Package: tcpspy Version: 1.7d-15 Severity: minor Tags: patch Dear Maintainer,
here are some remarks and fixes for the manual. Input file is tcpspy.8 Output from "mandoc -T lint tcpspy.8": mandoc: tcpspy.8:3:51: STYLE: whitespace at end of input line mandoc: tcpspy.8:52:2: WARNING: skipping paragraph macro: PP empty mandoc: tcpspy.8:117:2: WARNING: skipping paragraph macro: PP empty mandoc: tcpspy.8:176:81: STYLE: input text line longer than 80 bytes: a default mask with ... mandoc: tcpspy.8:187:71: STYLE: whitespace at end of input line mandoc: tcpspy.8:194:73: STYLE: whitespace at end of input line mandoc: tcpspy.8:260:85: STYLE: input text line longer than 80 bytes: tcpspy \-e 'not radd... ####### Remove space characters at the end of lines. Use "git apply ... --whitespace=fix" to fix extra space issues, or use global configuration "core.whitespace". 3:.\" Copyright (c) 2000, 2001, 2002 Tim J. Robbins. 5:.\" 16:.\" 187:True if the full filename (including directory) of the executable that 194:The pattern "" (an empty string) matches connections created/accepted by ##### Reduce space between words. 202:Expressions (including the comparisons listed above) may be joined together ##### Use the correct macro for the font change of a single argument or split the argument into two. 135:.BI ip 138:.BI ip6 ##### Change a HYPHEN-MINUS (code 0x55, 2D) to a minus (\-), if in front of a name for an option. 34:.RB [ "-dp" ] 35:.RB [ "-e" 37:.RB [ "-f" 39:.RB [ "-F" 41:.RB [ "-I" 43:.RB [ "-U" 45:.RB [ "-G" 55:.BI -e " 'rule'" 60:.BI -f " rulefile" 67:.B -e 69:.B -f 72:.BI -F " facility" 79:.BI -I " interval" 89:.BI -U " user" 94:.BI -G " group" 99:.B -U 101:.B -G 104:.B -d 109:.B -p 120:.B -e 155:.I -high 198:.B -p ##### Wrong distance between sentences. Separate the sentences and subordinate clauses; each begins on a new line. See man-pages(7) ("Conventions for source file layout") and "info groff" ("Input Conventions"). The best procedure is to always start a new sentence on a new line, at least, if you are typing on a computer. Remember coding: Only one command ("sentence") on each (logical) line. E-mail: Easier to quote exactly the relevant lines. Generally: Easier to edit the sentence. Patches: Less unaffected text. The amount of space between sentences in the output can then be controlled with the ".ss" request. 50:syslog. The following information is logged: username, local address and port, 56:Log only connections matching the specified rule. Rule syntax is outlined 57:below. If this option is specified more than once, connections matching any 58:of the specified rules are logged. You should quote the rule, as shown above. 63:Each rule is on a new line. The `#' character may be used to add comments; 75:instead of the compile-time default setting. See the 82:milliseconds, instead of the default of 1000 ms. Connections that last less 156:is used, low is assumed to be 0. It is an error to omit both 175:AND of the local address of the connection and "mask". If no mask is specified, 176:a default mask with all bits set (255.255.255.255) is used. The CIDR type netmask 177:is also possible. With IPv6 only a prefix length netmask is allowed, and the 178:length defaults to 128. Depending on the address family, these rules contain 224:Rules are evaluated from left to right. Whitespace (space, tab and newline) 225:characters are ignored between "words". Rules consisting of only whitespace 273:Tim J. Robbins <t...@robbins.dropbear.id.au> ##### Use \(en for a dash (en-dash) between space characters, not a minus (\-) or a hyphen (-), except in the NAME section. tcpspy.8:145:.BI lport " [low] - [high]" ##### Protect a period (.) or a apostrophe (') with '\&' from becoming a control character, if it could end up at the start of a line (by splitting the line into more lines). 227:Parentheses, '(' and ')' may be placed around expressions to affect the order ##### "[" and "]", showing optional arguments to options, should be typeset in roman. 145:.BI lport " [low] - [high]" 169:.BI laddr " n.n.n.n[/m.m.m.m]" 173:.BI laddr " ip6-addr[/m]" ##### --- tcpspy.8 2023-06-18 17:56:03.000000000 +0000 +++ tcpspy.8.new 2023-06-18 19:01:15.000000000 +0000 @@ -1,8 +1,8 @@ .