DSNIFF(8)                                               DSNIFF(8)

NAME
       dsniff - password sniffer

SYNOPSIS
       dsniff [-c] [-d] [-m] [-n] [-i interface] [-s snaplen] [-f
       services] [-t trigger[,...]]]  [-r|-w savefile] [expres-
       sion]

DESCRIPTION
       dsniff  is  a  password sniffer which handles FTP, Telnet,
       SMTP, HTTP, POP, poppass, NNTP, IMAP, SNMP, LDAP,  Rlogin,
       RIP,  OSPF,  PPTP  MS-CHAP, NFS, VRRP, YP/NIS, SOCKS, X11,
       CVS, IRC, AIM, ICQ, Napster,  PostgreSQL,  Meeting  Maker,
       Citrix  ICA,  Symantec  pcAnywhere, NAI Sniffer, Microsoft
       SMB, Oracle SQL*Net, Sybase and Microsoft SQL protocols.

       dsniff automatically detects  and  minimally  parses  each
       application  protocol,  only  saving the interesting bits,
       and uses Berkeley DB as its output file format, only  log-
       ging  unique authentication attempts. Full TCP/IP reassem-
       bly is provided by libnids(3).

       I wrote dsniff with honest intentions - to  audit  my  own
       network,  and  to  demonstrate the insecurity of cleartext
       network protocols.  Please do not abuse this software.

OPTIONS
       -c     Perform half-duplex TCP stream reassembly, to  han-
              dle  asymmetrically  routed  traffic  (such as when
              using arpspoof(8) to intercept client traffic bound
              for the local gateway).

       -d     Enable debugging mode.

       -m     Enable automatic protocol detection.

       -n     Do not resolve IP addresses to hostnames.

       -i interface
              Specify the interface to listen on.

       -s snaplen
              Analyze at most the first snaplen bytes of each TCP
              connection, rather than the default of 1024.

       -f services
              Load triggers from a services file.

        -t trigger[,...]
              Load triggers from a comma-separated  list,  speci-
              fied as port/proto=service (e.g. 80/tcp=http).

       -r savefile
              Read  sniffed sessions from a savefile created with

                                                                1

DSNIFF(8)                                               DSNIFF(8)

              the -w option.

       -w file
              Write sniffed  sessions  to  savefile  rather  than
              parsing and printing them out.

       expression
              Specify  a  tcpdump(8)  filter expression to select
              traffic to sniff.

       On a hangup signal dsniff will dump  its  current  trigger
       table to dsniff.services.

FILES
       /usr/local/lib/dsniff.services
              Default trigger table

       /usr/local/lib/dsniff.magic
              Network protocol magic

SEE ALSO
       arpspoof(8), libnids(3), services(5), magic(5)

AUTHOR
       Dug Song <dugsong@monkey.org>

BUGS
       dsniff's automatic protocol detection feature is based on
       the classic file(1) command by Ian Darwin, and shares its
       historical limitations and bugs.

                                                                2