|
0
|
1 .\" Copyright (c) 2008 by Rhyolite Software, LLC |
|
|
2 .\" |
|
|
3 .\" This agreement is not applicable to any entity which sells anti-spam |
|
|
4 .\" solutions to others or provides an anti-spam solution as part of a |
|
|
5 .\" security solution sold to other entities, or to a private network |
|
|
6 .\" which employs the DCC or uses data provided by operation of the DCC |
|
|
7 .\" but does not provide corresponding data to other users. |
|
|
8 .\" |
|
|
9 .\" Permission to use, copy, modify, and distribute this software without |
|
|
10 .\" changes for any purpose with or without fee is hereby granted, provided |
|
|
11 .\" that the above copyright notice and this permission notice appear in all |
|
|
12 .\" copies and any distributed versions or copies are either unchanged |
|
|
13 .\" or not called anything similar to "DCC" or "Distributed Checksum |
|
|
14 .\" Clearinghouse". |
|
|
15 .\" |
|
|
16 .\" Parties not eligible to receive a license under this agreement can |
|
|
17 .\" obtain a commercial license to use DCC by contacting Rhyolite Software |
|
|
18 .\" at sales@rhyolite.com. |
|
|
19 .\" |
|
|
20 .\" A commercial license would be for Distributed Checksum and Reputation |
|
|
21 .\" Clearinghouse software. That software includes additional features. This |
|
|
22 .\" free license for Distributed ChecksumClearinghouse Software does not in any |
|
|
23 .\" way grant permision to use Distributed Checksum and Reputation Clearinghouse |
|
|
24 .\" software |
|
|
25 .\" |
|
|
26 .\" THE SOFTWARE IS PROVIDED "AS IS" AND RHYOLITE SOFTWARE, LLC DISCLAIMS ALL |
|
|
27 .\" WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES |
|
|
28 .\" OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL RHYOLITE SOFTWARE, LLC |
|
|
29 .\" BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES |
|
|
30 .\" OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, |
|
|
31 .\" WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, |
|
|
32 .\" ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS |
|
|
33 .\" SOFTWARE. |
|
|
34 .\" |
|
|
35 .\" Rhyolite Software DCC 1.3.103-1.39 $Revision$ |
|
|
36 .\" |
|
|
37 .Dd February 26, 2009 |
|
|
38 .ds volume-ds-DCC Distributed Checksum Clearinghouse |
|
|
39 .Dt dblist 8 DCC |
|
|
40 .Os " " |
|
|
41 .Sh NAME |
|
|
42 .Nm dblist |
|
|
43 .Nd Database List Distributed Checksum Clearinghouse |
|
|
44 .Sh SYNOPSIS |
|
|
45 .Nm dblist |
|
|
46 .Op Fl vVHD |
|
|
47 .Op Fl G Ar on | off |
|
|
48 .Op Fl h Ar homedir |
|
|
49 .br |
|
|
50 .Oo |
|
|
51 .Fl s Xo |
|
|
52 .Sm off |
|
|
53 .Op Ar server-ID |
|
|
54 .Op Ar ,server-addr |
|
|
55 .Op Ar ,server-port |
|
|
56 .Xc |
|
|
57 .Sm on |
|
|
58 .Oc |
|
|
59 .br |
|
|
60 .Op Fl C Ar 'type h1 h2 h3 h4' |
|
|
61 .Op Fl I Ar server-ID |
|
|
62 .Op Fl A Ar dbaddr |
|
|
63 .Op Fl L Ar pathlen |
|
|
64 .br |
|
|
65 .Op Fl P Ar pages |
|
|
66 .Op Fl T Ar timestamp |
|
|
67 .Op Ar file1 file2 ... |
|
|
68 .Sh DESCRIPTION |
|
|
69 .Nm Dblist |
|
|
70 lists the contents of a DCC database as it does some consistency |
|
|
71 checking. |
|
|
72 .Bl -tag -width 3n |
|
|
73 .It Fl v |
|
|
74 lists more of the database. |
|
|
75 Additional information is produced with additional |
|
|
76 .Fl v |
|
|
77 arguments. |
|
|
78 .It Fl V |
|
|
79 displays the version of the DCC database lister. |
|
|
80 .It Fl H |
|
|
81 turns off the listing of the hash table as well as the analysis |
|
|
82 of the hash table. |
|
|
83 Determining the worst case and average lengths of chains in the |
|
|
84 hash table can take a long time for a large database on a small computer. |
|
|
85 .It Fl D |
|
|
86 turns off the listing of the data or checksum records. |
|
|
87 .It Fl G Ar on |
|
|
88 lists a greylist database. |
|
