ndiswrapper

title: ndiswrapper(8)

text:
# ndiswrapper(8)

## NAME
ndiswrapper - Linux kernel module and user space tool to load and run Windows XP drivers for wireless cards

## SYNOPSIS
ndiswrapper

## DESCRIPTION
ndiswrapper is two parts: user space tool that is used to install Windows XP drivers and kernel module to load the Windows XP drivers. Both are called ndiswrapper.

## ndiswrapper - tool
The user space tool (/usr/sbin/ndiswrapper) is used whenever a new Windows XP driver is to be installed. This program takes the following options:

OPTIONS

-i <inf file>

installs new Windows XP driver, where <inf file> is full path to INF file for that driver.

-l

lists the currently installed drivers.

-e <driver>

removes an installed Windows XP driver named <driver>.

-m

writes an alias for wlan0 (default wireless device) into module configuration file so that ndiswrapper kernel module is loaded automatically when this interface is used.

## ndiswrapper - kernel module
The kernel module loads the installed Windows drivers and executes them so that the wireless cards can be used in Linux. The module takes the following options:

OPTIONS

if_name=<basename>

The default basename for the interface is wlan%d, so that the wireless cards will be configured as wlan0, wlan1, ... (%d is replaced with lowest available number). You may use any other basename or fixed name, such as eth%d, ndis2 etc.

proc_uid=<uid>

The module creates files in /proc/net/ndiswrapper that provide some useful information. These files are created so that they can be read only by root by default. If some other user needs to access these files without having to login as root, then replace <uid> with the user ID of that user.

proc_gid=<gid>

The module creates files in /proc/net/ndiswrapper that provide some useful information. These files are created so that they can be read only by people in root group by default. If users from other groups need to access these files, then replace <gid> with the group ID of those users. ndiswrapper kernel module uses loadndisdriver user space tool to load all the Windows drivers. This tool is not to be used under normal circumstances. Only when ndiswrapper module is already loaded and a new Windows XP driver is installed (by ndiswrapper user space tool) and you want the kernel module to load that driver without having to unload the module that you need to use it.

## AUTHOR
This manual page was written by Giridhar Pemmasani <ndiswrapper-general@lists.sourceforge.net>, for the Debian project (but may be used by others).


neard

package: neard

title: neard(8)

summary: Near Field Communication daemon

text:
# neard(8)

## NAME
neard - Near Field Communication daemon

## SYNOPSIS
neard [--version] | [--help]

neard [--debug=<file1>:<file2>:...] [--plugin=<plugin1>,<plugin2>,...] [--noplugin=<plugin1>,<plugin2>,...] [--nodaemon]

## DESCRIPTION
neard is an NFC (Near Field Communication) daemon for managing NFC operations on devices running the Linux operating system. It relies on the Linux kernel NFC socket and generic netlink families, and is a fully modular system that can be extended through plug-ins.

It supports all 4 NFC tag types reading and writing, along with NFC LLCP (peer to peer mode) in both target and initiator modes. The Simple NDEF Exchange Protocol (SNEP), NDEF Push Protocol (NPP) and handover (Wi-Fi and Bluetooth) protocols are implemented as separate plugins on top of LLCP sockets.

## OPTIONS
The following options are supported:

--version

Print the neard software version and exit.

--help

Print neard's available options and exit.

--debug=<file1>:<file2>:...

Sets how much information neard sends to the log destination (usually syslog's "daemon" facility). If the file options are omitted, then debugging information from all the source files are printed. If file options are present, then only debug prints from that source file are printed. Example: --debug=src/service.c:plugins/wifi.c

--plugin=<plugin1>,<plugin2>,...

Load these plugins only. The option can be a pattern containing "*" and "?" characters.

--noplugin=<plugin1>,<plugin2>,...

Never load these plugins. The option can be a pattern containing "*" and "?" characters.

--nodaemon

Do not daemonize. This is useful for debugging, and directs log output to the controlling terminal in addition to syslog.

## SEE ALSO
neard.conf(5).

branch: sisyphus


snmpd

package: net-snmp-snmpd

title: snmpd(8)

text:
# snmpd(8)

## NAME
snmpd - daemon to respond to SNMP request packets.

## SYNOPSIS
snmpd [OPTIONS] [LISTENING ADDRESSES]

## DESCRIPTION
snmpd is an SNMP agent which binds to a port and awaits requests from SNMP management software. Upon receiving a request, it processes the request(s), collects the requested information and/or performs the requested operation(s) and returns the information to the sender.

## OPTIONS
-a

Log the source addresses of incoming requests.

-A

Append to the log file rather than truncating it.

-c FILE

Read FILE as a configuration file (or a comma-separated list of configuration files). Note that the loaded file will only understand snmpd.conf tokens, unless the configuration type is specified in the file as described in the snmp_config man page under SWITCHING CONFIGURATION TYPES IN MID-FILE.

-C

Do not read any configuration files except the ones optionally specified by the -c option. Note that this behaviour also covers the persistent configuration files. This may result in dynamically-assigned values being reset following an agent restart, unless the relevant persistent config files are explicitly loaded using the -c option.

-d

Dump (in hexadecimal) the sent and received SNMP packets.

-D[TOKEN[,...]]

Turn on debugging output for the given TOKEN(s). Without any tokens specified, it defaults to printing all the tokens (which is equivalent to the keyword "ALL"). You might want to try ALL for extremely verbose output. Note: You can not put a space between the -D flag and the listed TOKENs.

-f

Do not fork() from the calling shell.

-g GID

Change the group ID of the snmpd process into GID after opening listening sockets. This overrides the agentgroup configuration file parameter.

-h, --help

Display a brief usage message and then exit.

-H

Display a list of configuration file directives understood by the agent and then exit.

-I [-]INITLIST

Specifies which modules should (or should not) be initialized when the agent starts up. If the comma-separated INITLIST is preceded with a '-', it is the list of modules that should not be started. Otherwise this is the list of the only modules that should be started. To get a list of compiled modules, run the agent with the arguments -Dmib_init -H (assuming debugging support has been compiled in).

-L[eEfFoOsSnN]

Specify where logging output should be directed (standard error or output, to a file or via syslog). See LOGGING OPTIONS in snmpcmd(1) for details.

-m MIBLIST

Specifies a colon separated list of MIB modules to load for this application. This overrides the environment variable MIBS. See snmpcmd(1) for details.

-M DIRLIST

Specifies a colon separated list of directories to search for MIBs. This overrides the environment variable MIBDIRS. See snmpcmd(1) for details.

-n NAME

Set an alternative application name (which will affect the configuration files loaded). By default this will be snmpd, regardless of the name of the actual binary.

-p FILE

Save the process ID of the daemon in FILE.

-q

Print simpler output for easier automated parsing.

-r

Do not require root access to run the daemon. Specifically, do not exit if files only accessible to root (such as /dev/kmem etc.) cannot be opened.

-u UID

Change the user ID of the snmpd process into UID (which can be given in numerical or textual form) after opening listening sockets. This overrides the agentuser configuration file parameter.

-U

Instructs the agent to not remove its pid file (see the -p option) on shutdown. Overrides the leave_pidfile token in the snmpd.conf file, see snmpd.conf(5).

-v, --version

Print version information for the agent and then exit.

-V

Symbolically dump SNMP transactions.

-x ADDRESS

Listens for AgentX connections on the specified address rather than the default "/var/agentx/master". The address can either be a Unix domain socket path, or the address of a network interface. The format is the same as the format of listening addresses described below.

-X

Run as an AgentX subagent rather than as an SNMP master agent.

--name="value"

Allows one to specify any token ("name") supported in the snmpd.conf file and sets its value to "value". Overrides the corresponding token in the snmpd.conf file. See snmpd.conf(5) for the full list of tokens.

## LISTENING ADDRESSES
By default, snmpd listens for incoming SNMP requests on UDP port 161 on all IPv4 interfaces. However, it is possible to modify this behaviour by specifying one or more listening addresses as arguments to snmpd. A listening address takes the form:

[<transport-specifier>:]<transport-address>

At its simplest, a listening address may consist only of a port number, in which case snmpd listens on that UDP port on all IPv4 interfaces. Otherwise, the <transport-address> part of the specification is parsed according to the following table:

<transport-specifier>

<transport-address> format

udp (default)

hostname[:port] or IPv4-address[:port]

tcp

hostname[:port] or IPv4-address[:port]

unix

pathname

ipx

[network]:node[/port]

aal5pvc or pvc

[interface.][VPI.]VCI

udp6 or udpv6 or udpipv6

hostname[:port] or IPv6-address[:port]

tcp6 or tcpv6 or tcpipv6

hostname[:port] or IPv6-address[:port]

ssh

hostname:port

dtlsudp

hostname:port

Note that <transport-specifier> strings are case-insensitive so that, for example, "tcp" and "TCP" are equivalent. Here are some examples, along with their interpretation:

127.0.0.1:161

listen on UDP port 161, but only on the loopback interface. This prevents snmpd being queried remotely. The port specification ":161" is not strictly necessary since that is the default SNMP port.

TCP:1161

listen on TCP port 1161 on all IPv4 interfaces.

ipx:/40000

listen on IPX port 40000 on all IPX interfaces.

unix:/tmp/local-agent

listen on the Unix domain socket /tmp/local-agent.

/tmp/local-agent

is identical to the previous specification, since the Unix domain is assumed if the first character of the <transport-address> is '/'.

PVC:161

listen on the AAL5 permanent virtual circuit with VPI=0 and VCI=161 (decimal) on the first ATM adapter in the machine.

udp6:10161

listen on port 10161 on all IPv6 interfaces.

ssh:127.0.0.1:22

Allows connections from the snmp subsystem on the ssh server on port 22. The details of using SNMP over SSH are defined below.

dtlsudp:127.0.0.1:9161

Listen for connections over DTLS on UDP port 9161. The snmp.conf file must have the serverCert, configuration tokens defined.

Note that not all the transport domains listed above will always be available; for instance, hosts with no IPv6 support will not be able to use udp6 transport addresses, and attempts to do so will result in the error "Error opening specified endpoint". Likewise, since AAL5 PVC support is only currently available on Linux, it will fail with the same error on other platforms.

## Transport Specific Notes
ssh

The SSH transport, on the server side, is actually just a unix named pipe that can be connected to via a ssh subsystem configured in the main ssh server. The pipe location (configurable with the sshtosnmpsocket token in snmp.conf) is /var/lib/net-snmp/sshdomainsocket. Packets should be submitted to it via the sshtosnmp application, which also sends the user ID as well when starting the connection. The TSM security model should be used when packets should process it.

The sshtosnmp command knows how to connect to this pipe and talk to it. It should be configured in the OpenSSH sshd configuration file (which is normally /etc/ssh/sshd_config using the following configuration line:

Subsystem snmp /usr/local/bin/sshtosnmp /var/lib/net-snmp/sshdomainsocket

The sshtosnmp command will need read/write access to the /var/lib/net-snmp/sshdomainsocket pipe. Although it should be fairly safe to grant access to the average user since it still requires modifications to the ACM settings before the user can perform operations, paranoid administrators may want to make the /var/lib/net-snmp directory accessible only by users in a particular group. Use the sshtosnmpsocketperms snmp.conf configure option to set the permissions, owner and group of the created socket.

