iotop-c

package: iotop-c

title: iotop-c(8)

summary: simple top\-like I/O monitor

text:
# iotop-c(8)

## NAME
iotop - simple top-like I/O monitor

## SYNOPSIS
iotop [OPTIONS]

## DESCRIPTION
iotop watches I/O usage information available in the Linux kernel (requires 2.6.20 or later) and displays a table of current I/O usage by processes or threads on the system. At least the CONFIG_TASK_DELAY_ACCT, CONFIG_TASK_IO_ACCOUNTING, CONFIG_TASKSTATS and CONFIG_VM_EVENT_COUNTERS options need to be enabled in your Linux kernel build configuration.

Running iotop as non-root user is possible by adding the NET_ADMIN capability. This can be done by e.g.:

$ sudo setcap 'cap_net_admin+eip' <path-to>/iotop

Be warned that this will also allow other users to run it and get access to information that normally should not be available to them. iotop displays columns for the I/O bandwidth read and written by each process/thread during the sampling period. It also displays the percentage of time the thread/process spent while swapping in and while waiting on I/O. For each process, its I/O priority (class/level) is shown.

In addition, the total I/O bandwidth read and written during the sampling period are displayed at the top of the interface. Total DISK READ and Total DISK WRITE values represent total read and write bandwidth between processes and kernel threads on one side and kernel block device subsystem on the other. While Current DISK READ and Current DISK WRITE values represent corresponding bandwidths for current disk I/O between the kernel block device subsystem and the underlying hardware (HDD, SSD, etc.). Thus Total and Current values may not be equal at any given moment of time due to data caching and I/O operations reordering that take place inside the Linux kernel.

Use the left and right arrows to select the sort column, r or space to reverse the sorting order, o to toggle the --only option (this uses the visible values from the GRAPH column or the IO column in case the GRAPH column is hidden), p to toggle the --processes option, a to cycle between the --accumulated, --accum-bw and normal operation, i to change the priority of a thread or a process's thread, f to change filtering by UID/PID (--user and --pid options), 1-9 to toggle the visibility of the respective column, 0 to show all columns, up/down arrows, page-up/page-down/home/end keys to scroll and q to quit. Any unrecognized key will be ignored.

All processes or threads that have exited are displayed grayed for the same time as is visible in the GRAPH column or 3 seconds when it is hidden. The invalid data points in the GRAPHS column are displayed inverse or with letter x (see option --dead-x and x shortcut). When using unicode characters each position contains two datapoints and only the positions with two invalid data points are reversed.

It is possible for threads of a process to have different priority from their main process. This is shown with ! in the PRIO column of the main process as e.g. !be/4.

Threads activity is always aggregated with and shown inside the main process.

When showing threads, they always appear below their main process and are sorted in the same way as the processes.

There are two ways to change the IO priority of a process or thread - press i and use arrows to select the process or thread from the visible ones on screen or press i and type its TID (PID and TID have the same value for the main process). Then use tab and arrows to change the priority value and confirm with enter. Shortcuts esc or q will cancel this mode.

To change the UID and PID filters, press f and use tab to select the UID or PID field, then type the numerical id or n to remove the filter and confirm with enter. Filtering is always done by TID because it is unique. Note that for the main process PID is the same as TID. Shortcuts esc or q will cancel this mode.

Starting with Linux kernel 5.14.x task_delayacct is configurable at runtime and set to off by default. This setting can be changed in interactive mode by the Ctrl-T shortcut. In batch mode a warning is printed when the setting is OFF. From the command line this can be enabled by:

$ sudo sysctl kernel.task_delayacct=1

and disabled again by: $ sudo sysctl kernel.task_delayacct=0

It is advisable to keep this option off when not using this or another monitoring program because when enabled it has some effect on system performance.

## OPTIONS
-v, --version

Show the version number and exit

-h, --help

Show usage information and exit

-H, --help-type=TYPE

Set the type of interactive help shown. Accepted values for TYPE are none, win and inline.

-o, --only

Only show processes or threads actually doing I/O, instead of showing all processes or threads. This can be dynamically toggled by pressing o

--no-only

Show all processes or threads

-b, --batch

Turn on non-interactive mode. Useful for logging I/O usage over time

-n NUM, --iter=NUM

Set the number of iterations before quitting (never quit by default). This is most useful in non-interactive mode

-d SEC, --delay=SEC

Set the delay between iterations in seconds (1 second by default). Accepts non-integer values such as 1.1 seconds

-p PID, --pid=PID

A process/thread id to monitor (all by default)

-u USER, --user=USER

A user id to monitor (all by default). The value will always be resolved first unless it is prefixed by + in which case it is treated as numeric only. Values that do not resolve but appear to be numeric are used as numeric

-P, --processes

Only show processes. Normally iotop shows processes and all threads

--no-processes

Show processes and all threads

-a, --accumulated

Show accumulated I/O instead of bandwidth. In this mode, iotop shows the amount of I/O processes have done since the process or iotop started. Note that this option and --accum-bw are exclusive and they will turn each other off

--no-accumulated

Show bandwidth (useful when changing config file with --write)

-A, --accum-bw

Show accumulated I/O as bandwidth for the whole sampling period. In this mode, iotop shows the amount of I/O per second for the whole period since the process or iotop started Note that this option and --accumulated are exclusive and they will turn each other off

--no-accum-bw

Show bandwidth (useful when changing config file with --write)

-k, --kilobytes

Use kilobytes instead of a human friendly unit. This mode is useful when scripting the batch mode of iotop. Instead of choosing the most appropriate unit iotop will display all sizes in kilobytes

--no-kilobytes

Use human friendly units

-t, --time

Add a timestamp on each line (implies --batch). Each line will be prefixed by the current time

-c, --fullcmdline

Show processes' full file path and parameters

--no-fullcmdline

Show processes' names only

-1, --hide-pid

Hide PID/TID column

--show-pid

Show PID/TID column

-2, --hide-prio

Hide PRIO column

--show-prio

Show PRIO column

-3, --hide-user

Hide USER column

--show-user

Show USER column

-4, --hide-read

Hide DISK READ column

--show-read

Show DISK READ column

-5, --hide-write

Hide DISK WRITE column

--show-write

Show DISK WRITE column

-6, --hide-swapin

Hide SWAPIN column

--show-swapin

Show SWAPIN column

-7, --hide-io

Hide IO column

--show-io

Show IO column

-8, --hide-graph

Hide GRAPH column

--show-graph

Show GRAPH column

-9, --hide-command

Hide COMMAND column

--show-command

Show COMMAND column

-g TYPE, --grtype=TYPE

Set GRAPH column data source. Accepted values for TYPE are io, r, w, rw and sw.

-R, --reverse-graph

Reverse GRAPH direction - show most recent values on the right side

--no-reverse-graph

Do not reverse GRAPH direction - show most recent values on the left side

-q, --quiet

Suppress some lines of header (implies --batch). This option can be specified up to three times to remove header lines

-q

column names are only printed on the first iteration,

-qq

column names are never printed,

-qqq

the I/O summary is never printed

-x, --dead-x

Show exited processes/threads with letter x instead of inverse background

--no-dead-x

Show exited processes/threads with inverse background

-e, --hide-exited

Hide exited processes

--show-exited

Show exited processes

-l, --no-color

Do not colorize values

--color

Colorize values. This will override the effect of the environment variable NO_COLOR when explicitly specified on the command line.

-T, --hide-time

Do not show time clock in upper right corner

--show-time

Show time clock in upper right corner

--si

Use SI units of 1000 when printing values. The default is non-SI 1024

--no-si

Use non-SI units of 1024 when printing values

--threshold=1..10

Set the threshold to switch to next unit. The default value is 2

--ascii

Disable using Unicode

--unicode

Use Unicode drawing chars

-W, --write

Merge the preceding options to the current config, save the config and exit. Note that all options after this one will be ignored.

## KEYBOARD SHORTCUTS
q, Q

Exit

W

Save current settings to configuration file in $HOME/.config/iotop/iotoprc

D

Reset all settings to their default values

<space>, r

Toggle sort order

<home>

Scroll to the top of the list

<end>

Scroll to the bottom of the list

<page-up>

Scroll one screen up

<page-down>

Scroll one screen down

<up>

Scroll one line up

<down>

Scroll one line down

<right>

Sort by next column

<left>

Sort by previous column

<esc>

Cancel ionice or filter selection. In case only the help window is open then close it

o, O

Toggle showing only processes with IO activity

p, P

Toggle showing processes/threads

a, A

Cycle showing accumulated/accum-bw/current values

?

Toggle showing inline help

h, H

Toggle showing window help

c, C

Toggle showing full command line

1, 2, 3, 4, 5, 6, 7, 8, 9

Toggle showing the column (column number corresponds to the shortcut)

0

Show all columns

g, G

Cycle GRAPH source (IO=IO, R=DISK READ , W=DISK WRITE, R+W=DISK READ+DISK WRITE, SW=SWAPIN). Using g will cycle forward and G will cycle backward.

R

Toggle reverse GRAPH direction

i, I

IOnice a process/thread (depends on process/thread display mode)

f, F

Change UID and PID filters

u, U

Toggle using Unicode/ASCII characters for pseudo graph

l, L

Toggle colorizing values

x, X

Toggle the display mode of exited processes/threads between letter x and inverse background

e, E

Toggle the display of exited processes

T

Toggle the display of time clock in upper right corner

s, S

Toggle freeze of data collection

Ctrl-B, b

Toggle SI units

Ctrl-R, t

Cycle unit threshold

Ctrl-T

Toggle task_delayacct kernel sysctl

Ctrl-L

Redraw screen

/

Change search regular expression. While the search regular expression is being edited, there is an indicator next to it that shows if the expression is valid. The search is confirmed by <enter> or cancelled by <esc>. List of shortcuts in the editor:

<esc>

Cancel editing and remove the regular expression filter

<enter>

Confirm the current regular expression and exit edit mode. In case the regular expression is empty or invalid it will match everything.

Alt/Meta-<backspace>, Ctrl-W

Delete one word from cursor to the left

Alt/Meta-D

Delete one word from cursor to the right

Alt/Meta-B, Ctrl-<left>

Move the cursor to the beginning of the word on the left

Alt/Meta-F, Ctrl-<right>

Move the cursor after the end of the word on the right

Ctrl-A, <home>

Move the cursor to the leftmost position

Ctrl-E, <end>

Move the cursor after the last character

Ctrl-B, <left>

Move the cursor to the left

Ctrl-F, <right>

Move the cursor to the right

Ctrl-H, <backspace>

Delete the character left of cursor

Ctrl-D, <del>

Delete the character under the cursor

Ctrl-K

Delete from the character under the cursor to the end of the line

Ctrl-U

Delete everything

[anything-else]

Non-printable characters are ignored. Normal characters are inserted before the character under the cursor. UTF-8 sequences are parsed and treated as a single character. Unicode combining characters will be appended to the character under the cursor.

## ENVIRONMENT
As per the recommendation of https://www.no-color.org/ iotop honors the contents of the environment variable NO_COLOR and when it is set to a non empty string, all color output is suppressed.

## SEE ALSO
ionice(1), top(1), vmstat(1), atop(1), htop(1)

## AUTHOR
The original Python iotop implementation was written by Guillaume Chazarain. This rewrite in C was started in 2014 by Vyacheslav Trushkin and reworked to include all missing features from the original Python code and several new ones from 2020 to 2024 by Boian Bonev.