|
89 .It Fl h Ar homedir |
|
|
90 overrides the default DCC home directory, |
|
|
91 .Pa @prefix@ . |
|
|
92 .It Fl s Xo |
|
|
93 .Sm off |
|
|
94 .Op Ar server-ID |
|
|
95 .Op Ar ,server-addr |
|
|
96 .Op Ar ,server-port |
|
|
97 .Sm on |
|
|
98 .Xc |
|
|
99 somewhat quiets the DCC server process, |
|
|
100 .Xr dccd 8 , |
|
|
101 to get somewhat more consistent results. |
|
|
102 .Ar server-ID |
|
|
103 must be in the |
|
|
104 .Pa ids |
|
|
105 file. |
|
|
106 .Ar server-addr |
|
|
107 and |
|
|
108 .Ar server-port |
|
|
109 are the IP address and UDP port at which the server process listens. |
|
|
110 .It Fl C Ar 'type h1 h2 h3 h4' |
|
|
111 limits the listing to records containing that checksum or one of |
|
|
112 the other checksums specified with |
|
|
113 .Fl C . |
|
|
114 If the four hexadecimal values |
|
|
115 .Ar h1 h2 h3 h4 |
|
|
116 are absent, |
|
|
117 records with the matching |
|
|
118 .Ar type |
|
|
119 will be listed. |
|
|
120 If |
|
|
121 .Ar type |
|
|
122 is absent, any checksum with the four hexadecimal values will be listed. |
|
|
123 As many as 16 checksums can be specified. |
|
|
124 .It Fl I Ar server-ID |
|
|
125 limits the listing to records with that server-ID or one of the other |
|
|
126 server-IDs specified with |
|
|
127 .Fl I . |
|
|
128 As many as 16 server-IDs can be specified. |
|
|
129 .It Fl A Ar dbaddr |
|
|
130 excludes database records before |
|
|
131 .Ar dbaddr . |
|
|
132 .It Fl L Ar pathlen |
|
|
133 excludes records with path lengths shorter than |
|
|
134 .Ar pathlen . |
|
|
135 .It Fl P Ar pages |
|
|
136 ignores all but the last |
|
|
137 .Ar pages |
|
|
138 of the database. |
|
|
139 .It Fl T Ar timetamp |
|
|
140 excludes records with other timestamps. |
|
|
141 A timestamp with a missing microsecond value matches |
|
|
142 any record with that second. |
|
|
143 As many as 16 |
|
|
144 timestamps can be specified. |
|
|
145 .It Ar file1 file2 ... |
|
|
146 are names of databases to be listed. |
|
|
147 The default is |
|
|
148 .Pa dcc_db |
|
|
149 and its companion, |
|
|
150 .Pa dcc_db.hash |
|
|
151 in the DCC home directory. |
|
|
152 .El |
|
|
153 .Pp |
|
|
154 By default, the sizes of the main file and the hash table as well |
|
|
155 as how much they contain and values related to the performance of |
|
|
156 the hash are displayed. |
|
|
157 .Pp |
|
|
158 With a single |
|
|
159 .Fl v , |
|
|
160 most of the mail database file and the contents of memory |
|
|
161 mapped server flooding positions in the |
|
|
162 .Pa flod.map |
|
|
163 file are listed. |
|
|
164 The listing starts with the serial number of the database file |
|
|
165 which is when old entries were last removed from it by |
|
|
166 .Xr dbclean 8 |
|
|
167 That is followed by similar lines showing the oldest timestamp |
|
|
168 of checksums not expired by dbclean |
|
|
169 and of mail that is not "spam." |
|
|
170 .Pp |
|
|
171 The flooding positions from the |
|
|
172 .Pa flod.map |
|
|
173 file are record offsets or addresses in the main database file. |
|
|
174 .Pp |
|
|
175 A typical record in the main database file looks like: |
|
|
176 .Bd -literal -offset 2 |
|
|
177 02/07/02 20:25:12.497032 5 auth 1601 2fe5b94 |
|
|
178 path: 103<-101<-1601 |
|
|
179 Body 6 e2d3f96a c65aea01 3fece361 edff9ecf 2f21364 772d2 |
|
|
180 Fuz1 many 6ff56fe8 ffc312d7 a5fe8f13 12a537ae 2f21364 200a9 |
|
|
181 Fuz2 many fac882b8 03eea34f bd792c40 2fe6fd54 2f21364 72816 |
|
|
182 .Ed |
|
|
183 .Pp |
|
|
184 That example |
|
|
185 was received by a DCC server with server-ID |
|
|
186 .Em 1601 |
|
|
187 at about 8:25 UTC on the evening of February 7, 2000. |
|
|
188 The report was about a mail message set to |
|
|
189 .Em 5 |
|
|
190 addressees. |
|
|
