sudo tcpdump -i en0 -s 0 -w DumpFile.dmp

Each element of the command line is explained below.

The sudo command causes tcpdump to run with privileges, which is necessary to access promiscuous mode.

The -i en0 option tells tcpdump to capture packets on the first Ethernet interface. You need to select an interface; there is no default. For a list of interfaces, type ifconfig -a. Mac OS X 10.1 and later provide packet capture support on PPP, so you can also specify a PPP interface here (for example, -i ppp0).

Note: If you need to capture PPP packets on traditional Mac OS, try using Interarchy or Sample Code Project ‘OTStreamDumper’.

The -s 0 option requests the full packet rather than just the first 68 bytes.

The -w DumpFile.dmp parameter tells tcpdump to dump the packets to a file called DumpFile.dmp.

In response to this command, tcpdump will begin to capture packets and put them in the DumpFile.dmp file. When you want to stop capturing, interrupt tcpdump by typing ^C. You can then display the contents of the packets as text using the following command.

tcpdump -s 0 -n -e -x -vvv -r DumpFile.dmp

]]> http://www.rbcafe.com/tcp-dump.html/feed http://www.rbcafe.com/kill-2.html http://www.rbcafe.com/kill-2.html#comments Fri, 07 Jul 2006 15:08:06 +0000 RbCafe http://www.rbcafe.com/kill-2.html NAME

kill — terminate or signal a process

SYNOPSIS

kill [-s signal_name] pid …
kill -l [exit_status]
kill -signal_name pid …
kill -signal_number pid …

DESCRIPTION

The kill utility sends a signal to the processes specified by the pid op-operand(s).
erand(s).

Only the super-user may send signals to other users’ processes.

The options are as follows:

-s signal_name
A symbolic signal name specifying the signal to be sent instead
of the default TERM.

-l [exit_status]
If no operand is given, list the signal names; otherwise, write
the signal name corresponding to exit_status.

-signal_name
A symbolic signal name specifying the signal to be sent instead
of the default TERM.

-signal_number
A non-negative decimal integer, specifying the signal to be sent
instead of the default TERM.

The following pids have special meanings:
-1 If superuser, broadcast the signal to all processes; otherwise
broadcast to all processes belonging to the user.

Some of the more commonly used signals:

1 HUP (hang up)
2 INT (interrupt)
3 QUIT (quit)
6 ABRT (abort)
9 KILL (non-catchable, non-ignorable kill)
14 ALRM (alarm clock)
15 TERM (software termination signal)

Some shells may provide a builtin kill command which is similar or iden-identical
tical to this utility. Consult the builtin(1) manual page.

SEE ALSO

builtin(1), csh(1), killall(1), ps(1), kill(2), sigaction(2)

STANDARDS

The kill function is expected to be IEEE Std 1003.2 (“POSIX.2”) compat-compatible.
ible.

HISTORY

A kill command appeared in Version 6 AT&T UNIX.

BUGS

A replacement for the command “kill 0” for csh(1) users should be pro-provided.
vided.

kuncd — The Kernel User Notification Center daemon.

DESCRIPTION

The Kernel User Notification Center daemon handles requests by software
executing in the kernel to display notices and alerts to the user. The
daemon also handles kernel reqeusts to execute user-space helper tools.

The daemon is launched by mach_init(8) when a request has been received
from the kernel and will exit 15 seconds after the last request has been
processed.

The daemon cannot be used directly by the user.

SIGNALS

SIGTERM This signal will result in the daemon unregistering itself from
mach_init and exiting. Once it is unregistered, it will not run
again until it is reregistered.

SEE ALSO

mach_init(8)

HISTORY

The kuncd daemon was introduced in Mac OS X 10.3.

NOTES

This daemon and its current behavior may change without notice. Do not
rely on its existence or its behavior. Consider it an unsupported com-command.
mand.

notifyd — notification server

SYNOPSIS

notifyd [-d] [-v] [-shm_pages npages] [-no_restart]

DESCRIPTION

notifyd is the server for the Mac OS X notification system described in
notify(3). The server is usually started automatically during system
startup, and is not run from the command line.

The -d option causes notifyd to run in a debugging mode. It will stay
attached to the terminal and print verbose log messages to the terminal.

The -v option causes notifyd to produce verbose logging information.

The -shm_pages npages option sets the number of shared memory pages used
for passive notification. The default is one page. If a value of zero
is specified, shared memory is disabled, and passive notifications are
performed using IPC between the client and the server.

