How to use fw monitor

ash-2.03# snoop -v -c 1 -i fwmonitor.cap
ETHER: ----- Ether Header -----
ETHER:
ETHER: Packet 1 arrived at 8:26:43.00
ETHER: Packet size = 98 bytes
ETHER: Destination = 69:31:65:74:68:30, (multicast)
ETHER: Source = 0:0:0:0:0:0,
ETHER: Ethertype = 0800 (IP)
ETHER:
IP: ----- IP Header -----
IP:
IP: Version = 4
IP: Header length = 20 bytes
IP: Type of service = 0x00
IP: xxx. .... = 0 (precedence)
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: Total length = 84 bytes
IP: Identification = 47628
IP: Flags = 0x4
IP: .1.. .... = do not fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 1 (ICMP)
IP: Header checksum = 2679
IP: Source address = 172.16.1.1, 172.16.1.1
IP: Destination address = 172.16.1.2, 172.16.1.2
IP: No options
IP:
ICMP: ----- ICMP Header -----
ICMP:
ICMP: Type = 8 (Echo request)
ICMP: Code = 0 (ID: 51470 Sequence number: 256)
ICMP: Checksum = 2be5
ICMP:
1 packets captured
bash-2.03#
Figure 50: Inspecting fw monitor files with snoop – verbose output
! Especially when working in verbose mode (-v) it is recommended to display only a few packets.
! This paper does not cover advanced snoop usage including things like filtering, converting etc. You
Use –c to limit the number of packets or use filter expressions. snoop filter expressions are not
discussed in this paper. Refer to the snoop man page for further information.
can find further information at The Secrets of Snoop.
How to use fw monitor Page 41 of 70
Revision: 1.01