Access control can be granted to the user "foo" using the following style of simple snmpd.conf settings:

rouser -s tsm foo authpriv

Note that "authpriv" is acceptable assuming as SSH protects everything that way (assuming you have a non-insane setup). snmpd has no notion of how SSH has actually protected a packet and thus the snmp agent assumes all packets passed through the SSH transport have been protected at the authpriv level.

dtlsudp

The DTLS protocol, which is based off of TLS, requires both client and server certificates to establish the connection and authenticate both sides. In order to do this, the client will need to configure the snmp.conf file with the clientCert configuration tokens. The server will need to configure the snmp.conf file with the serverCert configuration tokens defined.

Access control setup is similar to the ssh transport as the TSM security model should be used to protect the packet.

## CONFIGURATION FILES
snmpd checks for the existence of and parses the following files:

/etc/snmp/snmp.conf

Common configuration for the agent and applications. See snmp.conf(5) for details.

/etc/snmp/snmpd.conf

/etc/snmp/snmpd.local.conf

Agent-specific configuration. See snmpd.conf(5) for details. These files are optional and may be used to configure access control, trap generation, subagent protocols and much else besides.

In addition to these two configuration files in /etc/snmp, the agent will read any files with the names snmpd.conf and snmpd.local.conf in a colon separated path specified in the SNMPCONFPATH environment variable.

/usr/share/snmp/mibs/

The agent will also load all files in this directory as MIBs. It will not, however, load any file that begins with a '.' or descend into subdirectories.

## SEE ALSO
(in recommended reading order)

snmp_config(5), snmp.conf(5), snmpd.conf(5)


snmptrapd

package: net-snmp-snmptrapd

title: snmptrapd(8)

text:
# snmptrapd(8)

## NAME
snmptrapd - Receive and log SNMP trap messages.

## SYNOPSIS
snmptrapd [OPTIONS] [LISTENING ADDRESSES]

## DESCRIPTION
snmptrapd is an SNMP application that receives and logs SNMP TRAP and INFORM messages.

Note: the default is to listen on UDP port 162 on all IPv4 interfaces. Since 162 is a privileged port, snmptrapd must typically be run as root.

## OPTIONS
-a

Ignore authenticationFailure traps.

-A

Append to the log file rather than truncating it. Note that this needs to come before any -Lf options that it should apply to.

-c FILE

Read FILE as a configuration file (or a comma-separated list of configuration files).

-C

Do not read any configuration files except the one optionally specified by the -c option.

-d

Dump (in hexadecimal) the sent and received SNMP packets.

-D[TOKEN[,...]]

Turn on debugging output for the given TOKEN(s). Try ALL for extremely verbose output.

-f

Do not fork() from the calling shell.

-F FORMAT

When logging to standard output, use the format in the string FORMAT. See the section FORMAT SPECIFICATIONS below for more details.

-h, --help

Display a brief usage message and then exit.

-H

Display a list of configuration file directives understood by the trap daemon and then exit.

-I [-]INITLIST

Specifies which modules should (or should not) be initialized when snmptrapd starts up. If the comma-separated INITLIST is preceded with a '-', it is the list of modules that should not be started. Otherwise this is the list of the only modules that should be started. To get a list of compiled modules, run snmptrapd with the arguments -Dmib_init -H (assuming debugging support has been compiled in).

-L[efos]

Specify where logging output should be directed (standard error or output, to a file or via syslog). See LOGGING OPTIONS in snmpcmd(1) for details.

-m MIBLIST

Specifies a colon separated list of MIB modules to load for this application. This overrides the environment variable MIBS. See snmpcmd(1) for details.

-M DIRLIST

Specifies a colon separated list of directories to search for MIBs. This overrides the environment variable MIBDIRS. See snmpcmd(1) for details.

-n

Do not attempt to translate source addresses of incoming packets into hostnames.

-p FILE

Save the process ID of the trap daemon in FILE.

-O [abeEfnqQsStTuUvxX]

Specifies how MIB objects and other output should be displayed. See the section OUTPUT OPTIONS in the snmpcmd(1) manual page for details.

-t

Do not log traps to syslog. This disables logging to syslog. This is useful if you want the snmptrapd application to only run traphandle hooks and not to log any traps to any location.

-v, --version

Print version information for the trap daemon and then exit.

-x ADDRESS

Connect to the AgentX master agent on the specified address, rather than the default "/var/agentx/master". See snmpd(8) for details of the format of such addresses.

-X

Do not connect to a AgentX master agent

--name="value"

Allows one to specify any token ("name") supported in the snmptrapd.conf file and sets its value to "value". Overrides the corresponding token in the snmptrapd.conf file. See snmptrapd.conf(5) for the full list of tokens.

## FORMAT SPECIFICATIONS
snmptrapd interprets format strings similarly to printf(3). It understands the following formatting sequences:

%%

a literal %

%a

the contents of the agent-addr field of the PDU (v1 TRAPs only)

%A

the hostname corresponding to the contents of the agent-addr field of the PDU, if available, otherwise the contents of the agent-addr field of the PDU (v1 TRAPs only).

%b

PDU transport address (Note: this is not necessarily an IPv4 address).

Something like "[UDP: [172.16.10.12]:23456->[10.150.0.8]]"

%B

PDU source hostname if available, otherwise PDU source address (see note above)

%E

SNMPv3 context engine id

%h

current hour on the local system

%H

the hour field from the sysUpTime.0 varbind

%j

current minute on the local system

%J

the minute field from the sysUpTime.0 varbind

%k

current second on the local system

%K

the seconds field from the sysUpTime.0 varbind

%l

current day of month on the local system

%L

the day of month field from the sysUpTime.0 varbind

%m

current (numeric) month on the local system

%M

the numeric month field from the sysUpTime.0 varbind

%N

enterprise string

%P

security information from the PDU (community name for v1/v2c, user and context for v3)

%q

trap sub-type (numeric, in decimal)

%s

SNMP version number (0: v1, 1: v2c, 2: v3)

%S

SNMPv3 security model version number

%t

decimal number of seconds since the operating system epoch (as returned by time(2))

%T

the value of the sysUpTime.0 varbind in seconds

%u

SNMPv3 security name, or v1/v2c community name

%v

list of variable-bindings from the notification payload. These will be separated by a tab, or by a comma and a blank if the alternate form is requested See also %V

%V

specifies the variable-bindings separator. This takes a sequence of characters, up to the next % (to embed a % in the string, use \%)

%w

trap type (numeric, in decimal)

%W

trap description

%y

current year on the local system

%Y

the year field from the sysUpTime.0 varbind

In addition to these values, an optional field width and precision may also be specified , just as in printf(3), and a flag value. The following flags are supported:

-

left justify

0

use leading zeros

\#

use alternate form

The "use alternate form" flag changes the behavior of various format string sequences:

Time information will be displayed based on GMT (rather than the local timezone)

The variable-bindings will be a comma-separated list (rather than a tab-separated one)

The system uptime will be broken down into a human-meaningful format (rather than being a simple integer)

### Examples:
To get a message like "14:03 TRAP3.1 from humpty.ucd.edu" you could use something like this:

```
snmptrapd -P -F "%02.2h:%02.2j TRAP%w.%q from %A\n"
```

If you want the same thing but in GMT rather than local time, use

```
snmptrapd -P -F "%#02.2h:%#02.2j TRAP%w.%q from %A\n"
```

## LISTENING ADDRESSES
By default, snmptrapd listens for incoming SNMP TRAP and INFORM packets on UDP port 162 on all IPv4 interfaces. However, it is possible to modify this behaviour by specifying one or more listening addresses as arguments to snmptrapd. See the snmpd(8) manual page for more information about the format of listening addresses.

## NOTIFICATION-LOG-MIB SUPPORT
As of net-snmp 5.0, the snmptrapd application supports the NOTIFICATION-LOG-MIB. It does this by opening an AgentX subagent connection to the master snmpd agent and registering the notification log tables. As long as the snmpd application is started first, it will attach itself to it and thus you should be able to view the last recorded notifications via the nlmLogTable and nlmLogVariableTable. See the snmptrapd.conf file and the "doNotRetainNotificationLogs" token for turning off this support. See the NOTIFICATION-LOG-MIB for more details about the MIB itself.

## EXTENSIBILITY AND CONFIGURATION
See the snmptrapd.conf(5) manual page.

## SEE ALSO
snmpcmd(1), snmpd(8), printf(3), snmptrapd.conf(5), syslog(8), traptoemail(1), variables(5)


arp

package: net-tools

title: arp(8)

summary: manipulate the system ARP cache

text:
# arp(8)

## NAME
arp - manipulate the system ARP cache

## SYNOPSIS
arp [-evn] [-H type] [-i if] -a [hostname]

arp [-v] [-i if] -d hostname [pub]

arp [-v] [-H type] [-i if] -s hostname hw_addr [temp]

arp [-v] [-H type] [-i if] -s hostname hw_addr [netmask nm] pub

arp [-v] [-H type] [-i if] -Ds hostname ifa [netmask nm] pub

arp [-vnD] [-H type] [-i if] -f [filename]

## NOTE
This program is obsolete. For replacement check ip neighbor.

## DESCRIPTION
Arp manipulates the kernel's ARP cache in various ways. The primary options are clearing an address mapping entry and manually setting up one. For debugging purposes, the arp program also allows a complete dump of the ARP cache.

## OPTIONS
-v, --verbose

Tell the user what is going on by being verbose.

-n, --numeric

shows numerical addresses instead of trying to determine symbolic host, port or user names.

-H type, --hw-type type, -t type

When setting or reading the ARP cache, this optional parameter tells arp which class of entries it should check for. The default value of this parameter is ether (i.e. hardware code 0x01 for IEEE 802.3 10Mbps Ethernet). Other values might include network technologies such as ARCnet (arcnet) , PROnet (pronet) , AX.25 (ax25) and NET/ROM (netrom).

-a [hostname], --all [hostname]

Shows the entries of the specified hosts. If the hostname parameter is not used, all entries will be displayed. The entries will be displayed in alternate (BSD) style.

-d hostname, --delete hostname

Remove any entry for the specified host. This can be used if the indicated host is brought down, for example.

-D, --use-device

Use the interface ifa's hardware address.

-e

Shows the entries in default (Linux) style.

-i If, --device If

Select an interface. When dumping the ARP cache only entries matching the specified interface will be printed. When setting a permanent or temp ARP entry this interface will be associated with the entry; if this option is not used, the kernel will guess based on the routing table. For pub entries the specified interface is the interface on which ARP requests will be answered. NOTE: This has to be different from the interface to which the IP datagrams will be routed.