The -no_restart option causes notifyd to register as a non-restartable
server with mach_init.

mDNSResponder — Multicast DNS daemon

SYNOPSIS

mDNSResponder

DESCRIPTION

mDNSResponder (also known as mdnsd on some systems) is a daemon invoked
at boot time to implement Multicast DNS and DNS Service Discovery.

mDNSResponder listens UDP port 5353 for Multicast DNS Query packets.
When it receives a query for which it knows an answer, mDNSResponder
issues the appropriate Multicast DNS Reply packet.

mDNSResponder also performs Multicast DNS Queries on behalf of client
processes, and maintains a cache of the replies.

mDNSResponder has no user-specifiable command-line argument, and users
should not run mDNSResponder manually.

To examine mDNSResponder’s internal state, for debugging and disagnostic
purposes, send it a SIGINFO signal, and it will then dump a snapshot sum-
mary of its internal state to /var/log/system.log, e.g.

sudo killall -INFO mDNSResponder

FILES

/usr/sbin/mDNSResponder

SEE ALSO

mDNS(1)

For information on Multicast DNS, see http://www.multicastdns.org/
For information on DNS Service Discovery, see http://www.dns-sd.org/
For information on how to use the Multicast DNS and the DNS Service Dis-
covery APIs on Mac OS X and other platforms, see
http://developer.apple.com/bonjour/
For the source code to mDNSResponder, see
http://developer.apple.com/darwin/projects/bonjour/

BUGS

mDNSResponder bugs are tracked in Apple Radar component “mDNSResponder”.

HISTORY

The mDNSResponder daemon first appeared in Mac OS X 10.2 (Jaguar).

Also available from the Darwin open source repository (though not offi-
cially supported by Apple) are mDNSResponder daemons for other platforms,
including Mac OS 9, Microsoft Windows, Linux, FreeBSD, NetBSD, Solaris,
and other POSIX systems.

Next One

diskarbitrationd — disk arbitration daemon

SYNOPSIS

diskarbitrationd [-d]

DESCRIPTION

diskarbitrationd listens for connections from clients, notifies clients
of the appearance of disks and filesystems, and governs the mounting of
filesystems and the claiming of disks amongst clients.

diskarbitrationd is accessed via the Disk Arbitration framework.

Options:

-d Report detailed information in /var/log/diskarbitrationd.log.
This option forces diskarbitrationd to run in the foreground.

The file /etc/fstab is consulted for user-defined mount points, indexed
by filesystem, in the mount point determination for a filesystem. Each
filesystem can be identified by its UUID or by its label, using the con-
structs “UUID” or “LABEL”, respectively. For example:

UUID=DF000C7E-AE0C-3B15-B730-DFD2EF15CB91 /export ufs ro
UUID=FAB060E9-79F7-33FF-BE85-E1D3ABD3EDEA none hfs rw,noauto
LABEL=The\040Volume\040Name\040Is\040This none msdos ro

FILES

/etc/fstab
/etc/mach_init.d/diskarbitrationd.plist
/var/log/diskarbitrationd.log
/var/run/diskarbitrationd.pid

Next One

dynamic_pager — dynamic pager external storage manager

SYNOPSIS

dynamic_pager [-E] [-F filename] [-S filesize] [-H high-water-trigger]
[-L low-water-trigger] [-P priority]

DESCRIPTION

The dynamic_pager daemon manages a pool of external swap files which the
kernel uses to support demand paging. This pool is expanded with new
swap files as load on the system increases, and contracted when the swap-
ping resources are no longer needed. The dynamic_pager daemon also pro-
vides a notification service for those applications which wish to receive
notices when the external paging pool expands or contracts.

OPTIONS

-E Encrypt the data in the swap files.

-F The base name of the filename to use for the external paging
files. By default this is /private/var/vm/swapfile.

-S The fixed filesize [in bytes] to use for the paging files. By
default dynamic_pager uses variable sized paging files, using
larger sized files as paging demands increase. The -S, -H and -L
options disable that default and cause dynamic_pager to use a
series of fixed sized external paging files.

-H If there are less than high-water-trigger bytes free in the
external paging files, the kernel will signal dynamic_pager to
add a new external paging file.

-L If there are more than low-water-trigger bytes free in the exter-
nal paging files, the kernel will coalese in-use pages and signal
dynamic_pager to discard an external paging file.
Low-water-trigger must be greater than high-water-trigger +
filesize.

-P This option is currently unimplemented.

FILES

/private/var/vm/swapfile* Default external paging files.

Next One

DirectoryService — DirectoryService daemon (a part of Mac OS X’s Open
Directory architecture)

SYNOPSIS

DirectoryService [-hv]

DESCRIPTION

Apple’s Open Directory architecture includes source code for both direc-
tory client access and directory servers. Open Directory forms the foun-
dation of how Mac OS X accesses all authoritative configuration informa-
tion (users, groups, mounts, managed desktop data, etc.). Mac OS X
obtains this information via abstraction APIs, enabling use of virtually
any directory system. Configuration of Open Directory is done through
the Directory Access applications in /Applications/Utilities. This
application can configure plugin settings, including turning on/off vari-
ous directory services.

