Re: HOW-TO trace ip packets

David Carmean (dave@west.net)
Wed, 15 Nov 1995 09:17:32 -0800 (PST)

On Wed, 15 Nov 1995, Curt Eckhart wrote:

> PM1> ptrace poptop
> Packet Tracing Enabled
>
> But nothing happens after that. What else do I need to do in order to
> see the packet traffic. And, if it doesn't already do this, can I
> direct some of it to the log service.
>

Did you create a filter named "poptop"? You have to
do that first. Here's an example that shows all RIP and ICMP packets.
You have to be sure to "deny" the telnet traffic to the Portmaster or
or it will just start talking to itself.

term1.sba> show filter foo
1 deny 0.0.0.0/0 0.0.0.0/0 tcp src eq 23
2 deny 0.0.0.0/0 0.0.0.0/0 tcp dst eq 23
3 permit 0.0.0.0/0 0.0.0.0/0 udp src eq 520
4 permit 0.0.0.0/0 0.0.0.0/0 udp dst eq 520
5 permit aaa.bbb.ccc.0/19 aaa.bbb.ccc.0/19 icmp

(The IPs have been changed to protect the innocent.)

Then >ptrace foo shows it.

I *wish* you could make it go to syslog, for those infrequent but
maddening problems, but it doesn't seem to.

------------------------------------------------------------------------
David Carmean WB6YZM DC574 dave@west.net
System/Network Administrator, WestNet Communications, Inc.
PGP Key Fingerprint: CD 1C C1 15 3E E3 1D 41 ED C2 3E A8 D6 29 BD C4
------------------------------------------------------------------------