- In order to fix that I need to do one of the following. Change a playback device from the command line. (then I can run it before calling the Winamp). Specify a playback device in the command line for Winamp. Specify a playback device in 'Winamp.ini'. Forget about Winamp, choose another player, for.
- Winamp 5 Full is part of these download collections: M3U Player, APE Players, AAC Player, Play MP3. Winamp 5 Full was reviewed by Bogdan Popa. SYSTEM REQUIREMENTS. 500MHz Pentium III.
NAME
tcpdump - dump traffic on a networkSYNOPSIS
AMP WinOFF is an utility for scheduling the shutdown of Windows computers, with several shutdown conditions and fully configurable. Some of its features are.
tcpdump[-AdDeflLnNOpqRStuUvxX] [-ccount][-Cfile_size] [-Ffile]
[-iinterface][-mmodule][-Msecret]
[-rfile][-ssnaplen][-Ttype][-wfile]
[-Wfilecount]
[-Espi@ipaddr algo:secret,..]
[-ydatalinktype][-Zuser]
[expression]
DESCRIPTION
Tcpdump prints out a description of the contents of packets on anetwork interface that match the boolean expression. It can alsobe run with the-wflag, which causes it to save the packet data to a file for lateranalysis, and/or with the-rflag, which causes it to read from a saved packet file rather than toread packets from a network interface. In all cases, only packets thatmatchexpressionwill be processed bytcpdump.
Tcpdumpwill, if not run with the-cflag, continue capturing packets until it is interrupted by a SIGINTsignal (generated, for example, by typing your interrupt character,typically control-C) or a SIGTERM signal (typically generated with thekill(1)command); if run with the-cflag, it will capture packets until it is interrupted by a SIGINT orSIGTERM signal or the specified number of packets have been processed.
Winamp Command Line
Whentcpdumpfinishes capturing packets, it will report counts of:
On platforms that support the SIGINFO signal, such as most BSDs(including Mac OS X) and Digital/Tru64 UNIX, it will report those countswhen it receives a SIGINFO signal (generated, for example, by typingyour ``status' character, typically control-T, although on someplatforms, such as Mac OS X, the ``status' character is not set bydefault, so you must set it withstty(1)in order to use it) and will continue capturing packets.
Reading packets from a network interface may require that you havespecial privileges:
Reading a saved packet file doesn't require special privileges.
OPTIONS
``tcpdump -l | tee dat' or``tcpdump -l > dat & tail -f dat'.
The expression consists of one or moreprimitives.Primitives usually consist of anid(name or number) preceded by one or more qualifiers.There are threedifferent kinds of qualifier:
[`fddi' is actually an alias for `ether'; the parser treats themidentically as meaning ``the data link level used on the specifiednetwork interface.' FDDI headers contain Ethernet-like sourceand destination addresses, and often contain Ethernet-like packettypes, so you can filter on these FDDI fields just as with theanalogous Ethernet fields.FDDI headers also contain other fields,but you cannot name them explicitly in a filter expression.
Similarly, `tr' and `wlan' are aliases for `ether'; the previousparagraph's statements about FDDI headers also apply to Token Ringand 802.11 wireless LAN headers. For 802.11 headers, the destinationaddress is the DA field and the source address is the SA field; theBSSID, RA, and TA fields aren't tested.]
In addition to the above, there are some special `primitive' keywordsthat don't follow the pattern:gateway,broadcast,less,greaterand arithmetic expressions.All of these are described below.
More complex filter expressions are built up by using the wordsand,orandnotto combine primitives.E.g., `host foo and not port ftp and not port ftp-data'.To save typing, identical qualifier lists can be omitted.E.g.,`tcp dst port ftp or ftp-data or domain' is exactly the same as`tcp dst port ftp or tcp dst port ftp-data or tcp dst port domain'.
Allowable primitives are:
- iso
- tcpdump checks the DSAP (Destination Service Access Point) andSSAP (Source Service Access Point) fields of the LLC header;
- stp and netbeui
- tcpdump checks the DSAP of the LLC header;
- atalk
- tcpdump checks for a SNAP-format packet with an OUI of 0x080007and the AppleTalk etype.
- iso, stp, and netbeui
- tcpdump checks for an 802.3 frame and then checks the LLC header asit does for FDDI, Token Ring, and 802.11;
- atalk
- tcpdump checks both for the AppleTalk etype in an Ethernet frame andfor a SNAP-format packet as it does for FDDI, Token Ring, and 802.11;
- aarp
- tcpdump checks for the AppleTalk ARP etype in either an Ethernetframe or an 802.2 SNAP frame with an OUI of 0x000000;
- ipx
- tcpdump checks for the IPX etype in an Ethernet frame, the IPXDSAP in the LLC header, the 802.3-with-no-LLC-header encapsulation ofIPX, and the IPX etype in a SNAP frame.
For example, `ether[0] & 1 != 0' catches all multicast traffic.The expression `ip[0] & 0xf != 5'catches all IPv4 packets with options.The expression`ip[6:2] & 0x1fff = 0'catches only unfragmented IPv4 datagrams and frag zero of fragmentedIPv4 datagrams.This check is implicitly applied to the tcp and udpindex operations.For instance, tcp[0] always means the firstbyte of the TCP header, and never means the first byte of anintervening fragment.