-s hostname hw_addr, --set hostname

Manually create an ARP address mapping entry for host hostname with hardware address set to hw_addr class, but for most classes one can assume that the usual presentation can be used. For the Ethernet class, this is 6 bytes in hexadecimal, separated by colons. When adding proxy arp entries (that is those with the publish flag set a netmask may be specified to proxy arp for entire subnets. This is not good practice, but is supported by older kernels because it can be useful. If the temp flag is not supplied entries will be permanent stored into the ARP cache.

NOTE: As of kernel 2.2.0 it is no longer possible to set an ARP entry for an entire subnet. Linux instead does automagic proxy arp when a route exists and it is forwarding. See arp(7) for details.

-f filename, --file filename

Similar to the -s option, only this time the address info is taken from file filename set up. The name of the data file is very often /etc/ethers, but this is not official. If no filename is specified /etc/ethers is used as default. The format of the file is simple; it only contains ASCII text lines with a hardware address and a hostname separated by whitespace. Additionally the pub, temp and netmask flags can be used.

In all places where a hostname is expected, one can also enter an IP address in dotted-decimal notation.

As a special case for compatibility the order of the hostname and the hardware address can be exchanged.

Each complete entry in the ARP cache will be marked with the C flag. Permanent entries are marked with M and published entries have the P flag.

## FILES
/proc/net/arp,

/etc/networks

/etc/hosts

/etc/ethers

## SEE ALSO
ip(8)

## AUTHORS
Fred N. van Kempen, <waltje@uwalt.nl.mugnet.org> with a lot of improvements from net-tools Maintainer Bernd Eckenfels <net-tools@lina.inka.de>.


ifconfig

title: ifconfig(8)

summary: configure a network interface

text:
# ifconfig(8)

## NAME
ifconfig - configure a network interface

## SYNOPSIS
ifconfig [interface]

ifconfig interface [aftype] options | address ...

## NOTE
This program is obsolete! For replacement check ip addr and ip link. For statistics use ip -s link.

## DESCRIPTION
Ifconfig is used to configure the kernel-resident network interfaces. It is used at boot time to set up interfaces as necessary. After that, it is usually only needed when debugging or when system tuning is needed.

If no arguments are given, ifconfig displays the status of the currently active interfaces. If a single interface argument is given, it displays the status of the given interface only; if a single -a argument is given, it displays the status of all interfaces, even those that are down. Otherwise, it configures an interface.

## Address Families
If the first argument after the interface name is recognized as the name of a supported address family, that address family is used for decoding and displaying all protocol addresses. Currently supported address families include inet (TCP/IP, default), inet6 (IPv6), ax25 (AMPR Packet Radio), ddp (Appletalk Phase 2), ipx (Novell IPX) and netrom (AMPR Packet radio). All numbers supplied as parts in IPv4 dotted decimal notation may be decimal, octal, or hexadecimal, as specified in the ISO C standard (that is, a leading 0x or 0X implies hexadecimal; otherwise, a leading '0' implies octal; otherwise, the number is interpreted as decimal). Use of hexamedial and octal numbers is not RFC-compliant and therefore its use is discouraged and may go away.

## OPTIONS
interface

The name of the interface. This is usually a driver name followed by a unit number, for example eth0 for the first Ethernet interface.

up

This flag causes the interface to be activated. It is implicitly specified if an address is assigned to the interface.

down

This flag causes the driver for this interface to be shut down.

[-]arp

Enable or disable the use of the ARP protocol on this interface.

[-]promisc

Enable or disable the promiscuous mode of the interface. If selected, all packets on the network will be received by the interface.

[-]allmulti

Enable or disable all-multicast mode. If selected, all multicast packets on the network will be received by the interface.

metric N

This parameter sets the interface metric. It is not available under GNU/Linux.

mtu N

This parameter sets the Maximum Transfer Unit (MTU) of an interface.

dstaddr addr

Set the remote IP address for a point-to-point link (such as PPP). This keyword is now obsolete; use the pointopoint keyword instead.

netmask addr

Set the IP network mask for this interface. This value defaults to the usual class A, B or C network mask (as derived from the interface IP address), but it can be set to any value.

add addr/prefixlen

Add an IPv6 address to an interface.

del addr/prefixlen

Remove an IPv6 address from an interface.

tunnel ::aa.bb.cc.dd

Create a new SIT (IPv6-in-IPv4) device, tunnelling to the given destination.

irq addr

Set the interrupt line used by this device. Not all devices can dynamically change their IRQ setting.

io_addr addr

Set the start address in I/O space for this device.

mem_start addr

Set the start address for shared memory used by this device. Only a few devices need this.

media type

Set the physical port or medium type to be used by the device. Not all devices can change this setting, and those that can vary in what values they support. Typical values for type are 10base2 (thin Ethernet), 10baseT (twisted-pair 10Mbps Ethernet), AUI (external transceiver) and so on. The special medium type of auto can be used to tell the driver to auto-sense the media. Again, not all drivers can do this.

[-]broadcast [addr]

If the address argument is given, set the protocol broadcast address for this interface. Otherwise, set (or clear) the IFF_BROADCAST flag for the interface.

[-]pointopoint [addr]

This keyword enables the point-to-point mode of an interface, meaning that it is a direct link between two machines with nobody else listening on it.

If the address argument is also given, set the protocol address of the other side of the link, just like the obsolete dstaddr keyword does. Otherwise, set or clear the IFF_POINTOPOINT flag for the interface.

hw class address

Set the hardware address of this interface, if the device driver supports this operation. The keyword must be followed by the name of the hardware class and the printable ASCII equivalent of the hardware address. Hardware classes currently supported include ether (Ethernet), ax25 (AMPR AX.25), ARCnet and netrom (AMPR NET/ROM).

multicast

Set the multicast flag on the interface. This should not normally be needed as the drivers set the flag correctly themselves.

address

The IP address to be assigned to this interface.

txqueuelen length

Set the length of the transmit queue of the device. It is useful to set this to small values for slower devices with a high latency (modem links, ISDN) to prevent fast bulk transfers from disturbing interactive traffic like telnet too much.

## NOTES
Since kernel release 2.2 there are no explicit interface statistics for alias interfaces anymore. The statistics printed for the original address are shared with all alias addresses on the same device. If you want per-address statistics you should add explicit accounting rules for the address using the ipchains(8) command.

Interrupt problems with Ethernet device drivers fail with EAGAIN. See http://www.scyld.com/expert/irq-conflict.html for more information.

## FILES
/proc/net/socket

/proc/net/dev

/proc/net/if_inet6

## BUGS
Ifconfig uses obsolete kernel interface. It uses the ioctl access method to get the full address information, which limits hardware addresses to 8 bytes. Since an Infiniband address is 20 bytes, only the first 8 bytes of Infiniband address are displayed.

While appletalk DDP and IPX addresses will be displayed they cannot be altered by this command.

## SEE ALSO
ip(8)

## AUTHORS
Fred N. van Kempen, <waltje@uwalt.nl.mugnet.org>

Alan Cox, <Alan.Cox@linux.org>

Phil Blundell, <Philip.Blundell@pobox.com>

Andi Kleen


ipmaddr

title: ipmaddr(8)

text:
# ipmaddr(8)

## NAME
ipmaddr - adds, deletes, and displays multicast addresses

## SYNOPSIS
/usr/sbin/ipmaddr [<operation>] [<args>]

## NOTE
This program is obsolete. For replacement check ip maddress.

## DESCRIPTION
The ipmaddr command can perform one of the following operations:

add - add a multicast address

del - delete a multicast address

show - list multicast addresses

## SEE ALSO
ip(8).


iptunnel

title: iptunnel(8)

text:
# iptunnel(8)

## NAME
iptunnel - creates, deletes, and displays configured tunnels

## SYNOPSIS
/usr/sbin/iptunnel [<operation>] [<args>]

## NOTE
This program is obsolete. For replacement check ip tunnel.

## DESCRIPTION
The iptunnel command creates configured tunnels for sending and receiving IPV6 or IPV4 packets that are encapsulated as the payload of an IPV4 datagram.

The iptunnel command can perform one of the following operations:

create - create a tunnel interface, which you must subsequently configure.

delete - delete a tunnel interface. You must disable the tunnel before you can delete it.

show - show the tunnel attributes (name, tunnel end points, next hop for tunneled packets).

## SEE ALSO
ip(8).


mii-tool

title: mii-tool(8)

text:
# mii-tool(8)

## NAME
mii-tool - view, manipulate media-independent interface status

## SYNOPSIS
mii-tool [-v, --verbose] [-V, --version] [-R, --reset] [-r, --restart] [-w, --watch] [-l, --log] [-A, --advertise=media,...] [-F, --force=media] [interface ...]

## NOTE
This program is obsolete. Valid media are only 100baseT4, 100baseTx-FD,100baseTx-HD, 10baseT-FD and 10baseT-HD ethernet cards. For replacement check ethtool.

## DESCRIPTION
This utility checks or sets the status of a network interface's Media Independent Interface (MII) unit. Most fast ethernet adapters use an MII to autonegotiate link speed and duplex setting.

Most intelligent network devices use an autonegotiation protocol to communicate what media technologies they support, and then select the fastest mutually supported media technology. The -A or --advertise options can be used to tell the MII to only advertise a subset of its capabilities. Some passive devices, such as single-speed hubs, are unable to autonegotiate. To handle such devices, the MII protocol also allows for establishing a link by simply detecting either a 10baseT or 100baseT link beat. The -F or --force options can be used to force the MII to operate in one mode, instead of autonegotiating. The -A and -F options are mutually exclusive.

The default short output reports the negotiated link speed and link status for each interface. If an interface or interfaces are not specified on the command line, then mii-tool will check any available interfaces from eth0 through eth7.

## OPTIONS
-v, --verbose

Display more detailed MII status information. If used twice, also display raw MII register contents.

-V, --version

Display program version information.

-R, --reset

Reset the MII to its default configuration.

-r, --restart

Restart autonegotiation.

-w, --watch

Watch interface(s) and report changes in link status. The MII interfaces are polled at one second intervals.

-l, --log

Used with -w, records link status changes in the system log instead of printing on standard output.

-F media, --force=media

Disable autonegotiation, and force the MII to either 100baseTx-FD, 100baseTx-HD, 10baseT-FD, or 10baseT-HD operation.

-A media,..., --advertise=media,...

Enable and restart autonegotiation, and advertise only the specified media technologies. Multiple technologies should be separated by commas. Valid media are 100baseT4, 100baseTx-FD, 100baseTx-HD, 10baseT-FD, and 10baseT-HD.

## SEE ALSO
ethtool(8)

## AUTHORS
David Hinds - dhinds@pcmcia.sourceforge.org

Donald Becker - becker@scyld.com


nameif

title: nameif(8)

text:
# nameif(8)

## NAME
nameif - name network interfaces based on MAC addresses

## SYNOPSIS
nameif [-c configfile] [-s]

nameif [-c configfile] [-s] {interface macaddress}

## NOTE
This program is obsolete. For replacement check ip link. This functionality is also much better provided by udev methods.

## DESCRIPTION
nameif renames network interfaces based on mac addresses. When no arguments are given /etc/mactab is read. Each line of it contains an interface name and a Ethernet MAC address. Comments are allowed starting with #. Otherwise the interfaces specified on the command line are processed. nameif looks for the interface with the given MAC address and renames it to the name given.

