1.\" @(#) $Header: /tcpdump/master/tcpdump/tcpdump.1.in,v 1.2 2008-11-09 23:35:03 mcr Exp $ (LBL) 2.\" 3.\" $NetBSD: tcpdump.8,v 1.9 2003/03/31 00:18:17 perry Exp $ 4.\" 5.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997 6.\" The Regents of the University of California. All rights reserved. 7.\" All rights reserved. 8.\" --- 186 unchanged lines hidden (view full) --- 195Print each packet (minus its link level header) in ASCII. Handy for 196capturing web pages. 197.TP 198.B \-b 199Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN 200notation. 201.TP 202.B \-B |
203Set the operating system capture buffer size to \fIbuffer_size\fP, in 204units of KiB (1024 bytes). |
205.TP 206.B \-c 207Exit after receiving \fIcount\fP packets. 208.TP 209.B \-C 210Before writing a raw packet to a savefile, check whether the file is 211currently larger than \fIfile_size\fP and, if so, close the current 212savefile and open a new one. Savefiles after the first savefile will --- 175 unchanged lines hidden (view full) --- 388interfaces that perform some or all of those checksum calculation in 389hardware; otherwise, all outgoing TCP checksums will be flagged as bad. 390.TP 391.B \-l 392Make stdout line buffered. 393Useful if you want to see the data 394while capturing it. 395E.g., |
396.IP 397.RS 398.RS 399.nf 400\fBtcpdump \-l | tee dat\fP 401.fi 402.RE 403.RE 404.IP 405or 406.IP 407.RS 408.RS 409.nf 410\fBtcpdump \-l > dat & tail \-f dat\fP 411.fi 412.RE 413.RE 414.IP 415Note that on Windows,``line buffered'' means ``unbuffered'', so that 416WinDump will write each character individually if 417.B \-l 418is specified. 419.IP 420.B \-U 421is similar to 422.B \-l 423in its behavior, but it will cause output to be ``packet-buffered'', so 424that the output is written to stdout at the end of each packet rather 425than at the end of each line; this is buffered on all platforms, 426including Windows. |
427.TP 428.B \-L 429List the known data link types for the interface, in the specified mode, 430and exit. The list of known data link types may be dependent on the 431specified mode; for example, on some platforms, a Wi-Fi interface might 432support one set of data link types when not in monitor mode (for 433example, it might support only fake Ethernet headers, or might support 434802.11 headers but not support 802.11 headers with radio information) --- 100 unchanged lines hidden (view full) --- 535.B \-ttttt 536Print a delta (micro-second resolution) between current and first line 537on each dump line. 538.TP 539.B \-u 540Print undecoded NFS handles. 541.TP 542.B \-U |
543If the |
544.B \-w |
545option is not specified, make the printed packet output 546``packet-buffered''; i.e., as the description of the contents of each 547packet is printed, it will be written to the standard output, rather 548than, when not writing to a terminal, being written only when the output 549buffer fills. |
550.IP |
551If the 552.B \-w 553option is specified, make the saved raw packet output 554``packet-buffered''; i.e., as each packet is saved, it will be written 555to the output file, rather than being written only when the output 556buffer fills. 557.IP |
558The 559.B \-U 560flag will not be supported if 561.I tcpdump 562was built with an older version of 563.I libpcap 564that lacks the 565.B pcap_dump_flush() --- 24 unchanged lines hidden (view full) --- 590.B \-X 591Telnet options are printed in hex as well. 592.TP 593.B \-w 594Write the raw packets to \fIfile\fR rather than parsing and printing 595them out. 596They can later be printed with the \-r option. 597Standard output is used if \fIfile\fR is ``-''. |
598.IP 599This output will be buffered if written to a file or pipe, so a program 600reading from the file or pipe may not see packets for an arbitrary 601amount of time after they are received. Use the 602.B \-U 603flag to cause packets to be written as soon as they are received. 604.IP |
605See 606.BR pcap-savefile (@MAN_FILE_FORMATS@) 607for a description of the file format. 608.TP 609.B \-W 610Used in conjunction with the 611.B \-C 612option, this will limit the number --- 1177 unchanged lines hidden --- |