This manual page was started by Paul Wise for the Debian project and is placed in the public domain.


ip-brctl

package: ip-brctl

title: ip-brctl(8)

summary: ethernet bridge administration

text:
# ip-brctl(8)

## NAME
ip-brctl - ethernet bridge administration

## SYNOPSIS
brctl [command]

## DESCRIPTION
ip-brctl is a reimplementation of the traditional brctl utility in shell making use of ip and bridge tools internally. It is supposed to behave identically to brctl, hence the remainder of this document will use that name instead of ip-brctl.

brctl is used to set up, maintain, and inspect the ethernet bridge configuration in the Linux kernel.

An ethernet bridge is a device commonly used to connect different networks of ethernets together, so that these ethernets will appear as one ethernet to the participants.

Each of the ethernets being connected corresponds to one physical interface in the bridge. These individual ethernets are bundled into one bigger ('logical') ethernet, this bigger ethernet corresponds to the bridge network interface.

## INSTANCES
The command brctl addbr <name> creates a new instance of the ethernet bridge. The network interface corresponding to the bridge will be called <name>.

The command brctl delbr <name> deletes the instance <name> of the ethernet bridge. The network interface corresponding to the bridge must be down before it can be deleted!

The command brctl show shows all current instances of the ethernet bridge.

## PORTS
Each bridge has a number of ports attached to it. Network traffic coming in on any of these ports will be forwarded to the other ports transparently, so that the bridge is invisible to the rest of the network (i.e. it will not show up in traceroute(8) ).

The command brctl addif <brname> <ifname> will make the interface <ifname> a port of the bridge <brname>. This means that all frames received on <ifname> will be processed as if destined for the bridge. Also, when sending frames on <brname>, <ifname> will be considered as a potential output interface.

The command brctl delif <brname> <ifname> will detach the interface <ifname> from the bridge <brname>.

The command brctl show <brname> will show some information on the bridge and its attached ports.

## AGEING
The bridge keeps track of ethernet addresses seen on each port. When it needs to forward a frame, and it happens to know on which port the destination ethernet address (specified in the frame) is located, it can 'cheat' by forwarding the frame to that port only, thus saving a lot of redundant copies and transmits.

However, the ethernet address location data is not static data. Machines can move to other ports, network cards can be replaced (which changes the machine's ethernet address), etc.

brctl showmacs <brname> shows a list of learned MAC addresses for this bridge.

brctl setageing <brname> <time> sets the ethernet (MAC) address ageing time, in seconds. After <time> seconds of not having seen a frame coming from a certain address, the bridge will time out (delete) that address from the Forwarding DataBase (fdb).

## SPANNING TREE PROTOCOL
Multiple ethernet bridges can work together to create even larger networks of ethernets using the IEEE 802.1d spanning tree protocol. This protocol is used for finding the shortest path between two ethernets, and for eliminating loops from the topology. As this protocol is a standard, Linux bridges will interwork properly with other third party bridge products. Bridges communicate with each other by sending and receiving BPDUs (Bridge Protocol Data Units). These BPDUs can be recognised by an ethernet destination address of 01:80:c2:00:00:00.

The spanning tree protocol can also be turned off (for those situations where it just doesn't make sense, for example when this Linux box is the only bridge on the LAN, or when you know that there are no loops in the topology.)

brctl(8) can be used for configuring certain spanning tree protocol parameters. For an explanation of these parameters, see the IEEE 802.1d specification (or send me an email). The default values should be just fine. If you don't know what these parameters mean, you probably won't feel the desire to tweak them.

brctl stp <bridge> <state> controls this bridge instance's participation in the spanning tree protocol. If <state> is "on" or "yes" the STP will be turned on, otherwise it will be turned off. When turned off, the bridge will not send or receive BPDUs, and will thus not participate in the spanning tree protocol. If your bridge isn't the only bridge on the LAN, or if there are loops in the LAN's topology, DO NOT turn this option off. If you turn this option off, please know what you are doing.

brctl setbridgeprio <bridge> <priority> sets the bridge's priority to <priority>. The priority value is an unsigned 16-bit quantity (a number between 0 and 65535), and has no dimension. Lower priority values are 'better'. The bridge with the lowest priority will be elected 'root bridge'.

brctl setfd <bridge> <time> sets the bridge's 'bridge forward delay' to <time> seconds.

brctl sethello <bridge> <time> sets the bridge's 'bridge hello time' to <time> seconds.

brctl setmaxage <bridge> <time> sets the bridge's 'maximum message age' to <time> seconds.

brctl setpathcost <bridge> <port> <cost> sets the port cost of the port <port> to <cost>. This is a dimensionless metric.

brctl setportprio <bridge> <port> <priority> sets the port <port>'s priority to <priority>. The priority value is an unsigned 8-bit quantity (a number between 0 and 255), and has no dimension. This metric is used in the designated port and root port selection algorithms.

## NOTES
brctl(8) is obsolete. Some features such as setgcint, STP guard, harpin mode, fastleave and root block are intentionally not implemented in this command; bridge-utils did not implement setgcint either and only documented it in the manual page. Instead use bridge command from iproute2 package for a more full set of features.

## SEE ALSO
iptables(8)

## AUTHOR
Lennert Buytenhek <buytenh@gnu.org> Stephen Hemminger <stephen@networkplumber.org>


ipaudit

package: ipaudit

title: ipaudit(8)

summary: IP traffic summarizer

text:
# ipaudit(8)

## NAME
ipaudit - IP traffic summarizer

## SYNOPSIS
ipaudit[options]INTERFACE[:INTERFACE[:..]]

## DESCRIPTION
ipaudit is an IP traffic monitor. It listens to a network interface in promiscuous mode (or reads data previously dumped to a file) and tallies the total traffic for every "connection". A connection is a combination of ip address pairs, protocol and for tcp/udp protocols, the ports numbers.

## OUTPUT
If hosts 105.33.41.107 telnets to 211.117.5.11 this creates a single connection. ipaudit will tally the total bytes of traffic and total packet count in each direction between the two hosts.

When ipaudit reports its findings, this telnet connection will be listed as

105.033.041.107 211.117.005.011 6 1105 23 19934 2993 41 33

The columns are (1) host 1 ip (2) host 2 ip, (3) protocol, (4) host 1 port, (5) host 2 port, (6) host 1 bytes received, (7) host 2 bytes received, (8) host 1 packets received, (9) host 2 packets received.

For protocol other then tcp/udp where there are no ports, the port numbers are set to 0 in the output. Note that the host ip octets are padded on the left with 0 to make 3 digits. This help make the output more readable.

As another example, if the first host now sends 10 ping packets to a non-existent host 105.33.41.188 then it will be reported as an output line

105.033.041.107 105.033.041.188 1 0 0 0 680 0 10

This says that address 105.33.41.188 received 680 bytes in 10 packets of protocol 1 - even though there is no such address!

The output is extended using the options. The -t option adds the connection starting and ending times to each output line, for example

105.033.041.107 211.117.005.011 6 1105 23 19934 2993 41 33 14:01:32.0495 14:04:23.9491 2 1

The -e option adds the Ethernet address for the two hosts to each output line,

105.033.041.107 211.117.005.011 6 1105 23 19934 2993 41 33 005000c0fa45 005000d1cc21

## COMMAND LINE OPTIONS
-b

Write traffic list in binary format (experimental).

-c npacket

Terminate program after reading npacket packets.

-d

Turn on debugging output.

-e

Write Ethernet addresses for each host. Program stops with an error if you are using a non-Ethernet interface.

-f

Filter incoming packets according to filter string. For example,

ipaudit -f "host 137.99.17.17" eth0

will pass the string "host 137.99.17.17" to the pcap library's filter routine. Thus ipaudit will only see packets with 137.99.17.17 in one of the two ip addresses. The filter commands are extensive and are explained fully in the tcpdump man page.

Note that if you are trying to observe vlan traffic with your filter, you will have to specify the 'vlan' filter before other filters. In fact if all your traffic was vlan tagged, the command above would filter out all traffic, because the 'vlan' specifier was not included. To see vlan traffic the example above would need to change to

ipaudit -f "vlan and host 137.99.17.17" eth0

Note that the -f command is different from the -p command. The -f command filters packets before ipaudit reads them. Thus -f affects what is stored in the normal output (directed by the -o command) AND in the packet dump (directed by the -w command). The -p command filter packets after ipaudit reads them, but before it writes them to the dump file. Thus the normal output (-o) is not affected, but the packet dump (-w) is.

-g config_file

Reads configuration from config_file. See CONFIGURATION FILE section below.

-i pidfile

Save the program process id to pidfile. This is used to terminate program execution when sampling time has expired. Use command like kill -2 `cat pidfile`

to signal ipaudit to stop. Once ipaudit receives this signal, it will print a list of traffic that it has seen.

-l ip-range[:ip-range[:ip-range[..]]]

Normally, the two ip address within a line of output are printed in ip sorted order. But if you are monitoring a link between two networks, you might want the addresses of one (local) network to come first on an output line. ip-range is list of ip ranges that defines the local network. Any ip address in this range is considered local and is printed first on the output line. If neither address belongs to the group of ip-range then they are printed in the default sorted order. If both ip addresses belong to the group of ip-range then the ip address which matches the first range in the colon separated list (see below) is printed first. If both ip addresses belong to the same range, then they are printed in sorted order. There can be many ip-ranges separate by colons. No spaces may appear in the argument. Each ip-range can be either a single ip address such as 127.0.0.23 which indicates a range of one, a partial ip address such as 127.0.5 which indicates a range from 127.0.5.0 to 127.0.5.255, a low and high ip address separate by a hyphen (-), and a single ip address with a slash (/) and either an integer between 0 and 32 (a "net address") or a network such as 255.255.255.128 which indicates a network.

If you run ipaudit with the debug option (-d) the program will print the entire list of ip ranges, so you can check their values.

Here is a list of arguments to -l along with the corresponding range.

COMMAND: ipaudit -l 137.99.11

RANGE: 137.99.11.0-137.99.11.255

COMMAND: ipaudit -l 137.99.11:127.0.5/23

RANGE: 137.99.11.0-137.99.11.255,127.0.4.0-127.0.5.255

COMMAND: ipaudit -l 127.1.5.17-127.1.7.131

RANGE: 127.1.5.17-127.1.7.131

COMMAND: ipaudit -l 10.10.10.0-10.10.10.127:10.10.10.129-10.10.10.255

RANGE: from 10.10.10.0 to 10.10.10.255 but excluding 10.10.10.128

The following example,

ipaudit -c 10000 -l 137.11 eth0

will tally 10,000 packets and list the results on-screen, placing ip addresses beginning with 137.11 first on each output line. Note that ipaudit pads the bytes with leading zeros, so that the output will actually start like

137.011.nnn.nnn ...

You can turn off this padding with the -S option.

-m

Does not turn on promiscuous mode on interface. By default promiscuous mode is enabled. Note that interface may be in promiscuous mode for other reasons.

-o outfile

Writes traffic list to outfile upon completion. By default, it writes traffic to stdout. The file name outfile can contain time format strings (see 'man strftime' for format options) that represent time at the start of ipaudit.

-p prot[,port..][:prot[,port..]..

Only dump packets with specific protocols and ports. For example, -p1:6:17 dumps only packets with protocols 1 (icmp), 6 (tcp) and 17 (udp). You can also break down udp and tcp packets by port numbers - for example -p1:6,21,23 will only dump icmp packets, ftp packets (protocol 6, port 21) and telnet packets (protocol 6, port 23).

