì²ó¤À¤±')¤ÏÀßÄê \fI¤µ¤ì¤Æ¤¤¤Ê¤¤\fP ¤³¤È¤ò¼¨¤¹¡£

.HD
IP ¥Õ¥é¥°¥á¥ó¥È²½(fragmentation)
.LP
¥¤¥ó¥¿¡¼¥Í¥Ã¥È¥Ç¡¼¥¿¥°¥é¥à¤Î¥Õ¥é¥°¥á¥ó¥È²½¤µ¤ì¤¿¤â¤Î¤Ï¼¡¤Î¤è¤¦¤Ëɽ¼¨¤¹¤ë¡£
.RS
.nf
.sp .5
\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB+)\fR
\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB)\fR
.sp .5
.fi
.RE
(ºÇ½é¤Î·Á¼°¤Ï¤Þ¤À³¤¯¥Õ¥é¥°¥á¥ó¥È¤¬¤¢¤ë¤³¤È¤ò¼¨¤·¡¢ÆóÈÖÌܤηÁ¼°¤Ï¤½
¤ì¤¬ºÇ¸å¤Î¥Õ¥é¥°¥á¥ó¥È¤Ç¤¢¤ë¤³¤È¤ò¼¨¤¹)
.LP
\fIid\fP ¤Ï¥Õ¥é¥°¥á¥ó¥È¤Î id ¡£\fIsize\fP ¤Ï¥Õ¥é¥°¥á¥ó¥È¤Î IP ¥Ø¥Ã¥À¤ò½ü¤¯¥µ¥¤¥º(¥Ð¥¤¥È¤Ç)¡£\fIoffset\fP ¤Ï¥Õ¥é¥°¥á¥ó¥È¤Î¤â¤È¤â¤È¤Î¥Ç¡¼¥¿¥°¥é¥àÆâ¤Ç¤Î¥ª¥Õ¥»¥Ã¥È(¥Ð¥¤¥È¤Ç)¡£
.LP
¥Õ¥é¥°¥á¥ó¥È¤Î¾ðÊó¤Ï¥Õ¥é¥°¥á¥ó¥ÈËè¤Ëɽ¼¨¤µ¤ì¤ë¡£ºÇ½é¤Î¥Õ¥é¥°¥á¥ó¥È¤Ë¤Ï
¾å°Ì¥×¥í¥È¥³¥ë¤Î¥Ø¥Ã¥À¤ò´Þ¤ß¡¢¥Õ¥é¥°¥á¥ó¥È¾ðÊó¤Ï¥×¥í¥È¥³¥ë¾ðÊó¤Ë³¤¤¤Æ
ɽ¼¨¤µ¤ì¤ë¡£ÆóÈÖÌܰʹߤΥե饰¥á¥ó¥È¤Ë¤Ï¾å°Ì¥×¥í¥È¥³¥ë¤Î¾ðÊó¤ò´Þ¤Þ¤Ê¤¤
¤Î¤Ç¡¢¥Õ¥é¥°¥á¥ó¥È¾ðÊó¤Ï¥½¡¼¥¹¤ª¤è¤Ó¥Ç¥£¥¹¥Æ¥£¥Í¡¼¥·¥ç¥ó¥¢¥É¥ì¥¹¤Ë³¤¤¤Æɽ¼¨¤µ¤ì¤ë¡£
°Ê²¼¤ÎÎã¤Ï CSNET ¤ÇÀܳ¤µ¤ì¤¿ arizona.edu ¤«¤é 
lbl-rtsg.arpa ¤Ø¤Î ftp Àܳ¤Î°ìÉô¤ò¼¨¤¹¤¬¡¢¤³¤ì¤Ë¤Ï 576 ¥Ð¥¤¥È¤Î¥Ç¡¼¥¿¥°¥é¥à¤Ï¤¢¤é¤ï¤ì¤Æ¤¤¤Ê¤¤:
.RS
.nf
.sp .5
\s-2\f(CWarizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+)
