Provided by: sniffit_0.5-2_amd64 bug


       sniffit - configuration file for sniffit (name arbitrary)


       This  page  describes  the  format for the config file for sniffit (see sniffit(8) ). This
       file allows you to specify in great detail witch packets should be processed  by  sniffit.
       This  file also controls (or will control) some functions for the continuous logging ('-L'

       A sniffit config file might look like (Be sure to end it with a BLANK line):

              # Sniffit Sample Config file -- Brecht Claerhout

              logfile /var/log/

              # First select all packets!
              select both mhosts 1
              select both mhosts 2

              # Now deselect all packets from/to those damn 'surfers'
              deselect both port 80
              deselect both port 8001

       This file will tell sniffit to process all packets on  the  subnet  except  those  FROM/TO
       ports  80  and  8001 (thus we don't want logs of those mass WWW connections witch turn our
       logs unreadable).


       The file consists of lines, lines are formed by fields, fields are separated  with  SPACES
       (NO TABS).  Unix comment lines (starting with '#' are allowed).  So this gives us:

              <field1> <field2> <field3> <field4> <field5>


              select  - Sniffit will look for packets that match the following description (other

              deselect - Sniffit will ignore packets that match the description

              logfile - change the logfile name to <field2> instead of the default 'sniffit.log'

              from - Packets FROM the host matching the following desc. are considered.

              to - similar, Packets TO the....

              both - similar, Packets FROM or TO the....

              a filename - as an argument of 'logfile' in <field1>

              host - The (de)selection criteria involves a hostname.

              port - similar, ... a portnumber

              mhosts  -  The  (de)selection  criteria  involves  multiple-hosts,  like  with  the
              wildcards in 0.3.0, but without the 'x'

              Either  a  hostname,  a portnumber, a service name or a number-dot partial notation
              indicating multiple hosts depending on  <field3>  (service  names  like  'ftp'  are
              resolved  as  the  services  available  present  on the host that runs Sniffit, and
              translated into a port nr)

              A portnumber, if <field3> was 'host' or 'mhosts' (optional, if not filled  in,  all
              ports are going to be (de)selected)


       The  config  file  is  interpreted  SEQUENTIAL,  so  watch  it, don't mix lines in a file.

                    select both mhosts 100.100.12.
                    deselect both port 80
                    select both host

              This file will get you the packets:
                    a) Send by hosts '100.100.12.*'
                    b) EXCEPT the WWW packets
                    c) BUT showing the WWW packets concerning

                    select both mhosts 100.100.12.
                    select both host
                    deselect both port 80

              Will give you the packets (probably unwanted result):
                    a) Send by hosts '100.100.12.*'
                    b) Send from/to (useless line)
                    c) deselecting all WWW packets on the subnet


       Brecht Claerhout <>