docs/manpages-3/log2pcap.1.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="log2pcap.1">
   4
   5 <refmeta>
   6         <refentrytitle>log2pcap</refentrytitle>
   7         <manvolnum>1</manvolnum>
   8 </refmeta>
   9
  10
  11 <refnamediv>
  12         <refname>log2pcap</refname>
  13         <refpurpose>Extract network traces from Samba log files</refpurpose>
  14 </refnamediv>
  15
  16 <refsynopsisdiv>
  17         <cmdsynopsis>
  18                 <command>log2pcap</command>
  19                 <arg choice="opt">-h</arg>
  20                 <arg choice="opt">-q</arg>
  21                 <arg choice="opt">logfile</arg>
  22                 <arg choice="opt">pcap_file</arg>
  23         </cmdsynopsis>
  24 </refsynopsisdiv>
  25
  26 <refsect1>
  27         <title>DESCRIPTION</title>
  28
  29         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  30         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  31
  32         <para><command>log2pcap</command> reads in a
  33         samba log file and generates a pcap file (readable
  34         by most sniffers, such as ethereal or tcpdump) based on the packet
  35         dumps in the log file.</para>
  36
  37         <para>The log file must have a <parameter>log level</parameter>
  38         of at least <constant>5</constant> to get the SMB header/parameters
  39         right, <constant>10</constant> to get the first 512 data bytes of the
  40         packet and <constant>50</constant> to get the whole packet.
  41         </para>
  42 </refsect1>
  43
  44 <refsect1>
  45         <title>OPTIONS</title>
  46
  47         <variablelist>
  48             <varlistentry>
  49                 <term>-h</term>
  50                 <listitem><para>If this parameter is
  51                 specified the output file will be a
  52                 hex dump, in a format that is readable
  53                 by the <application>text2pcap</application> utility.</para></listitem>
  54             </varlistentry>
  55
  56             <varlistentry>
  57                 <term>-q</term>
  58                 <listitem><para>Be quiet. No warning messages about missing
  59                 or incomplete data will be given.</para></listitem>
  60             </varlistentry>
  61
  62             <varlistentry>
  63                 <term>logfile</term>
  64                 <listitem><para>
  65                 Samba log file. log2pcap will try to read the log from stdin
  66                 if the log file is not specified.
  67                 </para></listitem>
  68             </varlistentry>
  69
  70             <varlistentry>
  71                 <term>pcap_file</term>
  72                 <listitem><para>
  73                 Name of the output file to write the pcap (or hexdump) data to.
  74                 If this argument is not specified, output data will be written
  75                 to stdout.
  76                 </para></listitem>
  77             </varlistentry>
  78
  79             &stdarg.help;
  80
  81         </variablelist>
  82 </refsect1>
  83
  84 <refsect1>
  85         <title>EXAMPLES</title>
  86
  87         <para>Extract all network traffic from all samba log files:</para>
  88
  89         <para><programlisting>
  90                         <prompt>$</prompt> log2pcap &lt; /var/log/* &gt; trace.pcap
  91         </programlisting></para>
  92
  93         <para>Convert to pcap using text2pcap:</para>
  94
  95         <para><programlisting>
  96         <prompt>$</prompt> log2pcap -h samba.log | text2pcap -T 139,139 - trace.pcap
  97         </programlisting></para>
  98 </refsect1>
  99
 100 <refsect1>
 101         <title>VERSION</title>
 102
 103         <para>This man page is correct for version 3.0 of the Samba suite.</para>
 104 </refsect1>
 105
 106 <refsect1>
 107         <title>BUGS</title>
 108
 109         <para>Only SMB data is extracted from the samba logs, no LDAP,
 110         NetBIOS lookup or other data.</para>
 111
 112         <para>The generated TCP and IP headers don't contain a valid
 113         checksum.</para>
 114
 115 </refsect1>
 116
 117
 118 <refsect1>
 119         <title>SEE ALSO</title>
 120         <para><citerefentry><refentrytitle>text2pcap</refentrytitle>
 121         <manvolnum>1</manvolnum></citerefentry>, <citerefentry><refentrytitle>ethereal</refentrytitle><manvolnum>1</manvolnum></citerefentry></para>
 122 </refsect1>
 123
 124 <refsect1>
 125         <title>AUTHOR</title>
 126
 127         <para>The original Samba software and related utilities
 128         were created by Andrew Tridgell. Samba is now developed
 129         by the Samba Team as an Open Source project similar
 130         to the way the Linux kernel is developed.</para>
 131
 132         <para>This manpage was written by Jelmer Vernooij.</para>
 133 </refsect1>
 134
 135 </refentry>