.TH DRIFTNET 1
.\"
.\" driftnet.1.in:
.\" Manual page for driftnet.
.\"
.\" Copyright (c) 2002 Chris Lightfoot.
.\" Email: chris@ex-parrot.com; WWW: http://www.ex-parrot.com/~chris/
.\"
.\" $Id: driftnet.1.in,v 1.7 2004/04/26 14:42:36 chris Exp $
.\"

.SH NAME
driftnet - capture images from network traffic and display them in an X window;
optionally, capture audio streams and play them.

.SH SYNOPSIS
\fBdriftnet\fP [\fIoptions\fP] [\fIfilter code\fP]

.SH DESCRIPTION
\fBDriftnet\fP watches network traffic, and picks out and displays JPEG and GIF
images for display. It is an horrific invasion of privacy and shouldn't be
used by anyone anywhere. It has been described as `a graphical
.BR tcpdump (8)',
`\fIEtherPeg\fP for Unix', and called all sorts of nasty names by people on
\fIFreshmeat\fP. It is also possible to use \fBdriftnet\fP to capture MPEG
audio data from the network and play it through a player such as
.BR mpg123 (1).

Images may be saved by clicking on them.

.SH OPTIONS

.TP
\fB-h\fP
Print a summary of usage.
.TP
\fB-v\fP
Print additional details of packets captured to the terminal.
.TP
\fB-b\fP
Beep when a new image is displayed.
.TP
\fB-i\fP \fIinterface\fP
Listen to packets on \fIinterface\fP. By default, \fBdriftnet\fP will try to
pick up traffic on all interfaces, but this does not work with all versions of
.BR pcap (3);
on such systems, an interface must be specified. On some systems, \fBdriftnet\fP
can only use promiscuous mode if an interface is specified.
.TP
\fB-f\fP \fIfile\fP
Instead of listening on an interface, read captured packets from a
.BR pcap (3);
dump \fIfile\fP; \fIfile\fP can be a named pipe for use with Kismet or similar.
.TP
\fB-p\fP
Do not put the interface into promiscuous mode.
.TP
\fB-a\fP
Operate in `adjunct mode', where \fBdriftnet\fP gathers images for use by
another program, such as Jamie Zawinski's \fBwebcollage\fP. In this mode, no
window is displayed; images are captured and saved in a temporary directory,
and their names written on standard output.
.TP
\fB-m\fP \fInumber\fP
In adjunct mode, silently drop images if there are more than \fInumber\fP in
the temporary directory. It is assumed that another process will delete images
which it has processed.
.TP
\fB-x\fP \fIprefix\fP
The filename prefix to use when saving images, by default `driftnet-'.
.TP
\fB-d\fP \fIdirectory\fP
Use \fIdirectory\fP to store temporary files. \fBDriftnet\fP will clear this
directory of its own temporary files on exit, but will not delete the directory
or any other files.
.TP
\fB-s\fP
Attempt to capture streamed audio data from the network, and either play it
or, in adjunct mode, save it in files. At present this only works with MPEG
data.
.TP
\fB-S\fP
Capture streamed audio data only, ignoring images.
.TP
\fB-M\fP \fIcommand\fP
Use the named \fIcommand\fP to play MPEG audio data. The \fIcommand\fP, which
is executed using the shell, should accept MPEG frames on standard input.
The default is `mpg123 -'.
.TP
\fB-Z\fP \fIusername\fP
Drop privileges to user \fIusername\fP after starting pcap.
.TP
\fB-l\fP
List the system capture interfaces.
.TP
\fB-r\fP
Put the interface in monitor mode (not supported on all interfaces).
.TP
\fB-g\fP
Enable GTK display (this is the default).
.TP
\fB-w\fP
Enable the HTTP server to display images.
.TP
\fB-W\fP
Port number for the HTTP server (implies -w). Default: 9090.
.TP
\fIfilter code\fP
Additional filter code to restrict the packets captured, in the libpcap
syntax. User filter code is evaluated as `tcp and (\fIfilter code\fP)'.

.SH SEE ALSO
.BR tcpdump (8),
.BR pcap (3),
.BR webcollage (1),
.BR mpg123 (1),
.br
.IR http://www.etherpeg.org/ ,
.br
.IR http://freshmeat.net/projects/driftnet/ ,
.br
.IR http://www.ex-parrot.com/~chris/driftnet/ .

.SH AUTHOR
Chris Lightfoot <chris@ex-parrot.com>
.br
David Suárez <david.sephirot@gmail.com>

.SH 1.3.0
\fBDriftnet\fP, version 1.3.0.
.br
$Id: driftnet.1.in,v 1.7 2004/04/26 14:42:36 chris Exp $

.SH COPYING
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.