Some offsets and field values may be expressed as names rather thanas numeric values.The following protocol header field offsets areavailable: icmptype (ICMP type field), icmpcode (ICMPcode field), and tcpflags (TCP flags field).
The following ICMP type field values are available: icmp-echoreply,icmp-unreach, icmp-sourcequench, icmp-redirect,icmp-echo, icmp-routeradvert, icmp-routersolicit,icmp-timxceed, icmp-paramprob, icmp-tstamp,icmp-tstampreply, icmp-ireq, icmp-ireqreply,icmp-maskreq, icmp-maskreply.
The following TCP flags field values are available: tcp-fin,tcp-syn, tcp-rst, tcp-push,tcp-ack, tcp-urg.
Primitives may be combined using:
Negation has highest precedence.Alternation and concatenation have equal precedence and associateleft to right.Note that explicit and tokens, not juxtaposition,are now required for concatenation.
If an identifier is given without a keyword, the most recent keywordis assumed.For example,is short forwhich should not be confused with
Expression arguments can be passed to tcpdump as either a singleargument or as multiple arguments, whichever is more convenient.Generally, if the expression contains Shell metacharacters, it iseasier to pass it as a single, quoted argument.Multiple arguments are concatenated with spaces before being parsed.
EXAMPLES
To print all packets arriving at or departing from sundown:
To print traffic between helios and either hot or ace:
Cyclone separator design software, free download. To print all IP packets between ace and any host except helios:
To print all traffic between local hosts and hosts at Berkeley:
To print all ftp traffic through internet gateway snup:(note that the expression is quoted to prevent the shell from(mis-)interpreting the parentheses):
To print traffic neither sourced from nor destined for local hosts(if you gateway to one other net, this stuff should never make itonto your local net).
To print the start and end packets (the SYN and FIN packets) of eachTCP conversation that involves a non-local host.
To print all IPv4 HTTP packets to and from port 80, i.e. print onlypackets that contain data, not, for example, SYN and FIN packets andACK-only packets. (IPv6 is left as an exercise for the reader.)
To print IP packets longer than 576 bytes sent through gateway snup:
To print IP broadcast or multicast packets that werenotsent via Ethernet broadcast or multicast:
To print all ICMP packets that are not echo requests/replies (i.e., notping packets):
OUTPUT FORMAT
The output of tcpdump is protocol dependent.The followinggives a brief description and examples of most of the formats.
Link Level Headers
If the '-e' option is given, the link level header is printed out.On Ethernets, the source and destination addresses, protocol,and packet length are printed.
On FDDI networks, the '-e' option causes tcpdump to printthe `frame control' field, the source and destination addresses,and the packet length.(The `frame control' field governs theinterpretation of the rest of the packet.Normal packets (suchas those containing IP datagrams) are `async' packets, with a priorityvalue between 0 and 7; for example, `async4'.Such packetsare assumed to contain an 802.2 Logical Link Control (LLC) packet;the LLC header is printed if it is not an ISO datagram or aso-called SNAP packet.
On Token Ring networks, the '-e' option causes tcpdump to printthe `access control' and `frame control' fields, the source anddestination addresses, and the packet length.As on FDDI networks,packets are assumed to contain an LLC packet.Regardless of whetherthe '-e' option is specified or not, the source routing information isprinted for source-routed packets.
On 802.11 networks, the '-e' option causes tcpdump to printthe `frame control' fields, all of the addresses in the 802.11 header,and the packet length.As on FDDI networks,packets are assumed to contain an LLC packet.
(N.B.: The following description assumes familiarity withthe SLIP compression algorithm described in RFC-1144.)
On SLIP links, a direction indicator (``I' for inbound, ``O' for outbound),packet type, and compression information are printed out.The packet type is printed first.The three types are ip, utcp, and ctcp.No further link information is printed for ip packets.For TCP packets, the connection identifier is printed following the type.If the packet is compressed, its encoded header is printed out.The special cases are printed out as*S+n and *SA+n, where n is the amount by whichthe sequence number (or sequence number and ack) has changed.If it is not a special case,zero or more changes are printed.A change is indicated by U (urgent pointer), W (window), A (ack),S (sequence number), and I (packet ID), followed by a delta (+n or -n),or a new value (=n).Finally, the amount of data in the packet and compressed header lengthare printed.
For example, the following line shows an outbound compressed TCP packet,with an implicit connection identifier; the ack has changed by 6,the sequence number by 49, and the packet ID by 6; there are 3 bytes ofdata and 6 bytes of compressed header:
ARP/RARP Packets
Arp/rarp output shows the type of request and its arguments.Theformat is intended to be self explanatory.Here is a short sample taken from the start of an `rlogin' fromhost rtsg to host csam:
The first line says that rtsg sent an arp packet askingfor the Ethernet address of internet host csam.Csamreplies with its Ethernet address (in this example, Ethernet addressesare in caps and internet addresses in lower case).This would look less redundant if we had done tcpdump -n:
If we had done tcpdump -e, the fact that the first packet isbroadcast and the second is point-to-point would be visible:
For the first packet this says the Ethernet source address is RTSG, thedestination is the Ethernet broadcast address, the type fieldcontained hex 0806 (type ETHER_ARP) and the total length was 64 bytes.TCP Packets
(N.B.:The following description assumes familiarity withthe TCP protocol described in RFC-793.If you are not familiarwith the protocol, neither this description nor tcpdump willbe of much use to you.)
