The Tcpdump Group git mirrors - libpcap/blob - rpcapd/rpcapd.manadmin.in

   1 .\"  rpcapd.8
   2 .\"
   3 .\"  Copyright (c) 2002-2005 NetGroup, Politecnico di Torino (Italy)
   4 .\"  Copyright (c) 2005-2009 CACE Technologies
   5 .\"  Copyright (c) 2018-     The TCPdump Group
   6 .\"  All rights reserved.
   7 .\"
   8 .\"  Redistribution and use in source and binary forms, with or without
   9 .\"  modification, are permitted provided that the following conditions
  10 .\"  are met:
  11 .\"
  12 .\"  1. Redistributions of source code must retain the above copyright
  13 .\"  notice, this list of conditions and the following disclaimer.
  14 .\"  2. Redistributions in binary form must reproduce the above copyright
  15 .\"  notice, this list of conditions and the following disclaimer in the
  16 .\"  documentation and/or other materials provided with the distribution.
  17 .\"  3. Neither the name of the Politecnico di Torino nor the names of its
  18 .\"  contributors may be used to endorse or promote products derived from
  19 .\"  this software without specific prior written permission.
  20 .\"
  21 .\"  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22 .\"  "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23 .\"  LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  24 .\"  A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  25 .\"  OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  26 .\"  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  27 .\"  LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  28 .\"  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  29 .\"  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  30 .\"  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  31 .\"  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  32 .\"
  33 .TH RPCAPD @MAN_ADMIN_COMMANDS@ "April 20, 2018"
  34 .SH NAME
  35 rpcapd \- capture daemon to be controlled by a remote libpcap application
  36 .SH SYNOPSIS
  37 .na
  38 rpcapd
  39 [
  40 .B \-b
  41 .I address
  42 ] [
  43 .B \-p
  44 .I port
  45 ] [
  46 .B \-4
  47 ] [
  48 .B \-l
  49 .I host_list
  50 ]
  51 .br
  52 .ti +8
  53 [
  54 .B \-a
  55 .IR host , port
  56 ] [
  57 .B \-n
  58 ] [
  59 .B \-v
  60 ] [
  61 .B \-d
  62 ] [
  63 .B \-i
  64 ]
  65 .br
  66 .ti +8
  67 [
  68 .B \-D
  69 ] [
  70 .B \-s
  71 .I config_file
  72 ]
  73 [
  74 .B \-f
  75 .I config_file
  76 ]
  77 [
  78 .B \-S
  79 ]
  80 .br
  81 .ti +8
  82 [
  83 .B \-K
  84 .I ssl_keyfile
  85 ] [
  86 .B \-X
  87 .I ssl_certfile
  88 ] [
  89 .B \-C
  90 ]
  91 .br
  92 .ad
  93 .SH DESCRIPTION
  94 .LP
  95 \fIRpcapd\fP is a daemon (Unix) or service (Win32) that allows the capture
  96 and filter part of libpcap to be run on a remote system.
  97 .LP
  98 Rpcapd can run in two modes: passive mode (default) and active mode.
  99 .LP
 100 In passive mode, the client (e.g., a network sniffer) connects to
 101 .BR rpcapd .
 102 It then sends hem the appropriate commands to start the capture.
 103 .LP
 104 In active mode,
 105 .B rpcapd
 106 tries to establish a connection toward the client
 107 (e.g., a network sniffer). The client then sends the appropriate commands
 108 to rpcapd to start the capture.
 109 .LP
 110 Active mode is useful in case
 111 .B rpcapd
 112 is run behind a firewall and
 113 cannot receive connections from the external world. In this case,
 114 .B rpcapd
 115 can be configured to establish the connection to a given host,
 116 which has to be configured in order to wait for that connection. After
 117 establishing the connection, the protocol continues its job in almost
 118 the same way in both active and passive mode.
 119 .SH Configuration file
 120 .LP
 121 The user can create a configuration file in the same folder of the
 122 executable, and put the configuration commands in there. In order for
 123 rpcapd to execute the commands, you have to restart it on Win32, i.e.
 124 the initialization file is parsed only at the beginning). The UNIX
 125 version of rpcapd will reread the configuration file when receiving a
 126 HUP signel. In that case, all the existing connections remain in place,
 127 while the new connections will be created according to the new parameters.
 128 .LP
 129 In case a user does not want to create the configuration file manually,
 130 they can launch rpcapd with the requested parameters plus "-s filename".
 131 Rpcapd will parse all the parameters and save them into the specified
 132 configuration file.
