blob: f734c2fb1f0549d249de6dcb346307b306a94f82 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
#compdef snoop
_snoop() {
local -a t_opt exp
t_opt=(
"r"\:"time relative to first packet"
"a"\:"absolute time"
"d"\:"delta time - time since receiving previous packet"
)
exp=(
"ether"
"ethertype"
"host"
"from"
"to"
"ip"
"ip6"
"arp"
"rarp"
"pppoe"
"pppoed"
"pppoes"
"vlan"
"vlan-id"
"broadcast"
"multicast"
"bootp"
"dhcp"
"dhcp6"
"apple"
"decnet"
"greater"
"less"
"udp"
"tcp"
"icmp"
"icmp6"
"ah"
"esp"
"net"
"port"
"rpc"
"zone"
"ldap"
"gateway"
"nofrag"
">"
">="
"<"
"<="
"="
"!="
"and"
"or"
"not"
"slp"
"sctp"
"ospf"
)
_arguments \
'-a[generate audio signal on receiving packets]' \
'-c[quit after capturing maxcount packets]:maxcount' \
'-d[capture packets from specified device]:device:_net_interfaces' \
'-i[display packets previously captured to file]:file:_files' \
'-n[use file as IP address-to-name mapping table]:file:_files' \
'-o[save captured packets to file]:file:_files' \
'-p[display one or more packets from captured file]:first packet number [ , last packet number]' \
'-q[do not display packet counter when capturing to file]' \
'-r[do not resolve IP addresses to names]' \
'-s[truncate each packet after snaplen bytes]:snaplen' \
'-t[time-stamp presentation]:time-stamp mode:(($t_opt))' \
'-C[list code generated from filter expression]' \
'-D[display number of packets dropped on the summary line]' \
'-N[create IP-address-to-name mapping table file (used with -i)]' \
'-I[capture packets from specified interface]:interface:_net_interfaces' \
'-P[capture packets in non-promiscuous mode]' \
'-S[display size of the entire link layer frame in bytes]' \
'-V[verbose summary mode]' \
'-v[verbose mode]' \
'-x[display offset and length of packet in HEX and ASCII]:offset [ , length]' \
'*:expression:(($exp))' \
}
_snoop "$@"
|