-q

formats output as SQL statements which can be directly piped into any SQL type database. It should work just fine for MySQL, Postgress and Oracle. Tested against MySQL currently. All that happens is that instead of a column display, output is formatted as INSERT statements that can be fed into a database as follows:

ipaudit -q eth0 | mysql -ppassword ipaudit

or to save traffic info every 60 seconds

ipaudit -q -D60 eth0 | mysql -ppassword ipaudit

This assumes that the table name is ipaudit and the database is also called ipaudit. The INSERT statements look as follows:

INSERT INTO ipaudit SET ip1='147.110.052.037',ip2='196.022.188.197',

protocol=6,ip1port=25,ip2port=1888,

ip1bytes=1514,ip2bytes=54,ip1pkts=1,ip2pkts=1;

INSERT INTO ipaudit SET ip1='147.110.052.037',ip2='196.023.147.049',

protocol=6,ip1port=25,ip2port=3477,

ip1bytes=4302,ip2bytes=66,ip1pkts=3,ip2pkts=1;

The table structure for the database is as follows:

CREATE TABLE ipaudit (

ip1 varchar(15) DEFAULT '' NOT NULL,

ip2 varchar(15) DEFAULT '' NOT NULL,

protocol tinyint(3) unsigned DEFAULT '0' NOT NULL,

ip1port smallint(5) unsigned DEFAULT '0' NOT NULL,

ip2port smallint(5) unsigned DEFAULT '0' NOT NULL,

ip1bytes int(10) unsigned DEFAULT '0' NOT NULL,

ip2bytes int(10) unsigned DEFAULT '0' NOT NULL,

ip1pkts int(10) unsigned DEFAULT '0' NOT NULL,

ip2pkts int(10) unsigned DEFAULT '0' NOT NULL,

eth1 varchar(12) DEFAULT '' NOT NULL,

eth2 varchar(12) DEFAULT '' NOT NULL,

constart time DEFAULT '00:00:00' NOT NULL,

constartmsec smallint(5) unsigned DEFAULT '0' NOT NULL,

constop time DEFAULT '00:00:00' NOT NULL,

constopmsec smallint(5) unsigned DEFAULT '0' NOT NULL,

probename varchar(80) DEFAULT '' NOT NULL

);

The above structure describes the full table required if all the options are enabled. In most cases, the start, stop, ethernet addresses and probename are not required as these have to be explicitly enabled via command line options. They can be dropped from the table for faster database inputs and queries if they are not required.

Based on the info in the table all manner of computations can be done and graphs can be drawn.

-r dumpfile

Reads network info from dumpfile instead of reading live from network. Such a dumpfile could have been produced by the programs ipaudit , tcpdump or ethereal among others. You can read from standard input using '-' as the file name.

-s nlen

Save no more than first nlen packet bytes. Default is 96, minimum is 68.

-t

Adds packets connection times to each line of traffic output. The time are in the format HH:MM:SS.SSSS where HH, MM and SS are hours, minutes and seconds (to a precision of 1/10,000). The first (second) time is the time the first (last) packet in the connection was detected. This is followed by two integers between 1 and 2. The first (second) integer is the source machine of the first packet (second) packet. A 1 (2) means the first (second) ip address on the line was the source.

-u

Some options produce time strings (-o, -w and -x will produce time strings depending on their arguments, -t always produces time strings). By default the time used is local time. The -u option will cause these options to use GMT time instead. This is crucial if you are going to combine ipaudit logs from different time zones.

-v

Print version and exit.

-w dumpfile

Writes first nlen bytes of every packet to dumpfile (see -s option about nlen). Can later be read by ipaudit , tcpdump , ethereal , etc. The -w option does not affect traffic analysis - it will still take place. By default this writes ALL of the packets to the file. Use the -p option to write traffic for specific protocols and ports only. However the -p option does not affect normal output, all packets are still logged and stored. Contrast this with the -f option. The option -w- will write packets to standard output where they can then be piped to another program which reads pcap packets. See EXAMPLES section below for an example of sending output from ipaudit to tcpdump and also a second instance of ipaudit. Use the -W option to limit the number of packets written to dumpfile, to avoid creating large files. The file name dumpfile can contain time format strings (see 'man strftime' for format options) that represent time at the start of ipaudit. So for example the command

ipaudit -w %Y-%m-%d-%H:%M.raw eth0

will save raw packets in the file 2003-02-10-22:44.raw if ipaudit starts at Feb 10, 2003 at 10:44 pm.

-x program

After ipaudit ends, either from receiving a signal or reaching its packet limit or time limit (-c or -E options), call program. This option is intend for calling reports scripts which read ipaudit output after completion. You can send at most one argument to this program, for example ipaudit -c 10000 -x 'report traffic.out' -o traffic.out eth0

runs ipaudit for 10,000 steps, places the output in the file traffic.out, and then calls the program 'report' with the argument 'traffic.out' - telling 'report' where to find its input file.

Note that to send an argument 'traffic.out' to 'report' we needed to enclose both options together in a single pair of quotes. Without the quotes -x would think that we were running 'report' without an option (and, the option traffic.out would be interpreted as the network interface - not what you wanted at all).

The program strings program can contain time format strings (see 'man strftime' for format options) that represent time at the start of ipaudit.

-z 'config file option'

You can use configuration file options (see CONFIGURATION FILE below) from the command line with the -z option. For example, instead of the '-t' option you can use the equivalent configuration file option from the command line as follows ipaudit -z'writetime yes' eth0

-A file[,lim]

Dump all packets to pcap format file "file". Limit number of packets to "lim" (optional).

-C

Print ICMP type and code information in port field of the sending IP address. By default the port fields are set to zero for all ICMP (and all non-TCP and non-UDP traffic). Note that ICMP type/code data is not like TCP/UDP port data, because each IP address in an IP connection has its own port address. In the ICMP case, the type/code info applies to the entire 'connection', not to just the sender or receiver. However, in ipaudit output the type/code information is placed in the port field of the packet sender when the -C option is used. The type/code fields are each a byte, the port value is assigned is the corresponding two byte value. The following table shows the standard values (taken from TCP/IP Illustrated Vol 1, W.R. Stevens)

0 Echo reply

768 Network unreachable

769 Host unreachable

770 Protocol unreachable

771 Port unreachable

772 Fragmentation needed but don't-fragment bit set

773 Source route failed

774 Destination network Unknown

775 Destination host Unknown

776 Source host isolated (obsolete)

777 Destination network administratively prohibited

778 Destination host administratively prohibited

779 Network Unreachable for TOS

780 Host unreachable for TOS

781 Communication administratively prohibited by filtering

782 Host precedence Violation

783 Precedence cutoff in effect

1024 Source quench

1280 Redirect for network

1281 Redirect for host

1282 Redirect for type-of-service and network

1283 Redirect for type-of-service and host

2048 Echo request

2304 Router advertisement

2560 Router solicitation

2816 Time-to-live equals 0 during transit

2817 Time-to-live equals 0 during re-assembly

3072 IP header bad

3073 Required option missing

3328 Time stamp request

3584 Time stamp reply

3840 Information request (obsolete)

4096 Information reply (obsolete)

4352 Address mask request

4608 Address mask reply

-D dumpperiod

Run in daemon mode. Instructs ipaudit to perform network summary every dumpperiod seconds. Ipaudit will spawn a new child process every dumpperiod seconds which will run for dumpperiod seconds before writing out data (as determined by the -w, -o and -x options). If the time formats are used as part of the file names, ipaudit will round the times to the nearest dumpperiod to the starting time. This way if you wish to dump data every 10 minutes, but start at 1:06, if you run the command

ipaudit -o %H:%M.txt eth0

the first collection period will run from 1:06 to 1:20, and the firs file name will be "01:10.txt", and afterwards the collection periods will run every 10 minutes on the 10 minute interval. This simplifies the task of synchronizing the output file with a regular interval.

Ipaudit currently has no option to append output with the -o or -w options. If two different collection periods write to the same file, the first data will be overwritten.

When you use daemon mode you need to specify an output file using the -o option. In daemon mode ipaudit will not write to the screen as it normally does. If you do not specify an output file when using daemon mode the program will end with an error message.

-E n

Quit after reading interface(s) for n seconds.

-G

Ignore config file. See CONFIGURATION FILE section below.

-H

Store host IPs only. On output the protocol and port fields will be set to zero.

-I ipaddr

Dump all packets to or from "ipaddr" if using -w option.

-L hostportlimit, hostlimit

Normally information is stored for every connection , which is a combination of host ip addresses, protocol and ports. Sometimes the traffic that is monitored will have a large number of connections, for example when scans are taking place where the ports numbers change repeatedly. hostportlimit sets a limit on the number of connections stored with unique port addresses. Otherwise ipaudit's hash table can overflow memory. When this limit is exceeded, ipaudit will set all ports to zero and store only host ips and protocols. Under some conditions even this precaution is not enough, for example when a Denial of Service attack where every packet has a unique forged source ip address. hostlimit sets a limit on the number of unique host pairs which are stored. When this limit is exceeded then every host ip is stored as 0.0.0.0. Only the protocol number will remain unchanged. By default there is no hostportlimit or hostlimit. You might want to set these limits. If so set them larger than your typical connection count. In our case the connection count never exceeds 200000 unless there is a DoS attack. The option -L500000,100000 works for us.

-M

See discussion below READING MULTIPLE NETWORK INTERFACES. The -M option turns off ipaudit removal of duplicate packets.

-N n_hash_slots

ipaudit stores connections in a hash table. The number of slots in this table is set when the program starts. Each slot can hold multiple connections, and storage and retrieval become inefficient when there are too few slots. You can control the number of slots with this option. The default number of slots (typically 1,000,000) is printed when the -v option is given.

-O locip,remip

When using the -L option, ipaudit sets overflow packet's ip addresses to 0.0.0.0. If you configured ipaudit (with -l) to classify ip addresses as local or remote, you can assign local and remote ip addresses to different fixed values. For example, with the option

-O 137.99.0.0,255.255.0.0

your overflow packets can have local ip addresses (as defined by the -l option) set to 137.99.0.0, while remote addresses are labeled as 255.255.0.0. This way you can still determine how much traffic travels in and out of your network even when traffic volume is too large to record individual ip addresses. Note there can be no spaces within the argument.

-P

This option adds the hostname as the first column in the output. This is useful to keep track of which host generated output if you have multiple collectors feeding into a common SQL database.

-R packet_interval

If saving selected packets (which involves the options -w and -p), then also save every packet_interval'th packet. This helps in later analysis of heavy traffic that was not pre-selected.

-S

By default ipaudit pads the ip addresses with leading zeroes, for example

128.010.223.005

This option tells ipaudit to print ip addresses without leading zeroes,

128.10.223.5

-T

Write out connection start and stop dates and times (in contrast to the -t option which only write out time but not dates).

-V vlan

Read only packets belonging to a specific vlan (802.1q tagging). If packets are not vlan tagged then this option is not used.

-W dumplimit

Limits the number of packets written to the dumpfile (see -w option). This is useful to prevent the dumpfile from becoming too large when traffic is high. A value of 0 (the default) means no limit.

