justniffer.8

.TH JUSTNIFFER 8 "Mar 21, 2016" "" ""
.SH NAME
\fBjustniffer \fP- tcp flow sniffer
\fB
.SH SYNOPSIS
.nf
.fam C
\fBjustniffer\fP [ [\fB-i\fP \fBinterface\fP] or [\fB-f\fP <tcpdump file>] ] [\fB-p\fP <packet filter>] [\fB-u\fP or \fB-x\fP] [ \fB-r\fP or \fB-l\fP <log format> or \fB-a\fP <log format>] [\fB-c\fP <config file>]  [\fB-e\fP <external program>]  [\fB-U\fP <user> ]  [\fB-n\fP <not_found_string> ]  [\fB-d\fP <max concurrent hosts for fragmented ip> ] [\fB-s\fP <max concurrent tcp streams> ]  [\fB-F\fP]  
.fam T

\fBExamples:\fP 
  Logging network traffic in Apache like format:
      \fBjustniffer -i eth0\fP 

  Tracing tcpdump dump in Apache like format:
      \fBjustniffer -f file.cap\fP 
  
  Tracing tcp streams from the network:
      \fBjustniffer -i eth0 -r\fP 

  Logging network traffic in Apache like format appending response times:
      \fBjustniffer -i eth0 -a " %response.time"\fP 

  Logging network traffic in a customized format:
      \fBjustniffer -i eth0 -l "%source.ip%tab%dest.ip%tab%request.header.host%tab%response.time"\fP 


.fi
.SH DESCRIPTION
 \fBjustniffer\fP captures reassembles and reorders TCP packets, performs IP packet defragmentation and displays the tcp flow or part of it.
 It is useful for logging network traffic in a 'standard' (web server like) or in a customized way.
 It can log network services performances (e.g. web server response time , application server keep alive behaviour, etc.) .
 Output format can be customized using the log format option \fB-l\fP (see \fBFORMAT KEYWORDS\fP). 
 Most of them can be used for retrieving HTTP protocol informations. See \fBEXAMPLES\fP

.SH TRACKING PERFORMANCES

 The main feature of \fBjustniffer\fP is to analize network traffic to monitor performances. The perfomance related keywords are:
  %session.time
    %connection.time
    %idle.time.0
    %request.time
    %response.time
        %response.time.begin
        %response.time.end
    %idle.time.1

 +---------+                           +---------+
 |         |                           |         |
 |  Client |                           | Server  |
 |         |                           |         |
 +---------+                           +---------+
      |                                     |
      |  -----   connect syn   -------->    |----+--------------------------------------+
      |                                     |    |                                      |
      |  <------   syn/ack    --------->    |    | %connection.time                     |
      |                                     |    |                                      |
      |  -------     ack     ---------->    |    |                                      |
      |           ESTABLISHED               |----+                                      |
      |                                     |    | %idle.time.0                         |
      |                                     |    |(after connection, before             |
      |                                     |    | request)                             |
      |                                     |    |                                      |
      |  ---  request/first packet  --->    |----+--------------------------------------+
      |                                     |    |                                      |
      |                                     |    |                                      |
      |  ---  request/....          --->    |    | %request.time                        |
      |  <------     ack     -----------    |    |                                      |
      |                                     |    |                                      |
      |  ---   request/last packet  --->    |    |                                      | 
      |  <------     ack     -----------    |----+--------------------+-----------------+ %session.time
      |                                     |    |                    |                 |
      |                                     |    |                    |                 |
      |                                     |    |%reponse.time.begin |                 |
      |                                     |    |                    |                 |
      |  <--  response/first packet ----    |----+                    | reponse         |
      |  -------     ack     ---------->    |    |                    | time            |
      |                                     |    |                    |                 |
      |  <--  response/....         ----    |    |%reponse.time.end   |                 |
      |  -------     ack     ---------->    |    |                    |                 |
      |                                     |    |                    |                 |
      |  <--  response/last packet  ----    |    |                    |                 |
      |  -------     ack     ---------->    |----+--------------------+-----------------+
      |                                     |    |                                      |
      |                                     |    |                                      |
      |                                     |    | %idle.time.1 (after response,        |
      |                                     |    | before new request or close)         |
      |                                     |    |                                      |
      |  <------   close      --------->    |----+--------------------+-----------------+
      |                                     |    |
      |                                     |    |


