1.\" @(#) $Header: /tcpdump/master/tcpdump/tcpdump.1.in,v 1.2 2008-11-09 23:35:03 mcr Exp $ (LBL)
2.\"
3.\" $NetBSD: tcpdump.8,v 1.9 2003/03/31 00:18:17 perry Exp $
4.\"
5.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
6.\" The Regents of the University of California. All rights reserved.
7.\" All rights reserved.
8.\"
--- 186 unchanged lines hidden (view full) ---
195Print each packet (minus its link level header) in ASCII. Handy for
196capturing web pages.
197.TP
198.B \-b
199Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN
200notation.
201.TP
202.B \-B
203Set the operating system capture buffer size to \fIbuffer_size\fP.
204.TP
205.B \-c
206Exit after receiving \fIcount\fP packets.
207.TP
208.B \-C
209Before writing a raw packet to a savefile, check whether the file is
210currently larger than \fIfile_size\fP and, if so, close the current
211savefile and open a new one. Savefiles after the first savefile will
--- 175 unchanged lines hidden (view full) ---
387interfaces that perform some or all of those checksum calculation in
388hardware; otherwise, all outgoing TCP checksums will be flagged as bad.
389.TP
390.B \-l
391Make stdout line buffered.
392Useful if you want to see the data
393while capturing it.
394E.g.,
395.br
396``tcpdump\ \ \-l\ \ |\ \ tee dat'' or
397``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''.
398.TP
399.B \-L
400List the known data link types for the interface, in the specified mode,
401and exit. The list of known data link types may be dependent on the
402specified mode; for example, on some platforms, a Wi-Fi interface might
403support one set of data link types when not in monitor mode (for
404example, it might support only fake Ethernet headers, or might support
405802.11 headers but not support 802.11 headers with radio information)
--- 100 unchanged lines hidden (view full) ---
506.B \-ttttt
507Print a delta (micro-second resolution) between current and first line
508on each dump line.
509.TP
510.B \-u
511Print undecoded NFS handles.
512.TP
513.B \-U
514Make output saved via the
515.B \-w
516option ``packet-buffered''; i.e., as each packet is saved, it will be
517written to the output file, rather than being written only when the
518output buffer fills.
519.IP
520The
521.B \-U
522flag will not be supported if
523.I tcpdump
524was built with an older version of
525.I libpcap
526that lacks the
527.B pcap_dump_flush()
--- 24 unchanged lines hidden (view full) ---
552.B \-X
553Telnet options are printed in hex as well.
554.TP
555.B \-w
556Write the raw packets to \fIfile\fR rather than parsing and printing
557them out.
558They can later be printed with the \-r option.
559Standard output is used if \fIfile\fR is ``-''.
560See
561.BR pcap-savefile (@MAN_FILE_FORMATS@)
562for a description of the file format.
563.TP
564.B \-W
565Used in conjunction with the
566.B \-C
567option, this will limit the number
--- 1177 unchanged lines hidden ---
2.\"
3.\" $NetBSD: tcpdump.8,v 1.9 2003/03/31 00:18:17 perry Exp $
4.\"
5.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
6.\" The Regents of the University of California. All rights reserved.
7.\" All rights reserved.
8.\"
--- 186 unchanged lines hidden (view full) ---
195Print each packet (minus its link level header) in ASCII. Handy for
196capturing web pages.
197.TP
198.B \-b
199Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN
200notation.
201.TP
202.B \-B
203Set the operating system capture buffer size to \fIbuffer_size\fP.
204.TP
205.B \-c
206Exit after receiving \fIcount\fP packets.
207.TP
208.B \-C
209Before writing a raw packet to a savefile, check whether the file is
210currently larger than \fIfile_size\fP and, if so, close the current
211savefile and open a new one. Savefiles after the first savefile will
--- 175 unchanged lines hidden (view full) ---
387interfaces that perform some or all of those checksum calculation in
388hardware; otherwise, all outgoing TCP checksums will be flagged as bad.
389.TP
390.B \-l
391Make stdout line buffered.
392Useful if you want to see the data
393while capturing it.
394E.g.,
395.br
396``tcpdump\ \ \-l\ \ |\ \ tee dat'' or
397``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''.
398.TP
399.B \-L
400List the known data link types for the interface, in the specified mode,
401and exit. The list of known data link types may be dependent on the
402specified mode; for example, on some platforms, a Wi-Fi interface might
403support one set of data link types when not in monitor mode (for
404example, it might support only fake Ethernet headers, or might support
405802.11 headers but not support 802.11 headers with radio information)
--- 100 unchanged lines hidden (view full) ---
506.B \-ttttt
507Print a delta (micro-second resolution) between current and first line
508on each dump line.
509.TP
510.B \-u
511Print undecoded NFS handles.
512.TP
513.B \-U
514Make output saved via the
515.B \-w
516option ``packet-buffered''; i.e., as each packet is saved, it will be
517written to the output file, rather than being written only when the
518output buffer fills.
519.IP
520The
521.B \-U
522flag will not be supported if
523.I tcpdump
524was built with an older version of
525.I libpcap
526that lacks the
527.B pcap_dump_flush()
--- 24 unchanged lines hidden (view full) ---
552.B \-X
553Telnet options are printed in hex as well.
554.TP
555.B \-w
556Write the raw packets to \fIfile\fR rather than parsing and printing
557them out.
558They can later be printed with the \-r option.
559Standard output is used if \fIfile\fR is ``-''.
560See
561.BR pcap-savefile (@MAN_FILE_FORMATS@)
562for a description of the file format.
563.TP
564.B \-W
565Used in conjunction with the
566.B \-C
567option, this will limit the number
--- 1177 unchanged lines hidden ---