ELF 4l4 (444@g@g@g@@$i$$/usr/libexec/ld-elf.so.1FreeBSD+CDA@"3 :&/)=2?;%<6+(5B#8.'7> C1  !,-0$9*4ȋu؋,},3 Y*$3( A8HX& hfNxUd$k}Ȍ،%_E(C8-HX R @ hzxKsXȍE؍h :Q  (X 8Z(HjX "h>)Q ?x *hK)/P 6HfȎlibpcap.so.2pcap_closestrcpypcap_dump_DYNAMICpcap_datalinkpcap_compilememcpypcap_open_livemallocpcap_open_offlinepcap_versionpcap_dump_close_initpcap_nextcallocfprintf__deregister_frame_infopcap_dump_openstrncpy__sFsscanffopenfclosepcap_setfilter_finipcap_geterrfwrite_GLOBAL_OFFSET_TABLE_pcap_filenoatoi__register_frame_infofreelibc.so.4waitpidpausegetenverrnogetpidqsortfgetsexecloptargselectfflushbzeroalarmenvironkillstrcatoptind__prognamesignalforkstrdupgetoptlocaltimegethostnamesprintfatexitstrchrstrpbrk_edata__bss_start_end $)     $(,048<@DHLPTX\ `!d&h'l(p*t+x,|-/012356789=>?@BC?*C5%%h%h%h%h%h % h(%h0%h8p%h@`%hHP% hP@%$hX0%(h` %,hh%0hp%4hx%8h%<h%@h%Dh%Hh%Lh%Ph%Thp%Xh`%\hP%`h@%dh0%hh %lh%ph%th%xh%|h%h%h%h %h(%h0%h8p%h@`%hHP%hP@%hX0%h` %hh%hp%hx%h%hU WVSҍu^|=~5}t/E@8t"&'8/u H @@8u$t Rh AWVSPU=HuL DD@СD8ut h ?pH]ÐU]ÍUthh o]Ít&'U]ÍULWVSuDžDžDžF3ha)tohnƒu`aѸ)PRShsS haSS) U RV"=u:=u1)ƅ~M 40=u 1 1=LRÅjtjVvhܜjhܜj hܜjjS)‰P=0tjPVjSQޡLt jPS1 =j_tjPx PR@¡tj t0P¡t 8u15hh_j=tb/5=p1;5 x4ht4$hhhhhhhhphh`hhPh h@hh0hh h%hQh5F;5=u!hj hj jh@B1tUPt0u8hHhz5h`hb juzhSDž1;5}D߉t4LÉك ;~F;5|Džu j}=L=jP+;|x=tR5PR5Rz u:Q5jh@B10 j=;uEp jjjpPS:Dž p;t4Ãt4 t;|]St4u=Cvu { { Ë At9s=pAPh%uh uhh11 ;us:PhGuh1F;urǃh9Ev5tQMEPuPR=tfCfCC =t[9|LfCfC9|6C CtfAAfA C <t<t<u =ufCfC=ptVCSPCSPC PCPCPCPCPCPCPC PC PhG0PRSQ]S" .=!;  DžPu=؉˅taC  uN{ u T XDžCSЀ<uCSЀ<t Džu:ƍ{ tƍ{u Džt4t9}#SEPR=xm1;5}#tt PoF;5|=tQjƒ=tR5S R5PR 0t%j Pt@jPPP[^_US]Lh(jS, =pSh`h]S Sq2rrr B@PBlPhh05hh|5h hd]ÍvUELjPsÐU\WVS]SCƒs {sZC ECECfECfE} tM EAfEAEA fEEUEEXCEC ECfECfE} tM AEA fEEAfEUEEEEEԊC E=\t$uE؃}uUE܈U =`tEPEPV]SMQ"* uj EPVSEP*YvU=u B;Eu?EUEBUEBUEB =\tUE܉BUEB1e[^_UWVSE(} tEA} t/=uhCE P hFU RE}u#M Qh`h(vuV+{E550nu'55pNЉU}MQjjPuVjj3 Vjj PyVjj Pi VjjPVVjjGPH VjjW:VjjG P, VjjGEPjj3 URjjP MQjj PuVjjP Vjj PVjjW VjjGPVjjGP VjjG P=\tS}tG)MG)‰UGEGEuVjjEP5VjjEP' EP*Ã} t UR1e[^_ÍvUWVS]Džd(} tGA} t3=uhE PhU Rddu!M Qh`h7S)\jPX uhhj9S(Dž`\9`},S(`XA`\9|ԃ=\th0j\RXQhtj\PXR~=ltjPlP1T=tuhdQDž``Xh=hthdQ=lt^=ht)TulPhdP'vTulPhdRk=dtch@P@P@PPhuV- h@P@P@P@Phah@P@P@PPh!uV h@P@P@P@Ph!]S hAQ A Q <q DžP55hP u855h@P ЉPP=htSWVMQEPh@vSWVMQEPhtdR hy=ht ww 7whdPww 7w~=htWSVMQEPhWSVMQEPhtdR) hy=htw ww7h dPw ww7hdR =\wh )Ӊ)؍)Ƹ)‰L))øLL)))L=htVSLPQh`VSLPQhdR wh )Ӊ)؍)Ƹ)‰L))øLL)))L=htVSLPQhVSLPQhdRV =hudRhdQ`\9`dRj} tdQrXtXP'18[^_ÉUh`5h( hh h h` hh h jDj`h` hh h@hv hfh Y h`Ih< h,h@ hh h h` hh h`h hh  h`~hq h ah`T hDh7 h@'h h h; h`h hÉUWVSuEC<:t<,tuEV,stEP* PEP}:}ue[^_US]wK=Pu9jhPuhhDjP]ÉUSE] =wdu+P@=TuDjhFT.vu/P@=XujhXT]ÍvUu uuhh{jÉUVS]SƋ[Q)F+FV)‹)Ѝȍe[^ÉUSEU HZQC9| QC9} v91[UWVEU 0: 1t ^_ÐUE w$4 1U,WVS]߰QE߰Qƃ ߰QEU