The general format of a tcp protocol line is:
Src and dst are the source and destination IPaddresses and ports.Flags are some combination of S (SYN),F (FIN), P (PUSH), R (RST), W (ECN CWR) or E (ECN-Echo), or a single`.' (no flags).Data-seqno describes the portion of sequence space coveredby the data in this packet (see example below).Ack is sequence number of the next data expected the otherdirection on this connection.Window is the number of bytes of receive buffer space availablethe other direction on this connection.Urg indicates there is `urgent' data in the packet.Options are tcp options enclosed in angle brackets (e.g., <mss 1024>).Src, dst and flags are always present.The other fieldsdepend on the contents of the packet's tcp protocol header andare output only if appropriate.
Here is the opening portion of an rlogin from host rtsg tohost csam.
The first line says that tcp port 1023 on rtsg sent a packetto port loginon csam.The S indicates that the SYN flag was set.The packet sequence number was 768512 and it contained no data.(The notation is `first:last(nbytes)' which means `sequencenumbers firstup to but not including last which is nbytes bytes of user data'.)There was no piggy-backed ack, the available receive window was 4096bytes and there was a max-segment-size option requesting an mss of1024 bytes.Csam replies with a similar packet except it includes a piggy-backedack for rtsg's SYN.Rtsg then acks csam's SYN.The `.' means noflags were set.The packet contained no data so there is no data sequence number.Note that the ack sequencenumber is a small integer (1).The first time tcpdump sees atcp `conversation', it prints the sequence number from the packet.On subsequent packets of the conversation, the difference betweenthe current packet's sequence number and this initial sequence numberis printed.This means that sequence numbers after thefirst can be interpretedas relative byte positions in the conversation's data stream (with thefirst data byte each direction being `1').`-S' will override thisfeature, causing the original sequence numbers to be output.
On the 6th line, rtsg sends csam 19 bytes of data (bytes 2 through 20in the rtsg -> csam side of the conversation).The PUSH flag is set in the packet.On the 7th line, csam says it's received data sent by rtsg up tobut not including byte 21.Most of this data is apparently sitting in thesocket buffer since csam's receive window has gotten 19 bytes smaller.Csam also sends one byte of data to rtsg in this packet.On the 8th and 9th lines,csam sends two bytes of urgent, pushed data to rtsg.
If the snapshot was small enough that tcpdump didn't capturethe full TCP header, it interprets as much of the header as it canand then reports ``[|tcp]' to indicate the remainder could notbe interpreted.If the header contains a bogus option (one with a lengththat's either too small or beyond the end of the header), tcpdumpreports it as ``[bad opt]' and does not interpret any furtheroptions (since it's impossible to tell where they start).If the headerlength indicates options are present but the IP datagram length is notlong enough for the options to actually be there, tcpdump reportsit as ``[bad hdr length]'.
Capturing TCP packets with particular flag combinations (SYN-ACK, URG-ACK, etc.)
There are 8 bits in the control bits section of the TCP header:
- 2) Recipient responds with SYN, ACK
Ffmpeg Command Line Options
Recall the structure of a TCP header without options:
A TCP header usually holds 20 octets of data, unless options arepresent.The first line of the graph contains octets 0 - 3, thesecond line shows octets 4 - 7 etc.
Starting to count with 0, the relevant TCP control bits are containedin octet 13:
Let's have a closer look at octet no. 13:
These are the TCP control bits we are interestedin.We have numbered the bits in this octet from 0 to 7, right toleft, so the PSH bit is bit number 3, while the URG bit is number 5.
Recall that we want to capture packets with only SYN set.Let's see what happens to octet 13 if a TCP datagram arriveswith the SYN bit set in its header:
Looking at thecontrol bits section we see that only bit number 1 (SYN) is set.
Assuming that octet number 13 is an 8-bit unsigned integer innetwork byte order, the binary value of this octet is
This relationship can be expressed as
- tcpdump -i xl0 tcp[13] 2
The expression says 'let the 13th octet of a TCP datagram havethe decimal value 2', which is exactly what we want.
Now, let's assume that we need to capture SYN packets, but wedon't care if ACK or any other TCP control bit is set at thesame time.Let's see what happens to octet 13 when a TCP datagramwith SYN-ACK set arrives:
Now bits 1 and 4 are set in the 13th octet.The binary value ofoctet 13 is
In order to achieve our goal, we need to logically AND thebinary value of octet 13 with some other value to preservethe SYN bit.We know that we want SYN to be set in any case,so we'll logically AND the value in the 13th octet withthe binary value of a SYN:
We see that this AND operation delivers the same resultregardless whether ACK or another TCP control bit is set.The decimal representation of the AND value as well asthe result of this operation is 2 (binary 00000010),so we know that for packets with SYN set the followingrelation must hold true:
tcpdump -i xl0 'tcp[13] & 2 2'
Note that you should use single quotes or a backslashin the expression to hide the AND ('&') special characterfrom the shell.
UDP Packets
UDP format is illustrated by this rwho packet:
This says that port who on host actinide sent a udpdatagram to port who on host broadcast, the Internetbroadcast address.The packet contained 84 bytes of user data.Some UDP services are recognized (from the source or destinationport number) and the higher level protocol information printed.In particular, Domain Name service requests (RFC-1034/1035) and SunRPC calls (RFC-1050) to NFS.