191 The report was from a client that presented a client-ID and matching |
|
|
192 password that the server recognized or authenticated. |
|
|
193 The report was then sent or |
|
|
194 .Sq flooded |
|
|
195 to the server with server-ID |
|
|
196 .Em 101 |
|
|
197 which in turn sent it to a server with server-ID |
|
|
198 .Em 103 . |
|
|
199 That server sent it to the local DCC server. |
|
|
200 The record is at the address |
|
|
201 .Em 0x2fe5b94 |
|
|
202 in the database. |
|
|
203 The record contains 3 checksums. |
|
|
204 The simple checksum of the body of the message was |
|
|
205 .Em e2d3f96a c65aea01 3fece361 edff9ecf |
|
|
206 The total number of recipients of messages with this body checksum |
|
|
207 known in the database is |
|
|
208 .Em 6 , |
|
|
209 which implies this checksum had been previously reported with a target |
|
|
210 count of 1. |
|
|
211 The previous report in the database of a message with this body checksum |
|
|
212 is at |
|
|
213 .Em 0x2f21364 . |
|
|
214 The hash table entry for this body checksum is at |
|
|
215 .Em 0x772d2 . |
|
|
216 This report included two fuzzy checksums. |
|
|
217 Both have been previously reported as having been sent to |
|
|
218 .Em many |
|
|
219 targets. |
|
|
220 .Pp |
|
|
221 An asterisk (*) before the name of the checksum |
|
|
222 would indicate that a later record in the database makes this |
|
|
223 checksum redundant. |
|
|
224 A report of |
|
|
225 .Em many |
|
|
226 addressees makes all preceding reports redundant. |
|
|
227 .Pp |
|
|
228 The string |
|
|
229 .Em trimmed |
|
|
230 after the server-ID |
|
|
231 marks older reports that have had uninteresting checksums removed. |
|
|
232 The string |
|
|
233 .Em compressed |
|
|
234 after the server-ID |
|
|
235 would indicate that this older report has been trimmed and compressed with |
|
|
236 older reports. |
|
|
237 .Pp |
|
|
238 With two |
|
|
239 .Fl v |
|
|
240 arguments, |
|
|
241 records added to the database by |
|
|
242 .Xr dbclean 8 |
|
|
243 from the server whitelist are also displayed. |
|
|
244 .Pp |
|
|
245 Three |
|
|
246 .Fl v |
|
|
247 arguments cause the hash table to be displayed. |
|
|
248 Three typical hash table entries look like: |
|
|
249 .Bd -literal -offset 2 |
|
|
250 19b8: 19ee 19b7 |
|
|
251 19b9: 19c0 0 90120 Fuz1 |
|
|
252 19ba: 0 0 1b72300 Fuz1 |
|
|
253 .Ed |
|
|
254 .Pp |
|
|
255 The entry in slot number |
|
|
256 .Em 0x19b8 |
|
|
257 is unused or free. |
|
|
258 Slot number |
|
|
259 .Em 0x19b9 |
|
|
260 is the start of a chain of collisions or entries |
|
|
261 with the same hash value of 0x19b9. |
|
|
262 The next slot in this chain is at |
|
|
263 .Em 0x19c0 . |
|
|
264 The corresponding |
|
|
265 .Em Fuz1 |
|
|
266 checksum is at |
|
|
267 .Em 0x9012 |
|
|
268 in the database. |
|
|
269 The third slot at |
|
|
270 .Em 0x19ba |
|
|
271 is also that of a |
|
|
272 .Em Fuz1 |
|
|
273 checksum, |
|
|
274 but it is not part of a hash chain and its database record |
|
|
275 is at |
|
|
276 .Em 0x1b72300 . |
|
|
277 .Sh FILES |
|
|
278 .Bl -tag -width dcc_db.hash -compact |
|
|
279 .It Pa @prefix@ |
|
|
280 is the DCC home directory containing data and control files. |
|
|
281 .It Pa dcc_db grey_dcc_db |
|
|
282 main file of checksums. |
|
|
283 .It Pa dcc_db.hash grey_dcc_db.hash |
|
|
284 database hash table. |
|
|
285 .It Pa flod.map grey_flod.map |
|
|
286 memory mapped flooding positions. |
|
|
287 .El |
|
|
288 .Sh SEE ALSO |
|
|
289 .Xr cdcc 8 , |
|
|
290 .Xr dcc 8 , |
|
|
291 .Xr dbclean 8 , |
|
|
292 .Xr dccd 8 , |
|
|
293 .Xr dccifd 8 , |
|
|
294 .Xr dccm 8 , |
|
|
295 .Xr dccproc 8 . |
|
|
296 .Sh HISTORY |
|
|
297 Implementation of |
|
|
298 .Nm |
|
|
299 was started at Rhyolite Software, in 2000. |
|
|
300 This document describes version 1.3.103. |
