Using the ssadm logdump Command

ssadm logdump is based on the Solaris snoop program and has similar characteristics. In addition to the packet information available with snoop, SunScreen's logging mechanisms add information such as the interface on which the packet was received and the reason that the packet was logged. Any filtering language operation that works in snoop will work in logdump.

For details about ssadm logdump, see Chapter 11, Logging and the ssadm-logdump man page.

To run ssadm logdump and display packets in a saved log file:

# ssadm logdump -i logfile

Where log_file is a log file that is downloaded from the Screen.

Except for the differences detailed in Chapter 11, Logging, logdump uses the same filter language as the snoop(1m) program. Note also that logdump does not handle IPv6.