UDP Name Server Requests
(N.B.:The following description assumes familiarity withthe Domain Service protocol described in RFC-1035.If you are not familiarwith the protocol, the following description will appear to be writtenin greek.)
Name server requests are formatted as
Host h2opolo asked the domain server on helios for anaddress record (qtype=A) associated with the name ucbvax.berkeley.edu.The query id was `3'.The `+' indicates the recursion desired flagwas set.The query length was 37 bytes, not including the UDP andIP protocol headers.The query operation was the normal one, Query,so the op field was omitted.If the op had been anything else, it wouldhave been printed between the `3' and the `+'.Similarly, the qclass was the normal one,C_IN, and omitted.Any other qclass would have been printedimmediately after the `A'.A few anomalies are checked and may result in extra fields enclosed insquare brackets: If a query contains an answer, authority records oradditional records section,ancount,nscount,orarcountare printed as `[na]', `[nn]' or `[nau]' where nis the appropriate count.If any of the response bits are set (AA, RA or rcode) or any of the`must be zero' bits are set in bytes two and three, `[b2&3=x]'is printed, where x is the hex value of header bytes two and three.
UDP Name Server Responses
Name server responses are formatted as
In the first example, helios responds to query id 3 from h2opolowith 3 answer records, 3 name server records and 7 additional records.The first answer record is type A (address) and its data is internetaddress 128.32.137.3.The total size of the response was 273 bytes,excluding UDP and IP headers.The op (Query) and response code(NoError) were omitted, as was the class (C_IN) of the A record.In the second example, helios responds to query 2 with aresponse code of non-existent domain (NXDomain) with no answers,one name server and no authority records.The `*' indicates thatthe authoritative answer bit was set.Since there were noanswers, no type, class or data were printed.
Other flag characters that might appear are `-' (recursion available,RA, not set) and `|' (truncated message, TC, set).If the`question' section doesn't contain exactly one entry, `[nq]'is printed.
Note that name server requests and responses tend to be large and thedefault snaplen of 68 bytes may not capture enough of the packetto print.Use the -s flag to increase the snaplen if youneed to seriously investigate name server traffic.`-s 128'has worked well for me.
SMB/CIFS decoding
tcpdump now includes fairly extensive SMB/CIFS/NBT decoding for dataon UDP/137, UDP/138 and TCP/139.Some primitive decoding of IPX andNetBEUI SMB data is also done.
By default a fairly minimal decode is done, with a much more detaileddecode done if -v is used.Be warned that with -v a single SMB packetmay take up a page or more, so only use -v if you really want all thegory details.
For information on SMB packet formats and what all te fields mean seewww.cifs.org or the pub/samba/specs/ directory on your favoritesamba.org mirror site.The SMB patches were written by Andrew Tridgell(tridge@samba.org).
NFS Requests and Replies
Sun NFS (Network File System) requests and replies are printed as:
In the first line, host sushi sends a transaction with id 6709to wrl (note that the number following the src host is atransaction id, not the source port).The request was 112 bytes,excluding the UDP and IP headers.The operation was a readlink(read symbolic link) on file handle (fh) 21,24/10.731657119.(If one is lucky, as in this case, the file handle can be interpretedas a major,minor device number pair, followed by the inode number andgeneration number.)Wrl replies `ok' with the contents of the link.In the third line, sushi asks wrl to lookup the name`xcolors' in directory file 9,74/4096.6878.Note that the data printeddepends on the operation type.The format is intended to be selfexplanatory if read in conjunction withan NFS protocol spec.
If the -v (verbose) flag is given, additional information is printed.For example:
(-v also prints the IP header TTL, ID, length, and fragmentation fields,which have been omitted from this example.) In the first line,sushi asks wrl to read 8192 bytes from file 21,11/12.195,at byte offset 24576.Wrl replies `ok'; the packet shown on thesecond line is the first fragment of the reply, and hence is only 1472bytes long (the other bytes will follow in subsequent fragments, butthese fragments do not have NFS or even UDP headers and so might not beprinted, depending on the filter expression used).Because the -v flagis given, some of the file attributes (which are returned in additionto the file data) are printed: the file type (``REG', for regular file),the file mode (in octal), the uid and gid, and the file size.If the -v flag is given more than once, even more details are printed.
Note that NFS requests are very large and much of the detail won't be printedunless snaplen is increased.Try using `-s 192' to watchNFS traffic.
NFS reply packets do not explicitly identify the RPC operation.Instead,tcpdump keeps track of ``recent' requests, and matches them to thereplies using the transaction ID.If a reply does not closely follow thecorresponding request, it might not be parsable.
AFS Requests and Replies
Transarc AFS (Andrew File System) requests and replies are printedas:
In the first line, host elvis sends a RX packet to pike.This wasa RX data packet to the fs (fileserver) service, and is the start ofan RPC call.The RPC call was a rename, with the old directory file idof 536876964/1/1 and an old filename of `.newsrc.new', and a new directoryfile id of 536876964/1/1 and a new filename of `.newsrc'.The host pikeresponds with a RPC reply to the rename call (which was successful, becauseit was a data packet and not an abort packet).In general, all AFS RPCs are decoded at least by RPC call name.MostAFS RPCs have at least some of the arguments decoded (generally onlythe `interesting' arguments, for some definition of interesting).