.SH OPTIONS
\fB-i\fP or \fB--interface\fP=<\fBinterface\fP>\fBinterface\fP to listen on (e.g. eth0, en1, etc.)
.TP
Example: justniffer -i eth0
.TP
.B
\fB-f\fP or \fB--filecap\fP=<file>
tcpdump file to read from (for offline network traffic processing). It must be a pcap file (produced by network capture programs such as tcpdump or wireshark)
\fBWARNING\fP: justniffer needs a complete dump, usually, sniffers collect just the few first (96) bytes per packet. (when using tcpdump you must specify "-s 0" option. Example: tcpdump -i eth0 -s 0 -w /tmp/file.cap)
.TP
Example: justniffer -f /tmp/file.cap
.TP
.B
\fB-F\fP or \fB--force-read-pcap\fP
Force the reading of a pcap file also if captured with truncated packets (for example when using tcpdump without the "-s 0" option)
.TP
.B
\fB-p\fP or \fB--packet-filter\fP=<filter>
packet filter (pcap filter syntax) (see \fBpcap-filter\fP(7))
.TP
Examples: 

  sniffing proxy traffic
    \fBjustniffer -i eth0 -p "tcp port 8080"\fP

  sniffing row telnet traffic
    \fBjustniffer -i eth0 -r -p "tcp port 23"\fP

  sniffing row pop3 traffic
    \fBjustniffer -i eth0 -r -p "tcp port 110"\fP
    
  sniffing  traffic from/to a specific host 
    \fBjustniffer -i eth0 -r -p "host 10.10.10.2"\fP

  sniffing  HTTP traffic from/to a specific host and port 
    \fBjustniffer -i eth0 -r -p "host 10.10.10.2 and tcp port 80"\fP
.TP
.B
\fB-l\fP or \fB--log-format\fP=<format>
log format. You can specify the output string format containing reserved keyword that will be replaced with the proper value (see \fBFORMAT KEYWORDS\fP). If missing, the CLF (Common Log Format, used by 
almost all web servers) is used as default.
"%source.ip - - [%request.timestamp(%d/%b/%Y:%T %z)] \"%request.line\" %response.code %response.header.content-length \"%request.header.referer\" \"%request.header.user-agent)\""
.TP
Example: justniffer -i eth0 -l "\\"%request.line\\"%tab%response.time"

    "POST /v2/rss/alerts?src=ffbmext2.1.034 HTTP/1.1" 0.139011
    "POST /v2/rss/network/oreste.notelli?src=ffbmext2.1.034 HTTP/1.1" 0.623382
    "GET /man_page_howto.html HTTP/1.1"       0.024437
    "GET /ig?hl=en HTTP/1.1"  0.764945
    "GET /?hl=en&tab=wv HTTP/1.1"   0.242342
    "GET /s/-yCdCsgUnsI/css/homepage_c.css HTTP/1.1"        0.071942
    "GET /vi/YUvWcegtqik/default.jpg HTTP/1.1"      0.821472

.TP
.B
\fB-a\fP or \fB--append-log-format\fP=<format>
append log format. append the specified format to the default common log format (apache access_log)
.TP
Example: justniffer -i eth0 -a " %response.time"

192.168.10.102 - - [25/Jun/2009:12:02:18 +0200] "GET /nwshp?hl=en&client=firefox-a&rls=com.ubuntu:en-US:unofficial&hs=Ap6&tab=wn HTTP/1.1" 200 94077 "http://www.google.it/webhp?hl=en&safe=off&client=firefox-a&rls=com.ubuntu:en-US:unofficial&hs=Ap6&btnG=Search" "Mozilla/5.0 (X11; U; Linux i686; en-US;rv:1.9.0.11) Gecko/2009060308 Ubuntu/9.04 (jaunty) Firefox/3.0.10)" 0.712165