When the -s argument is given all error messages go to the syslog.

When the -c argument is given with a file name that file is read instead of /etc/mactab.

## NOTES
nameif should be run before the interface is up, otherwise it'll fail.

## FILES
/etc/mactab

## SEE ALSO
ip(8), udev(7)

## BUGS
Only works for Ethernet currently.


netstat

title: netstat(8)

text:
# netstat(8)

## NAME
netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships

## SYNOPSIS
netstat [address_family_options] [--tcp|-t] [--udp|-u] [--raw|-w] [--listening|-l] [--all|-a] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--symbolic|-N] [--extend|-e[--extend|-e]] [--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c] [delay]

netstat {--route|-r} [address_family_options] [--extend|-e[--extend|-e]] [--verbose|-v] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]

netstat {--interfaces|-I|-i} [iface] [--all|-a] [--extend|-e] [--verbose|-v] [--program|-p] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]

netstat {--groups|-g} [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]

netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]

netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--raw|-w] [delay]

netstat {--version|-V}

netstat {--help|-h}

address_family_options:

[--protocol={inet,unix,ipx,ax25,netrom,ddp}[,...]] [--unix|-x] [--inet|--ip] [--ax25] [--ipx] [--netrom] [--ddp]

## NOTE
This program is obsolete. Replacement for netstat is netlist. Replacement for netstat -r is ip route. Replacement for netstat -i is ip -s link. Replacement for netstat -g is ip maddr.

## DESCRIPTION
Netstat prints information about the Linux networking subsystem. The type of information printed is controlled by the first argument, as follows:

### (none)
By default, netstat displays a list of open sockets. If you don't specify any address families, then the active sockets of all configured address families will be printed.

### --route , -r
Display the kernel routing tables.

### --groups , -g
Display multicast group membership information for IPv4 and IPv6.

### --interfaces=iface , -I=iface , -i
Display a table of all network interfaces, or the specified iface.

### --masquerade , -M
Display a list of masqueraded connections.

### --statistics , -s
Display summary statistics for each protocol.

## OPTIONS

### --verbose , -v
Tell the user what is going on by being verbose. Especially print some useful information about unconfigured address families.

### --numeric , -n
Show numerical addresses instead of trying to determine symbolic host, port or user names.

### --numeric-hosts
shows numerical host addresses but does not affect the resolution of port or user names.

### --numeric-ports
shows numerical port numbers but does not affect the resolution of host or user names.

### --numeric-users
shows numerical user IDs but does not affect the resolution of host or port names.

### --protocol=family , -A
Specifies the address families (perhaps better described as low level protocols) for which connections are to be shown. family is a comma (',') separated list of address family keywords like inet, unix, ipx, ax25, netrom, and ddp. This has the same effect as using the --inet, --unix (-x), --ipx, --ax25, --netrom, and --ddp options.

The address family inet includes raw, udp and tcp protocol sockets.

### -c, --continuous
This will cause netstat to print the selected information every second continuously.

### -e, --extend
Display additional information. Use this option twice for maximum detail.

### -o, --timers
Include information related to networking timers.

### -p, --program
Show the PID and name of the program to which each socket belongs.

### -l, --listening
Show only listening sockets. (These are omitted by default.)

### -a, --all
Show both listening and non-listening sockets. With the --interfaces option, show interfaces that are not marked

### -F
Print routing information from the FIB. (This is the default.)

### -C
Print routing information from the route cache.

### delay
Netstat will cycle printing through statistics every delay seconds. UP.

## OUTPUT

### Proto
The protocol (tcp, udp, raw) used by the socket.

### Recv-Q
The count of bytes not copied by the user program connected to this socket.

### Send-Q
The count of bytes not acknowledged by the remote host.

### Local Address
Address and port number of the local end of the socket. Unless the --numeric (-n) option is specified, the socket address is resolved to its canonical host name (FQDN), and the port number is translated into the corresponding service name.

### Foreign Address
Address and port number of the remote end of the socket. Analogous to "Local Address."

### State
The state of the socket. Since there are no states in raw mode and usually no states used in UDP, this column may be left blank. Normally this can be one of several values:

ESTABLISHED

The socket has an established connection.

SYN_SENT

The socket is actively attempting to establish a connection.

SYN_RECV

A connection request has been received from the network.

FIN_WAIT1

The socket is closed, and the connection is shutting down.

FIN_WAIT2

Connection is closed, and the socket is waiting for a shutdown from the remote end.

TIME_WAIT

The socket is waiting after close to handle packets still in the network.

CLOSED

The socket is not being used.

CLOSE_WAIT

The remote end has shut down, waiting for the socket to close.

LAST_ACK

The remote end has shut down, and the socket is closed. Waiting for acknowledgement.

LISTEN

The socket is listening for incoming connections. Such sockets are not included in the output unless you specify the --listening (-l) or --all (-a) option.

CLOSING

Both sockets are shut down but we still don't have all our data sent.

UNKNOWN

The state of the socket is unknown.

### User
The username or the user id (UID) of the owner of the socket.

### PID/Program name
Slash-separated pair of the process id (PID) and process name of the process that owns the socket. --program causes this column to be included. You will also need superuser privileges to see this information on sockets you don't own. This identification information is not yet available for IPX sockets.

### Timer
(this needs to be written)

### Proto
The protocol (usually unix) used by the socket.

### RefCnt
The reference count (i.e. attached processes via this socket).

### Flags
The flags displayed is SO_ACCEPTON (displayed as ACC), SO_WAITDATA (W) or SO_NOSPACE (N). SO_ACCECPTON is used on unconnected sockets if their corresponding processes are waiting for a connect request. The other flags are not of normal interest.

### Type
There are several types of socket access:

SOCK_DGRAM

The socket is used in Datagram (connectionless) mode.

SOCK_STREAM

This is a stream (connection) socket.

SOCK_RAW

The socket is used as a raw socket.

SOCK_RDM

This one serves reliably-delivered messages.

SOCK_SEQPACKET

This is a sequential packet socket.

SOCK_PACKET

Raw interface access socket.

UNKNOWN

Who ever knows what the future will bring us - just fill in here :-)

### State
This field will contain one of the following Keywords:

FREE

The socket is not allocated

LISTENING

The socket is listening for a connection request. Such sockets are only included in the output if you specify the --listening (-l) or --all (-a) option.

CONNECTING

The socket is about to establish a connection.

CONNECTED

The socket is connected.

DISCONNECTING

The socket is disconnecting.

(empty)

The socket is not connected to another one.

UNKNOWN

This state should never happen.

### PID/Program name
Process ID (PID) and process name of the process that has the socket open. More info available in Active Internet connections section written above.

### Path
This is the path name as which the corresponding processes attached to the socket.

### Active IPX sockets
(this needs to be done by somebody who knows it)

### Active NET/ROM sockets
(this needs to be done by somebody who knows it)

### Active AX.25 sockets
(this needs to be done by somebody who knows it)

## NOTES
Starting with Linux release 2.2 netstat -i does not show interface statistics for alias interfaces. To get per alias interface counters you need to setup explicit rules using the ipchains(8) command.

## FILES
/etc/services -- The services translation file

/proc -- Mount point for the proc filesystem, which gives access to kernel status information via the following files.

/proc/net/dev -- device information

/proc/net/raw -- raw socket information

/proc/net/tcp -- TCP socket information

/proc/net/udp -- UDP socket information

/proc/net/igmp -- IGMP multicast information

/proc/net/unix -- Unix domain socket information

/proc/net/ipx -- IPX socket information

/proc/net/ax25 -- AX25 socket information

/proc/net/appletalk -- DDP (appletalk) socket information

/proc/net/nr -- NET/ROM socket information

/proc/net/route -- IP routing information

/proc/net/ax25_route -- AX25 routing information

/proc/net/ipx_route -- IPX routing information

/proc/net/nr_nodes -- NET/ROM nodelist

/proc/net/nr_neigh -- NET/ROM neighbours

/proc/net/ip_masquerade -- masqueraded connections

/proc/net/snmp -- statistics

## SEE ALSO
netlist(1),ip(8)

## BUGS
Occasionally strange information may appear if a socket changes as it is viewed. This is unlikely to occur.

## AUTHORS
The netstat user interface was written by Fred Baumgarten <dc6iq@insu1.etec.uni-karlsruhe.de> the man page basically by Matt Welsh <mdw@tc.cornell.edu>. It was updated by Alan Cox <Alan.Cox@linux.org> but could do with a bit more work. It was updated again by Tuan Hoang <tqhoang@bigfoot.com>.

The man page and the command included in the net-tools package is totally rewritten by Bernd Eckenfels <ecki@linux.de>.


plipconfig

title: plipconfig(8)

summary: fine tune PLIP device parameters

text:
# plipconfig(8)

## NAME
plipconfig - fine tune PLIP device parameters

## SYNOPSIS
plipconfig interface

plipconfig interface [nibble NN] [trigger NN] [unit NN]

## DESCRIPTION
Plipconfig is used to (hopefully) improve PLIP performance by changing the default timing parameters used by the PLIP protocol. Results are dependent on the parallel port hardware, cable, and the CPU speed of each machine on each end of the PLIP link.

If the single interface argument is given, plipconfig displays the status of the given interface only. Otherwise, it will try to set the options.

## OPTIONS
nibble NN

Sets the nibble wait value in microseconds. Default is 3000.

trigger NN

Sets the trigger wait value in microseconds. Default is 500.

PLIP speed can in some cases be improved by lowering the default values. Values which are too low may cause excess use of CPU, poor interrupt response time resulting in serial ports dropping characters, or in dropping of PLIP packets. Changing the plip MTU can also affect PLIP speed.

## NOTE
If you get no response it is far more likely the irq is wrong and needs setting with ifconfig. The few cases where the default parameters will be too fast are those using very long cables. Something you should never do as the parallel port is not specified or designed for driving long cable runs.

## SEE ALSO
ifconfig(8)

## BUGS
Non.

## AUTHOR
John Paul Morrison, <jmorriso@bogomips.ee.ubc.ca>, <ve7jpm@ve7jpm.ampr.org>


route

title: route(8)

summary: show / manipulate the IP routing table

text:
# route(8)

## NAME
route - show / manipulate the IP routing table

## SYNOPSIS
route [-CFvnee]

route

[-v] [-A family] add [-net|-host] target [netmask Nm] [gw Gw] [metric N] [mss M] [window W] [irtt I] [reject] [mod] [dyn] [reinstate] [[dev] If]

route

[-v] [-A family] del [-net|-host] target [gw Gw] [netmask Nm] [metric N] [[dev] If]

route

[-V] [--version] [-h] [--help]

## NOTE
This program is obsolete. For replacement check ip route.

## DESCRIPTION
Route manipulates the kernel's IP routing tables. Its primary use is to set up static routes to specific hosts or networks via an interface after it has been configured with the ifconfig(8) program.

When the add or del options are used, route modifies the routing tables. Without these options, route displays the current contents of the routing tables.