The format is intended to be self-describing, but it will probablynot be useful to people who are not familiar with the workings ofAFS and RX.
If the -v (verbose) flag is given twice, acknowledgement packets andadditional header information is printed, such as the the RX call ID,call number, sequence number, serial number, and the RX packet flags.
If the -v flag is given twice, additional information is printed,such as the the RX call ID, serial number, and the RX packet flags.The MTU negotiation information is also printed from RX ack packets.
If the -v flag is given three times, the security index and service idare printed.
Error codes are printed for abort packets, with the exception of Ubikbeacon packets (because abort packets are used to signify a yes votefor the Ubik protocol).
Note that AFS requests are very large and many of the arguments won'tbe printed unless snaplen is increased.Try using `-s 256'to watch AFS traffic.
AFS reply packets do not explicitly identify the RPC operation.Instead,tcpdump keeps track of ``recent' requests, and matches them to thereplies using the call number and service ID.If a reply does not closelyfollow thecorresponding request, it might not be parsable.
KIP AppleTalk (DDP in UDP)
AppleTalk DDP packets encapsulated in UDP datagrams are de-encapsulatedand dumped as DDP packets (i.e., all the UDP header information isdiscarded).The file/etc/atalk.namesis used to translate AppleTalk net and node numbers to names.Lines in this file have the form
The first two lines give the names of AppleTalk networks.The thirdline gives the name of a particular host (a host is distinguishedfrom a net by the 3rd octet in the number -a net number must have two octets and a host number musthave three octets.) The number and name should be separated bywhitespace (blanks or tabs).The/etc/atalk.namesfile may contain blank lines or comment lines (lines starting witha `#').AppleTalk addresses are printed in the form
(If the/etc/atalk.namesdoesn't exist or doesn't contain an entry for some AppleTalkhost/net number, addresses are printed in numeric form.)In the first example, NBP (DDP port 2) on net 144.1 node 209is sending to whatever is listening on port 220 of net icsd node 112.The second line is the same except the full name of the source nodeis known (`office').The third line is a send from port 235 onnet jssmag node 149 to broadcast on the icsd-net NBP port (note thatthe broadcast address (255) is indicated by a net name with no hostnumber - for this reason it's a good idea to keep node names andnet names distinct in /etc/atalk.names).NBP (name binding protocol) and ATP (AppleTalk transaction protocol)packets have their contents interpreted.Other protocols just dumpthe protocol name (or number if no name is registered for theprotocol) and packet size.
NBP packets are formatted like the following examples:
The first line is a name lookup request for laserwriters sent by net icsd host112 and broadcast on net jssmag.The nbp id for the lookup is 190.The second line shows a reply for this request (note that it has thesame id) from host jssmag.209 saying that it has a laserwriterresource named 'RM1140' registered on port 250.The third line isanother reply to the same request saying host techpit has laserwriter'techpit' registered on port 186.ATP packet formatting is demonstrated by the following example:
Jssmag.209 initiates transaction id 12266 with host helios by requestingup to 8 packets (the `<0-7>').The hex number at the end of the lineis the value of the `userdata' field in the request.Helios responds with 8 512-byte packets.The `:digit' following thetransaction id gives the packet sequence number in the transactionand the number in parens is the amount of data in the packet,excluding the atp header.The `*' on packet 7 indicates that theEOM bit was set.
Jssmag.209 then requests that packets 3 & 5 be retransmitted.Heliosresends them then jssmag.209 releases the transaction.Finally,jssmag.209 initiates the next request.The `*' on the requestindicates that XO (`exactly once') was not set.
IP Fragmentation
Fragmented Internet datagrams are printed as
(The first form indicates there are more fragments.The secondindicates this is the last fragment.)Id is the fragment id.Size is the fragmentsize (in bytes) excluding the IP header.Offset is thisfragment's offset (in bytes) in the original datagram.
The fragment information is output for each fragment.The firstfragment contains the higher level protocol header and the fraginfo is printed after the protocol info.Fragmentsafter the first contain no higher level protocol header and thefrag info is printed after the source and destination addresses.For example, here is part of an ftp from arizona.edu to lbl-rtsg.arpaover a CSNET connection that doesn't appear to handle 576 byte datagrams:
There are a couple of things to note here: First, addresses in the2nd line don't include port numbers.This is because the TCPprotocol information is all in the first fragment and we have no ideawhat the port or sequence numbers are when we print the later fragments.Second, the tcp sequence information in the first line is printed as if therewere 308 bytes of user data when, in fact, there are 512 bytes (308 inthe first frag and 204 in the second).If you are looking for holesin the sequence space or trying to match up ackswith packets, this can fool you.A packet with the IP don't fragment flag is marked with atrailing (DF).
Timestamps
By default, all output lines are preceded by a timestamp.The timestampis the current clock time in the form
and is as accurate as the kernel's clock.The timestamp reflects the time the kernel first saw the packet.No attemptis made to account for the time lag between when theEthernet interface removed the packet from the wire and when the kernelserviced the `new packet' interrupt.AUTHORS
The original authors are:Van Jacobson,Craig Leres andSteven McCanne, all of theLawrence Berkeley National Laboratory, University of California, Berkeley, CA.