.TP
.B
\fB-r\fP or \fB--raw\fP
show raw stream. it is a shortcut for  -l %request%response
.TP
Example: justniffer -i eth0 -r
.TP
.B
\fB-s\fP or \fB--max-tcp-streams\fP
max concurrent tcp stream. (default= 65536) excess will be discarded
.TP
.B
\fB-d\fP or \fB--max-fragmented-ip\fP
max concurrent fragmented ip. (default= 65536) excess will be discarded
.TP
.B
\fB-x\fP or \fB--hex-encode\fP
encode unprintable characters in [<char hexcode>] format
.TP
Example: 
  justniffer -i eth0 -rx
.TP
.B
\fB-u\fP or \fB--unprintable\fP
encode as dots (.) unprintable characters ( for more control on character you should use pipilining to cat -v. 
.TP
Example: 
  justniffer -i eth0 -l "%request%newline%response"| cat -v
  justniffer -i eth0 -ru
.TP
.B
\fB-e\fP or \fB--execute\fP=<external program>
call the specified external program/shell script pipelining the standard output for each request/response phase
You can write shell script for handling, for example, HTTP traffic
.TP
Example: 
  justniffer -i eth0 -l "%request%newline%response" -e "tail -2 "

.TP
.B
\fB-n\fP or \fB--not-found\fP=<not found string>
Not found string. It is used to replace a specified keyword when it cannot be valued because it is not found.
All request.header.* and response.header.* keywords can override the "not found string" passing it as parameter.
For example: 
 %request.header.host() will be replaced by the Host header value, or an empty string if Host header not found
 %request.header.host(UNKNOWN) will be replaced by the Host header value, or the UNKNOWN string if Host header not found
 %request.header.host will be replaced by the Host header value, or , if Host header not found, with the string specified by the \fB-n\fP option 
.TP
Examples: 
  justniffer -i eth0 -l "%request.header.connection" -n N/A  

  will produce such logs:
    N/A
    N/A
    keep-alive
    close

Note: each keyword can override the "not found string" value:

  justniffer -i eth0 -l "%request.header.connection(None) %request.header.connection(-) %request.header.connection() %request.header.connection" -n N/A  

  will produce such logs:
    None -  N/A
    None -  N/A
    keep-alive keep-alive keep-alive keep-alive
    close close close close
.TP
.B
\fB-U\fP or \fB--user\fP=<user>
User to imperfonificate when executing the program specified with the \fB-e\fP option, used to avoid to security exploits when running justniffer with root privileges
.TP
Example: 
  justniffer -i eth0 -l "%request%newline%response" -e " grep password >> /tmp/passwords.txt"  -U guest
.TP
.B
\fB-c\fP or \fB--config\fP=<config file>
configuration file. You can specify options in a configuration file (command line options override file configuration options) using the following format specifications:
.PP
.nf
.fam C
       <option> = <value>

       \fBconfiguration file example\fP:
.fam T
.fi
.RS
log-format = "%request.url %request.header.host %response.code %response.time"
.PP
packet-filter = "tcp port 80 or tcp port 8080 or tcp port 3526"