## CONFIGURATION FILE
In addition to command line options you can use a configuration file. When IPAUDIT starts it first looks for a file named "ipaudit.conf" in the current directory, then in the home directory. You can also give the '-g' (see COMMAND LINE OPTIONS above) to specify a configuration file.

The configuration can contain comments beginning with #.

The options in the config file are specified by keyword/value pairs. For example, to configure ipaudit to write the time information for each connection the option is

writetime on

In keyword is 'writetime' and the option is 'on'. Many options are either ON/OFF. The words TRUE, YES and OK are synonymous with ON. Any other word means OFF.

Other options require one or more values, for example

interface eth0 eth1

tells ipaudit to read interfaces eth0 and eth1.

You can also use config file options from the command line with the '-z' command line option. While most commands support both option formats, command line options and config file options, some newer commands only have config file options. To execute these newer command from the command line you must invoke the -z option.

Below is a list of config file options:

allowduplicate {on|off}

Like -M option, turns off duplicate packet detection used when reading multiple interfaces.

chroot directory

This option runs a 'chroot' command, which is used for security purposes. This restricts ipaudit to reading and writing files located in the specified directory and below. Also, all file references (except the reference to the configuration file) will be relative to this directory. For example, if you want to insure that the ipaudit program does not read or write files outside the directory '/home/ipaudit' you can place this command line in the config file,

chroot /home/ipaudit

Then the following reference to the data file

outfile /home/ipaudit/data/30min/%Y-%m-%d-%H:%M.txt

will become

outfile /data/30min/%Y-%m-%d-%H:%M.txt

You must have root permission to use this option. To use this option from the command line, use the command line switch '-z' like this

-z 'chroot /home/ipaudit'

count packet_limit

Like -c option, maximum number of packets to read.

daemon period

Like -D option, ipaudit goes into daemon mode, writes statistics every 'period' seconds.

ethernet {on|off}

Like -e option, prints ethernet addresses on each connection written. Default is off.

filter bpf_filter

Like -f option, specifies bpf filter.

hashslots nslots

Like the -N option, sets the number of slots in the hash table used by ipaudit.

hostip ip

Like -I option, tells ipaudit to write *all* packets (the first length bytes as set by -s or packetlen options) for the host ip, regardless of the setting for -p or saveport options.

hostonly {on|off}

Like -H option, Save and write information only for host pairs, not for "connections", host pairs, protocols and ports.

hostportlimit hostportlimit hostlimit

Like -L option, sets limit for number of unique host-pair/protocol/port connections, and a separate limit for the number of unique host-pair connections.

icmptype {on|off}

Like -C option, writes ICMP type and code information in port field of the sending IP address.

interface i1 [i2] [i3]

List interface(s) to read packets from.

localrange ip_range

Like -l option, determines which range(s) of ip addresses are considered local when writing ipaudit output.

mysql host user password database [table]

Ipaudit can write directly to a MySQL database if such support has been compiled. See the section MYSQL SUPPORT below for detailed information on the table format used. If support has not been compiled in then the program will print an error when started and stop. A simple test is to run the following

ipaudit -z mysql

If you get the following ERROR then MySQL support was not compiled in.

ERROR: Cannot output to MySQL database as requested because

MySQL support was not compiled into this instance of ipaudit.

The host option determines which machine the database resides on. Use 'localhost' if it is on the same machine. The user and password specified must have write permission in database. The optional table is the name of the table written to in the database. The table will be created if it does not already exist. The default table name is 'connections'.

The mysql option does not have a command line equivalent. Use the '-z' option if you want to invoke it from the command line, like this

ipaudit -z 'mysql localhost ipaudit password testdb' eth0

outfile file_name

Like -o option, name of output file for ipaudit output

overflowip {on|off}

Like -O option, assigns label ip addresses to use for local and remote overflow traffic.

packetlen length

Like -s option, maximum number of bytes saved for each packet.

packetsample sample_interval

Like -R option, write out every sample_interval'th packet.

pidfile file_name

Like -i option, write out file with process id.

probename {on|off}

Like -p option, this option adds the hostname as the first column in the output.

probelabel label

This option is like probename above, but rather than print the hostname in the first column, it prints the specified label.

progfile program_name

Like -x option, gives program name to run after ipaudit completes.

promisc {on|off}

Like -m option, puts interface(s) in promiscuous mode if on. Default is on.

readfile file_name

Like -r option, gives name of pcap packet capture file to be read.

savefile file_name

Like -w option, synonymous with the writefile config file option above.

saveport protocol>[,port[,port]..][:<protocol[,port[,port]..]]..

Like -p option, limits which protocols/ports packets must have to be saved with writefile(savefile) option.

shortip {on|off}

Like -S option, prints ip addresses without leading 0s.

sniffinterval n

Like -E option, stops ipaudit after n seconds.

sql {on|off}

Like -q option, outputs traffic data in SQL format.

usegmt {on|off}

Like -u option, prints time using GMT.

user username

Switch to user and user's default group after the network interface(s) are opened. If using daemon mode, then only the child process(s) switch to user and user's default group, the parent process remains as root. You must have root permission to use this option. To use this option from the command line, use the command line switch '-z' like this

-z 'user ipaudit'

vlan vlan#

Like -V option, read only vlan packets with id vlan#.

writefile file_name

Like -w option, gives name of pcap packet capture file to write.

writepacketlimit {on|off}

Like -W option, limits number of packets written to the dumpfile.

writetime {on|off}

Like -t option, writes times with connection data.

## READING MULTIPLE NETWORK INTERFACES
ipaudit has the ability to read network data from more than one network interface at a time. You can specify multiple interfaces on the command line such as

ipaudit -t eth0:eth1

with the interface names separated by colons (:). Also, in the config file you use the interface option such as

interface eth0 eth1

There are some details to consider when monitoring multiple interfaces. In particular there is the issue of double counting packets that travel between interfaces. Consider the following example. Suppose you have a router with four interfaces A, B, C and D. Interface A connects to the Internet. Interfaces B, C and D connect to three separate internal networks called Net-B, Net-C and Net-D. Interfaces B, C, D are also mirrored (tapped) by three network interface on your computer running ipaudit. If Net-B sends a packet to Net-C ipaudit will see it twice. Once as it travels into the router through interface B, and a second time when it travels out of the router through interface C. If ipaudit simply recorded every packet on every interface, it would have two copies of every packet that travels between B and C. Similarly they would also be two copies of every packet sent between B and D and between C and D. This is a problem which ipaudit attempts to solve.

The solution is to record the interface for the first packet of each connection. Then, subsequent packets for this connection are recorded only if they are read from the same interface. In this way duplicate packets are ignored.

This technique should work fine under normal circumstances, but it fails when the hostportlimit is reached (see discussion about the -L option). When the hostportlimit is reached ipaudit stops recording ip addresses. In order to save memory it sets all ip address to 0.0.0.0. The correct ip address is needed to successfully remove duplicate packet information. When this information is lost many different connections are stored together, making it impossible to remove duplicate packets by noting which interface they were read from. If you wish, you can run ipaudit without removing duplicate packets with the -M option.

## MYSQL SUPPORT
Ipaudit can write its output directly into a MySQL table if such support has been compiled in (see the 'mysql' option under CONFIGURATION FILE above). When MySQL output is selected, the options -t and -p are automatically selected. This includes the packet first and last times and first and last talkers in the database table, as well as the hostname (or probelabel if that has been specified).

By default, the name of the MySQL table is 'connections', but this can be changed in the 'mysql' statement described above. The format of the MySQL table is as follows, where the values in the first column below are the names of the MySQL table columns, and the values second column is the MySQL data type used.

NAME DATA TYPE

probe varchar(12)

local int unsigned

remote int unsigned

prot tinyint unsigned

lport smallint unsigned

rport smallint unsigned

incb bigint unsigned

outb bigint unsigned

incp int unsigned

outp int unsigned

sec1 int unsigned

msec1 int unsigned

sec2 int unsigned

msec2 int unsigned

talk1 tinyint unsigned

talk2 tinyint unsigned

These columns hold values identical to ipaudit's standard output except fro the columns local, remote, sec1, msec1, sec2 and msec2.

The columns local and remote hold ipaddress as 4 byte integers. You can use the MySQL function INET_NTOA(LOCAL) to convert it to dotted quad notation, for example

INET_NTOA(3221888773) -> "192.10.31.5".

The column sec1 holds the first packet time in units of seconds since Jan 1, 1970 GMT, column msec1 holds the number of microseconds since the start of the last second interval. Columns sec2 and msec2 hold the corresponding data for the last packet time.

A convenient way to convert the columns sec1 and sec2 to a more standard date/time notation is to use the GNU version of the Unix 'date' utility as so,

date -d "Jan 1, 1970 GMT <sec> sec" where <sec> is replaced by the integer value of sec1 or sec2. For example,

date -d "Jan 1, 1970 GMT 1054315274 sec" yields

Fri May 30 13:21:14 EDT 2003

## EXAMPLES
ipaudit -w dump.fil -p1:2:6,21,23 eth0

This runs tells ipaudit to write all packet header for icmp, telnet, and ftp to dump.fil and to read traffic from the network interface eth0. ipaudit will continue to run until it is interrupted with control-C or the kill command, at which time it will list on the terminal a summary of traffic that it saw.

ipaudit -i ipaudit.pid -o traffic.out le0

Read traffic from interface le0 and place in the file traffic.out when program completes. The process id number is written to ipaudit.pid at the program start. Thus you can terminate ipaudit with the command kill -2 `cat ipaudit.pid`

ipaudit -c 50000 eth0 > traffic.out

Read 50,000 packets of traffic from eth0, pipe default stdout output into file traffic.out.

ipaudit -w- -oipaudit.out eth0:eth1 | tcpdump -r- -wtest.cap port 23 or port 111 or net 10.1.4

Reads data from interfaces eth0 and eth0 while writing output to ipaudit.out. In addition raw packets are sent to standard out (-w- option) and are piped to tcpdump. The trick here is that tcpdump is used to write raw packets instead of ipaudit. The advantage is that tcpdump offers finer control than ipaudit's -p option over what packets are written to the capture file. In this example it is necessary to write the ipaudit output directly to file instead of to standard out (the default) so as not to interfere with the packets written to standard out. You could also use the BPF filters called by ipaudit to accomplish the same thing,

ipaudit -w- -oipaudit.out eth0:eth1 | ipaudit -r- -wtest.cap -f 'port 23 or port 111 or net 10.1.4'

## EXAMPLE OUTPUT
without -t option

192.051.201.068 192.051.201.076 6 2076 139 0 58 0 1

192.051.201.001 224.000.000.009 17 520 520 0 1092 0 2

192.051.091.021 192.051.091.127 17 138 138 0 243 0 1

192.051.221.242 192.051.221.255 17 138 138 0 248 0 1

192.051.201.021 192.051.201.070 17 123 123 180 180 2 2

Columns are ip address for first (second) machine, protocol number (1 is icmp, 6 is tcp, 17 is udp), udp/tcp ports on first (second) machine (set to 0 if protocol not udp/tcp), bytes received by first (second) machine, number of packets received by first (second) machine.

with -t option

192.051.201.068 192.051.201.076 6 2076 139 0 58 0 1 13:38:59.8229 13:38:59.8229 1 1

192.051.201.001 224.000.000.009 17 520 520 0 1092 0 2 13:38:59.1435 13:38:59.9248 1 1

192.051.091.021 192.051.091.127 17 138 138 0 243 0 1 13:38:56.5373 13:38:56.5373 1 1

192.051.221.242 192.051.221.255 17 138 138 0 248 0 1 13:38:54.7191 13:38:54.7191 1 1

192.051.201.021 192.051.201.070 17 123 123 180 180 2 2 13:38:54.6649 13:38:57.5350 2 1

As above but with the addition of time the first (last) packet was detected, and the machine which sent the first (last) packet.