## OPTIONS
-A family

use the specified address family (eg `inet'; use `route --help' for a full list).

-F

operate on the kernel's FIB (Forwarding Information Base) routing table. This is the default.

-C

operate on the kernel's routing cache.

-v

select verbose operation.

-n

show numerical addresses instead of trying to determine symbolic host names. This is useful if you are trying to determine why the route to your nameserver has vanished.

-e

use netstat(8)-format for displaying the routing table. -ee will generate a very long line with all parameters from the routing table.

del

delete a route.

add

add a new route.

target

the destination network or host. You can provide IP addresses in dotted decimal or host/network names.

-net

the target is a network.

-host

the target is a host.

netmask NM

when adding a network route, the netmask to be used.

gw GW

route packets via a gateway. NOTE: The specified gateway must be reachable first. This usually means that you have to set up a static route to the gateway beforehand. If you specify the address of one of your local interfaces, it will be used to decide about the interface to which the packets should be routed to. This is a BSDism compatibility hack.

metric M

set the metric field in the routing table (used by routing daemons) to M.

mss M

set the TCP Maximum Segment Size (MSS) for connections over this route to M bytes. The default is the device MTU minus headers, or a lower MTU when path mtu discovery occured. This setting can be used to force smaller TCP packets on the other end when path mtu discovery does not work (usually because of misconfigured firewalls that block ICMP Fragmentation Needed)

window W

set the TCP window size for connections over this route to W bytes. This is typically only used on AX.25 networks and with drivers unable to handle back to back frames.

irtt I

set the initial round trip time (irtt) for TCP connections over this route to I milliseconds (1-12000). This is typically only used on AX.25 networks. If omitted the RFC 1122 default of 300ms is used.

reject

install a blocking route, which will force a route lookup to fail. This is for example used to mask out networks before using the default route. This is NOT for firewalling.

mod, dyn, reinstate

install a dynamic or modified route. These flags are for diagnostic purposes, and are generally only set by routing daemons.

dev If

force the route to be associated with the specified device, as the kernel will otherwise try to determine the device on its own (by checking already existing routes and device specifications, and where the route is added to). In most normal networks you won't need this. If dev If is the last option on the command line, the word dev may be omitted, as it's the default. Otherwise the order of the route modifiers (metric - netmask - gw - dev) doesn't matter.

## EXAMPLES
route add -net 127.0.0.0

adds the normal loopback entry, using netmask 255.0.0.0 (class A net, determined from the destination address) and associated with the "lo" device (assuming this device was prviously set up correctly with ifconfig(8)).

route add -net 192.56.76.0 netmask 255.255.255.0 dev eth0

adds a route to the network 192.56.76.x via "eth0". The Class C netmask modifier is not really necessary here because 192.* is a Class C IP address. The word "dev" can be omitted here.

route add default gw mango-gw

adds a default route (which will be used if no other route matches). All packets using this route will be gatewayed through "mango-gw". The device which will actually be used for that route depends on how we can reach "mango-gw" - the static route to "mango-gw" will have to be set up before.

route add ipx4 sl0

Adds the route to the "ipx4" host via the SLIP interface (assuming that "ipx4" is the SLIP host).

route add -net 192.57.66.0 netmask 255.255.255.0 gw ipx4

This command adds the net "192.57.66.x" to be gatewayed through the former route to the SLIP interface.

route add -net 224.0.0.0 netmask 240.0.0.0 dev eth0

This is an obscure one documented so people know how to do it. This sets all of the class D (multicast) IP routes to go via "eth0". This is the correct normal configuration line with a multicasting kernel.

route add -net 10.0.0.0 netmask 255.0.0.0 reject

This installs a rejecting route for the private network "10.x.x.x."

## OUTPUT
The output of the kernel routing table is organized in the following columns

Destination

The destination network or destination host.

Gateway

The gateway address or '*' if none set.

Genmask

The netmask for the destination net; '255.255.255.255' for a host destination and '0.0.0.0' for the default route.

Flags

Possible flags include

U (route is up)

H (target is a host)

G (use gateway)

R (reinstate route for dynamic routing)

D (dynamically installed by daemon or redirect)

M (modified from routing daemon or redirect)

A (installed by addrconf)

C (cache entry)

! (reject route)

Metric

The 'distance' to the target (usually counted in hops). It is not used by recent kernels, but may be needed by routing daemons.

Ref

Number of references to this route. (Not used in the Linux kernel.)

Use

Count of lookups for the route. Depending on the use of -F and -C this will be either route cache misses (-F) or hits (-C).

Iface

Interface to which packets for this route will be sent.

MSS

Default maximum segement size for TCP connections over this route.

Window

Default window size for TCP connections over this route.

irtt

Initial RTT (Round Trip Time). The kernel uses this to guess about the best TCP protocol parameters without waiting on (possibly slow) answers.

HH (cached only)

The number of ARP entries and cached routes that refer to the hardware header cache for the cached route. This will be -1 if a hardware address is not needed for the interface of the cached route (e.g. lo).

Arp (cached only)

Whether or not the hardware address for the cached route is up to date.

## FILES
/proc/net/ipv6_route

/proc/net/route

/proc/net/rt_cache

## SEE ALSO
ip(8)

## HISTORY
Route for Linux was originally written by Fred N. van Kempen, <waltje@uwalt.nl.mugnet.org> and then modified by Johannes Stille and Linus Torvalds for pl15. Alan Cox added the mss and window options for Linux 1.1.22. irtt support and merged with netstat from Bernd Eckenfels.

## AUTHOR
Currently maintained by Phil Blundell <Philip.Blundell@pobox.com>.


slattach

title: slattach(8)

text:
# slattach(8)

## NAME
slattach - attach a network interface to a serial line

## SYNOPSIS
slattach [-dehlLmnqv] [-c command] [-p proto] [-s speed] [tty]

## DESCRIPTION
Slattach is a tiny little program that can be used to put a normal terminal ("serial") line into one of several "network" modes, thus allowing you to use it for point-to-point links to other computers.

## OPTIONS
[-c command]

Execute command when the line is hung up. This can be used to run scripts or re-establish connections when a link goes down.

[-d]

Enable debugging output. Useful when determining why a given setup doesn't work.

[-h]

Exit when the carrier is lost. This works on both /dev/tty and /dev/cua devices by directly monitoring the carrier status every 15 seconds. [-v] Enable verbose output. Useful in shell scripts.

[-q]

Operate in quiet mode - no messages at all.

[-l]

Create an UUCP-style lockfile for the device in /var/lock/serial.

[-n]

Equivalent to the "mesg n" command.

[-m]

Do not initialize the line into 8 bits raw mode.

[-e]

Exit right after initializing device, instead of waiting for the line to hangup.

[-L]

Enable 3 wire operation. The terminal is moved into CLOCAL mode, carrier watching is disabled.

[-p proto]

Set a specific kind of protocol to use on the line. The default is set to cslip , i.e. compressed SLIP. Other possible values are slip (normal SLIP), adaptive (adaptive CSLIP/SLIP), ppp (Point-to-Point Protocol) and kiss (a protocol used for communicating with AX.25 packet radio terminal node controllers). The special argument tty can be used to put the device back into normal serial operation. Using 'ppp' mode is not normally useful as ppp requires an additional ppp daemon pppd to be active on the line. For kiss connections the axattach program should be used.

[-s speed]

Set a specific line speed, other than the default.

If no arguments are given, the current terminal line (usually: the login device) is used. Otherwise, an attempt is made to claim the indicated terminal port, lock it, and open it.

## FILES
/dev/cua* /var/lock/serial/LCK.*

## BUGS
None known.

## SEE ALSO
axattach(8), dip(8) pppd(8), sliplogin(8).

## AUTHORS
Fred N. van Kempen, <waltje@uwalt.nl.mugnet.org>

Alan Cox, <Alan.Cox@linux.org>

Miquel van Smoorenburg, <miquels@drinkel.ow.org>

George Shearer, <gshearer@one.net>

Yossi Gottlieb, <yogo@math.tau.ac.il>


afpd

package: netatalk

title: afpd(8)

summary: Apple Filing Protocol daemon

text:
# afpd(8)

## Name
afpd — Apple Filing Protocol daemon

## Synopsis
afpd [-d] [-F configfile]

afpd [-v | -V | -h]

## Description
afpd provides an Apple Filing Protocol (AFP) interface to the Unix file system. It is normally started at boot time by netatalk(8).

afp.conf is the configuration file used by afpd to determine the behavior and configuration of a file server.

## Options
-d

Do not disassociate daemon from terminal.

-v

Print version information and exit.

-V

Print verbose information and exit.

-h

Print help and exit.

-F configfile

Specifies the configuration file to use.

## Signals
To shut down a user's afpd process it is recommended that SIGKILL (-9) NOT be used, except as a last resort, as this may leave the CNID database in an inconsistent state. The safe way to terminate an afpd is to send it a SIGTERM (-15) signal and wait for it to die on its own.

SIGTERM and SIGUSR1 signals that are sent to the parent afpd process are propagated to the children, so all processes will be affected.

SIGTERM

Clean exit. Propagates from parent to children.

SIGQUIT

Sending this to the parent afpd will cause it to exit, but leaving all children running! This can be used to implement an AFP service without downtime.

SIGHUP

Sending a SIGHUP to afpd will cause it to reload its configuration files.

SIGINT

Sending a SIGINT to a child afpd enables max_debug logging for this process. The log is sent to the file afpd.PID.XXXXXX in the system tmp directory. Sending another SIGINT will revert to the original log settings.

SIGUSR1

The afpd process will send the message "The server is going down for maintenance." to the client and shut itself down in 5 minutes. New connections are not allowed. If this is sent to a child afpd, the other children are not affected. However, the main process will still exit, disabling all new connections.

SIGUSR2

The afpd process will look in the message directory configured at build time for a file named message.pid. For each one found, a the contents will be sent as a message to the associated AFP client. The file is removed after the message is sent. This should only be sent to a child afpd.

## Files
afp.conf

configuration file used by afpd

extmap.conf

file name extension mapping

afp_signature.conf

list of server signatures

afp_voluuid.conf

list of UUIDs for Time Machine volumes

message.pid

contains messages to be sent to users

## See Also
netatalk(8), hosts_access(5), afp.conf(5), afp_signature.conf(5), afp_voluuid.conf(5), extmap.conf(5), dbd(1)

## Author
Contributors to the Netatalk Project


title: cnid_dbd(8)

summary: CNID database access daemon

text:
# cnid_dbd(8)

## Name
cnid_dbd — CNID database access daemon

## Synopsis
cnid_dbd

cnid_dbd [-v | -V]

## Description
cnid_dbd provides an interface for storage and retrieval of catalog node IDs (CNIDs) and related information to the afpd daemon when using the dbd (Database Daemon) CNID backend.