arizona > rtsg: (frag 595a:204@328)
rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560\fP\s+2
.sp .5
.fi
.RE
Æó¤Ä¤ÎÃí°ÕÅÀ¤¬¤¢¤ë: °ì¤ÄÌܤȤ·¤Æ¡¢Æó¹ÔÌܤǼ¨¤µ¤ì¤ë¥¢¥É¥ì¥¹¤Ë¤Ï¥Ý¡¼¥È
ÈÖ¹æ¤Ï´Þ¤Þ¤ì¤Æ¤¤¤Ê¤¤ÅÀ¤ËÃí°Õ¤¹¤ë¤³¤È¡£
TCP ¥×¥í¥È¥³¥ë¤Î¾ðÊó¤ÏºÇ½é¤Î¥Õ¥é¥°¥á¥ó¥È¤Ë´Þ¤Þ¤ì¤ë¤¿¤á¡¢
»Ä¤ê¤Î¥Õ¥é¥°¥á¥ó¥È¤«¤é¤Ïɽ¼¨¤¹¤Ù¤­¥Ý¡¼¥ÈÈÖ¹æ¤ä¥·¡¼¥±¥ó¥¹Èֹ椬¤ï¤«¤é¤Ê¤¤¤¿¤á¤Ç¤¢¤ë¡£
Æó¤ÄÌܤϡ¢°ì¹ÔÌܤΠTCP ¤Î¥·¡¼¥±¥ó¥¹¾ðÊó
¤Ë¤Ï¼ÂºÝ¤Ë¤Ï 512 ¥Ð¥¤¥È(ºÇ½é¤Î¥Õ¥é¥°¥á¥ó¥È¤Ç 308 ¥Ð¥¤¥È¡¢ÆóÈÖÌܤΥեé
¥°¥á¥ó¥È¤Ç204 ¥Ð¥¤¥È¤Î¾ì¹ç)¤Î¥æ¡¼¥¶¥Ç¡¼¥¿¤¬ 308 ¥Ð¥¤¥È¤Ç¤¢¤ë¤«¤Î¤è¤¦¤Ë
ɽ¼¨¤µ¤ì¤Æ¤¤¤ëÅÀ¤Ç¤¢¤ë¡£¥·¡¼¥±¥ó¥¹¤Îϳ¤ì¤ä¥Ñ¥±¥Ã¥È¤Î ack ¤ÎÂбþ¤òÄ´ºº
¤¹¤ë¤È¤­¡¢¤³¤³¤ËǺ¤Þ¤µ¤ì¤ë¤³¤È¤¬¤¢¤ë¤«¤â¤·¤ì¤Ê¤¤¡£
.LP
\fI¥Õ¥é¥°¥á¥ó¥È²½¶Ø»ß¥Õ¥é¥°\fP ¤ÎÀßÄꤵ¤ì¤¿¥Ñ¥±¥Ã¥È¤Î¾ì¹ç¡¢¹ÔËö¤Ë \fB(DF)\fP¤Èɽ¼¨¤¹¤ë¡£ 
.HD
»þ´Öɽ¼¨
.LP
¥Ç¥Õ¥©¥ë¥È¤Ç¤ÏÁ´¤Æ¤Î½ÐÎϹԤÎÀèƬ¤Ë¥¿¥¤¥à¥¹¥¿¥ó¥×¤¬¤Ä¤¯¡£¥¿¥¤¥à¥¹¥¿¥ó¥×¤Ï¸½ºß¤Î»þ¹ï¤ò¼¡¤Î·Á¼°¤Çɽ¼¨¤·¡¢
.RS
.nf
\fIhh:mm:ss.frac\fP
.fi
.RE
¤³¤ì¤Ï¡¢kernel ¤Î»þ´Ö¾ðÊóƱÍͤËÀµ³Î¤Ç¤¢¤ë¡£¥¿¥¤¥à¥¹¥¿¥ó¥×¤Ï kernel ¤¬
¥Ñ¥±¥Ã¥È¤ò³Îǧ¤·¤¿»þÅÀ¤Î»þ¹ï¤òÈ¿±Ç¤·¤Æ¤¤¤ë¡£¥¤¡¼¥µ¥Í¥Ã¥È¥¤¥ó¥¿¡¼¥Õ¥§¥¤¥¹
