1c1
< .\" $OpenBSD: pf.os.5,v 1.6 2004/03/31 11:13:03 dhartmei Exp $
---
> .\" $OpenBSD: pf.os.5,v 1.7 2005/11/16 20:07:18 stevesk Exp $
17c17
< .\" $FreeBSD: head/contrib/pf/man/pf.os.5 148787 2005-08-06 13:03:03Z brueffer $
---
> .\" $FreeBSD: head/contrib/pf/man/pf.os.5 171172 2007-07-03 12:30:03Z mlaier $
210c210
< 03:13:48.118526 10.0.0.1.3377 > 10.0.0.0.2: S [tcp sum ok] \e
---
> 03:13:48.118526 10.0.0.1.3377 > 10.0.0.2.80: S [tcp sum ok] \e
212c212
< (ttl 64, id 11315)
---
> (ttl 64, id 11315, len 44)
219,240d218
< .Pp
< .Xr tcpdump 1
< does not explicitly give the packet length.
< But it can usually be derived by adding the size of the IPv4 header to
< the size of the TCP header to the size of the TCP options.
< The size of both headers is typically twenty each and the usual
< sizes of the TCP options are:
< .Pp
< .Bl -tag -width timestamp -offset indent -compact
< .It mss
< four bytes.
< .It nop
< 1 byte.
< .It sackOK
< two bytes.
< .It timestamp
< ten bytes.
< .It wscale
< three bytes.
< .El
< .Pp
< In the above example, the packet size comes out to 44 bytes.