CNIDs are a component of Classic Mac OS based file systems with semantics that does not map easily onto Unix file systems. This makes separate storage in a database necessary.

cnid_dbd is never started via the command line or system startup scripts but only by the cnid_metad daemon. There is one instance of cnid_dbd per netatalk volume.

cnid_dbd uses the Berkeley DB database library and uses transactionally protected updates. The dbd backend with transactions will avoid corruption of the CNID database even if the system crashes unexpectedly.

cnid_dbd inherits the effective userid and groupid from cnid_metad on startup, which is normally caused by afpd serving a netatalk volume to a client. It changes to the Berkeley DB database home directory dbdir that is associated with the volume. If the userid inherited from cnid_metad is 0 (root), cnid_dbd will change userid and groupid to the owner and group of the database home directory. Otherwise, it will continue to use the inherited values. cnid_dbd will then attempt to open the database and start serving requests using filedescriptor clntfd. Subsequent instances of afpd that want to access the same volume are redirected to the running cnid_dbd process by cnid_metad via the filedescriptor ctrlfd.

cnid_dbd can be configured to run forever or to exit after a period of inactivity. If cnid_dbd receives a TERM or an INT signal it will exit cleanly after flushing dirty database buffers to disk and closing Berkeley DB database environments. It is safe to terminate cnid_dbd this way, it will be restarted when necessary. Other signals are not handled and will cause an immediate exit, possibly leaving the CNID database in an inconsistent state (no transactions) or losing recent updates during recovery (transactions).

The Berkeley DB database subsystem will create files named log.xxxxxxxxxx in the database home directory dbdir, where xxxxxxxxxx is a monotonically increasing integer. These files contain the transactional database changes. They will be removed regularly, unless the logfile_autoremove option is specified in the db_param configuration file (see below) with a value of 0 (default 1).

## Options
-v | -V

Show version and exit.

## Configuration
cnid_dbd reads configuration information from the file db_param in the database directory dbdir on startup. If the file does not exist or a parameter is not listed, suitable default values are used. The format for a single parameter is the parameter name, followed by one or more spaces, followed by the parameter value, followed by a newline. The following parameters are currently recognized:

logfile_autoremove

If set to 0, unused Berkeley DB transactional logfiles (log.xxxxxxxxxx in the database home directory) are not removed on startup of cnid_dbd and on a regular basis. Default: 1.

cachesize

Determines the size of the Berkeley DB cache in kilobytes. Default: 8192. Each cnid_dbd process grabs that much memory on top of its normal memory footprint. It can be used to tune database performance. The db_stat utility with the -m option that comes with Berkeley DB can help you determine whether you need to change this value. The default is pretty conservative so that a large percentage of requests should be satisfied from the cache directly. If memory is not a bottleneck on your system you might want to leave it at that value. The Berkeley DB Tutorial and Reference Guide has a section Selecting a cache size that gives more detailed information.

flush_frequency; flush_interval

flush_frequency (Default: 1000) and flush_interval (Default: 1800) control how often changes to the database are checkpointed. Both of these operations are performed if either i) more than flush_frequency requests have been received or ii) more than flush_interval seconds have elapsed since the last save/checkpoint. Be careful to check your hard disk configuration for on disk cache settings. Many IDE disks just cache writes as the default behaviour, so even flushing database files to disk will not have the desired effect.

fd_table_size

is the maximum number of connections (filedescriptors) that can be open for afpd client processes in cnid_dbd. Default: 512. If this number is exceeded, one of the existing connections is closed and reused. The affected afpd process will transparently reconnect later, which causes slight overhead. On the other hand, setting this parameter too high could affect performance in cnid_dbd since all descriptors have to be checked in a select() system call, or worse, you might exceed the per process limit of open file descriptors on your system. It is safe to set the value to 1 on volumes where only one afpd client process is expected to run, e.g. home directories.

idle_timeout

is the number of seconds of inactivity before an idle cnid_dbd exits. Default: 600. Set this to 0 to disable the timeout.

## Updating
Starting with Netatalk 2.1.1, automatic Berkeley DB updates are supported, as long as Netatalk 2.1.0 or later was used to create the database.

In order to update between older Netatalk releases using different Berkeley DB library versions, follow these steps:

- Stop the to be upgraded old version of Netatalk

- Using the old Berkeley DB utilities run db_recover -h path/to/.AppleDB

- Using the new Berkeley DB utilities run db_upgrade -v -h path/to/.AppleDB -f cnid2.db

- Again using the new Berkeley DB utilities run db_checkpoint -1 -h path/to/.AppleDB

- Start the the new version of Netatalk

## See Also
cnid_metad(8), afpd(8), dbd(1)

## Author
Contributors to the Netatalk Project


title: cnid_metad(8)

text:
# cnid_metad(8)

## Name
cnid_metad — daemon for starting cnid_dbd daemons on demand

## Synopsis
cnid_metad [-d] [-F configuration file]

cnid_metad [-v | -V]

## Description
cnid_metad waits for requests from afpd to start up instances of the cnid_dbd daemon. It keeps track of the status of a cnid_dbd instance once started and will restart it if necessary.

When built with support for the dbd (Database Daemon) CNID backend, netatalk(8) will start and stop cnid_metad as needed. The user will normally not interact with it directly.

## Options
-d

cnid_metad will remain in the foreground and will also leave the standard input, standard output and standard error file descriptors open. Useful for debugging.

-F configuration file

Use configuration file as the configuration file.

-v, -V

Show version and exit.

## Caveats
cnid_metad does not block or catch any signals apart from SIGPIPE. It will therefore exit on most signals received. This will also cause all instances of cnid_dbd started by that cnid_metad to exit gracefully. Since state about and IPC access to the subprocesses is only maintained in memory by cnid_metad this is desired behaviour. As soon as cnid_metad is restarted afpd processes will transparently reconnect.

## See Also
netatalk(8), cnid_dbd(8), afpd(8), dbd(1), afp.conf(5)

## Author
Contributors to the Netatalk Project


netatalk

title: netatalk(8)

text:
# netatalk(8)

## Name
netatalk — Netatalk AFP server service controller daemon

## Synopsis
netatalk [-F configfile]

netatalk [-v | -V]

## Description
netatalk is the daemon used to control the Netatalk AFP file server, which is made up of multiple forking daemons. For most deployments you would use netatalk for centralized control rather than launching and stopping each daemon individually. The netatalk daemon is normally started at boot time by an init system.

The controller daemon will launch the AFP daemon afpd and the CNID meta daemon cnid_metad. The latter will in turn launch the CNID database daemon cnid_dbd.

The configurations of all four daemons are managed in a single configuration file called afp.conf.

## Options
-d

Do not disassociate daemon from terminal.

-F configfile

Specifies the configuration file to use.

-v | -V

Print version information and exit.

## Signals
SIGTERM

Stop the Netatalk AFP and CNID daemons.

SIGHUP

Sending a SIGHUP will cause the Netatalk AFP and CNID daemons to reload their configurations from afp.conf.

## Files
afp.conf

configuration file used by netatalk(8), afpd(8) and cnid_metad(8)

## See Also
afpd(8), cnid_metad(8), afp.conf(5)

## Author
Contributors to the Netatalk Project


netatopd

package: netatop

title: netatopd(8)

text:
# netatopd(8)

## NAME
netatopd - log network statistics of finished processes

## DESCRIPTION
This manual page documents the netatopd daemon. This daemon reads the counters of exited processes delivered by the netatop module and writes the counters to a logfile.

The 'usual' state of this daemon is the getsockopt() command NETATOP_GETCNT_EXIT. With this command, netatopd blocks until an exited task is available on the exitlist of the netatop module. The obtained netpertask struct that countains the counters of an exited process is written to a logfile (similar to the process accounting info provided by the base kernel itself). The daeon stops logging when there is only 5% of free space left in the filesystem of the logfile.

The logfile starts with a small header struct that contains a.o. a sequence number indicating how many netpertask structs are currently logged. This header is mmapped and can be consulted by analysis processes like atop that consult the logfile. Behind the header, the netpertask structs can be found in compressed form. Every compressed netpertask struct is preceeded by one byte specifying the size of the compressed netpertask struct.

Before an analysis process starts using the logfile, it has to subscribe itself by decrementing a semaphore owned by the netatopd daemon. In this way, netatopd knows how many analysis processes are currently using the logfile. When no processes use the logfile any more, netatopd truncates the logfile and start building a new one as soon as a new subscription of an analysis process is noticed.

## FILES
/var/run/netatop.log

File in which netatopd writes the compressed accounting records about processes that have finished.

## SEE ALSO
netatop(4), atop(1), atopsar(1), atoprc(5)

https://www.atoptool.nl

## AUTHOR
Gerlof Langeveld (gerlof.langeveld@atoptool.nl)


netdiscover

package: netdiscover

title: netdiscover(8)

text:
# netdiscover(8)

## NAME
netdiscover - active/passive ARP reconnaissance tool

## SYNOPSIS

```
netdiscover [-i device] [-r range | -l file | -p] [-m file] [-F filter]

            [-s time] [-c count] [-n node] [-dfPLNS]
```

## DESCRIPTION
netdiscover is an active/passive ARP reconnaissance tool, initially developed to gain information about wireless networks without DHCP servers in wardriving scenarios. It can also be used on switched networks. Built on top of libnet and libpcap, it can passively detect online hosts or search for them by sending ARP requests.

Furthermore, it can be used to inspect your network's ARP traffic, or find network addresses using auto scan mode, which will scan for common local networks.

## OPTIONS
-i device

The network interface to sniff and inject packets. If no interface is specified, first available will be used.

-r range

Scan a given range instead of auto scan. Valid range values include, for example: 192.168.0.0/24, 192.168.2.0/23, 192.168.0.0/12, 192.168.0.0/8. Note that netdiscover is also a passive scanner, and all detected IPs will be displayed, in addition to those included in the specified range.

-l file

Scan ranges contained on the given file. It must contain only one range per line.

-p

Enable passive mode. In passive mode, netdiscover does not send anything, but does only sniff.

-m file

Scan a list of known MACs and host names.

-F filter

Customize pcap filter expression (default: "arp").

-s time

Sleep given time in milliseconds between each ARP request injection. (default 1)

-c count

Number of times to send each ARP request. Useful for networks with packet loss, so it will scan given times for each host. (default 1)

-n node

Last IP octet of the source IP used for scanning. You can change it if the default host (x.x.x.67) is already used. (allowed range is 2 to 253, default 67)

-d

Ignore configuration files at home dir (for autoscan and fast mode only). This will use default ranges and IPs for autoscan and fast mode. See below for information about configuration files.

-R

Assume user is root or that he has the required capabilities without running any checks.

-f

Enable fast mode scan. This will only scan for .1, .100 and .254 on each network. This mode is useful while searching for ranges being used. After you found such range you can make a specific range scan to find online boxes.

-P

Produces an output suitable to be redirected into a file or to be parsed by another program, instead of using interactive mode. Enabling this option, netdiscover will stop after scanning given ranges.

-L

Similar to -P but continue program execution to capture ARP packets passively after the active scan. phase to capture ARP packets passively.

-N

Do not print header. Only valid when -P or -L is enabled.

