---
name: "sniffit"
section: "5"
platform: "linux"
package: "sniffit"
version: "0.7-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/sniffit/5"
---

# sniffit(5)

configuration file for sniffit (name arbitrary)

## NAME

sniffit - configuration file for sniffit (name arbitrary)

## DESCRIPTION

This page describes the format for the config file for **sniffit** (see [**sniffit**(8)](/sniffit/8.md) ). This file allows you to specify in great detail witch packets should be processed by **sniffit.** This file also controls (or will control) some functions for the continuous logging ('-L' option).

A **sniffit** config file might look like (Be sure to end it with a BLANK line):

-

  ```
  # Sniffit Sample Config file -- Brecht Claerhout
  logfile /var/log/sniffit.today.log
  # First select all packets!
  select both mhosts 1
  select both mhosts 2
  # Now deselect all packets from/to those damn 'surfers'
  deselect both port 80
  deselect both port 8001
  ```

This file will tell **sniffit** to process all packets on the subnet except those FROM/TO ports 80 and 8001 (thus we don't want logs of those mass WWW connections witch turn our logs unreadable).

## GLOBAL FORMAT

The file consists of lines, lines are formed by fields, fields are separated with SPACES (NO TABS). Unix comment lines (starting with '#' are allowed). So this gives us:

-

  \<field1\> \<field2\> \<field3\> \<field4\> \<field5\>

## FIELD FORMAT

- \<field1\>

  **select** - **Sniffit** will look for packets that match the following description (other fields)

-

  **deselect** - **Sniffit** will ignore packets that match the description

-

  **logfile** - change the logfile name to \<field2\> instead of the default 'sniffit.log'

- \<field2\>

  **from** - Packets FROM the host matching the following desc. are considered.

-

  **to** - similar, Packets TO the....

-

  **both** - similar, Packets FROM or TO the....

-

  **a filename** - as an argument of 'logfile' in \<field1\>

- \<field3\>

  **host** - The (de)selection criteria involves a hostname.

-

  **port** - similar, ... a portnumber

-

  **mhosts** - The (de)selection criteria involves multiple-hosts, like with the wildcards in 0.3.0, but without the 'x'

- \<field4\>

  Either a hostname, a portnumber, a service name or a number-dot partial notation indicating multiple hosts depending on \<field3\> (service names like 'ftp' are resolved as the services available present on the host that runs Sniffit, and translated into a port nr)

- \<field5\>

  A portnumber, if \<field3\> was 'host' or 'mhosts' (optional, if not filled in, all ports are going to be (de)selected)

## FILE INTERPRETING

The config file is interpreted SEQUENTIAL, so watch it, don't mix lines in a file. Example:

-

  ```
        select both mhosts 100.100.12.
        deselect both port 80
        select both host 100.100.12.2
  This file will get you the packets:
        a) Send by hosts '100.100.12.*'
        b) EXCEPT the WWW packets
        c) BUT showing the WWW packets concerning
           100.100.12.2
  ```

-

  ```
        select both mhosts 100.100.12.
        select both host 100.100.12.2
        deselect both port 80
  Will give you the packets (probably unwanted result):
        a) Send by hosts '100.100.12.*'
        b) Send from/to 100.100.12.2 (useless line)
        c) deselecting all WWW packets on the subnet
  ```

## AUTHOR

Brecht Claerhout \<coder@reptile.rug.ac.be\>

## SEE ALSO

[**sniffit**(8)](/sniffit/8.md)