Background

Many people think of the OSI seven-layer model. For TCP/IP, it is probably more useful to focus on four layers as described in TABLE C-1:

Table C-1. TCP/IP Protocol Suite Layers

OSI Layer	Description
Application Layer (SMTP, TELNET, LDAP)	Application layer protocols such as TELNET and LDAP, use a transport layer (TCP) to send their protocol messages as streams of bytes from one host to another.
Transport Layer (TCP & UDP)	Applications use the transport layer via an API such as sockets. TCP is a connection-orientated transport layer and provides applications a way of sending arbitrary streams of data to each other. UDP Port numbers allows one machine to send datagrams to another machine over IP.
Network Layer (IP, IPX, and so on)	The network layer sends packets of information from one host to another. The packets are often sent via a number of hops across data-link layers. This layer is also responsible for fragmentation, (the splitting of packets into smaller fragments that will fit into a data-link frame) and routing (deciding what the next hop is for any particular packet).
Data Link Layer (Ethernet, Token Ring, FDDI)	The data-link layer transfers frames from the host to another directly connected host.

Each layer has a specific purpose independent of the others, yet each layer talks to the next layer. Data starts at the application layer, works its way down the stack to the data-link layer, and is then sent to the other system. The other system's data-link layer receives the frame, then sends it up the stack.

The snoop utility in the Solaris OE provides you with the ability to debug problems on a network by capturing packets from the network and displaying their contents. snoop uses both the network packet filter and streams buffer modules to provide efficient capture of packets from the network.

Note

The Solaris 8 and 9 OE snoop utility has been enhanced with new options to facilitate both IPv4 and IPv6 protocols.

Having this functionality is very useful in diagnosing and debugging problems. snoop has many features, including the ability to let you to filter Ethernet packets for specific information contained within a specific packet. Using several commandline options, it is possible to use snoop in such a way that you can view specific portions of Ethernet packets as they pass along your network.

If you do not know, or are unsure if you are running the Solaris 8 7/01 OE or above, a recommended approach to finding this out, is to enter the following command:

 $  cat /etc/release  

Running this command shows you the installed version of the Solaris OE. If you are running the Solaris 8 7/01 OE, you will see something similar to the following output:

Solaris 8 Maintenance 7/01 applied

The reason for bringing this to your attention is the fact that there is no visible LDAP specific characteristics to this version of snoop . In addition, no other documentation, apart from a minor change to the snoop (1M) man page exists for this enhanced functionality. In general, the ldap module is just one of several other protocol decoders for snoop .