---
name: "stenoread"
section: "1"
platform: "linux"
package: "stenographer-client"
version: "1.0.1-7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/stenoread"
---

# stenoread(1)

read logs out of Stenographer

## NAME

**stenoread** - read logs out of Stenographer

## SYNOPSIS

```
stenoread <stenographer_query> [tcpdump_arguments]
```

## DESCRIPTION

**The stenoread command line script automates pulling packets from Stenographer** **and presenting them in a usable format to analysts. It requests raw packets** **from stenographer, then runs them through tcpdump to provide a more** **full-featured formatting/filtering experience.**

**The first argument to stenoread is a stenographer query (see below).** **All other arguments are passed to tcpdump. For example:**

```
        # Request all packets from IP 1.2.3.4 port 6543, then do extra filtering by
        # TCP flag, which typical stenographer does not support.
        $ stenoread 'host 1.2.3.4 and port 6543' 'tcp[tcpflags] & tcp-push != 0'
        # Request packets on port 8765, disabling IP resolution (-n) and showing
        # link-level headers (-e) when printing them out.
        $ stenoread 'port 8765' -n -e
        # Request packets for any IPs in the range 1.1.1.0-1.1.1.255, writing them
        #out to a local PCAP file so they can be opened in Wireshark.
        $ stenoread 'net 1.1.1.0/24' -w /tmp/output_for_wireshark.pcap
```

## QUERY LANGUAGE

**A user requests packets from stenographer by specifying them with a very** **simple query language. This language is a simple subset of BPF, and includes** **the primitives:**

```
        host 8.8.8.8          # Single IP address (hostnames not allowed)
        net 1.0.0.0/8         # Network with CIDR
        net 1.0.0.0 mask 255.255.255.0  # Network with mask
        port 80               # Port number (UDP or TCP)
        ip proto 6            # IP protocol number 6
        icmp                  # equivalent to 'ip proto 1'
        tcp                   # equivalent to 'ip proto 6'
        udp                   # equivalent to 'ip proto 17'
        # Stenographer-specific time additions:
        before 2012-11-03T11:05:00Z      # Packets before a specific time (UTC)
        after 2012-11-03T11:05:00-0700   # Packets after a specific time (with TZ)
        before 45m ago        # Packets before a relative time
        before 3h ago         # Packets after a relative time
```

**Primitives can be combined with and/&& and with or/\|\|, which have equal** **precedence and evaluate left-to-right. Parens can also be used to group:**

```
        (udp and port 514) or (tcp and port 8080)
```

## ENVIRONMENT

**Set the STENOGRAPHER\_CONFIG environmental variable to point to your** **stenographer config if it's in a nonstandard place** **(defaults to /etc/stenographer/config).**