PLOGTCP(8)

NAME
plogtcp - TCP packet logger.

SYNOPSIS
plogtcp [-q] [-lwr] [-f flagmask] [-i hostname[/mask]]

DESCRIPTION
plogtcp is a daemon that logs all TCP packets that your host receives.

  OPTIONS

-q  Quiet mode. Do not send output to stdout. Only error messages are printed.

-l  Make a simple human readeable log.

-w  Log raw data, exactly as it was read from the socket, prefixing to each packet, sizeof( time_t) bytes containing the date when the packet arrived. You can later interpret this data, obtaining a detailed report of the packet data using the program ipretplog.

-r  Resolve domain names. By default the program won't resolve IP addresses to domain names because of the slow down it produces.

-f flagmask
    Only log packets that matches flagmask. The TCP header flags are six, each, one bit long. They are URG, ACK, PUSH, RST, SYN and FIN. They are arranged in the TCP header in that order. To log packets that have set any of them, you must use a number with a 1 at the flag position. If you want to log packets with two or more flags set, you must use a logic OR with the numbers of each flag. So, to log TCP packets with only the SYN flag on, and all others off, you must use a flagmask of 2. To detect FIN scannings set it to 1. To detect both SYN and FIN you must use a 3. If it is confusing see the file TCP.flags.txt in the documentation of Protolog.

-i hostname[/mask]
    Ignore packets. hostname can be a hostname, a network name, or an IP address. The mask can be a network mask or a number that specify the number of ones at the left side of the network mask. So, a mask of 16 is the same that 255.255.0.0. You can also use this option more than once, to ignore logging packets from hosts that belong to different networks.

FILES
@logdir@/tcp.log TCP simple human readeable log

@logdir@/tcp.raw time + TCP raw data (header + data)

SEE ALSO
ipretplog(8), plogicmp(8), plogudp(8).

BUGS
None for now, if you find one, mail it to me <diego@grigna.com>

VERSION
Protolog is now at version @version@.

The latest version of Protolog could be found at:
    http://www.grigna.com/diego/linux/

AUTHOR
The author of Protolog is:

    Diego Javier Grigna <diego@grigna.com>