.SH FORMAT KEYWORDS
List of all recognized keywords:
.RS
.TP
.B
%close.originator([not applicable string])
who closed the connection: client, server, timedout, n/a
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%close.time
elapsed time from last response and when the connection is closed
.TP
.B
%close.timestamp([format])
is replaced by the close timestamp. You can use optional format specification (see \fBTIMESTAMP FORMAT\fP) 
.TP
.B
%connection.timestamp2([not applicable string])
is replaced by the close timestamp using format "seconds.microseconds". 
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%connection
 connection persistence indicator:
    unique: the request/response is the unique in the tcp connection
    start: the request/response is the first in the tcp connection
    last : the request/response is the last in the tcp connection
    continue : the request/response is the middle in the tcp connection
.TP
.B
%connection.time([not applicable string])
elapsed time for the estabilishind the tcp connection
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%connection.timestamp([format])
is replaced by the connection timestamp. You can use optional format specification (see \fBTIMESTAMP FORMAT\fP) 
.TP
.B
%connection.timestamp2([not applicable string])
is replaced by the connection timestamp using format "seconds.microseconds"
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%idle.time.0([not applicable string])
elapsed time form when the connection is established and the request is started
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%idle.time.1([not applicable string])
elapsed time form when the last response and the next request (or the connection closing)
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%dest.ip
is replaced by the destination ip address
.TP
.B
%dest.port
is replaced by the destination tcp port
.TP
.B
%source.ip
is replaced by the source ip address
.TP
.B
%source.port
is replaced by the source tcp port
.TP
.B
%request
is replaced by the  the whole request ( (it is multiline and may contain unprintable characters)
.TP
.B
%request.timestamp([format])
is replaced by the request timestamp. You can use optional format specification (see \fBTIMESTAMP FORMAT\fP)
.TP
.B
%request.timestamp2([not applicable string])
is replaced by the request timestamp using format "seconds.microseconds"
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.size
is replaced by the request size (including request header size)
.TP
.B
%request.line
is replaced by the request line (e.g. "GET /index.html HTTP/1.1")
.TP
.B
%request.method
is replaced by the request method (e.g. GET, POST, HEAD)
.TP
.B
%request.url
is replaced by the url
.TP
.B
%request.protocol
is replaced by the protocolo (e.g. HTTP/1.0, HTTP/1.1) 
.TP
.B
%request.grep(<regular-expression>)
is replaced by the result of the specified regular expression applied on the whole request [Perl regular expression syntax, see \fBperlre\fP(1) or \fBperl\fP(1)]. The most nested subgroup is returned 
.TP
.B
%request.header
is replaced by the request header (it is multiline)
.TP
.B
%request.header.authorization([not found string])
is replaced by the request Authorization header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.host([not found string])
is replaced by the request Host header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.user-agent([not found string])
is replaced by the request User-Agent header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.accept([not found string])
is replaced by the request Accept header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.accept-language([not found string])
is replaced by the request Accept-Language header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.accept-charset([not found string])
is replaced by the request Accept-Charset header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.accept-encoding([not found string])
is replaced by the request Accept-Encoding header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.connection([not found string])
is replaced by the request Connection header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.content-encoding([not found string])
is replaced by the request Content-Encoding header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.content-language([not found string])
is replaced by the request Content-Language header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.content-length([not found string])
is replaced by the request Content-Length header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.content-md5([not found string])
is replaced by the request Content-MD5 header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.cookie([not found string])
is replaced by the request Cookie header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.range([not found string])
is replaced by the request Range header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.referer([not found string])
is replaced by the request Referer header  value
The optional "" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.keep-alive([not found string])
is replaced by the request Keep-Alive header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.via([not found string])
is replaced by the request Via header  value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%request.header.value(<header-name>)
is replaced by the request header value (e.g. "%request.header.value(Cookie)")
.TP
.B
%request.header.grep(<regular-expression>)
is replaced by the result of the specified regular expression applied on the request header [Perl regular expression syntax, see \fBperlre\fP(1) or \fBperl\fP(1)]. The most nested subgroup is returned (e.g. to obtain the request URL:  "%request.header.grep(^[^\\s]*\\s*([^\\s]*))"
.TP
.B
%response
is replaced by the while response (it is multiline and may contain unprintable characters)
.TP
.B
%response.size
is replaced by the response size (including response the header size)
.TP
.B
%response.timestamp([format])
is replaced by the response timestamp. You can use optional format specification (see \fBTIMESTAMP FORMAT\fP)
.TP
.B
%response.timestamp2([not applicable string])
is replaced by the response timestamp using format "seconds.microseconds"
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.time([not applicable string])
is replaced by the response time (difference from the request time and the time the response finish)
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.time.begin([not applicable string])
elapsed time form when the request and the response start
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.time.end([not applicable string])
elapsed time form the response start and the response end
the  "not applicable" string is replaced in case the keyword value cannot be applicable. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.line
is replaced by the reponse line
.TP
.B
%response.protocol
is replaced by the reponse protocol
.TP
.B
%response.code
is replaced by the response code (e.g. 200, 404, 500, etc.)
.TP
.B
%response.message
is replaced by response message (e.g. OK, Not Found, Internal Server Error, etc.)
.TP
.B
%response.grep(<regular-expression>)
is replaced by the result of the specified regular expression applied on the whole response [Perl regular expression syntax, see \fBperlre\fP(1) or \fBperl\fP(1)]. The most nested subgroup is returned 
.TP
.B
%response.header
is replaced by the response header (it is multiline)
.TP
.B
%response.header.accept-ranges([not found string])
is replaced by the response Accept-Ranges header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.allow([not found string])
is replaced by the response Allow header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.server([not found string])
is replaced by the response Server header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.date([not found string])
is replaced by the response Date header value 
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.content-language([not found string])
is replaced by the respone Content-Language header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.content-length([not found string])
is replaced by the respone Content-Lenght header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.content-md5([not found string])
is replaced by the respone Content-MD5 header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.content-type([not found string])
is replaced by the response Content-Type header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.content-encoding([not found string])
is replaced by the response Content-Encoding header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.content-language([not found string])
is replaced by the response Content-Language header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.transfer-encoding([not found string])
is replaced by the response Transfer-Encoding header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B