\" This file is part of tcpspy, a TCP/IP connection monitor. .\" -.\" Copyright (c) 2000, 2001, 2002 Tim J. Robbins. +.\" Copyright (c) 2000, 2001, 2002 Tim J. Robbins. .\" All rights reserved. -.\" +.\" .\" Redistribution and use in source and binary forms, with or without .\" modification, are permitted provided that the following conditions .\" are met: @@ -13,7 +13,7 @@ .\" documentation and/or other materials provided with the distribution. .\" 3. The name of the author may not be used to endorse or promote products .\" derived from this software without specific prior written permission. -.\" +.\" .\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, .\" INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY .\" AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL @@ -31,82 +31,85 @@ tcpspy \- TCP/IP Connection Monitor .SH SYNOPSIS .B tcpspy -.RB [ "-dp" ] -.RB [ "-e" +.RB [ "\-dp" ] +.RB [ "\-e" .IR "rule" ]... -.RB [ "-f" +.RB [ "\-f" .IR "rulefile" ]... -.RB [ "-F" +.RB [ "\-F" .IR "facility" ] -.RB [ "-I" +.RB [ "\-I" .IR "interval" ] -.RB [ "-U" +.RB [ "\-U" .IR "user" ] -.RB [ "-G" +.RB [ "\-G" .IR "group" ] .SH DESCRIPTION .I tcpspy logs information about selected incoming and outgoing TCP/IP connections to -syslog. The following information is logged: username, local address and port, +syslog. +The following information is logged: username, local address and port, remote address, port, and optionally the filename of the executable. -.PP .SS "Options" .TP -.BI -e " 'rule'" -Log only connections matching the specified rule. Rule syntax is outlined -below. If this option is specified more than once, connections matching any -of the specified rules are logged. You should quote the rule, as shown above. +.BI \-e " 'rule'" +Log only connections matching the specified rule. +Rule syntax is outlined below. +If this option is specified more than once, +connections matching any of the specified rules are logged. +You should quote the rule, as shown above. .TP -.BI -f " rulefile" +.BI \-f " rulefile" Read rules from .IR rulefile . -Each rule is on a new line. The `#' character may be used to add comments; +Each rule is on a new line. +The `#' character may be used to add comments; everything from this character to the end of the line is ignored. The -.B -e +.B \-e and -.B -f +.B \-f options may be used together. .TP -.BI -F " facility" +.BI \-F " facility" Log to syslog facility .I facility instead of the compile-time default setting. See the .BR syslog.conf (5) manual page for a list of facilities. .TP -.BI -I " interval" +.BI \-I " interval" Update the internal state every .I interval -milliseconds, instead of the default of 1000 ms. Connections that last less -than +milliseconds, instead of the default of 1000 ms. +Connections that last less than .I interval milliseconds may be missed, so you should experiment to find a value small enough that it catches most connections, but not so small that it causes tcpspy to use too much CPU time. .TP -.BI -U " user" +.BI \-U " user" Switch to the specified user after startup. .I user may be a numeric user id or a user name from the system password file. .TP -.BI -G " group" +.BI \-G " group" Switch to the specified group after startup. .I group may be a numeric group id or a group name from the system group file. If a username to switch to with the -.B -U +.B \-U option is specified but -.B -G +.B \-G is omitted, tcpspy will switch to that specified user's primary group. .TP -.B -d +.B \-d Debugging mode; if this option is specified, tcpspy will not detach from the console after initialisation, and will log connections to standard output instead of syslog. .TP -.B -p +.B \-p Log the filename of the executable that created/accepted the connection. You may require superuser privileges to obtain this information for processes you do not own (this is a kernel limitation). @@ -114,10 +117,9 @@ you do not own (this is a kernel limitat This option can greatly increase the amount of CPU time required to process each connection/disconnection. -.PP .SS "Rule Syntax" A rule may be specified with the -.B -e +.B \-e option to log information about connections matching this rule, overriding the default