-S

(DEPRECATED) Enable sleep time suppression between each request. If set, netdiscover will sleep after having scanned 255 hosts instead of sleeping after each one. This mode was used in netdiscover 0.3 beta4 and before. Avoid this option in networks with packet loss, or in wireless networks with low signal level. (also called hardcore mode)

## USAGE
If passive mode (-p), scan list (-l) or scan range (-r) options aren't enabled, netdiscover will scan for common LAN addresses (192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8).

Screen control keys:

```
    h  Show help screen.

    j  Scroll down (or down arrow).

    k  Scroll up (or up arrow).

    .  Scroll page up.

    ,  Scroll page down.

    q  Close help screen or end application.
```

Screen views:

```
    a  Show ARP replies list.

    r  Show ARP requests list.

    u  Show unique hosts detected.
```

## CONFIG FILES
There are 2 configuration files that netdiscover will look for, each time it is executed. If files doesn't exist, netdiscover will use default values. You can use the -d switch to disable reading and loading configuration files.

~/.netdiscover/ranges

This file contains a list of ranges (one per line) used for auto scan mode instead of default ranges. By default netdiscover will use a list of common ranges used on local networks.

Example:

```
    192.168.21.0/24

    172.24.0.0/14

    10.0.0.0/12
```

~/.netdiscover/fastips

List containing the last octet of the IPs to be scanned on each subnet, when using fast mode (-f), by default (1,100,154). You must put a number per line.

## USAGE EXAMPLES
Scan common LAN addresses on eth0:

```
    # netdiscover -i eth0
```

Fast scan common LAN addresses on eth0 (search only for gateways):

```
    # netdiscover -i eth0 -f
```

Scan some fixed ranges:

```
    # netdiscover -i eth0 -r 172.26.0.0/24

    # netdiscover -r 192.168.0.0/16

    # netdiscover -r 10.0.0.0/8
```

Scan common LAN addresses with sleep time 0.5 milliseconds instead of default 1:

```
    # netdiscover -s 0.5
```

Scan fixed range on fast mode with sleep time 0.5 milliseconds instead of default 1:

```
    # netdiscover -r 192.168.0.0/16 -f -s 0.5
```

Scan a range using 101 as last octet for SOURCE IP

```
    # netdiscover -r 10.1.0.0/16 -n 101
```

Only sniff for ARP traffic, don't send nothing:

```
    # netdiscover -p
```

## AUTHOR
netdiscover was written by Jaime Penalba Estebanez <jpenalbae@gmail.com>.

This manual page was originally written by Nicolas Weyland, for the Debian project. This man page has been merged into netdiscover project and modified from the original by Jaime Penalba and Joao Eriberto Mota Filho.


nethogs

package: nethogs

title: nethogs(8)

text:
# nethogs(8)

## NAME
nethogs - Net top tool grouping bandwidth per process

## SYNOPSIS
nethogs [-V] [-h] [-x] [-d seconds] [-v mode] [-c count] [-t] [-p] [-s] [-a] [-l] [-f filter] [-C] [-b] [-g period] [-P pid] [device(s)]

## DESCRIPTION
NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most such tools do, it groups bandwidth by process - and does not rely on a special kernel module to be loaded. So if there's suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this, and if it's some kind of spinning process, kill it.

### Options
-V

prints version.

-h

prints available commands usage.

-x

bughunt mode - implies tracemode.

-d

delay for update refresh rate in seconds. default is 1.

-v

view mode (0 = kB/s, 1 = total kB, 2 = total bytes, 3 = total MB, 4 = MB/s, 5 = GB/s). default is 0. kB: 2e10 bytes, MB: 2e20 bytes, GB: 2e30 bytes

-c

number of updates. default is 0 (unlimited).

-t

tracemode.

-p

sniff in promiscuous mode (not recommended).

-s

sort output by sent column.

-l

display command line.

-a

monitor all devices, even loopback/stopped ones.

-C

capture TCP and UDP.

-b

Display the program basename.

-g

garbage collection period in number of refresh. default is 50.

-P

Show only processes with the specified pid(s).

-f

EXPERIMENTAL: specify string pcap filter (like tcpdump). This may be removed or changed in a future version.

device(s) to monitor. default is all interfaces up and running excluding loopback

## INTERACTIVE CONTROL
q

quit

s

sort by SENT traffic

r

sort by RECEIVED traffic

l

display command line

b

display the program basename

m

switch between total (KB, B, MB) and throughput (KB/s, MB/s, GB/s) mode

## RUNNING WITHOUT ROOT
In order to be run by an unprivileged user, nethogs needs the cap_net_admin and cap_net_raw capabilities. Additionally, to display process names, cap_dac_read_search and cap_sys_ptrace capabilities are required. These can be set on the executable by using the setcap(8) command, as follows:

```
sudo setcap "cap_net_admin,cap_net_raw,cap_dac_read_search,cap_sys_ptrace+pe" /usr/local/sbin/nethogs
```

## Notes
1. When using the -P <pid> option, in a case where a process exited (normally or abruptly), Nethogs does not track that it exited. So, the operating system might create a new process (for another program) with the same pid. In this case, this new process will be shown by Nethogs.

## SEE ALSO
netstat(8) tcpdump(1) pcap(3)

## AUTHOR

```
Written by Arnout Engelen <arnouten@bzzt.net>.
```


netlabel-config

title: netlabel-config(8)

summary: NetLabel configuration utility

text:
# netlabel-config(8)

## NAME
netlabel-config - NetLabel configuration utility

## SYNOPSIS
netlabelctl reset| load

## DESCRIPTION
The NetLabel configuration utility, netlabel-config, is a script designed to make it easier for system administratiors to create, manage, and use complex NetLabel configurations. The netlabel-config script uses the netlabelctl(8) tool and /etc/netlabel.rules configuration file to load a saved NetLabel configuration into the kernel and reset the kernel's NetLabel configuration to the default state when needed.

reset

Removes any NetLabel configuration loaded into the kernel and resets the kernel's NetLabel state to the default.

load

Loads the NetLabel configuration specified by /etc/netlabel.rules into the kernel.

## EXIT STATUS
Returns zero on success, errno values on failure.

## NOTES
The NetLabel subsystem is supported on Linux Kernels version 2.6.19 and later. The static, or fallback, labels are only supported on Linux Kernels version 2.6.25 and later. The domain mapping address selectors are only supported on Linux Kernels 2.6.28 and later and CALIPSO/RFC5570 is only supported on Linux Kernels 4.8.0 and later.

The NetLabel project site, with more information including the source code repository, can be found at https://github.com/netlabel. Please report any bugs at the project site or directly to the author.

## AUTHOR
Paul Moore <paul@paul-moore.com>

## SEE ALSO
netlabelctl(8)


netlabelctl

title: netlabelctl(8)

summary: NetLabel management utility

text:
# netlabelctl(8)

## NAME
netlabelctl - NetLabel management utility

## SYNOPSIS
netlabelctl [<global_flags>] <module> [<module_commands>]

## DESCRIPTION
The NetLabel management utility, netlabelctl, is a command line program designed to allow system administrators to configure the NetLabel system in the kernel. The utility is based around different "modules" which correspond to the different types of NetLabel commands supported by the kernel.

## OPTIONS

### Global Flags
-h

Help message

-p

Attempt to make the output human readable or "pretty"

-t <seconds>

Set a timeout to be used when waiting for the NetLabel subsystem to respond

-v

Enable extra output

-V

Display the version information

### Modules and Commands
mgmt

The management module is used to perform general queries about the NetLabel subsystem within the kernel. The different commands and their syntax are listed below.

version

Display the kernel's NetLabel management protocol version.

protocols

Display the kernel's list of supported labeling protocols.

map

The domain mapping module is used to map different NetLabel labeling protocols to either individual LSM domains or the default domain mapping. It is up to each LSM to determine what defines a domain. With SELinux, the normal SELinux domain should be used, i.e. "ping_t". In addition to protocol selection based only on the LSM domain, it is also possible to select the labeling protocol based on both the LSM domain and destination address. The network address selectors can specify either single hosts or entire networks and work for both IPv4 and IPv6, although the labeling protocol chosen must support the IP version chosen. When specifying the labeling protocol to use for each mapping there is an optional "extra" field which is used to further identify the specific labeling protocol configuration. When specifying the unlabeled protocol, "unlbl", an extra value of either "4" or "6" may be used. This restricts the mapping to IPv4 or IPv6 addresses. Omitting the extra value will result in a mapping for all address families. When specifying the CIPSO/IPv4 or the CALIPSO/IPv6 protocol, "cipso" or "calipso", the DOI value should be specified; see the EXAMPLES section for details. The different commands and their syntax are listed below.

add default|domain:<domain> [address:<ADDR>[/<MASK>]] protocol:<protocol>[,<extra>]

Add a new LSM domain / network address to NetLabel protocol mapping.

del default|domain:<domain>

Delete an existing LSM domain to NetLabel protocol mapping.

list

Display all of the configured LSM domain to NetLabel protocol mappings.

unlbl

The unlabeled (unlbl) module controls the unlabeled protocol which is used both when labeling outgoing traffic is not desired as well as when unlabeled traffic is received by the system. This module allows administrators to block all unlabeled packets from the system through the "accept" flag and assign static, or fallback, security labels to unlabeled traffic based on the inbound network interface and source address.

accept on|off

Toggle the unlabeled traffic accept flag.

add default|interface:<dev> address:<addr>[/<mask>] label:<label>

Add a new static/fallback entry.

del default|interface:<dev> address:<addr>[/<mask>]

Delete an existing static/fallback entry.

list

Display the status of the unlabeled accept flag.

cipso

The CIPSO/IPv4 (cipso) module controls the CIPSO/IPv4 labeling engine in the kernel. The CIPSO/IPv4 engine provided by NetLabel supports multiple Domains Of Interpretation (DOI) and the CIPSO/IPv4 module allows for different configurations for each DOI. At present there are three types of configurations, the "trans" configuration which allows on-the-fly translation of MLS sensitivity labels, the "pass" configuration which does not perform any translation of the MLS sensitivity label and the "local" configuration which conveys the full LSM security label over localhost/loopback connections. Regardless of which configuration type is chosen a DOI value must be specified and if the "trans" or "pass" configurations are specified then a list of the CIPSO/IPv4 tag types to use when generating the CIPSO/IPv4 packet labels must also be specified. The list of CIPSO/IPv4 tags is ordered such that when possible the first tag type listed is used when a CIPSO/IPv4 label is generated. However, if it is not possible to use the first tag type then each tag type is checked, in order, until a suitable tag type is found. If a valid tag type can not be found then the operation causing the CIPSO/IPv4 label will fail, typically this occurs whenever a new socket is created. The different commands and their syntax are listed below.

add trans doi:<DOI> tags:<T1>,<Tn> levels:<LL1>=<RL1>,<LLn>=<RLn> categories:<LC1>=<RC1>,<LCn>=<RCn>

Add a new CIPSO/IPv4 configuration using the standard/translated mapping with the given level and category translations. The levels are translated in such a way that the local level "LLn" is translated to the remote, on-the-wire level of "RLn"; the reverse translation is done for incoming packets. The same translation is done for the categories using "LCn" and "RCn". In order for a packet to be accepted, or a socket created by an application, there must be a translation for the sensitivity level and all the categories present in the MLS sensitivity label; if the entire requested sensitivity label can not be translated the application will fail.

add pass doi:<DOI> tags:<T1>,<Tn>

Add a new CIPSO/IPv4 configuration without any level or category translations.

add local doi:<DOI>

Add a new CIPSO/IPv4 configuration for localhost/loopback connections.

del doi:<DOI>

Delete an existing CIPSO/IPv4 configuration with the given DOI value. If any LSM domain mappings are present which make use of this DOI they will also be deleted.

list [doi:<DOI>]

Display a list of all the CIPSO/IPv4 configurations or just the configuration matching the optionally specified DOI.

calipso

The CALIPSO/IPv6 (calipso) module controls the CALIPSO/IPv6 labeling engine in the kernel. This behaves in a very similar way to the CIPSO/IPv4 engine, however the protocol only specifies one tag-type (equivalent to CIPSO tag-type 1) and so the tag-type should not be specified. In addition there is no support for the "local" or "trans" configuration. The different commands and their syntax are listed below.

add pass doi:<DOI>

Add a new CALIPSO/IPv6 configuration without any level or category translations.

del doi:<DOI>

Delete an existing CALIPSO/IPv6 configuration with the given DOI value. If any LSM domain mappings are present which make use of this DOI they will also be deleted.

list [doi:<DOI>]

Display a list of all the CALIPSO/IPv6 configurations or just the configuration matching the optionally specified DOI.

