From owner-freebsd-chat Wed Dec 11 01:29:13 1996 Return-Path: Received: (from root@localhost) by freefall.freebsd.org (8.8.4/8.8.4) id BAA28704 for chat-outgoing; Wed, 11 Dec 1996 01:29:13 -0800 (PST) Received: from genesis.atrad.adelaide.edu.au (genesis.atrad.adelaide.edu.au [129.127.96.120]) by freefall.freebsd.org (8.8.4/8.8.4) with ESMTP id BAA28696 for ; Wed, 11 Dec 1996 01:29:10 -0800 (PST) Received: (from msmith@localhost) by genesis.atrad.adelaide.edu.au (8.8.2/8.7.3) id TAA23998; Wed, 11 Dec 1996 19:59:00 +1030 (CST) From: Michael Smith Message-Id: <199612110929.TAA23998@genesis.atrad.adelaide.edu.au> Subject: Re: Risk of having bpf0? (was URGENT: Packet sniffer found on my system) In-Reply-To: from "David E. O'Brien" at "Dec 11, 96 01:11:56 am" To: obrien@NUXI.com (David E. O'Brien) Date: Wed, 11 Dec 1996 19:58:59 +1030 (CST) Cc: chat@freebsd.org X-Mailer: ELM [version 2.4ME+ PL28 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-chat@freebsd.org X-Loop: FreeBSD.org Precedence: bulk (moved from -security, where this doesn't belong anymore) David E. O'Brien stands accused of saying: > > Tcpdump does all this and lots more; the filter language is pretty powerful. > > > > The fact that it knows how to interpret lots of protocols and that you > > can extend it (courtesy of the source and an easy internal interface) > > puts it over anyuthing else I've seen yet. > > Except for Solaris's snoop. The output is *SO* much nicer than tcpdumps. > If you ever get a chance try snoop -v or snoop -V. tcpdump's output is ideally designed for being digested by something else; I've done Tcl/Tk stuff, but to be pretty you need lots of CPU. > -- David (obrien@cs.ucdavis.edu) -- ]] Mike Smith, Software Engineer msmith@gsoft.com.au [[ ]] Genesis Software genesis@gsoft.com.au [[ ]] High-speed data acquisition and (GSM mobile) 0411-222-496 [[ ]] realtime instrument control. (ph) +61-8-8267-3493 [[ ]] Unix hardware collector. "Where are your PEZ?" The Tick [[