t PE K;t:u@AuP?U uEeSUR7]E}UUEE߃j:WÃtCURVhhWu.EPURV-EPEPUR EPVhxWu\UREPVURK }1 ~ EuEE EEURVhW uMhhhhqE U PEPURV'E EEU E EU E EU|EPVw URhU=ptnhq1FU 4Ph"J U tPh(( GE;8|he[^_US]M 1U9}v;|;\  9|1[UWVS} ]EPEPEPSh.uT1ɉ9} ‰A~ Uue[^_ÐU$SM1ҍ]%B~uuuuh.hW]ÐU WVS} uƃ>uEwvCBh:PzƒuPQ‰vBCBh:P1ƒu܋Ee[^_ÍvUVSu] 99$|vjhrh~h hh h@Bhjhhrh~hhh h@Bhpl`]5A5)%h5u%5hh-jsv(Ph$55 5b5Fm5*Q555 5P1 lh5fCDhh5Xx\iY5u4.5u5vhhhhh5a hhh(5>sv5VPh@Tj0d$5 jh@SV<e[^ÍvUU1 t t t t=uUS]C;tPu؋]US]C;tPt؋]U WVS] }uƉ73>tTVƉ7>t?FV^эtNPuFe[^_UVSMu 9t0vAFC<wB<w8%t9uӅt1v8|[^ÍvUVS]1Shd}tue[^UWVSE1۾Aǹt$hsPƃuvPPR98#dPhvufp1hrh~hEhh3 h@Bhh|upÃhu<`vhu@Hvhyunhu#hh_j\Ph$5;5huvhuHPvhthguh1uvhuvhuXvhuh vhQulvhuhu.XC|Dmhu"hh23heu\vh -uvhuHvhu.hhhhh#@h%uu.hhh(h3-uvhBu6pPh@j8hLudHvhTyuXh^Iuvhou2| JhzuF4|%@v1t-hhhhn VhWƒWt V[^_ÍvUhhxuPtt P[UWVS1;Wh55x4¡tt u%hWx4h1jvPHP¡ jj5Vt4$ }!t4*Ph Vt4}!t4Ph C;[^_ÐUSPtPPTtPTXtPX\`dp=xtW1;}.xtP{xC;|ӡxtPQxttP2t|tP|tPtPtPftPGtP(tP tP``@B]UVSuj,jÃu1sjV‰SCCCC(C$E CC uS1ۃCuC =u؍e[^U$S]uu C1 EUm]}fUf fUm]EmÐU WVSu]SE PV‹Fu1v9Xu0} t @u1e[^_UVSu] s3V8V9uCSCtPtBFt*9^$uCF$9^(uCF(SCtPtBCt Pt P{Soe[^ÉUVS]uuu u…tBB 1e[^ÍvUS]uu St PS]ÐU WVSEPU RMQ EUBMÍvE9C3} uzC ;Et)tsw}tURj}t}uCC MK QEPsSURދ^_Mq jUÃEPjE URj2CMKEC CCQU R3V MQEPs@UBMu#vMyt ^svMSZE@t#p(t^sCUZ(z$uZ$1e[^_ÉUE@$ÐUS]M CtHtD;K(t?;K$uAC$@vQABQABC(HC(AAK([ÐUVSUBZ~2J9uBpr9}<tJ;J} Bv1B[^ÍvUWVSUru1WFuKBHJȋZ9} J<uBxz9}<tJ;Ju B BB[^_UEÉU WVS}tWu Wm1;G}R@Et;sCt Pt PSuƋEW;G|RbWYe[^_ÐUWVS}E11tM1ҋG9}DOMEvMtCEBt E@uEEtu;U|ȃwh@Sh EPhVhؾe[^_U WVS} E1ۍG9}ƉE41E9|9uE)9}Mڃ u23 C9|ue[^_ÍvUWVSE 11ۉuvE؉‹My}}0)ЊC~F~11    ҉F=~[^_U WVSMUE  U U EUA<< A<A<[^_ÍvUu1҉EUm ÐUS=tt&'Ѓ;u[] U]ÍKipaudit.confHOME/ERROR: Cannot open read file %s. Interface (%s) DLT_EN10MBDataLinkType = %s DLT_IEEE802DLT_SLIPDLT_SLIP_BSDOSDLT_PPPDLT_PPP_BSDOSDLT_FDDIDLT_NULLDLT_RAWDLT_ATM_RFC1483DataLinkType = %d ERROR: Cannot open raw packet file <%s> IP Packet Count %d Raw Packet Length %d Captured Length %d Captured bytes ... %03d %03d.%03d.%03d.%03d %03d.%03d.%03d.%03d %3d %5d %5d ܓ`    t ̓  ipaudit received signal number <%i> date is <%04d-%02d-%02d-%02d:%02d:%02d> number of packets read <%d> number of ip packets read <%d> -wbabERROR: Cannot open output file <%s> wtatERROR: Cannot allocate memory for connection index #Time: %d INSERT INTO ipaudit SET unknownprobename='%s',%s %u.%u.%u.%u%03u.%03u.%03u.%03uip2='%s',ip1='%s',protocol=%u,ipport2=%u,ipport1=%u%s %s %u %u %u,ip2bytes=%d,ip1bytes=%d,ip2pkts=%d,ip1pkts=%d %d %d %d %dip1='%s',ip2='%s',protocol=%u,ip1port=%u,ip2port=%u,ip1bytes=%d,ip2bytes=%d,ip1pkts=%d,ip2pkts=%d,constart='%02d:%02d:%02d',constartmsec=%04d %02d:%02d:%02d.