 133 .SH Installing rpcapd on Win32
 134 .LP
 135 The remote daemon is installed automatically when installing WinPcap.
 136 The installation process places the rpcapd file into the WinPcap folder.
 137 This file can be executed either from the command line, or as a service.
 138 For instance, the installation process updates the list of available
 139 services list and it creates a new item (Remote Packet Capture Protocol
 140 v.0 (experimental) ).  To avoid security problems, the service is
 141 inactive and it has to be started manually (control panel -
 142 administrative tools - services - start).
 143 .LP
 144 The service has a set of "standard" parameters, i.e. it is launched
 145 with the
 146 .B \-d
 147 flag (in order to make it run as a service) and the
 148 .B "-f rpcapd.ini"
 149 flag.
 150 .SH Starting rpcapd on Win32
 151 .LP
 152 The rpcapd executable can be launched directly, i.e.  it can run in the
 153 foreground as well (not as a daemon/service).  The procedure is quite
 154 simple: you have to invoke the executable from the command line with all
 155 the requested parameters except for the
 156 .B \-d
 157 flag.  The capture server will
 158 start in the foreground.
 159 .SH Installing rpcapd on Unix-like systems
 160 TBD
 161 .SH Starting rpcapd on Unix-like systems
 162 .B rpcapd
 163 needs sufficient privileges to perform packet capture, e.g.
 164 run as root or be owned by root and have suid set. Most operating
 165 systems provide more elegant solutions when run as user than the
 166 above solutions, all of them different.
 167 .SH OPTIONS
 168 .TP
 169 .BI \-b " address"
 170 Bind to the IP address specified by
 171 .I address
 172 (either numeric or literal).
 173 By default,
 174 .B rpcapd
 175 binds to all local IPv4 and IPv6 addresses.
 176 .TP
 177 .BI \-p " port"
 178 Bind to the port specified by
 179 .IR port .
 180 By default,
 181 .B rpcapd
 182 binds to port 2002.
 183 .TP
 184 .B \-4
 185 Listen only on IPv4 addresses.
 186 By default,
 187 .B rpcapd
 188 listens on both IPv4 and IPv6 addresses.
 189 .TP
 190 .BI -l " host_list"
 191 Only allow hosts specified in the
 192 .I host_list
 193 argument to connect to this server.
 194 .I host_list
 195 is a list of host names or IP addresses, separated by commas.
 196 We suggest that you use use host names rather than literal IP addresses
 197 in order to avoid problems with different address families.
 198 .TP
 199 .B \-n
 200 Permit NULL authentication (usually used with
 201 .BR \-l ).
 202 .TP
 203 .BI \-a " host" , "port"
 204 Run in active mode, connecting to host
 205 .I host
 206 on port
 207 .IR port .
 208 In case
 209 .I port
 210 is omitted, the default port (2003) is used.
 211 .TP
 212 .B -v
 213 Run in active mode only; by default, if
 214 .B \-a
 215 is specified,
 216 .B rpcapd
 217 it accepts passive connections as well.
 218 .TP
 219 .B \-d
 220 Run in daemon mode (UNIX only) or as a service (Win32 only)
 221 Warning (Win32): this switch is provided automatically when
 222 the service is started from the control panel.
 223 .TP
 224 .B \-i
 225 Run in inetd mode (UNIX only).
 226 .TP
 227 .B \-D
 228 Log debugging messages.
 229 .TP
 230 .BI \-s " config_file"
 231 Save the current configuration to
 232 .I config_file
 233 in the format specified by
 234 .BR rpcapd-config (@MAN_FILE_FORMATS@).
 235 .TP
 236 .BI \-f " config_file"
 237 Load the current configuration from
 238 .I config_file
 239 in the format specified by
 240 .BR rpcapd-config (@MAN_FILE_FORMATS@);
 241 all switches specified from the command line are ignored.
 242 .TP
 243 .B \-h
 244 Print this help screen.
 245 .LP
 246 If rpcapd was compiled with SSL support, these options are also
 247 available:
 248 .TP
 249 .B \-S
 250 Require that SSL be used on connections.
 251 .TP
 252 .B \-C
 253 With SSL enabled, XXX - I'm not sure how *fetching* the list of
 254 compression mechanisms does anything to compression.
 255 .TP
 256 .B \-S
 257 .I ssl_keyfile
 258 With SSL enabled, use
 259 .I ssl_keyfile
 260 as the SSL key file.
 261 .TP
 262 .B \-X
 263 .I ssl_certfile
 264 With SSL enabled, use
 265 .I ssl_certfile
 266 as the SSL certificate file.
 267 .br
 268 .ad
 269 .SH "SEE ALSO"
 270 pcap(3PCAP), rpcapd-config(@MAN_FILE_FORMATS@)