Nettl filters

[Kenneth_18]

Hi,

How do I specify in nettl to monitor packets only in a particular port of a quad ethernet nic?

Also can anyone show me a sample filter I can use and how to use it with nettl so that I could capture packets based on particular ip addresses or port numbers only.

Thanks in advance.

[Steven Gillard_2 · Accepted solution]

I assume you're talking about tcp / udp port numbers here? If so, and you must use nettl/netfmt, the following netfmt filters will work:

filter ip_daddr # destination addr
filter ip_saddr # source addr
filter tcp_sport # source tcp port
filter tcp_dport # dest tcp port
filter udp_sport # source udp port
filter udp_dport # dest udp port

Run man netfmt for a full list. Just put whatever combination of the above you need into a file (remembering that a packet needs to match ALL filters to be allowed through), and then start tracing as follows:

# nettl -tn pduin pduout -e ns_ls_ip -s 1024 | netfmt -lnNF -c

That will dump packets to stdout, you can redirect to a file if necessary. Don't forget to turn off tracing when done with the following command:

# nettl -tf -e ns_ls_ip

Alternatively, get tcpdump or ethereal from the porting centre as I find these tools a lot easier to use on a busy system than nettl:

http://hpux.connect.org.uk/

Regards,
Steve

[T G Manikandan]

this doc should help you

[RolandH]

Thanx TG,

great stuff for nettl.
That saves me to write it down. =;-}}
Thanx.

NO POINTS PLEASE!! ONLY COMMENT

Roland