%04d,constop='%02d:%02d:%02d',constopmsec=%04d %1d %1d%02x%02x%02x%02x%02x%02x,eth2='%s',eth1='%s' %s %s,eth1='%s',eth2='%s'; Usage: ipaudit [OPTIONS] [interface[:interface[:interface..]]] Read and record info on ip connections and optionally dump packets to file -r readfile - Read packets from pcap format file Don't need interface with this option -w writefile - Dump selected packets to pcap format file -i pidfile - Write process id to file -l ip-range - Order output ip address pairs by ip range -s nlen - Dump first bytes of each packet (default %d, min %d) -x program - Run program when done -c npacket - Only read in specific number of ip packets -e - Write out ethernet addresses -t - Write out connection start and stop times -o outfile - Place output in 'outfile'. Default is stdout -p string - Dump only selected ip protocols and ports string format -p n:n:n,p,p:n where n is protocol number and p is port number (only for protocols 6 (tcp) and 17 (udp) -v - Print version and exit. -g config - Read config file (instead of default -G - Do not read config file -b - Write output in binary format (experimental) -f filterstr - Use pcap filters (see tcpdump) -C - Preserve ICMP type/code in source port field -F period - Forking mode. -H - Store hosts only (protocol, ports set to zero) -I ipaddr - Dump all packets with 'ipaddr' -L hostportlimit,hostlimit - Max number of hostport,host packets recorded -N nhashslot - Number of hash slots -S - Print ip addresses in short format (no leading 0s) -M - Allow double logging of packets which pass between multiple interfaces -m - Don't put the interface into promiscuous mode. -q - Output in SQL format for direct database input -P - Display hostname as part of output -W dumplimit - Limit to number of packets written with -w command -D period - Standalone mode, append results to output stream dumps data approx. each period seconds Example: ipaudit -w dump.fil -p1:2:6,21,23 eth0 Write only packets with protocols 1 (icmp), 2 (?), and 6 (tcp) and tcp ports 21 and 23 (ftp,telnet) ERROR: Out of memory ERROR: Out of memory. %[0-9.]-%[0-9.]%[0-9.]/%[0-9]%[0-9.].%[0-9].ERROR: Cannot read network range argument (-l option). Program continues with using default network range. IP Range %15s %15s %d.%d.%d.%d :CGF:HI:L:MN:SW:abc:dei:f:g:l:mo:p:Pqr:s:tx:w:v:D:Mar 25 2003ipaudit 0.95%s (compiled %s) libpcap version %s Default number of hash slots = %d ERROR: Cannot open pidfile_m '%s' %d %d,%dERROR: Number of hash slots (-N%d) must be one or greater ̳Ķȴ P|ȷ 0ԴTԵd$tسHyestrueonokrtdebugstrictethernetfilterpidfileprogfilereadfilewritefilesavefilecountoutfilepromiscsqlprobenamesaveportpacketlenlocalrangewritetimeicmptypehostonlyhostiphostportlimitallowduplicatehashslotsshortipinterfacewritepacketlimitdumpperiodforkipaudit: Error reading ipaudit config file. Unrecognized option: "%s"Do you need root?ipaudit: Trouble opening <%s>, msg="%s" (%s) compile: %ssetfilter: %sNumber of hash table slots %d Number of hash table slots used %d Number of elements stored in table %d Longest linked list %d @``@BO#D?g"XE [1Z:pH]V%'@ 3Bbm*>sv^{zN^n~Όތ.