## BUGS
Sometimes under Linux when reading lo and eth0 interfaces simultaneously packets on the lo interface are dropped.

Hash table size is fixed at run-time. Would be nice to have dynamically adjusted hash table size.

Report any bugs to jon.rifkin@uconn.edu. If possible, run with -d option and email output. Thanks.

## AUTHOR
j rifkin jon.rifkin@uconn.edu

http://ipaudit.sourceforge.net

## VERSION
1.0 Oct 13, 2005

## SEE ALSO
ipstrings(1) total(1) tcpdump(1) pcap(3)


ipstrings

title: ipstrings(8)

summary: Reads strings from pcap dump files

text:
# ipstrings(8)

## NAME
ipstrings - Reads strings from pcap dump files

## SYNOPSIS
ipstrings [-cefimnprstuwvz] [interface]

## DESCRIPTION
ipstrings reads text strings from all traffic on a network interface or from a pcap format data file (produced by tcpdump and other programs).

## OPTIONS
interface

Network interface to read data from.

-c <npacket>

Terminate program after reading <npacket> packets.

-e

Print source and destination ethernet address with each string.

-f

Filter incoming packets according to filter string. For example,

ipstrings -f "host 137.99.17.17" eth0

will pass the string "host 137.99.17.17" to the pcap library's filter routine. Thus ipstrings will only see packets with 137.99.17.17 in one of the two ip addresses. The filter commands are extensive and are explained fully in the tcpdump man page.

-i

Print source and destination ip address with each string.

-m

Do not enter promiscuous mode when reading network interface.

-n <nchar>

Consider strings to be any set of printable characters (ASCII 32 to 126) <NCHAR> characters long or greater. When <NCHAR> is set to zero, then only those sets of printable characters which are terminated by an ASCII 0 are printed.

-p

Print protocol number, source and destination port number for packets for each string printed. If protocol number is not 6 or 17 (tcp or udp) then port values are printed as 0.

-r <dumpfile>

Reads network info from <dumpfile> instead of reading live from network. Such a dumpfile could have been produced by the programs ipstrings , tcpdump or ethereal (http://www.zing.org). You can read from standard input using '-' as the file name, this feature is provided by the pcap libarary.

-s <nlen>

Read no more than first <nlen> packet bytes. Default is 96, minimum is 68.

-t

Write packet time in format HH:MM:SS.SSSS for string printed.

-u

Write packet time in GMT time instead of the default local time.

-w <dumpfile>

Writes first <nlen> bytes of every packet to <dumpfile> in pcap format (see -s option about <nlen>). Can later be read by programs such as ipaudit , ipstrings , tcpdump or ethereal , Use '-' to write to standard out (this is a feature provided by the pcap library).

-v

Print version information.

-z

Write packet size in bytes (size of ip portion, does not include ethernet or other header).

## INPUT EXAMPLES
To read strings from packets going by interface eth0

ipstrings eth0

To read all strings from a pcap dump file 'pcap.dump'

ipstrings -r pcap.dump

To read only for host 10.2.2.2

ipstrings -r pcap.dump -f "host 10.2.2.2"

To read 'pcap.dump' only for host 10.2.2.2 and port 21 (ftp)

ipstrings -r pcap.dump -f "host 10.2.2.2 and port 21"

To read gzip'ed 'pcap.dump.gz" for all hosts and only port 23 (telnet)

zcat pcap.dump.gz | ipstrings -r- "port 23"

## OUTPUT EXAMPLES
A short FTP session to 127.0.0.1 was captured in pcap.file. When we give the command

ipstrings -ip -rpcap.fil

the output is

127.000.000.001 127.000.000.001 6 21 1323 220 bluebird FTP server (Versi

127.000.000.001 127.000.000.001 6 1323 21 USER jibe

127.000.000.001 127.000.000.001 6 21 1323 331 Password required for jibe

127.000.000.001 127.000.000.001 6 1323 21 PASS xxxxxxxx

127.000.000.001 127.000.000.001 6 21 1323 230 User jibe logged in.

127.000.000.001 127.000.000.001 6 1323 21 SYST

127.000.000.001 127.000.000.001 6 21 1323 215 UNIX Type: L8

127.000.000.001 127.000.000.001 6 1323 21 QUIT

127.000.000.001 127.000.000.001 6 21 1323 221-You have transferred 0 byt

127.000.000.001 127.000.000.001 6 21 1323 221-Total traffic for this ses

The first two columns are the source and destination ip addresses. Column three is the protocol, in this example all are 6 meaning all packets are tcp. Columns four and five are the source and destination port numbers. Starting in the sixth column are the printable strings that were found in the packets.

## BUGS
Report any to jon.rifkin@uconn.edu.

## URL
http://ipaudit.sourceforge.net

## VERSION
1.0 Oct 13, 2005

## SEE ALSO
tcpdump(1) pcap(3) ipaudit(1)


ipcad

package: ipcad

title: ipcad(8)

text:
# ipcad(8)

## NAME
ipcad — IP accounting daemon with Cisco-like ip accounting export

## SYNOPSIS
ipcad

[-h] [-c config] [-d] [-r] [-s]

## DESCRIPTION
IPCAD stands for IP Cisco Accounting Daemon. It runs in background and listens traffic on the specified interfaces. Collected statistics can be obtained via the same method used to gather ip accounting from Cisco routers.

## OPTIONS
The options are as follows:

-h

Print the help page

-c config

Specify configuration file

-d

Work in background

-r

Import saved accounting table on startup

-s

Save the active accounting table on exit

## RSH COMMANDS
Once started, ipcad listens for rsh requests and/or exports NetFlow. In case of rsh, data can be requested from ipcad by issuing a following:

rsh localhost command

Commands may be freely abbreviated.

### Recognized commands are:
help

Show available commands

show ip accounting

Show current accounting table

show ip accounting checkpoint

Show checkpointed accounting table

clear ip accounting

Move accounting to checkpoint base

clear ip accounting checkpoint

Clear checkpoint base

show interface <ifname>

Show interface status and counters

stat

Show overall interface status and statistics

dump [<pathname>]

Dump current accounting table

restore [<pathname>]

Restore current table

import [<pathname>]

Import (add) entries from specified file

shutdown

Shutdown ipcad

## EXAMPLE
Run ipcad as daemon, import saved state tables on startup and save them on exit:

ipcad -rds

Save statistics: the following commands will save statistics for further processing. No data loss will occur in this case.

rsh localhost cle ip acco

rsh localhost sh ip acco checkpoint > file_to_parse

Please refer to ipcad.conf(5) manual page for NetFlow configuration options.

## SEE ALSO
ipcad.conf(5).

## AUTHORS
Lev Walkin <vlm@lionet.info>


ipmievd

package: ipmitool

title: ipmievd(8)

text:
# ipmievd(8)

## NAME
ipmievd - IPMI event daemon for sending events to syslog

## SYNOPSIS
ipmievd [-c|-h|-d N|-v|-V] -I open <open | sel> [<option>]

ipmievd [-c|-h|-v|-V] -I lan -H <hostname>

[-p <port>]

[-U <username>]

[-A <authtype>]

[-L <privlvl>]

[-a|-E|-P|-f <password>]

[-o <oemtype>]

[-O <sel oem>]

sel [<option>]

ipmievd [-c|-h|-v|-V] -I lanplus -H <hostname>

[-p <port>]

[-U <username>]

[-L <privlvl>]

[-a|-E|-P|-f <password>]

[-o <oemtype>]

[-O <sel oem>]

[-C <ciphersuite>]

sel [<option>]

## DESCRIPTION
ipmievd is a daemon which will listen for events from the BMC that are being sent to the SEL and also log those messages to syslog. It is able to run in one of two modes: either using the Event Message Buffer and asynchronous event notification from the OpenIPMI kernel driver or actively polling the contents of the SEL for new events. Upon receipt of an event via either mechanism it will be logged to syslog with the LOG_LOCAL4 facility.

It is based on the ipmitool utility and shares the same IPMI interface support and session setup options. Please see the ipmitool manpage for more information on supported IPMI interfaces.

## OPTIONS
-a

Prompt for the remote server password.

-A <authtype>

Specify an authentication type to use during IPMIv1.5 lan session activation. Supported types are NONE, PASSWORD, MD2, MD5, or OEM.

-c

Present output in CSV (comma separated variable) format. This is not available with all commands.

-C <ciphersuite>

The remote server authentication, integrity, and encryption algorithms to use for IPMIv2 lanplus connections. See table 22-19 in the IPMIv2 specification. The default is 3 which specifies RAKP-HMAC-SHA1 authentication, HMAC-SHA1-96 integrity, and AES-CBC-128 encryption algorightms.

-E

The remote server password is specified by the environment variable IPMI_PASSWORD.

-f <password_file>

Specifies a file containing the remote server password. If this option is absent, or if password_file is empty, the password will default to NULL.

-h

Get basic usage help from the command line.

-H <address>

Remote server address, can be IP address or hostname. This option is required for lan and lanplus interfaces.

-I <interface>

Selects IPMI interface to use. Supported interfaces that are compiled in are visible in the usage help output.

-L <privlvl>

Force session privilege level. Can be CALLBACK, USER, OPERATOR, ADMIN. Default is ADMIN.

-m <local_address>

Set the local IPMB address. The default is 0x20 and there should be no need to change it for normal operation.

-o <oemtype>

Select OEM type to support. This usually involves minor hacks in place in the code to work around quirks in various BMCs from various manufacturers. Use -o list to see a list of current supported OEM types.

-O <sel oem>

Open selected file and read OEM SEL event descriptions to be used during SEL listings. See examples in contrib dir for file format.

-p <port>

Remote server UDP port to connect to. Default is 623.

-P <password>

Remote server password is specified on the command line. If supported it will be obscured in the process list. Note! Specifying the password as a command line option is not recommended.

-S <sdr_cache_file>

Use local file for remote SDR cache. Using a local SDR cache can drastically increase performance for commands that require knowledge of the entire SDR to perform their function.

-t <target_address>

Bridge IPMI requests to the remote target address.

-U <username>

Remote server username, default is NULL user.

-d N

Use device number N to specify the /dev/ipmiN (or /dev/ipmi/N or /dev/ipmidev/N) device to use for in-band BMC communication. Used to target a specific BMC on a multi-node, multi-BMC system through the ipmi device driver interface. Default is 0.

-v

Increase verbose output level. This option may be specified multiple times to increase the level of debug output. If given three times you will get hexdumps of all incoming and outgoing packets.

-V

Display version information.

If no password method is specified then ipmievd will prompt the user for a password. If no password is entered at the prompt, the remote server password will default to NULL.