It is currently being maintained by tcpdump.org.
The current version is available via http:
- ftp://ftp.ee.lbl.gov/tcpdump.tar.Z
IPv6/IPsec support is added by WIDE/KAME project.This program uses Eric Young's SSLeay library, under specific configuration.
BUGS
Please send problems, bugs, questions, desirable enhancements, etc. to:- patches@tcpdump.org
NIT doesn't let you watch your own outbound traffic, BPF will.We recommend that you use the latter.
On Linux systems with 2.0[.x] kernels:
We recommend that you upgrade to a 2.2 or later kernel.
Some attempt should be made to reassemble IP fragments or, at leastto compute the right length for the higher level protocol.
Name server inverse queries are not dumped correctly: the (empty)question section is printed rather than real query in the answersection.Some believe that inverse queries are themselves a bug andprefer to fix the program generating them rather than tcpdump.
A packet trace that crosses a daylight savings time change will giveskewed time stamps (the time change is ignored).
Filter expressions on fields other than those in Token Ring headers willnot correctly handle source-routed Token Ring packets.
Filter expressions on fields other than those in 802.11 headers will notcorrectly handle 802.11 data packets with both To DS and From DS set.
ip6 protoshould chase header chain, but at this moment it does not.ip6 protochainis supplied for this behavior.
Arithmetic expression against transport layer headers, like tcp[0],does not work against IPv6 packets.It only looks at IPv4 packets.
This document was created byman2html,using the manual pages.Time: 02:59:27 GMT, December 01, 2006
Winamp Linein Command
Breadcrumb -- Wiki Main : Skin Developer : Visual Developer : Plug-in Developer : Articles Page : FAQ : Glossary
- 4Trouble Shooting
Installation
MilkDrop 2 comes with Winamp. To install it, just download and install the latest version of Winamp. During the installation, make sure the 'MilkDrop' visualizer option is checked, so that it gets installed, too.
Once Winamp is installed, launch it. Load some music files into your playlist and start playing some music. (Be sure to play some music before trying to launch the visualizer - otherwise you'll just see a black screen.)
Once music is playing, hit CTRL+K and a list of visualization plug-ins will appear. Select 'MilkDrop 2' from the list. Then click the 'Start' button, and it will launch the visualizer.
Tweaking to achieve best image quality
a) Fullscreen Display Mode [first tab of config screen]
When you run MilkDrop fullscreen, it changes the display mode to whatever you select here. Generally speaking, the speed (framerate) and smoothness of MilkDrop will drop as the resolution (number of pixels on the screen)increases. So, if it's running to slow in fullscreen mode, try selecting a smaller fullscreen display mode.
b) Canvas Stretch [second tab]
This option lets you trade resolution [crispness] for speed. If MilkDrop runs too slow, in any mode (windowed/fullscreen/desktop), try cranking up the canvas stretch to, say, 1.5X or 2X. The image will not look as crisp, but MilkDrop will probably run much faster. (Assuming that your graphics chip was the bottleneck.)
c) Mesh Size [second tab]
This is the main option that affects how much processor (CPU) MilkDrop uses. If you crank it up far beyond the default, expect to be CPU-bound (where your framerate drops because the CPU is the bottleneck). To get MilkDrop to speed up, drop the Mesh Size back down. The Mesh Size decides how many points on the screen the per-vertex equations will be executed for; the higher the mesh size, the more fidelity you will see in the motion.
d) Tips for LCD and laptop users
LCD screens: Note that most LCD screens (flatpanels) usually run at a fixed frequency only - usually 60 Hz - meaning that they update the screen 60 times per second. However, sometimes the video driver reports that it supports other refresh rates, such as 72, 75, 85, etc. It is strongly recommended that [for fullscreen mode, and for Windows in general] you choose a display mode with a 60 Hz refresh rate, for the smoothest possible animation. For this plugin, you will also want to choose Maximum Framerates that divide evenly into 60 - such as 60, 30, 20, 15, 12, 10, 6, 5, and so on - so that the # of times the LCD shows each frame of animation remains constant, resulting in the smoothest possible animation.
e) color (bit) depth: 16 or 32?
The answer, nowadays, is a resounding '32'. Video memory is plentiful these days; use 32 bit color, for both your windows desktop (..so that MilkDrop's windowed mode can run at 32 bits) and for MilkDrop's Fullscreen Display Mode setting (where '8888' denotes 32 bits). Some ancient video cards don't have enough memory to run MilkDrop properly (or smoothly) in 32 bits, though; you might want to try 16-bit color if your card has less than 32 MB of video memory, if you are using a laptop, or if your video card is significantly old. In the MilkDrop config panel, 16-bit modes show up as '555' or '565'.
If you find that your card runs best in 32-bit color, you should have no problems with brightness levels while running MilkDrop. However, if your card runs best in 16-bit color, you should then adjust the Brightness slider on the second tab of the config panel (which only affects 16-bit color video modes!). The goal is to make the image as bright as possible, without oversaturating it (washing it out, often to bright pink or white). This setting also varies for different cards, depending on how the card rounds color values, so we recommend seeing how bright you can set the slider closer to '0') without oversaturating the image. Usually,a setting of '0' or '2' works the best.