%response.header.expires([not found string])
is replaced by the response Expires header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.etag([not found string])
is replaced by the response ETag header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.cache-control([not found string])
is replaced by the response Cache-Control header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.last-modified([not found string])
is replaced by the response Last-Modified header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.pragma([not found string])
is replaced by the response Pragma header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.age([not found string])
is replaced by the response Age header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.connection([not found string])
is replaced by the response Connection header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.keep-alive([not found string])
is replaced by the response Keep-Alive header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.via([not found string])
is replaced by the response Via header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.vary([not found string])
is replaced by the response Vary header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.www-authenticate([not found string])
is replaced by the response WWW-Authenticate header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.set-cookie([not found string])
is replaced by the response Set-Cookie header value
The optional "not found" string is replaced in case the keyword value was not found. 
if not provided the -n value or the default value "-" is used 
.TP
.B
%response.header.value(<header-name>)
is replaced by the response header value (e.g. "%request.header.value(Set-Cookie)")
.TP
.B
%response.header.grep(<regular-expression>)
is replaced by the result of the specified regular expression applied on the response header [Perl regular expression syntax, see \fBperlre\fP(1) or \fBperl\fP(1)]. The most nested subgroup is returned (e.g. to obtain the request URL:  "%request.header.grep(^[^\\s]*\\s*([^\\s]*))"
.TP
.B
%session.requests
is replaced by TCP session request sequence number, since the TCP session started.
.TP
.B
%session.time
is replaced by the TCP session lifespan
.TP
.B
%tab
is replaced by a tab
.TP
.B
%streams
is replaced by the number of currently opened tcp streams
.TP
.B
%-
break (used for breaking keywords). For example, if you want to obtaine output like this:

"0.234342		seconds"

you must use the break keyword (\fB%-\fP) to mark the %tab keyword end: 