of logging all connections. .PP @@ -132,17 +134,17 @@ user id .BI user " \N'34'username\N'34'" Same as above, but using a username instead of a user id. .TP -.BI ip +.B ip True if the connection is IPv4. .TP -.BI ip6 +.B ip6 True if the connection is IPv6. .TP .BI lport " port" True if the local end of the connection has port number .IR port . .TP -.BI lport " [low] - [high]" +.BI lport " \fR[\fPlow\fR]\fP \(en \fR[\fPhigh\fR]" True if the local end of the connection has a port number greater than or equal to .I low @@ -152,8 +154,9 @@ If the form .I low- is used, high is assumed to be 65535. If the form -.I -high -is used, low is assumed to be 0. It is an error to omit both +.I \-high +is used, low is assumed to be 0. +It is an error to omit both .IR low " and " high . .TP .BI lport " \N'34'service\N'34'" @@ -166,16 +169,20 @@ Same as .B lport but compares the port number of the remote end of the connection. .TP -.BI laddr " n.n.n.n[/m.m.m.m]" +.BI laddr " n.n.n.n\fR[\fP/m.m.m.m\fR]" .TP .BI laddr " n.n.n.n/m" .TP -.BI laddr " ip6-addr[/m]" +.BI laddr " ip6-addr\fR[\fP/m\fR]" Interpreted as a "net/mask" expression; true if "net" is equal to the bitwise -AND of the local address of the connection and "mask". If no mask is specified, -a default mask with all bits set (255.255.255.255) is used. The CIDR type netmask -is also possible. With IPv6 only a prefix length netmask is allowed, and the -length defaults to 128. Depending on the address family, these rules contain +AND of the local address of the connection and "mask". +If no mask is specified, +a default mask with all bits set (255.255.255.255) is used. +The CIDR type netmask is also possible. +With IPv6 only a prefix length netmask is allowed, +and the length defaults to 128. +Depending on the address family, +these rules contain an implicit match condition "ip" or "ip6", respectively. .TP .B raddr @@ -184,22 +191,22 @@ Same as but compares the remote address. .TP .BI exe " \N'34'pattern\N'34'" -True if the full filename (including directory) of the executable that +True if the full filename (including directory) of the executable that created/accepted the connection matches .IR pattern , a .BR glob (7)-style wildcard pattern. -The pattern "" (an empty string) matches connections created/accepted by +The pattern "" (an empty string) matches connections created/accepted by processes whose executable filename is unknown. If the -.B -p +.B \-p option is not specified, a warning message will be printed, and the result of this comparison will always be true. .PP -Expressions (including the comparisons listed above) may be joined together +Expressions (including the comparisons listed above) may be joined together with the following logical operations: .TP .IB expr1 " or " expr2 @@ -221,10 +228,12 @@ True if .I expr is false (logical NOT). .PP -Rules are evaluated from left to right. Whitespace (space, tab and newline) -characters are ignored between "words". Rules consisting of only whitespace +Rules are evaluated from left to right. +Whitespace (space, tab and newline) +characters are ignored between "words". +Rules consisting of only whitespace match no connections, but do not cause an error. -Parentheses, '(' and ')' may be placed around expressions to affect the order +Parentheses, \&'(' and \&')' may be placed around expressions to affect the order of evaluation. .PP The Examples section contains some sample rules which further demonstrate how @@ -270,7 +279,7 @@ Empty rule files cause to log no connections instead of all connections. .SH AUTHOR -Tim J. Robbins <t...@robbins.dropbear.id.au> +Tim J.\& Robbins <t...@robbins.dropbear.id.au> .SH SEE ALSO .BR glob (7), -- System Information: Debian Release: trixie/sid APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 6.1.27-1 (SMP w/2 CPU threads; PREEMPT) Kernel taint flags: TAINT_WARN Locale: LANG=is_IS.iso88591, LC_CTYPE=is_IS.iso88591 (charmap=ISO-8859-1), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: sysvinit (via /sbin/init) Versions of packages tcpspy depends on: ii libc6 2.36-9 ii lsb-base 11.6 ii sysvinit-utils [lsb-base] 3.06-4 tcpspy recommends no packages. tcpspy suggests no packages. -- no debconf information