Usage
4.a. Keyboard Commands
The following keys can be used to control MilkDrop while it is running.(Note: pressing F1 while MilkDrop is running will show you this list)
GENERAL
PRESET LOADING
loading a new preset will load everything *except* thelocked shaders, creating a mix between the two presets.
Team fortress 2 non steam pc update patch 1.7. PRESET EDITING AND SAVING
(see MilkDrop Preset Authoring)
MUSIC PLAYBACK
Winamp Line In Url
FUNCTION KEYS
SPRITES AND CUSTOM MESSAGES (FOR VJ's)
DELETE: clear message (if visible)
Note that there are more keys available, but because manyare only relevant to people designing their own presets, they are listed in the preset authoring guide instead.
4.b. config panel
The configuration panel lets you customize the way MilkDrop runs.To learn how to get to the configuration panel, see the 'Installation'section above.
Once you're in the config panel, you'll see a number of tabsat the top, some dropdown boxes, and some checkboxes. Eachof the tabs at the top brings you to a different page of configuration options. To get help on a setting, simply clickon the '?' in the upper-right corner of the config panel, and then click on the setting you want help with.
4.c. preset authoring
Please check the MilkDrop Preset Authoring guide for instructions on how to create and save your own presets.
4.d. rating system
The built-in rating system allows you to rate each preset on a scale from 0 to 5. A rating of 5 is very good, while a rating of 0 isthe worst. The ratings decide how often the presets will be randomlyloaded. If a preset has a rating of 0, it will never be randomlyloaded (unless they're all zero; then they all have an equal chance).
To show the rating for a preset, press F6. You can adjust the rating for a preset with the +/- keys. When you make adjustments,they save automatically; there's no need to save the preset to makethe rating change permanent.
Here's a recommended interpretation of the numeric values:
If a preset seems 'lost' because you set its rating to 0 and itwon't ever come back, you can always load it up by hitting 'L'to conjure the 'Load Preset' menu, finding the preset you want,loading it, then hitting +.
4.e. custom messages
ABOUT CUSTOM MESSAGES:The 'Custom Message' feature of MilkDrop allows you to displayshort text messages on the screen while MilkDrop is running.They are highly configurable; you can set all of the followingparameters: the font, the size, the positioning, color, bold state, italic state, and so on; and you can even have it randomize some of these properties.
CREATING THE MESSAGES:You can save up to 100 messages in the file MILK_MSG.INI inyour WinampPlugins folder. To open this file, go to the MilkDrop configuration screen (ALT+K from Winamp) and click the'Edit Custom Messages' button. Or, you can just edit it manually if you know how; it's plain-text.
The first thing you see when you open the file is a bunch oflines that start with two forward slashes (//). These arecomment lines, and they explain the syntax for adding a fontor a message to the file. This is your main reference forfinding out what all the parameters do for the fonts & messages;it is recommended that you leave this information in the file,although it can be removed or (modified) and the messages willstill work.
After the comments come first the fonts, then the messages.The fonts are simply a way to specify a typeface, bold state,italics state, and red/green/blue color for the font. You can configure up to 16 fonts like this (numbered 00-15). These fontswill serve as template fonts for the custom messages.
The next section is the actual messages. Each one has atext message (the 'text' parameter) that will be shown to theuser, and each one references one of the 16 fonts that weredefined in the previous section. You can also specify thesize (size), position (x,y), a growth factor (growth) thatwill grow/shrink the message over its lifetime, the numberof seconds to show the message (time), and the fraction of thattime that is spent fading in (fade).
You can also randomize some of these values: 'randx' and 'randy'will randomly perturb the (x,y) coordinates every time the messageis shown to the user, and 'randr'/'randg'/'randb' will randomlyperturb the (r,g,b) color in the same way.
Finally, you can override any of the default properties for thefont that this message uses: (face, bold, ital, r, g, b).
INVOCATION AND USAGE:There are two ways to invoke custom messages: one automatic,the other manual.
The automatic way is to go to the MilkDrop config panel (ALT+K),click the 'More Options' button, and set the value in the'Time between RANDOM custom messages' box to something greaterthan zero. This will cause MilkDrop to randomly display custom messages while it is running, and the average time (in seconds) between messages will be the value you entered here. If you wish to disable random custom messages, set this value to -1(or any negative number). Note that all messages in the filehave an equal change of being picked.
The manual way is to type in the two-digit code (00-99) of the message while MilkDrop is running. However, you can't use the numeric keypad for this - you have to use the numbers at the TOP of your keyboard to do it. If you mess up while enteringthe first digit, just press the '*' key to start over.
Note that if you change the MILK_MSG.INI file while MilkDropis running, you will not be able to see the changes untilyou hit F7, which tells MilkDrop to re-read the MILK_MSG.INI file from disk.
4.f. sprites
ABOUT SPRITES:The 'Sprite' feature of MilkDrop allows you to display any image of your choice in the foreground (on top of MilkDrop) while it runs. The sprites can fade in and out, move around, respond to the music, and so on. You define them in a file - milk_img.ini in your winampplugins directory - much like you define custom messages, each having an identifying code number from 00 through 99 (used to invoke them). However, the way the individual sprites are defined is different; you write code for them, instead of just setting parameter values. This is a little bit tougher to do (it's very much like preset authoring), but adds a great deal of flexibility to what you can do with the sprites.
