
				IPdump
		    http://ipdump.sourceforge.net/
    Copyright 1999-2000, Lars Eggert <larse@users.sourceforge.net>
			 All rights reserved.



INTRODUCTION 
------------ 
IPdump is a tool to generate detailed packet header dumps from packet
traces in libpcap format (such as generated by tcpdump). At this time,
IPdump understands the following protocol headers:

* Ethernet link layer 
* IPv4/IPsec, ARP, RARP
* ICMPv4, IGMPv4, UDP, TCP, IPIP
* SDP, SAP, DVMRP, RIP

IPdump has been designed to be easily extendible to other protocols.
Support for additional header types will be added as needed.

There is some overlap in functionality with tcpdump. However, tcpdump's
output (even in verbose mode) is usually much less detailed than ipdump.



CHANGE HISTORY 
-------------- 

06/07/00 Made available on sourceforge under Artistic License. No
 	 functional changes.

08/20/99 Added (some) RIP support. Fixes to other modules. First steps toward 
         multi-platform.

05/17/99 Added ARP/RARP and DVRMP support. Factored out common code.

05/12/99 Added IGMPv4, SDP and SAP support.

03/30/99 First public release.



INSTALLATION 
------------ 
IPdump has only been compiled and tested under FreeBSD 2.X/3.X/4.X. On
those systems, it should compile "out of the box." It has not yet been
tested under other Unix flavors, BSDish systems should work better then
others.

IPdump requires libpcap; edit Makefile to indicate libpcap's
installation directory. Libpcap can be obtained from LBNL's web site
at http://ee.lbl.gov/



USAGE 
----- 
IPdump is a filter (reading from stdin and writing to stdout). Most
common usage is as a frontend to tcpdump, like this:

% tcpdump -w- <other tcpdump options> | ipdump [-env]

Options: 
    -e  print link-layer header
    -n  suppress host name lookups 
    -v  verbose output (print payload data)

For long or nested headers, use tcpdump's -s option to grab a larger
chunk of the packet than the default 68 octets. (See the tcpdump man
page.)


SAMPLE OUTPUT
-------------
The following is a dump of an IPv4 authenticated ICMP ping packet.
IPdump generates two columns of output. The first column contains
header type (e.g. "ICMPv4"), indicating which header the line of
output was generated from. The second column contains the header
information, one line per item, in header-order. Multi-line items
(such as encapsulated headers) are indented. Text in brackets ("[]")
is an interpretation of a numeric header field performed by IPdump
(e.g. translation of a numeric IP address into a DNS name).

ETHER   destination: 0:60:97:29:c7:fd
ETHER   source: 0:40:5:a0:82:ed
ETHER   type: 2048 [IP]
------  ----------------------------------------------------------------
IPv4    version: 4
IPv4    header length: 5 [20 octets]
IPv4    type of service: 0
IPv4            precedence: 0 [routine]
IPv4            flags: 0  [normal]
IPv4    total length: 116 [octets]
IPv4    identification: 35158
IPv4    flags: 0 [may fragment|last fragment]
IPv4    fragment offset: 0
IPv4    time to live: 255
IPv4    protocol: 51 [ah]
IPv4    checksum: 61521
IPv4    source address: 128.9.160.214 [add-e.isi.edu]
IPv4    destination address: 128.9.160.197 [sin-e.isi.edu]
------  ----------------------------------------------------------------
IP-AH   next header: 1 [icmp]
IP-AH   payload length: 6 [32 octets]
IP-AH   security parameters index: 305419896
IP-AH   sequence number: 75
IP-AH   authentication data: [20 octets]
IP-AH           ec e5 98 fc   27 ff 38 23   [    ' 8#]
IP-AH           0a b2 a2 5d   f4 41 35 b9   [   ] A5 ]
IP-AH           05 06 f3 45                 [   E    ]
------  ----------------------------------------------------------------
ICMPv4  type: 8 [echo]
ICMPv4  code: 0 
ICMPv4  checksum: 45406
ICMPv4  identifier: 33035
ICMPv4  sequence number: 256
ICMPv4  data: [56 octets]
ICMPv4          8b 33 f8 36   52 28 04 00   [ 3 6R(  ]
ICMPv4          08 09 0a 0b   0c 0d 0e 0f   [        ]
ICMPv4          10 11 12 13   14 15 16 17   [        ]
ICMPv4          18 19 1a 1b   1c 1d 1e 1f   [        ]
ICMPv4          20 21 22 23   24 25 26 27   [ !"#$%&']
ICMPv4          28 29 2a 2b   2c 2d 2e 2f   [()*+,-./]
ICMPv4          30 31 32 33   34 35 36 37   [01234567]


WISH LIST 
--------- 
This is a list of possible future additions to IPdump, in no particular order:

    * support for more protocols, especially IPv6 & related 
    * allow more selective output (instead of dumping the whole header) 
    * better port to other platforms


COPYRIGHT 
---------  
Copyright 1999-2000, Lars Eggert <larse@users.sourceforge.net>

This program is free software; you can redistribute it and/or modify
it under the terms of the "Artistic License" which comes with this
Kit.

This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the Artistic
License for more details.

You should have received a copy of the Artistic License with this Kit,
in the file named "LICENSE". If not, I'll be glad to provide one.


- 
LocalWords: IPdump libpcap libpcap's LBNL's ee lbl gov stdin stdout tcpdump's
LocalWords: env IGMPv SDP ICMP ARP RARP DVMRP sourceforge DVRMP icmp BSDish
