1.\" @(#) $Header: /tcpdump/master/tcpdump/tcpdump.1.in,v 1.2 2008-11-09 23:35:03 mcr Exp $ (LBL)
2.\"
3.\" $NetBSD: tcpdump.8,v 1.9 2003/03/31 00:18:17 perry Exp $
4.\"
5.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
6.\" The Regents of the University of California. All rights reserved.
7.\" All rights reserved.
8.\"
--- 186 unchanged lines hidden (view full) ---
195Print each packet (minus its link level header) in ASCII. Handy for
196capturing web pages.
197.TP
198.B \-b
199Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN
200notation.
201.TP
202.B \-B
203Set the operating system capture buffer size to \fIbuffer_size\fP, in
204units of KiB (1024 bytes).
205.TP
206.B \-c
207Exit after receiving \fIcount\fP packets.
208.TP
209.B \-C
210Before writing a raw packet to a savefile, check whether the file is
211currently larger than \fIfile_size\fP and, if so, close the current
212savefile and open a new one. Savefiles after the first savefile will
--- 175 unchanged lines hidden (view full) ---
388interfaces that perform some or all of those checksum calculation in
389hardware; otherwise, all outgoing TCP checksums will be flagged as bad.
390.TP
391.B \-l
392Make stdout line buffered.
393Useful if you want to see the data
394while capturing it.
395E.g.,
396.IP
397.RS
398.RS
399.nf
400\fBtcpdump \-l | tee dat\fP
401.fi
402.RE
403.RE
404.IP
405or
406.IP
407.RS
408.RS
409.nf
410\fBtcpdump \-l > dat & tail \-f dat\fP
411.fi
412.RE
413.RE
414.IP
415Note that on Windows,``line buffered'' means ``unbuffered'', so that
416WinDump will write each character individually if
417.B \-l
418is specified.
419.IP
420.B \-U
421is similar to
422.B \-l
423in its behavior, but it will cause output to be ``packet-buffered'', so
424that the output is written to stdout at the end of each packet rather
425than at the end of each line; this is buffered on all platforms,
426including Windows.
427.TP
428.B \-L
429List the known data link types for the interface, in the specified mode,
430and exit. The list of known data link types may be dependent on the
431specified mode; for example, on some platforms, a Wi-Fi interface might
432support one set of data link types when not in monitor mode (for
433example, it might support only fake Ethernet headers, or might support
434802.11 headers but not support 802.11 headers with radio information)
--- 100 unchanged lines hidden (view full) ---
535.B \-ttttt
536Print a delta (micro-second resolution) between current and first line
537on each dump line.
538.TP
539.B \-u
540Print undecoded NFS handles.
541.TP
542.B \-U
543If the
544.B \-w
545option is not specified, make the printed packet output
546``packet-buffered''; i.e., as the description of the contents of each
547packet is printed, it will be written to the standard output, rather
548than, when not writing to a terminal, being written only when the output
549buffer fills.
550.IP
551If the
552.B \-w
553option is specified, make the saved raw packet output
554``packet-buffered''; i.e., as each packet is saved, it will be written
555to the output file, rather than being written only when the output
556buffer fills.
557.IP
558The
559.B \-U
560flag will not be supported if
561.I tcpdump
562was built with an older version of
563.I libpcap
564that lacks the
565.B pcap_dump_flush()
--- 24 unchanged lines hidden (view full) ---
590.B \-X
591Telnet options are printed in hex as well.
592.TP
593.B \-w
594Write the raw packets to \fIfile\fR rather than parsing and printing
595them out.
596They can later be printed with the \-r option.
597Standard output is used if \fIfile\fR is ``-''.
598.IP
599This output will be buffered if written to a file or pipe, so a program
600reading from the file or pipe may not see packets for an arbitrary
601amount of time after they are received. Use the
602.B \-U
603flag to cause packets to be written as soon as they are received.
604.IP
605See
606.BR pcap-savefile (@MAN_FILE_FORMATS@)
607for a description of the file format.