Open Directory Access

Directory Services is a core part of the Open Directory technology.
Directory Services provides a client read/write/authentication API
abstraction for accessing directory-based data. Directory Services con-
sists of an access API, and an API daemon, and a plug-in API.

An additional element of Open Directory is the existing Darwin component
of lookupd that provides a read-only abstraction for accessing all BSD
configuration information. Both lookupd and Directory Services work in
conjunction with each other via the DSAgent to provide authoritative and
consistent configuration information to all processes running on Mac OS X
regardless of which Directory API they are using. The source code for
DSAgent is also available.

More information can be accessed from the Darwin Open Directory Page:
http://developer.apple.com/darwin/projects/opendirectory/

Open Directory Servers

Apple’s Open Directory Servers are OpenLDAP and NetInfo. OpenLDAP and
NetInfo are included as part of Mac OS X Desktop and Server, and are also
included with Darwin. Both OpenLDAP and NetInfo provide a robust and
scalable platform for serving directory based configuration information
for both stand-alone and networked CPUs. OpenLDAP and NetInfo share the
same datastore and both separately consist of:

o Access API
o Server process
o Command line tools for displaying and modifying the contents of the Directory Server data.

Documentation

Directory Services Access API and Plug-in API is documented at:
http://developer.apple.com/techpubs/macosx/Networking/

The headers for the DirectoryService APIs can also be found in the fol-
lowing location:

/System/Library/Frameworks/DirectoryService.framework/Headers/

OPTIONS

The options are as follows:

-h Display list of options
-v Display the release version.

PLUGINS

The following plugins can be managed using the Directory Access applica-
tion.

o BSD (Flat File and NIS)
o NetInfo
o LDAPv3
o Search
o SMB
o SLP
o Bonjour (zero-conf)
o Appletalk
o PasswordServer

DIAGNOSTICS

There are two helpful signals you can send to the DirectoryService daemon
to help diagnose problems you may be having. (Example: % sudo killall
-USR1 DirectoryService). USR2 logging automatically turns off after 5
minutes.

o USR1 Turns Debug Logging (on/off) See /Library/Logs/DirectoryService/DirectoryService.debug.log
o USR2 Turns API Logging (on/off) See /var/log/system.log

crashreporterd — crash detection and panic logging daemon

SYNOPSIS

crashreporterd

DESCRIPTION

crashreporterd is the daemon responsible for detecting application
crashes. crashreporterd listens for mach exceptions and when it detects
a mach exception launches crashdump to investigate the crash and report
it to the user.

crashreporterd is also responsible for writing panic information to
/Library/Logs/panic.log when the system is rebooted after a panic.

crashreporterd should only be started at boot time by the CrashReporter
startup item - killing or restarting crashreporterd at any other time
will lead to upredictable behavior when an application crashes. Adminis-
trators can edit the CRASHREPORTER entry in /etc/hostconfig to prevent
crashreporterd from starting at boot time.

FILES

/usr/libexec/crashreporterd daemon
/System/Library/StartupItems/CrashReporter/ startup item
/etc/hostconfig configuration
/Library/Logs/panic.log panic log

Next One

launchd — System wide and per-user daemon/agent manager

SYNOPSIS

launchd [-v] [-s] [-x] [– command [args …]]

DESCRIPTION

launchd manages daemons, both for the system as a whole and for individ-
ual users. Ideal daemons can launch on demand based on criteria specified
in their respective XML property lists located in one of the directories
specified in the FILES section.

When run with a command, a specific instance of launchd is created and
the command is implicitly added to the list of jobs maintained by
launchd. If the command exits, that instance of launchd will clean up
all jobs maintained by itself and exit. All children of the command will
use that instance of launchd.

During boot launchd is invoked by the kernel to run as the first process
on the system and to further bootstrap the rest of the system.

OPTIONS WHEN RUN AS PID 1

-v Verbose boot.
-s Single user mode. Instructs launchd to give a shell prompt before booting the system.
-x Safe mode boot. Instructs the system to boot conservatively.

NOTES

In Darwin it is preferable to have your daemon launch via launchd instead
of modifying rc or creating a SystemStarter Startup Item.

At some point in the future, we hope to completely phase out the use of
rc.

FILES

~/Library/LaunchAgents Per-user agents provided by the user.
/Library/LaunchAgents Per-user agents provided by the administrator.
/Library/LaunchDaemons System wide daemons provided by the administrator.
/System/Library/LaunchAgents Mac OS X Per-user agents.
/System/Library/LaunchDaemons Mac OS X System wide daemons.

Next One