CREATING THE SPRITES:
You can define up to 100 sprites in the file MILK_IMG.INI in your WinampPlugins folder. To open this file, go to the MilkDrop configuration screen (ALT+K from Winamp) and click the 'Edit Sprites' button. Or, you can just edit it manually if you know how; it's plain-text.
The first thing you see when you open the file is a bunch of lines that start with two forward slashes (//). These are comment lines, and they explain the syntax for creating a sprite. This is your main reference for finding out what all the parameters do for the fonts & messages; it is recommended that you leave this information in the file, although it can be removed (or modified) and the sprites will still work.
After the comments come the sprite definitions. Each sprite is made up of one parameter that indicates the image file to use (this is the 'img=..' line), and two types of code: initialization code, and regular code.
The first - initialization code - is executed only once, when you launch the sprite. Use it to do one-time initialization of variables (such as the opacity (a), rotation angle (rot), position (x,y), and so on) or to invent new variables that you will access later. This code is marked by the 'init_1=..', 'init_2=..', etc. lines. The second type of code - marked by 'code_1=..', 'code_2=..', etc. is executed every frame, just prior to plastering the sprite on the screen. Use it to animate the sprite, moving it around (changing x,y), scaling it up and down (sx,sy), fading it in and out (a), changing its color, and so on.
INVOCATION AND USAGE:There is currently only one way to invoke sprites: manually. To do this, first press 'K' to enter 'sprite mode' (while running MilkDrop). Now, whenever you type in a two-digit code (00-99), MilkDrop will try to find & launch the sprite you've requested, from the milk_img.ini file. If there is an error, it will display an error message in the upper-right corner. Note that to enter the two-digit code, you can't use the numeric keypad; you have to use the numbers at the TOP of your keyboard.
If you make an error entering the first digit of the code, just press '*' to start over. If you want to clear the most recently-invoked sprite, press DELETE. If you want to clear the oldest sprite, press SHIFT + DELETE. If you want to clear all sprites, press SHIFT + CTRL + DELETE.
Winamp Command Line Options
If you want to clear sprites by their 2-digit code, press SHIFT + K (instead of just 'K') to enter 'sprite kill mode.' Now, when you enter a two-digit code, instead of invoking the sprite, MilkDrop clears all running sprites with that two-digit code.
Trouble Shooting
If MilkDrop has a critical problem (e.g. fails to load, freezes, etc.)or if the image is distorted, torn, corrupted, or all one solid color, try the following two suggestions to resolve the problem. In 90% of these cases it can be fixed. If you have a different problem, scroll down past this part and try to find the appropriate symptom and its solution.
1. UPDATE YOUR VIDEO DRIVER, OR TRY OTHER DRIVERS
Almost all display problems are caused by buggy video drivers! A 'driver' is a piece of software that translates graphics-related commands from programs, like MilkDrop, into the native language of your specific graphics hardware.
For desktop machines, there are typically three sources for video drivers:
- those from the *chip* manufacturer's website (usually nvidia.com or ati.com) (best source)
- those from the card manufacturer's website (LeadTEK, PNY, etc.)
- those that shipped with Windows (yuck)
For laptops:
Ffmpeg Command Line Aac
- the driver from the *laptop* manufacturer
- (maybe) the driver from the graphics chip manufacturer (ATI, Nvidia, etc) - however, it's fairly common to find that the laptop requires a custom driver written by the laptop manufacturer.
- the driver that shipped with Windows (yuck)
Give them all a shot. Track down every driver you can find for your card, and try it. Try the WHQL ones first - these versions of the drivers have passed 'Windows Hardware Quality Labs' certification and are usually the more stable and reliable ones. In general, it's a very good idea to use only Microsoft-certified WHQL drivers for your video card. Often people want to get the newest, fastest beta drivers, but these drivers are almost ALWAYS riddled with new bugs. You can also watch the version number of the drivers a company releases - if the version number just jumped to a new series such as from the 70's to the 80's), watch out, it probably has a lot of bugs that need worked out - give it 3-4 months before expecting the new driver series to work well. With video drivers, the newest isn't always the best!
Here is a list of some common card/chip manufacturers and where to get their drivers. Don't forget to choose the WHQL driver!
For others - or in general - if your graphics chip is made by Trident, for example, then try a google search for:
Then click on 'support', then 'drivers' (or 'downloads'), then 'graphics driver', and so on.
2. [RE]INSTALL DIRECTX
Make sure you have a quasi-recent version of Microsoft DirectX installed. In reality, though, almost every PC in the world has DirectX 9 on it at this point, so this shouldn't be a problem. If you go to download it, you'll only be able to find DirectX 10 - this is fine to install, though, as it includes DirectX 9 inside it. As a last resort, though, if you are having problems, you could try re-installing DirectX to see if it helps.
If you're having a non-critical problem, browse the following list of common problems and their causes and solutions. Note that for each symptom- cause-solution block, there can be multiple symptoms with the same cause and solution, and the same symptom might be listed in multiple blocks.
If the solutions below don't work for you, please visit the forums at http://forums.winamp.com/forumdisplay.php?forumid=84, where you can read the most recent troubleshooting issues and solutions.
Known Issues / Misc. / Tips:
Using Line-In