608.TP
609.B \-W
610Used in conjunction with the
611.B \-C
612option, this will limit the number
--- 1177 unchanged lines hidden ---
2.\"
3.\" $NetBSD: tcpdump.8,v 1.9 2003/03/31 00:18:17 perry Exp $
4.\"
5.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
6.\" The Regents of the University of California. All rights reserved.
7.\" All rights reserved.
8.\"
--- 186 unchanged lines hidden (view full) ---
195Print each packet (minus its link level header) in ASCII. Handy for
196capturing web pages.
197.TP
198.B \-b
199Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN
200notation.
201.TP
202.B \-B
203Set the operating system capture buffer size to \fIbuffer_size\fP, in
204units of KiB (1024 bytes).
205.TP
206.B \-c
207Exit after receiving \fIcount\fP packets.
208.TP
209.B \-C
210Before writing a raw packet to a savefile, check whether the file is
211currently larger than \fIfile_size\fP and, if so, close the current
212savefile and open a new one. Savefiles after the first savefile will
--- 175 unchanged lines hidden (view full) ---
388interfaces that perform some or all of those checksum calculation in
389hardware; otherwise, all outgoing TCP checksums will be flagged as bad.
390.TP
391.B \-l
392Make stdout line buffered.
393Useful if you want to see the data
394while capturing it.
395E.g.,
396.IP
397.RS
398.RS
399.nf
400\fBtcpdump \-l | tee dat\fP
401.fi
402.RE
403.RE
404.IP
405or
406.IP
407.RS
408.RS
409.nf
410\fBtcpdump \-l > dat & tail \-f dat\fP
411.fi
412.RE
413.RE
414.IP
415Note that on Windows,``line buffered'' means ``unbuffered'', so that
416WinDump will write each character individually if
417.B \-l
418is specified.
419.IP
420.B \-U
421is similar to
422.B \-l
423in its behavior, but it will cause output to be ``packet-buffered'', so
424that the output is written to stdout at the end of each packet rather
425than at the end of each line; this is buffered on all platforms,
426including Windows.
427.TP
428.B \-L
429List the known data link types for the interface, in the specified mode,
430and exit. The list of known data link types may be dependent on the
431specified mode; for example, on some platforms, a Wi-Fi interface might
432support one set of data link types when not in monitor mode (for
433example, it might support only fake Ethernet headers, or might support
434802.11 headers but not support 802.11 headers with radio information)
--- 100 unchanged lines hidden (view full) ---
535.B \-ttttt
536Print a delta (micro-second resolution) between current and first line
537on each dump line.
538.TP
539.B \-u
540Print undecoded NFS handles.
541.TP
542.B \-U
543If the
544.B \-w
545option is not specified, make the printed packet output
546``packet-buffered''; i.e., as the description of the contents of each
547packet is printed, it will be written to the standard output, rather
548than, when not writing to a terminal, being written only when the output
549buffer fills.
550.IP
551If the
552.B \-w
553option is specified, make the saved raw packet output
554``packet-buffered''; i.e., as each packet is saved, it will be written
555to the output file, rather than being written only when the output
556buffer fills.
557.IP
558The
559.B \-U
560flag will not be supported if
561.I tcpdump
562was built with an older version of
563.I libpcap
564that lacks the
565.B pcap_dump_flush()
--- 24 unchanged lines hidden (view full) ---
590.B \-X
591Telnet options are printed in hex as well.
592.TP
593.B \-w
594Write the raw packets to \fIfile\fR rather than parsing and printing
595them out.
596They can later be printed with the \-r option.
597Standard output is used if \fIfile\fR is ``-''.
598.IP
599This output will be buffered if written to a file or pipe, so a program
600reading from the file or pipe may not see packets for an arbitrary
601amount of time after they are received. Use the
602.B \-U
603flag to cause packets to be written as soon as they are received.
604.IP
605See
606.BR pcap-savefile (@MAN_FILE_FORMATS@)
607for a description of the file format.
608.TP
609.B \-W
610Used in conjunction with the
611.B \-C
612option, this will limit the number
--- 1177 unchanged lines hidden ---