## COMMANDS
help

This can be used to get command-line help. It may also be placed at the end of commands to get option usage help. > ipmievd help

Commands:

open Use OpenIPMI for asynchronous notification of events

sel Poll SEL for notification of events

open

This command starts ipmievd with the OpenIPMI event watching mechanism which relies on the Event Message Buffer feature of IPMI. This requires a properly installed and configured OpenIPMI driver on Linux and is only valid to be run through the open interface. See the ipmitool manpage and associated documentation for more information on setting up the OpenIPMI driver. Note: Some BMC do not support the Event Message Buffer required for this command. Other BMCs claim to support it but do not actually deliver events to it. If this is the case please use the sel method.

daemon

Launch process as a daemon and reparent to init process. All messages will be sent to syslog. This is the default action.

nodaemon

Do NOT become a daemon, instead log all messages to stderr.

pidfile=<filename>

Save process ID to this file when in daemon mode. Defaults to /run/ipmievd.pidN (where N is the ipmi device number -- defaults to 0).

sel

This command starts ipmievd with the SEL Polling event watching mechanism. This will poll the SEL periodically to determine if new events have been logged. This command should work with all BMCs and is capable of using the LAN interface as well to monitor a remote system and log its events to a local syslog.

daemon

Launch process as a daemon and reparent to init process. All messages will be sent to syslog. This is the default action.

nodaemon

Do NOT become a daemon, instead log all messages to stderr.

pidfile=<filename>

Save process ID to this file when in daemon mode. Defaults to /run/ipmievd.pidN (where N is the ipmi device number -- defaults to 0).

timeout=<seconds>

Time between checks for SEL polling method. Default is 10 seconds.

## EXAMPLES
Example 1: Daemon process watching OpenIPMI for events

> ipmievd -I open open daemon

Example 2: Local non-daemon process checking remote SEL every 30 seconds

> ipmievd -I lan -H 1.2.3.4 -f passfile sel nodaemon timeout=30

Reading Sensors...

Waiting for Events...

## FILES
/usr/share/misc/enterprise-numbers

system IANA PEN registry taken from http://www.iana.org/assignments/enterprise-numbers

~/.local/usr/share/misc/enterprise-numbers

user's override for the system IANA PEN registry, this file if it exists is loaded instead of the system registry (see above).

## AUTHOR
Duncan Laurie <duncan@iceblink.org>

## SEE ALSO
IPMItool Homepage

http://ipmitool.sourceforge.net

Intelligent Platform Management Interface Specification

http://www.intel.com/design/servers/ipmi

OpenIPMI Homepage

http://openipmi.sourceforge.net


ialarms

package: ipmiutil

title: ialarms(8)

summary: display and set alarm indicators

text:
# ialarms(8)

## NAME
ipmiutil_alarms - display and set alarm indicators

## SYNOPSIS
ipmiutil alarms [-abcdimnoprx -N node -U user -P/-R pswd -EFJTVY]

## DESCRIPTION
ipmiutil alarms is a program that uses IPMI commands to display and set alarm indicators, which are usually LEDs on the system chassis front panel. This utility can use either the /dev/ipmi0 driver from OpenIPMI, the /dev/imb driver from Intel, the /dev/ipmikcs driver from valinux, direct user-space IOs, or the IPMI LAN interface if -N. Note that a LAN user must have Administrative privileges to read or write the alarm LEDs.

Note that this utility may not be the only logic setting alarm states. The BMC firmware, system management software, or cluster fault manager may also want to set alarm states. Intel provides a Telco Alarms Manager API which presents a consolidated interface for all alarm management applications.

## OPTIONS
Command line options are described below.

-r

Read-only. Show the alarms status, but do not set any states. This is also the default mode if no parameters are specified.

-iN

Sets the Chassis Identify feature, which can be an LED or some other alarm. If N=0, turn off the Chassis ID, otherwise turn the ID on for N seconds. N=255 will turn on the ID indefinitely, if it is IPMI 2.0.

-aN

Sets Disk A Fault LED. If N=0, turn it off. If N=1, turn it on. Used only for TIGPT1U platform.

-bN

Sets Disk B Fault LED. If N=0, turn it off. If N=1, turn it on. Used only for TIGPT1U platform.

-dXN

Sets Disk X Fault LED, where X=0-6. If N=0, turn it off. If N=1, turn it on. Used only for NSC2U platform.

-cN

Sets the Critical Alarm. If N=0, turn it off. If N=1, turn it on.

-mN

Sets the Major Alarm. If N=0, turn it off. If N=1, turn it on.

-nN

Sets the Minor Alarm. If N=0, turn it off. If N=1, turn it on.

-pN

Sets the Power Alarm. If N=0, turn it off. If N=1, turn it on. Note that the Power LED is also wired to the System Fault LED in the back of the system, so this state may be off for Power, but the LED could be lit for a System Fault reason instead. Refer to the system Technical Product Specification for System Faults.

-o

Sets all alarms off, including the Chassis ID.

-x

Causes extra debug messages to be displayed.

-N nodename

Nodename or IP address of the remote target system. If a nodename is specified, IPMI LAN interface is used. Otherwise the local system management interface is used.

-P/-R rmt_pswd

Remote password for the nodename given. The default is a null password.

-U rmt_user

Remote username for the nodename given. The default is a null username.

-E

Use the remote password from Environment variable IPMI_PASSWORD.

-F drv_t

Force the driver type to one of the followng: imb, va, open, gnu, landesk, lan, lan2, lan2i, kcs, smb. Note that lan2i means lan2 with intelplus. The default is to detect any available driver type and use it.

-J

Use the specified LanPlus cipher suite (0 thru 17): 0=none/none/none, 1=sha1/none/none, 2=sha1/sha1/none, 3=sha1/sha1/cbc128, 4=sha1/sha1/xrc4_128, 5=sha1/sha1/xrc4_40, 6=md5/none/none, ... 14=md5/md5/xrc4_40. Default is 3.

-T

Use this IPMI LAN Authentication Type: 0=None, 1=MD2, 2=MD5, 4=Straight Password, 5=OEM.

-V

Use this IPMI LAN privilege level. 1=Callback level, 2=User level, 3=Operator level, 4=Administrator level (default), 5=OEM level.

-Y

Yes, do prompt the user for the IPMI LAN remote password. Alternatives for the password are -E or -P.

## SEE ALSO
ipmiutil(8) iconfig(8) icmd(8) idiscover(8) ievents(8) ifru(8) igetevent(8) ihealth(8) ilan(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8) iwdt(8)

## WARNINGS
See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

## COPYRIGHT
Copyright (C) 2009 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

## AUTHOR
Andy Cress <arcress at users.sourceforge.net>


icmd

title: icmd(8)

text:
# icmd(8)

## NAME
ipmiutil_cmd - a tool to send specific IPMI commands via the command line.

## SYNOPSIS
ipmiutil cmd [-pqsx -NUPREFJTVY] bus rsSa netFn/lun cmd [data bytes]

## DESCRIPTION
This ipmiutil cmd tool sends specific IPMI commands to the firmware. The commands are composed as hex values on the command line. This tool was written to allow in-band use to match the DOS CMDTOOL.EXE or IPMITOOL.EXE program which is distributed with many Intel servers. Certain scripts or pre-written commands may have been supplied for the DOS tool that can now be used while the system is running Linux or Windows.

This utility can use either the /dev/ipmi0 driver from OpenIPMI, the /dev/imb driver from Intel, the /dev/ipmikcs driver from valinux, direct user-space IOs, or the IPMI LAN interface if -N.

This tool should only be used if you are familiar with the IPMI 1.5 specification, or you have specific pre-written commands to send.

## OPTIONS
Command line options are described below.

-p

Port to use. Defaults to RMCP port 623.

-q

Quiet mode. Show only minimal header information.

-s

Skips the GetDeviceID command

-x

Causes extra debug messages to be displayed.

-N nodename

Nodename or IP address of the remote target system. If a nodename is specified, IPMI LAN interface is used. Otherwise the local system management interface is used.

-U rmt_user

Remote username for the nodename given. The default is a null username.

-P/-R rmt_pswd

Remote password for the nodename given. The default is a null password.

-E

Use the remote password from Environment variable IPMI_PASSWORD.

-F drv_t

Force the driver type to one of the followng: imb, va, open, gnu, landesk, lan, lan2, lan2i, kcs, smb. Note that lan2i means lan2 with intelplus. The default is to detect any available driver type and use it.

-J

Use the specified LanPlus cipher suite (0 thru 17): 0=none/none/none, 1=sha1/none/none, 2=sha1/sha1/none, 3=sha1/sha1/cbc128, 4=sha1/sha1/xrc4_128, 5=sha1/sha1/xrc4_40, 6=md5/none/none, ... 14=md5/md5/xrc4_40. Default is 3.

-T

Use a specified IPMI LAN Authentication Type: 0=None, 1=MD2, 2=MD5, 4=Straight Password, 5=OEM.

-V

Use a specified IPMI LAN privilege level. 1=Callback level, 2=User level, 3=Operator level, 4=Administrator level (default), 5=OEM level.

-Y

Yes, do prompt the user for the IPMI LAN remote password. Alternatives for the password are -E or -P.

## PARAMETERS
The following parameters are used by icmd. Each is represented as a two-digit hex byte. The parameters have no default values.

bus

This byte contains the bus number for this command, usually 00.

rsSa

This is the resource slave address, usually 0x20 for the BMC.

netFn/lun

This byte combines the net Function and Lun. The 2 low-order bits are the Lun and the 6 high-order bits are the net Function. This representation is consistent with the DOS CMDTOOL/IPMITOOL.

cmd

This byte contains the IPMI command.

[data bytes]

This is a sequence of zero to 16 bytes that represent data bytes specific to this command.

## EXAMPLES
icmd 00 20 18 01

Sends the GetDevice ID command to the BMC.

icmd 00 20 28 43 00 00 ff ff 00 ff

Sends a Get SEL entry command for the last entry in the firmware log.

## SEE ALSO
ipmiutil(8) ialarms(8) iconfig(8) idiscover(8) ievents(8) ifru(8) igetevent(8) ihealth(8) ilan(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8) iwdt(8)

## WARNINGS
See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

## COPYRIGHT
Copyright (C) 2009 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

## AUTHOR
Andy Cress <arcress at users.sourceforge.net>


iconfig

title: iconfig(8)

text:
# iconfig(8)

## NAME
ipmiutil_config - list, save, and restore BMC configuration parameters

## SYNOPSIS
ipmiutil config [-lpxLNUPREFJTVY] [-r file] [-s file]

## DESCRIPTION
ipmiutil config is a program that uses an IPMI driver to send IPMI commands which list, save and restore BMC configuration parameters for LAN, Serial, PEF, SOL, User, Channel. This combines the functionality of ipmiutil lan (ilan) and ipmiutil serial (iserial). Note that some of the LAN parameters cannot be restored remotely over the IPMI LAN, changing the configuration that is in use. This utility can use either the /dev/ipmi0 driver from OpenIPMI, the /dev/imb driver from Intel, the /dev/ipmikcs driver from valinux, direct user-space IOs, or the IPMI LAN interface if -N.

## OPTIONS
Command line options are described below.

-l

Lists BMC configuration parameters with a keyword, index, and its hex values. This is the default behavior if no options are specified.

-r config_file

Restores BMC configuration from config_file, which was produced with -s below.

-s config_file

Saves BMC configuration to config_file. This file could be edited, in certain cases, such as to vary the BMC IP address (LanParam 3), or to use the UserPassword records. Note that lines beginning with '#' are comments and are ignored. For editing UserPassword records, convert your text value to hex format; for example "echo 'mypassword' |od -t x1", and leave off the trailing 0a.

-x

Causes extra debug messages to be displayed.