¤¬²óÀþ¤«¤é¥Ñ¥±¥Ã¥È¤ò¼èÆÀ¤·¤¿»þÅÀ¤«¤é¥«¡¼¥Í¥ë¤¬ `¿·¤·¤¤¥Ñ¥±¥Ã¥È' ¤Ë¤è¤ë
³ä¤ê¹þ¤ß¤ò¼õ¤±¤ë»þÅÀ¤Þ¤Ç¤Î»þ´Öº¹¤ÏÈ¿±Ç¤µ¤ì¤Æ¤¤¤Ê¤¤¡£
.SH ´ØÏ¢¹àÌÜ
traffic(1C), nit(4P), bpf(4), pcap(3)
.SH Ãø¼Ô
¸¶Ãø¼Ô¤Ï:
.LP
Van Jacobson,
Craig Leres and
Steven McCanne, all of the
Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
.LP
ºÇ¿·ÈÇ¤Ï tcpdump.org ¤Ë¤è¤Ã¤Æ´ÉÍý¤µ¤ì¤Æ¤¤¤ë¡£
.LP
.RS
.I http://www.tcpdump.org/
.RE
.LP
IPv6/IPsec ¤Î¥µ¥Ý¡¼¥È¤Ï WIDE/KAME ¥×¥í¥¸¥§¥¯¥È¤Ë¤è¤Ã¤ÆÄɲ䵤줿¡£
¤³¤Î¥×¥í¥°¥é¥à¤Ï Eric Young ¤Î SSLeay ¥é¥¤¥Ö¥é¥ê¤òÆÃÄê¤ÎÀßÄê¤Î¸µ¤Ë»ÈÍѤ·¤Æ¤¤¤ë¡£
.SH ¥Ð¥°
ÌäÂêÅÀ¡¢¥Ð¥°¡¢¼ÁÌä¡¢³ÈÄ¥¤Î¤ª´ê¤¤¤Ê¤É¤Ï¡¢°Ê²¼¤Î¥¢¥É¥ì¥¹¤ËÁ÷¤Ã¤Æ¤Û¤·¤¤¡£
.LP
.RS
tcpdump-workers@tcpdump.org
.RE
.LP
¥½¡¼¥¹¥³¡¼¥É¤Î´ó£¤Ê¤É¤Ï°Ê²¼¤Î¥¢¥É¥ì¥¹¤ØÁ÷¤Ã¤Æ¤Û¤·¤¤¡£
.LP
.RS
patches@tcpdump.org
.RE
.LP
NIT ¤Ï³°¤Ø½Ð¤Æ¤¤¤¯ÄÌ¿®¤Ï¸«¤ë¤³¤È¤¬¤Ç¤­¤Ê¤¤¡£BPF ¤Ï¤½¤ì¤¬²Äǽ¤Ç¤¢¤ë¡£¸å¼Ô¤ÎÍøÍѤò¿ä¾©¤¹¤ë¡£
.LP
ÍÑÅӤˤè¤Ã¤Æ¤Ï¡¢IP¥Õ¥é¥°¥á¥ó¥È¤òºÆ¹½ÃÛ¤·¤¿¤ê¡¢¾å°Ì¥×¥í¥È¥³¥ë¤ÎŤµ¤ò·×»»¤¹¤ë¤¯¤é¤¤¤Î¤³¤È¤ÏɬÍפȤʤë¤À¤í¤¦¡£
.LP
¥Í¡¼¥à¥µ¡¼¥Ð¤ÎµÕ°ú¤­Í×µá¤ÏÀµ³Î¤Ëɽ¼¨¤Ç¤­¤Ê¤¤¡£(¶õ¤Î)¼ÁÌä¤Ï¤à¤·¤í²óÅú¤Î
Ãæ¤Ë´Þ¤Þ¤ì¤ëÍ×µá¤È¤·¤Æɽ¼¨¤µ¤ì¤ë¡£µÕ°ú¤­Í×µá¤Ë¤Ï¥Ð¥°¤¬¤Õ¤¯¤Þ¤ì¤Æ¤¤¤Æ¡¢