## EXIT STATUS
Returns zero on success, errno values on failure.

## EXAMPLES
netlabelctl cipso add pass doi:16 tags:1

Add a CIPSO/IPv4 configuration with a DOI value of "16", using CIPSO tag "1" (the permissive bitmap tag). The CIPSO and LSM levels/categories are passed through the NetLabel subsystem without any translation.

netlabelctl cipso add trans doi:8 tags:1 levels:0=0,1=1 categories:0=1,1=0

Add a CIPSO/IPv4 configuration with a DOI value of "8", using CIPSO tag "1" (the permissive bitmap tag). The specified mapping converts local LSM levels "0" and "1" to CIPSO levels "0" and "1" respectively while local LSM categories "0" and "1" are mapped to CIPSO categories "1" and "0" respectively.

netlabelctl -p cipso list

Display all of the CIPSO/IPv4 configurations in a human readable format.

netlabelctl -p cipso list doi:16

Display specific information about the CIPSO/IPv4 DOI 16 configuration.

netlabelctl cipso del doi:8

Delete the CIPSO/IPv4 configuration assigned to DOI 8. In addition to removing the CIPSO/IPv4 configuration any domain mappings using this configuration will also be removed.

netlabelctl map add domain:lsm_domain protocol:cipso,8

Add a domain mapping so that all outgoing packets sent from the "lsm_domain" will be labeled according to the CIPSO/IPv4 protocol using DOI 8.

netlabelctl map add domain:lsm_domain address:192.168.1.0/24 protocol:cipso,8

Add a mapping so that all outgoing packets sent from the "lsm_domain" to the 192.168.1.0/24 network will be labeled according to the CIPSO/IPv4 protocol using DOI 8.

netlabelctl -p map list

Display all of the domain mappings in a human readable format.

netlabelctl del domain:lsm_domain

Delete the domain mapping for the "lsm_domain", packets sent from the "lsm_domain" will fallback to the default NetLabel mapping.

netlabelctl unlbl add interface:lo address:::1 label:foo

Add a static/fallback label to assign the "foo" security label to unlabeled packets entering the system over the "lo" (loopback) interface with an IPv6 source address of "::1" (localhost).

netlabelctl unlbl add default address:192.168.0.0/16 label:bar

Add a static/fallback label to assign the "bar" security label to unlabeled packets entering the system over any interface with an IPv4 source address in the 192.168.0.0/16 network.

## NOTES
The NetLabel subsystem is supported on Linux Kernels version 2.6.19 and later. The static, or fallback, labels are only supported on Linux Kernels version 2.6.25 and later. The domain mapping address selectors are only supported on Linux Kernels 2.6.28 and later and CALIPSO/RFC5570 is only supported on Linux Kernels 4.8.0 and later.

The NetLabel project site, with more information including the source code repository, can be found at https://github.com/netlabel. Please report any bugs at the project site or directly to the author.

## AUTHOR
Paul Moore <paul@paul-moore.com>

## SEE ALSO
netlabel-config(8)


title: netopeer2-server(8)

text:
# netopeer2-server(8)

## NAME
netopeer2-server - NETCONF server daemon build on libnetconf2 with sysrepo datastore

## SYNOPSIS
netopeer2-server [-dFhV] [-p PATH] [-U[PATH]] [-m MODE] [-u UID] [-g GID] [-t TIMEOUT] [-v LEVEL] [-c CATEGORY]

## DESCRIPTION
netopeer2-server is as a full-fledged NETCONF server providing a remote NETCONF interface for sysrepo datastore. It configures itself based on ietf-netconf-server YANG module data in sysrepo.

## OPTIONS
-d

Debug mode (do not daemonize and print verbose messages to stderr instead of syslog).

-F

Run in foreground (do not daemonize) and log to syslog.

-h

Display help.

-V

Show program version.

-p PATH

Path to pidfile.

-f PATH

Path to netopeer2 server files directory.

-U[ENDPTNAME:PATH]

Set UNIX socket path for a specific endpoint.

-m MODE

Set mode for the listening UNIX socket.

-u UID

Set UID/user for the listening UNIX socket.

-g GID

Set GID/group for the listening UNIX socket.

-t TIMEOUT

Timeout in seconds of all sysrepo functions (applying edit-config, reading data, ...), if 0 (default), the default sysrepo timeouts are used.

-v LEVEL

Verbose output LEVEL:

• 0 - errors

• 1 - errors and warnings

• 2 - errors, warnings, and verbose messages

-c CATEGORY[,CATEGORY...]

Verbose debug level, print only these debug message categories. Categories:

• DICT

• YANG

• YIN

• XPATH

• DIFF

• MSG

• LN2DBG

• SSH

• SYSREPO

## SEE ALSO
https://sysrepo.org (sysrepo home page with basic information about netopeer2-server)

https://github.com/CESNET/netopeer2 (Netopeer2 Git repository)

## AUTHORS
Michal Vasko <mvasko@cesnet.cz>

Radek Krejci <rkrejci@cesnet.cz>

## COPYRIGHT
Copyright © 2018-2021 CESNET, a.l.e.

Copyright © 2018-2021 Deutsche Telekom AG.


netplan-apply

package: netplan

title: netplan-apply(8)

text:
# netplan-apply(8)

## NAME
netplan-apply - apply configuration from Netplan YAML files to a running system

## SYNOPSIS
netplan [--debug] apply -h|--help

netplan [--debug] apply

## DESCRIPTION
netplan apply applies the current Netplan configuration to a running system.

The process works as follows:

1.

The back-end configuration is generated from Netplan YAML files.

2.

The appropriate back ends (systemd-networkd(8) or NetworkManager(8)) are invoked to bring up configured interfaces.

3.

netplan apply iterates through interfaces that are still down, unbinding them from their drivers and rebinding them. This gives udev(7) renaming rules the opportunity to run.

4.

If any devices have been rebound, the appropriate back ends are re-invoked in case more matches can be done.

For information about the generation step, see netplan-generate(8). For details of the configuration file format, see netplan(5).

## OPTIONS
-h, --help

Print basic help.

--debug

Print debugging output during the process.

## KNOWN ISSUES
netplan apply will not remove virtual devices such as bridges and bonds that have been created, even if they are no longer described in the Netplan configuration. That is due to the fact that Netplan operates statelessly and is not aware of the previously defined virtual devices.

This can be resolved by manually removing the virtual device (for example ip link delete dev bond0) and then running netplan apply, by rebooting, or by creating a temporary backup of the YAML state in /etc/netplan before modifying the configuration and passing this state to Netplan (e.g. mkdir -p /tmp/netplan_state_backup/etc && cp -r /etc/netplan /tmp/netplan_state_backup/etc/ then running netplan apply --state /tmp/netplan_state_backup).

## SEE ALSO
netplan(5), netplan-generate(8), netplan-try(8), udev(7), systemd-networkd.service(8), NetworkManager(8)

## AUTHORS
Daniel Axtens (daniel.axtens@canonical.com).


netplan-dbus

title: netplan-dbus(8)

text:
# netplan-dbus(8)

## NAME
netplan-dbus - daemon to access Netplan functionality via a D-Bus API

## SYNOPSIS
netplan-dbus

## DESCRIPTION
netplan-dbus is a D-Bus daemon, providing io.netplan.Netplan on the system bus. The /io/netplan/Netplan object provides an io.netplan.Netplan interface, offering the following methods:

- Apply() -> b: calls netplan apply and returns a success or failure status.

- Generate() -> b: calls netplan generate and returns a success or failure status.

- Info() -> a(sv): returns a dictionary "Features -> as", containing an array of all available feature flags.

- Config() -> o: prepares a new configuration object as /io/netplan/Netplan/config/<ID>, by copying the current state from /{etc,run,lib}/netplan/*.yaml.

The /io/netplan/Netplan/config/<ID> objects provide a io.netplan.Netplan.Config interface, offering the following methods:

- Get() -> s: calls netplan get --root-dir=/run/netplan/config-ID all and returns the merged YAML configuration of the the given configuration object's state

- Set(s:CONFIG_DELTA, s:ORIGIN_HINT) -> b: calls netplan set --root-dir=/run/netplan/config-ID --origin-hint=ORIGIN_HINT CONFIG_DELTA

CONFIG_DELTA can be something like: network.ethernets.eth0.dhcp4=true and ORIGIN_HINT can be something like: 70-snapd (it will then write the configuration to 70-snapd.yaml). Once Set() is called on a configuration object, all other current and future configuration objects are being invalidated and cannot Set() or Try()/Apply() anymore, due to this pending dirty state. After the dirty configuration object is rejected via Cancel(), the other configuration objects are valid again. If the dirty configuration object is accepted via Apply(), newly created configuration objects will be valid, while the older states will stay invalid.

- Try(u:TIMEOUT_SEC) -> b: replaces the main Netplan configuration with this configuration object's state and calls netplan try --timeout=TIMEOUT_SEC.

- Cancel() -> b: rejects a currently running Try() attempt on this configuration object and/or discards the configuration object.

- Apply() -> b: replaces the main Netplan configuration with this configuration object's state and calls netplan apply.

For information about the Apply()/Try()/Get()/Set() functionality, see netplan-apply(8)/netplan-try(8)/netplan-get(8)/netplan-set(8) accordingly. For details of the configuration file format, see netplan(5).

## SEE ALSO
netplan(5), netplan-apply(8), netplan-try(8), netplan-get(8), netplan-set(8)

## AUTHORS
Lukas Märdian (lukas.maerdian@canonical.com).