-p password_to_set

This specifies the firmware password to set for BMC LAN access for all users during the restore. If not specified, the password configuration will not be changed, unless a valid UserPassword record is present in the file to be restored. Note that user passwords are write-only via standard IPMI commands.

-L lan_ch_num

This specifies the IPMI LAN channel number used for BMC LAN. This varies by platform, and can be found in the platform technical specifications. By default, bmcconfig scans all IPMI channels to find a LAN channel for BMC LAN.

-N nodename

Nodename or IP address of the remote target system. If a nodename is specified, IPMI LAN interface is used. Otherwise the local system management interface is used.

-P/-R rmt_pswd

Remote password for the nodename given. The default is a null password.

-U rmt_user

Remote username for the nodename given. The default is a null username.

-E

Use the remote password from Environment variable IPMI_PASSWORD.

-F drv_t

Force the driver type to one of the followng: imb, va, open, gnu, landesk, lan, lan2, lan2i, kcs, smb. Note that lan2i means lan2 with intelplus. The default is to detect any available driver type and use it.

-J

Use the specified LanPlus cipher suite (0 thru 17): 0=none/none/none, 1=sha1/none/none, 2=sha1/sha1/none, 3=sha1/sha1/cbc128, 4=sha1/sha1/xrc4_128, 5=sha1/sha1/xrc4_40, 6=md5/none/none, ... 14=md5/md5/xrc4_40. Default is 3.

-T

Use a specified IPMI LAN Authentication Type: 0=None, 1=MD2, 2=MD5, 4=Straight Password, 5=OEM.

-V

Use a specified IPMI LAN privilege level. 1=Callback level, 2=User level, 3=Operator level, 4=Administrator level (default), 5=OEM level.

-Y

Yes, do prompt the user for the IPMI LAN remote password. Alternatives for the password are -E or -P.

## SEE ALSO
ipmiutil(8) ialarms(8) icmd(8) idiscover(8) ievents(8) ifru(8) igetevent(8) ihealth(8) ilan(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8) iwdt(8)

## WARNINGS
See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

## COPYRIGHT
Copyright (C) 2009 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

## AUTHOR
Andy Cress <arcress at users.sourceforge.net>


idcmi

title: idcmi(8)

summary: handle DCMI functions

text:
# idcmi(8)

## NAME
ipmiutil_dcmi - handle DCMI functions

## SYNOPSIS
ipmiutil dcmi [-admsx -NUPREFTVY] <function>

## DESCRIPTION
This ipmiutil dcmi subcommand handles DCMI command functions according to the DCMI specification.

This utility can use either the /dev/ipmi0 driver from OpenIPMI, the /dev/imb driver from Intel, the /dev/ipmikcs driver from valinux, direct user-space IOs, or the IPMI LAN interface if -N.

## OPTIONS
Command line options are described below.

-a string

Set the DCMI Asset Tag to this string.

-d string

Set the DCMI MC ID to this string.

-m 002000

Target a specific MC (e.g. bus 00, sa 20, lun 00). This could be used for PICMG or ATCA blade systems. The trailing character, if present, indicates SMI addressing if 's', or IPMB addressing if 'i' or not present.

-s

When getting info, also get the DCMI sensor information.

-x

Causes extra debug messages to be displayed.

-N nodename

Nodename or IP address of the remote target system. If a nodename is specified, IPMI LAN interface is used. Otherwise the local system management interface is used.

-U rmt_user

Remote username for the nodename given. The default is a null username.

-P/-R rmt_pswd

Remote password for the nodename given. The default is a null password.

-E

Use the remote password from Environment variable IPMI_PASSWORD.

-F drv_t

Force the driver type to one of the followng: imb, va, open, gnu, landesk, lan, lan2, lan2i, kcs, smb. Note that lan2i means lan2 with intelplus. The default is to detect any available driver type and use it.

-J

Use the specified LanPlus cipher suite (0 thru 17): 0=none/none/none, 1=sha1/none/none, 2=sha1/sha1/none, 3=sha1/sha1/cbc128, 4=sha1/sha1/xrc4_128, 5=sha1/sha1/xrc4_40, 6=md5/none/none, ... 14=md5/md5/xrc4_40. Default is 3.

-T

Use a specified IPMI LAN Authentication Type: 0=None, 1=MD2, 2=MD5, 4=Straight Password, 5=OEM.

-V

Use a specified IPMI LAN privilege level. 1=Callback level, 2=User level, 3=Operator level, 4=Administrator level (default), 5=OEM level.

-Y

Yes, do prompt the user for the IPMI LAN remote password. Alternatives for the password are -E or -P.

## FUNCTIONS
info

Get DCMI Capabilities, MC ID, and Asset Tag. This is the default function if no function was specified.

power

Get DCMI Power reading and DCMI Power limit, if supported in the DCMI capabilties.

power set_limit

Set Power limit

power set_action <action>

Set Power limit exception action (where action = no_action | power_off | log_sel)

power set_correction

Set Power limit correction time (in ms)

power set_sample

Set Power limit sampling period (in sec)

power activate

Activate Power limit

power deactivate

Deactivate Power limit

thermal

Get/Set DCMI Thermal parameters. This requires DCMI 1.5 support.

config

Get/Set DCMI Configuration parameters. This requires DCMI 1.5 support.

help

Show the help (usage) message

## EXAMPLES
ipmiutil dcmi info -s

Gets DCMI information, plus DCMI sensor information

ipmiutil dcmi -N 192.168.1.1 -U root -P pswd

Gets DCMI information over IPMI LAN.

## SEE ALSO
ipmiutil(8) ialarms(8) iconfig(8) idiscover(8) ievents(8) ifru(8) igetevent(8) ihealth(8) ilan(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8) iwdt(8)

## WARNINGS
See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

## COPYRIGHT
Copyright (C) 2010 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

## AUTHOR
Andy Cress <arcress at users.sourceforge.net>


idelloem

title: idelloem(8)

summary: OEM commands for Dell servers

text:
# idelloem(8)

## NAME
ipmiutil_delloem - OEM commands for Dell servers

## SYNOPSIS
ipmiutil delloem [-mx -NPRUEFJTVY] commands

## DESCRIPTION
ipmiutil delloem commands is a program that uses Dell OEM IPMI commands to perform platform-specific functions.

## OPTIONS
-m 002000

Show FRU for a specific MC (e.g. bus 00, sa 20, lun 00). This could be used for PICMG or ATCA blade systems. The trailing character, if present, indicates SMI addressing if 's', or IPMB addressing if 'i' or not present.

-x

Causes extra debug messages to be displayed.

-N nodename

Nodename or IP address of the remote target system. If a nodename is specified, IPMI LAN interface is used. Otherwise the local system management interface is used.

-P/-R rmt_pswd

Remote password for the nodename given. The default is a null password.

-U rmt_user

Remote username for the nodename given. The default is a null username.

-E

Use the remote password from Environment variable IPMI_PASSWORD.

-F drv_t

Force the driver type to one of the followng: imb, va, open, gnu, landesk, lan, lan2, lan2i, kcs, smb. Note that lan2i means lan2 with intelplus. The default is to detect any available driver type and use it.

-J

Use the specified LanPlus cipher suite (0 thru 17): 0=none/none/none, 1=sha1/none/none, 2=sha1/sha1/none, 3=sha1/sha1/cbc128, 4=sha1/sha1/xrc4_128, 5=sha1/sha1/xrc4_40, 6=md5/none/none, ... 14=md5/md5/xrc4_40. Default is 3.

-T

Use a specified IPMI LAN Authentication Type: 0=None, 1=MD2, 2=MD5, 4=Straight Password, 5=OEM.

-V

Use a specified IPMI LAN privilege level. 1=Callback level, 2=User level, 3=Operator level, 4=Administrator level (default), 5=OEM level.

-Y

Yes, do prompt the user for the IPMI LAN remote password. Alternatives for the password are -E or -P.

## COMMANDS

mac list

Lists the MAC address of LOMs

mac get <NIC number>

Shows the MAC address of specified LOM. 0-7 System LOM, 8- DRAC/iDRAC.

lan set <Mode>

Sets the NIC Selection Mode (dedicated, shared,

shared with failover lom2, shared with Failover all loms).

lan get

Returns the current NIC Selection Mode (dedicated, shared,

shared with failover lom2, shared with Failover all loms).

lan get active

Returns the current active NIC (dedicated, LOM1, LOM2, LOM3, LOM4).

powermonitor

Shows power tracking statistics

powermonitor clear cumulativepower

Reset cumulative power reading

powermonitor clear peakpower

Reset peak power reading

powermonitor powerconsumption

Displays power consumption in <watt|btuphr>

powermonitor powerconsumptionhistory <watt|btuphr>

Displays power consumption history

powermonitor getpowerbudget

Displays power cap in <watt|btuphr>

powermonitor setpowerbudget <val> <watt|btuphr|percent>

Allows user to set the power cap in <watt|BTU/hr|percentage>

powermonitor enablepowercap

To enable set power cap

powermonitor disablepowercap

To disable set power cap

windbg start

Starts the windbg session (Cold Reset & SOL Activation)

windbg end

Ends the windbg session (SOL Deactivation)

vFlash info Card

Shows Extended SD Card information

## SEE ALSO
ipmiutil(8) ialarms(8) iconfig(8) icmd(8) idiscover(8) ievents(8) ifru(8) igetevent(8) ihealth(8) ilan(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8)

## WARNINGS
See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

## COPYRIGHT
Copyright (C) 2009 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

## AUTHOR
Andy Cress <arcress at users.sourceforge.net>


idiscover

title: idiscover(8)

summary: discover IPMI LAN-enabled nodes

text:
# idiscover(8)

## NAME
ipmiutil_discover - discover IPMI LAN-enabled nodes

## SYNOPSIS
idiscover [-abegisx]

## DESCRIPTION
idiscover is a program that uses IPMI LAN commands to discover any nodes on the LAN that are available, by probing the RMCP port (623.) on those nodes. This utility uses IPMI LAN, so no IPMI drivers are needed. There are three methods that can be used:

-a = broadcast RMCP ping method (default)

-g = GetChannelAuthCap command method

else = specific RMCP ping method

A beginning IP address can be specified with -b for broadcast and specific methods. An ending IP can be specified for non-broadcast methods.

## OPTIONS
Command line options are described below.

-a

All nodes, use the broadcast ping method. This is the default if no options are specified. This will detect the first enabled ethernet interface, and defaults to the broadcast address x.x.x.255 (where x.x.x.x is IP address) unless -b is used to specify otherwise.

-b <ip>

Beginning IP address, required, unless using broadcast with defaults. This could be a specific IP address, or a broadcast address, ending in 255, if the broadcast method (-a) is used.

-e <ip>

Endign IP address of the range. Not used for broadcast method. If this is not specified, a range of one IP address matching the beginning IP is assumed.

-g

Use the GetChannelAuthenticationCapabilities command method over IPMI LAN instead of the RMCP ping. Not compatible with broadcast. This may be useful if the vendor BMC does not support RMCP ping for some reason.

-i eth0

The interface name to use when sending the probes. The default is to detect the first enabled ethernet interface (e.g. eth0).

-m

shows MAC address. Uses the broadcast ping method, but uses a raw socket so that the MAC address can be displayed. This detects the first enabled ethernet interface, and defaults to the broadcast address 255.255.255.255 like -a. Using -m with raw sockets requires root privilege.

-r N

Repeat the ping N times to each node. Default is to send 1 ping per node.