 "%response.time%tab%-seconds" 
.TP
.B
%%
is replaced by the '%' character
.TP
.B
%newline
is replaced by a newline
.SH TIMESTAMP FORMAT
Timestamp format keywords (see \fBstrftime\fP(3) ) :
.RS
.TP
.B
%A
is replaced by national representation of the full weekday name.
.TP
.B
%a
is replaced by national representation of the abbreviated weekday
name.
.TP
.B
%B
is replaced by national representation of the full month name.
.TP
.B
%b
is replaced by national representation of the abbreviated month
name.
.TP
.B
%C
is replaced by (year / 100) as decimal number; single digits are
preceded by a zero.
.TP
.B
%c
is replaced by national representation of time and date.
.TP
.B
%D
is equivalent to ``%m/%d/%y''.
.TP
.B
%d
is replaced by the day of the month as a decimal number (01-31).
.TP
.B
%E* %O*
POSIX locale extensions.  The sequences %Ec %EC %Ex %EX %Ey %EY %Od
%Oe %OH %OI %Om %OM %OS %Ou %OU %OV %Ow %OW %Oy are supposed to
provide alternate representations.
.RS
.PP
Additionly %OB implemented to represent alternative months names
(used standalone, without day mentioned).
.RE
.TP
.B
%e
is replaced by the day of month as a decimal number (1-31); single
digits are preceded by a blank.
.TP
.B
%F
is equivalent to ``%Y-%m-%d''.
.TP
.B
%G
is replaced by a year as a decimal number with century.  This year
is the one that contains the greater part of the week (Monday as
the first day of the week).
.TP
.B
%g
is replaced by the same year as in ``%G'', but as a decimal number
without century (00-99).
.TP
.B
%H
is replaced by the hour (24-hour clock) as a decimal number
(00-23).
.TP
.B
%h
the same as %b.
.TP
.B
%I
is replaced by the hour (12-hour clock) as a decimal number
(01-12).
.TP
.B
%j
is replaced by the day of the year as a decimal number (001-366).
.TP
.B
%k
is replaced by the hour (24-hour clock) as a decimal number (0-23);
single digits are preceded by a blank.
.TP
.B
%l
is replaced by the hour (12-hour clock) as a decimal number (1-12);
single digits are preceded by a blank.
.TP
.B
%M
is replaced by the minute as a decimal number (00-59).
.TP
.B
%m
is replaced by the month as a decimal number (01-12).
.TP
.B
%n
is replaced by a newline.
.TP
.B
%O*
the same as %E*.
.TP
.B
%p
is replaced by national representation of either "ante meridiem" or
"post meridiem" as appropriate.
.TP
.B
%R
is equivalent to ``%H:%M''.
.TP
.B
%r
is equivalent to ``%I:%M:%S %p''.
.TP
.B
%S
is replaced by the second as a decimal number (00-60).
.TP
.B
%s
is replaced by the number of seconds since the Epoch, UTC (see
\fBmktime\fP(3)).
.TP
.B
%T
is equivalent to ``%H:%M:%S''.
.TP
.B
%t
is replaced by a tab.
.TP
.B
%U
is replaced by the week number of the year (Sunday as the first day
of the week) as a decimal number (00-53).
.TP
.B
%u
is replaced by the weekday (Monday as the first day of the week) as
a decimal number (1-7).
.TP
.B
%V
is replaced by the week number of the year (Monday as the first day
.RS
.TP
.B
of the week) as a decimal number (01-53).
If the week containing
January 1 has four or more days in the new year, then it is week 1;
otherwise it is the last week of the previous year, and the next
week is week 1.
.RE
.TP
.B
%v
is equivalent to ``%e-%b-%Y''.
.TP
.B
%W
is replaced by the week number of the year (Monday as the first day
of the week) as a decimal number (00-53).
.TP
.B
%w
is replaced by the weekday (Sunday as the first day of the week) as
a decimal number (0-6).
.TP
.B
%X
is replaced by national representation of the time.
.TP
.B
%x
is replaced by national representation of the date.
.TP
.B
%Y
is replaced by the year with century as a decimal number.
.TP
.B
%y
is replaced by the year without century as a decimal number
(00-99).
.TP
.B
%Z
is replaced by the time zone name.
.TP
.B
%z
is replaced by the time zone offset from UTC; a leading plus sign
stands for east of UTC, a minus sign for west of UTC, hours and
minutes follow with two digits each and no delimiter between them
(common form for RFC 822 date headers).
.TP
.B
%+
is replaced by national representation of the date and time (the
format is similar to that produced by \fBdate\fP(1)).
.TP
.B
%%
is replaced by `%'.
.SH EXAMPLES
Some examples:
.RS
.IP \(bu 3
sudo justsfniffer \fB-i\fP eth0 > /tmp/test.log
.IP \(bu 3
sudo justsfniffer \fB-i\fP eth0 \fB-l\fP "%request.timestamp(%T %D) - %request.header.host - %response.code - %response.time"
> /tmp/test.log
.IP \(bu 3
sudo justniffer \fB-i\fP eth0 \fB-c\fP config
.IP \(bu 3
justniffer \fB-f\fP ./test.cap 
.SH AUTHOR
Oreste Notelli <oreste.notelli@plecno.com>
.SH COPYRIGHT
Copyright (c) 2007-2016 Plecno s.r.l.