¤½¤ì¤ò½¤Àµ¤¹¤ë¤Î¤Ï tcpdump ¤Ç¤Ï¤Ê¤¯¤Æ¥Í¡¼¥à¥µ¡¼¥Ó¥¹¤ÎÊý¤Ç¤¢¤ë¤Ù¤­¤È¹Í
¤¨¤Æ¤¤¤ë¿Í¤â¤¤¤ë¡£
.LP
¥¢¥Ã¥×¥ë¤Î EtherTalk ¤Î DDP ¥Ñ¥±¥Ã¥È¤Ï KIP DDP ¥Ñ¥±¥Ã¥È¤Î¤è¤¦¤ËÍÆ°×¤Ë 
dump ¤Ç¤­¤ë¤Ï¤º¤À¤¬¡¢¹Ô¤Ê¤ï¤Ê¤¤¡£¤¿¤È¤¨ ethertalk ¤ò°·¤ª¤¦¤È¤¤¤¦µ¤¤Ë¤Ê¤Ã
¤Æ¤â(¤Ê¤Ã¤Æ¤Ê¤¤¤¬)¡¢LBL¤¬ ¥Í¥Ã¥È¥ï¡¼¥¯¾å¤Îethertalk ¤Ø¤Î¥¢¥¯¥»¥¹¤òµö¤µ
¤Ê¤¤¤Î¤Ç¡¢¥³¡¼¥É¤Î¥Æ¥¹¥È¤¬¤Ç¤­¤Ê¤¤¤Î¤À¡£
.LP
²Æ»þ´Ö¤ËÀÚ¤êÂؤï¤ë¤È¤­¤Ë¥Ñ¥±¥Ã¥È¥È¥ì¡¼¥¹¤ò¹Ô¤Ê¤Ã¤Æ¤¤¤ë¤È»þ´Ö¤¬¤º¤ì¤Æ¤·
¤Þ¤¦(»þ´Ö¤ÎÊѹ¹¤Ï̵»ë¤µ¤ì¤ë)¡£
.LP
FDDI ¥Ø¥Ã¥À¤ËÂФ¹¤ë¥Õ¥£¥ë¥¿¤Î¾ò·ï¼°¤Ï¤¹¤Ù¤Æ¤Î FDDI ¥Ñ¥±¥Ã¥È¤¬¥¤¡¼¥µ¥Í¥Ã¥È
¤Î¥Ñ¥±¥Ã¥È¤ò¥«¥×¥»¥ë²½¤·¤Æ¤¤¤ë¤â¤Î¤È¤ß¤Ê¤·¤ÆŬÍѤµ¤ì¤ë¡£
¤³¤ì¤Ï¡¢IP,ARP ¤È DECNET PhaseIV ¤Ë¤Ä¤¤¤Æ¤ÏÀµ¤·¤¯Æ°ºî¤¹¤ë¤¬¡¢
ISO CLNS ¤Î¤è¤¦¤Ê¥×¥í¥È¥³¥ë¤Ç¤Ï¤¦¤Þ¤¯¤¤¤«¤Ê¤¤¤À¤í¤¦¡£
¤½¤ì¤æ¤¨¤Ë¥Õ¥£¥ë¥¿¡¼¤Ï¾ò·ï¼°¤Ë°ìÃפ·¤Ê¤¤¤è¤¦¤Ê¥Ñ¥±¥Ã¥È¤ò¤¢¤ä¤Þ¤Ã¤Æ
¤¢¤Ä¤«¤Ã¤Æ¤·¤Þ¤¦¤«¤â¤·¤ì¤Ê¤¤¡£
.LP
.B "ip6 proto"
¤Ï¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤òÄÉÀפ¹¤ë¤Ù¤­¤À¤¬¡¢º£¤Î¤È¤³¤í¤½¤¦¤Ï¤Ê¤Ã¤Æ¤¤¤Ê¤¤¡£
.B tcp
¤ä
.B udp
¤â¥Ø¥Ã¥À¥Á¥§¥¤¥ó¤òÄÉÀפ¹¤ë¤Ù¤­¤Ç¤¢¤ë¡£
.LP
\fBtcp[0]\fP¤Î¤è¤¦¤Ê¥È¥é¥ó¥¹¥Ý¡¼¥ÈÁإإåÀ¤ËÂФ¹¤ë»»½Ñɽ¸½¤Ï¡¢
IPv6 ¥Ñ¥±¥Ã¥È¤ËÂФ·¤Æ¤Ï¤¦¤Þ¤¯Æ¯¤«¤Ê¤¤¡£
IPv4 ¥Ñ¥±¥Ã¥È¤ËÂФ·¤Æ¤Î¤ßƯ¤¯¡£