-x

Causes extra debug messages to be displayed.

## EXAMPLES

idiscover -a -b 192.168.1.255

Sends a broadcast RMCP ping to discover IPMI LAN nodes on the specified subnet.

idiscover -b 192.168.1.100 -e 192.168.1.254

Sends RMCP pings to a range of IP addresses.

idiscover -g -b 192.168.1.100 -e 192.168.1.254

Sends GetChannelAuthCap commands to a range of IP addresses.

## SEE ALSO
ipmiutil(8) ialarms(8) iconfig(8) icmd(8) ievents(8) ifru(8) igetevent(8) ihealth(8) ilan(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8) iwdt(8)

## WARNINGS
See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

## COPYRIGHT
Copyright (C) 2009 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

## AUTHOR
Andy Cress <arcress at users.sourceforge.net>


iekanalyzer

title: iekanalyzer(8)

summary: run FRU-Ekeying analyzer with FRU files

text:
# iekanalyzer(8)

## NAME
ipmiutil_ekanalyzer - run FRU-Ekeying analyzer with FRU files

## SYNOPSIS
ipmiutil ekanalyzer [-mx -NPRUEFJTVY] commands (deprecated, see ifru instead)

## DESCRIPTION
ipmiutil ekanalyzer is a program that analyzes FRU Ekeying information from files saved from PICMG IPMI systems.

This function is disabled by default in ipmiutil-2.9.9 and later.

ekanalyzer command xx=filename1 xx=filename2 [rc=filename3]

NOTE: This command can support a maximum of 8 files per command line

filename1

binary file that stores FRU data of a Carrier or an AMC module

filename2

binary file that stores FRU data of an AMC module. These binary files can be generated from this command:

ipmiutil fru -i id -d filename

filename3

configuration file used for configuring On-Carrier Device ID or OEM GUID. This file is optional.

xx

indicates the type of the file. It can take the following value:

oc : On-Carrier device

a1 : AMC slot A1

a2 : AMC slot A2

a3 : AMC slot A3

a4 : AMC slot A4

b1 : AMC slot B1

b2 : AMC slot B2

b3 : AMC slot B3

b4 : AMC slot B4

sm : Shelf Manager

## OPTIONS
-m 002000

Show FRU for a specific MC (e.g. bus 00, sa 20, lun 00). This could be used for PICMG or ATCA blade systems. The trailing character, if present, indicates SMI addressing if 's', or IPMB addressing if 'i' or not present.

-x

Causes extra debug messages to be displayed.

-N nodename

Nodename or IP address of the remote target system. If a nodename is specified, IPMI LAN interface is used. Otherwise the local system management interface is used.

-P/-R rmt_pswd

Remote password for the nodename given. The default is a null password.

-U rmt_user

Remote username for the nodename given. The default is a null username.

-E

Use the remote password from Environment variable IPMI_PASSWORD.

-F drv_t

Force the driver type to one of the followng: imb, va, open, gnu, landesk, lan, lan2, lan2i, kcs, smb. Note that lan2i means lan2 with intelplus. The default is to detect any available driver type and use it.

-J

Use the specified LanPlus cipher suite (0 thru 17): 0=none/none/none, 1=sha1/none/none, 2=sha1/sha1/none, 3=sha1/sha1/cbc128, 4=sha1/sha1/xrc4_128, 5=sha1/sha1/xrc4_40, 6=md5/none/none, ... 14=md5/md5/xrc4_40. Default is 3.

-T

Use a specified IPMI LAN Authentication Type: 0=None, 1=MD2, 2=MD5, 4=Straight Password, 5=OEM.

-V

Use a specified IPMI LAN privilege level. 1=Callback level, 2=User level, 3=Operator level, 4=Administrator level (default), 5=OEM level.

-Y

Yes, do prompt the user for the IPMI LAN remote password. Alternatives for the password are -E or -P.

## COMMANDS
The available commands for ekanalyzer are:

print [carrier | power | all]

carrier (default) oc=filename1 oc=filename2 ...

Display point to point physical connectivity between carriers and AMC modules.

Example:

\# ipmiutil ekanalyzer print carrier oc=fru oc=carrierfru

From Carrier file: fru

Number of AMC bays supported by Carrier: 2

AMC slot B1 topology:

Port 0 =====> On Carrier Device ID 0, Port 16

Port 1 =====> On Carrier Device ID 0, Port 12

Port 2 =====> AMC slot B2, Port 2

AMC slot B2 topology:

Port 0 =====> On Carrier Device ID 0, Port 3

Port 2 =====> AMC slot B1, Port 2

*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

From Carrier file: carrierfru

On Carrier Device ID 0 topology:

Port 0 =====> AMC slot B1, Port 4

Port 1 =====> AMC slot B1, Port 5

Port 2 =====> AMC slot B2, Port 6

Port 3 =====> AMC slot B2, Port 7

AMC slot B1 topology:

Port 0 =====> AMC slot B2, Port 0

AMC slot B1 topology:

Port 1 =====> AMC slot B2, Port 1

Number of AMC bays supported by Carrier: 2

power xx=filename1 xx=filename2 ...

Display power supply information between carrier and AMC modules.

all xx=filename xx=filename ...

Display both physical connectivity and power supply of each carrier and AMC modules.

frushow xx=filename

Convert a binary FRU file into human readable text format. Use -v option to get more display information.

summary [match | unmatch | all]

match (default) xx=filename xx=filename ...

Display only matched results of Ekeying match between an On-Carrier device and an AMC module or between 2 AMC modules. Example:

\# ipmiutil ekanalyzer summary match oc=fru b1=amcB1 a2=amcA2

On-Carrier Device vs AMC slot B1

AMC slot B1 port 0 ==> On-Carrier Device 0 port 16

Matching Result

From On-Carrier Device ID 0

Channel ID 11 || Lane 0: enable

Link Type: AMC.2 Ethernet

Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link

Link Group ID: 0 || Link Asym. Match: exact match

To AMC slot B1

Channel ID 0 || Lane 0: enable

Link Type: AMC.2 Ethernet

Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link

Link Group ID: 0 || Link Asym. Match: exact match

*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

AMC slot B1 port 1 ==> On-Carrier Device 0 port 12

Matching Result

From On-Carrier Device ID 0

Channel ID 6 || Lane 0: enable

Link Type: AMC.2 Ethernet

Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link

Link Group ID: 0 || Link Asym. Match: exact match

To AMC slot B1

Channel ID 1 || Lane 0: enable

Link Type: AMC.2 Ethernet

Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link

Link Group ID: 0 || Link Asym. Match: exact match

*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

On-Carrier Device vs AMC slot A2

AMC slot A2 port 0 ==> On-Carrier Device 0 port 3

Matching Result

From On-Carrier Device ID 0

Channel ID 9 || Lane 0: enable

Link Type: AMC.2 Ethernet

Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link

Link Group ID: 0 || Link Asym. Match: exact match

To AMC slot A2

Channel ID 0 || Lane 0: enable

Link Type: AMC.2 Ethernet

Link Type extension: 1000BASE-BX (SerDES Gigabit) Ethernet link

Link Group ID: 0 || Link Asym. Match: exact match

*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

AMC slot B1 vs AMC slot A2

AMC slot A2 port 2 ==> AMC slot B1 port 2

Matching Result

From AMC slot B1

Channel ID 2 || Lane 0: enable

Link Type: AMC.3 Storage

Link Type extension: Serial Attached SCSI (SAS/SATA)

Link Group ID: 0 || Link Asym. Match: FC or SAS interface {exact match}

To AMC slot A2

Channel ID 2 || Lane 0: enable

Link Type: AMC.3 Storage

Link Type extension: Serial Attached SCSI (SAS/SATA)

Link Group ID: 0 || Link Asym. Match: FC or SAS interface {exact match}

*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

unmatch xx=filename xx=filename ...

Display the unmatched results of Ekeying match between an On-Carrier device and an AMC module or between 2 AMC modules

all xx=filename xx=filename ...

Display both matched result and unmatched results of Ekeying match between two cards or two modules.

## SEE ALSO
ialarms(8) iconfig(8) icmd(8) idiscover(8) ievents(8) ifirewall(8) ifru(8) ifruset(8) ifwum(8) igetevent(8) ihealth(8) ihpm(8) ilan(8) ipicmg(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8) isunoem(8) iwdt(8) ipmiutil(8) ipmi_port(8)

## WARNINGS
See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

## COPYRIGHT
Copyright (C) 2009 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

## AUTHOR
Andy Cress <arcress at users.sourceforge.net>


ievents

title: ievents(8)

summary: decode IPMI and PET event data

text:
# ievents(8)

## NAME
ievents - decode IPMI and PET event data

## SYNOPSIS
ievents [-bfhnprsx] 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10

## DESCRIPTION
ievents is a standalone utility delivered with ipmiutil, used to interpret raw hex data from IPMI events or from IPMI PET SNMP trap varbind data. This utility uses the same interpretation logic as is used by "ipmiutil sel" (showsel) and "ipmiutil getevt" (getevents).

The data bytes in the input are always assumed to be in hex form.

This could be useful if a utility other than "ipmiutil sel" were used to obtain IPMI SEL records or events and interpretation is needed.

This would also be needed at an enterprise management station to interpret the PET SNMP trap hex data into human-readable form, see option -p.

## OPTIONS
-b bin_file

Interpret a file containing raw binary/hex SEL data dumped in binary form, such as that produced by "ipmitool sel writeraw bin_file". Each set of 16 bytes in the file will be interpreted as an IPMI event. (same as -h)

-f sel_file

Interpret a file containing raw ascii text SEL data captured with ipmiutil sel -r, or some other similar utility. Each line in the file should be in this form, with no leading spaces:

04 00 02 76 a9 4a 47 20 00 04 10 09 6f 42 0f ff

If this option is not specified, the default is to use the 16 bytes taken from the command-line arguments. (same as -r)

-h bin_file

Interpret a file containing raw binary/hex SEL data dumped in binary form, such as that produced by "ipmitool sel writeraw bin_file". Each set of 16 bytes in the file will be interpreted as an IPMI event. (same as -b)

-n

This option generates a New IPMI platform event, using 9 bytes of input. The input bytes are the same as the last 9 bytes of an IPMI event.

-p

Decode as PET event bytes, where the input is 34 PET hex data bytes, skipping the first 8 of the 47-byte PET data. The default without -p assumes that the input is a 16-byte IPMI event.

-r sel_file

Interpret a file containing raw ascii text SEL data captured with ipmiutil sel -r, or some other similar utility. (same as -f)

-s sensor_file

Sensor file with the output of "ipmiutil sensor", used to get the PET sensor_type from the sensor_num. The default is /usr/share/ipmiutil/sensor_out.txt as generated during the ipmiutil package installation. This is only needed with PET interpretation (-p).

-x

show eXtra debug messages

## SEE ALSO
ipmiutil(8) ialarms(8) iconfig(8) icmd(8) idiscover(8) ifru(8) igetevent(8) ihealth(8) ilan(8) ireset(8) isel(8) isensor(8) iserial(8) isol(8) iwdt(8)

## WARNINGS
See http://ipmiutil.sourceforge.net/ for the latest version of ipmiutil and any bug fix list.

## COPYRIGHT
Copyright (C) 2009 Kontron America, Inc.

See the file COPYING in the distribution for more details regarding redistribution.

This utility is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.

## AUTHOR
Andy Cress <arcress at users.sourceforge.net>