manpages-3/log2pcap.1.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="log2pcap.1">
   4
   5 <refmeta>
   6         <refentrytitle>log2pcap</refentrytitle>
   7         <manvolnum>1</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">User Commands</refmiscinfo>
  10         <refmiscinfo class="version">3.2</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>log2pcap</refname>
  16         <refpurpose>Extract network traces from Samba log files</refpurpose>
  17 </refnamediv>
  18
  19 <refsynopsisdiv>
  20         <cmdsynopsis>
  21                 <command>log2pcap</command>
  22                 <arg choice="opt">-h</arg>
  23                 <arg choice="opt">-q</arg>
  24                 <arg choice="opt">logfile</arg>
  25                 <arg choice="opt">pcap_file</arg>
  26         </cmdsynopsis>
  27 </refsynopsisdiv>
  28
  29 <refsect1>
  30         <title>DESCRIPTION</title>
  31
  32         <para>This tool is part of the <citerefentry><refentrytitle>samba</refentrytitle>
  33         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  34
  35         <para><command>log2pcap</command> reads in a
  36         samba log file and generates a pcap file (readable
  37         by most sniffers, such as ethereal or tcpdump) based on the packet
  38         dumps in the log file.</para>
  39
  40         <para>The log file must have a <parameter>log level</parameter>
  41         of at least <constant>5</constant> to get the SMB header/parameters
  42         right, <constant>10</constant> to get the first 512 data bytes of the
  43         packet and <constant>50</constant> to get the whole packet.
  44         </para>
  45 </refsect1>
  46
  47 <refsect1>
  48         <title>OPTIONS</title>
  49
  50         <variablelist>
  51             <varlistentry>
  52                 <term>-h</term>
  53                 <listitem><para>If this parameter is
  54                 specified the output file will be a
  55                 hex dump, in a format that is readable
  56                 by the <application>text2pcap</application> utility.</para></listitem>
  57             </varlistentry>
  58
  59             <varlistentry>
  60                 <term>-q</term>
  61                 <listitem><para>Be quiet. No warning messages about missing
  62                 or incomplete data will be given.</para></listitem>
  63             </varlistentry>
  64
  65             <varlistentry>
  66                 <term>logfile</term>
  67                 <listitem><para>
  68                 Samba log file. log2pcap will try to read the log from stdin
  69                 if the log file is not specified.
  70                 </para></listitem>
  71             </varlistentry>
  72
  73             <varlistentry>
  74                 <term>pcap_file</term>
  75                 <listitem><para>
  76                 Name of the output file to write the pcap (or hexdump) data to.
  77                 If this argument is not specified, output data will be written
  78                 to stdout.
  79                 </para></listitem>
  80             </varlistentry>
  81
  82             &stdarg.help;
  83
  84         </variablelist>
  85 </refsect1>
  86
  87 <refsect1>
  88         <title>EXAMPLES</title>
  89
  90         <para>Extract all network traffic from all samba log files:</para>
  91
  92         <para><programlisting>
  93                         <prompt>$</prompt> log2pcap &lt; /var/log/* &gt; trace.pcap
  94         </programlisting></para>
  95
  96         <para>Convert to pcap using text2pcap:</para>
  97
  98         <para><programlisting>
  99         <prompt>$</prompt> log2pcap -h samba.log | text2pcap -T 139,139 - trace.pcap
 100         </programlisting></para>
 101 </refsect1>
 102
 103 <refsect1>
 104         <title>VERSION</title>
 105
 106         <para>This man page is correct for version 3.0 of the Samba suite.</para>
 107 </refsect1>
 108
 109 <refsect1>
 110         <title>BUGS</title>
 111
 112         <para>Only SMB data is extracted from the samba logs, no LDAP,
 113         NetBIOS lookup or other data.</para>
 114
 115         <para>The generated TCP and IP headers don't contain a valid
 116         checksum.</para>
 117
 118 </refsect1>
 119
 120
 121 <refsect1>
 122         <title>SEE ALSO</title>
 123         <para><citerefentry><refentrytitle>text2pcap</refentrytitle>
 124         <manvolnum>1</manvolnum></citerefentry>, <citerefentry><refentrytitle>ethereal</refentrytitle><manvolnum>1</manvolnum></citerefentry></para>
 125 </refsect1>
 126
 127 <refsect1>
 128         <title>AUTHOR</title>
 129
 130         <para>The original Samba software and related utilities
 131         were created by Andrew Tridgell. Samba is now developed
 132         by the Samba Team as an Open Source project similar
 133         to the way the Linux kernel is developed.</para>
 134
 135         <para>This manpage was written by Jelmer Vernooij.</para>
 136 </refsect1>
 137
 138 </refentry>