如何收集窥探痕迹

Question

I have to collect the snoop traces of the network packets flowing from a switching element to a UNIX server which are on the same network path. Can you please tell me the procedure to do the same.

PS- The switching element can be accessed from browser(mozilla etc) and can be logged in also(via UNIX server).

Answer 1

The snoop utility is designed to capture network packets. Snoop can be configured to collect network traffic from ANY machine (Microsoft® Windows®, Linux® and UNIX®) and is especially helpful in tracking down network bottlenecks.

snoop -o <output file> machine1 and machine2

This syntax collects packets between machine 1 to machine 2. It ignores network traffic involving other machines.

Note: This snoop will only collect data packets if the machines involved are on the same network switch.

snoop -o <output file> machine1,machine2

Note: This syntax collects ALL the packets that enter and leave those two machines.

snoop -o <output file>

Note: This syntax collects ALL the packets that are on the network. This would include ALL packets to and from other machines as well. Regardless of which syntax is used, the following rules apply:

1.The snoop should run while you reproduce the problem.

2.After reproducing the problem, you end the snoop by hitting <Ctrl C>

for more informations link 1

for more informations link 2