>N^n~΍ލ.>N^n~ΎGCC: (GNU) c 2.95.4 20020320 [FreeBSD]GCC: (GNU) c 2.95.4 20020320 [FreeBSD]GCC: (GNU) c 2.95.4 20020320 [FreeBSD]GCC: (GNU) c 2.95.4 20020320 [FreeBSD]GCC: (GNU) c 2.95.4 20020320 [FreeBSD]01.0101.0101.0101.0101.01.symtab.strtab.shstrtab.interp.note.ABI-tag.hash.dynsym.dynstr.rel.bss.rel.plt.init.text.fini.rodata.data.eh_frame.dynamic.ctors.dtors.got.comment.note#1(($7 LL@?VG  (P    Y T 0_@@e  Ok@@O s@@g y  i$$iiiiKj` jkdkp 6 $~(L    @ @ $ p D -H 9p O bЏ mw  L          X    $ $ȋ+̭b 7؋,? H,N \8 gĮ, v3}}  Y 8, p $(  e 8dp H X& hf%z 0K 7x>|2 J(w QW ]l t${x Ȟ  t      Ȍ ،t'  %Q 1( B N<e Wl ag|l s }%_| TC E (C  8-HXd   " . O 9 F U\X dT p@ {  dM hz, xKܜ     s X! , 5ȍ;G0D O؍hV:` m   r\ : P Q(u d, ( /   (X8Z HjL m  X $h / 9 C[ Q` \ h rhy   x  h   L  X \T )  " .b ;B U kx zHȎcrtstuff.cgcc2_compiled.p.3__DTOR_LIST__completed.4__do_global_dtors_aux__EH_FRAME_BEGIN__fini_dummyobject.11frame_dummyinit_dummyforce_to_data__CTOR_LIST____do_global_ctors_aux__CTOR_END____DTOR_END____FRAME_END__ipaudit.cbuffer.60hash.crseq_mf.9f.58pcap_closemrandstrcpyget_pkttimewaitpidnippkt_mpausedump_period_min_iprangeparse_ip_rangeprintfadd_portoutputbin_mpcap_dumpfiltercmd_mfind_nonspacedebug_m_DYNAMICgetenverrnopcap_datalinkuselimit_mstrcmpipcap_compileht_getnextgetpidr0_mqsortfgetsPrintUsageip2strmemcpywritepkttxtstr2ipexeclsplitpcap_open_liveht_freemallocht_debuginfowritepktbinoptarght_storekeypcap_open_offlinepcapfile_mr3_mallow_duplicate_mpcap_versionstandalone_mihandlernpkt_mselectfflushcmpipget_two_tokht_initwalkget_packetoffsetread_configmakehashprobenamebzerois_true_strniplist_mpcap_dump_close_initalarmpcapfiletype_mopen_interfacepcap_nextnconn_mcallocht_getoldestenvironfprintfkillstrcatprintshort_m__deregister_frame_infoendnpcapfile_mht_gethashpcapoffset_mis_rseq_init_moptindht_inittcp_ports_m__progname_starthostonly_mht_findkeysignalparse_portstrpcap_dump_openstrncpyparent_ihandlerhostportlimit_museicmptype_mndump_limit_m__sFforksscanfmaxpkt_mstrdupreadfile_miplist_mfopen__bss_startcmptimegetoptlocaltimenhashslots_mmainwrite_time_malloc_errprots_mfclosetimefoldkeyfind_spaceis_spaceht_freekeypcap_setfilter_finigethostnamesprintfprogfile_matexitisig_mread_optionsr1_mpcap_geterrdbf_outputpidfile_mpromisc_mht_makenewestprinteth_mhostlimit_moutfile_mfwrite_edatawritefile_mset_defaults_GLOBAL_OFFSET_TABLE__endpcap_filenonlen_mexitht_getcountr2_mread_interface_strstorepktudp_ports_mht_findelematoiip_mfork_mht_freeelemadd_protocolstrchrinit_rand_sequence__register_frame_infopcapfilename_mstrpbrkfree