| tcpdump.1.in (235530) | tcpdump.1.in (241235) |
|---|---|
| 1.\" @(#) $Header: /tcpdump/master/tcpdump/tcpdump.1.in,v 1.2 2008-11-09 23:35:03 mcr Exp $ (LBL) 2.\" 3.\" $NetBSD: tcpdump.8,v 1.9 2003/03/31 00:18:17 perry Exp $ 4.\" 5.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997 6.\" The Regents of the University of California. All rights reserved. 7.\" All rights reserved. 8.\" --- 186 unchanged lines hidden (view full) --- 195Print each packet (minus its link level header) in ASCII. Handy for 196capturing web pages. 197.TP 198.B \-b 199Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN 200notation. 201.TP 202.B \-B | 1.\" @(#) $Header: /tcpdump/master/tcpdump/tcpdump.1.in,v 1.2 2008-11-09 23:35:03 mcr Exp $ (LBL) 2.\" 3.\" $NetBSD: tcpdump.8,v 1.9 2003/03/31 00:18:17 perry Exp $ 4.\" 5.\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997 6.\" The Regents of the University of California. All rights reserved. 7.\" All rights reserved. 8.\" --- 186 unchanged lines hidden (view full) --- 195Print each packet (minus its link level header) in ASCII. Handy for 196capturing web pages. 197.TP 198.B \-b 199Print the AS number in BGP packets in ASDOT notation rather than ASPLAIN 200notation. 201.TP 202.B \-B |
| 203Set the operating system capture buffer size to \fIbuffer_size\fP. | 203Set the operating system capture buffer size to \fIbuffer_size\fP, in 204units of KiB (1024 bytes). |
| 204.TP 205.B \-c 206Exit after receiving \fIcount\fP packets. 207.TP 208.B \-C 209Before writing a raw packet to a savefile, check whether the file is 210currently larger than \fIfile_size\fP and, if so, close the current 211savefile and open a new one. Savefiles after the first savefile will --- 175 unchanged lines hidden (view full) --- 387interfaces that perform some or all of those checksum calculation in 388hardware; otherwise, all outgoing TCP checksums will be flagged as bad. 389.TP 390.B \-l 391Make stdout line buffered. 392Useful if you want to see the data 393while capturing it. 394E.g., | 205.TP 206.B \-c 207Exit after receiving \fIcount\fP packets. 208.TP 209.B \-C 210Before writing a raw packet to a savefile, check whether the file is 211currently larger than \fIfile_size\fP and, if so, close the current 212savefile and open a new one. Savefiles after the first savefile will --- 175 unchanged lines hidden (view full) --- 388interfaces that perform some or all of those checksum calculation in 389hardware; otherwise, all outgoing TCP checksums will be flagged as bad. 390.TP 391.B \-l 392Make stdout line buffered. 393Useful if you want to see the data 394while capturing it. 395E.g., |
| 395.br 396``tcpdump\ \ \-l\ \ |\ \ tee dat'' or 397``tcpdump\ \ \-l \ \ > dat\ \ &\ \ tail\ \ \-f\ \ dat''. | 396.IP 397.RS 398.RS 399.nf 400\fBtcpdump \-l | tee dat\fP 401.fi 402.RE 403.RE 404.IP 405or 406.IP 407.RS 408.RS 409.nf 410\fBtcpdump \-l > dat & tail \-f dat\fP 411.fi 412.RE 413.RE 414.IP 415Note that on Windows,``line buffered'' means ``unbuffered'', so that 416WinDump will write each character individually if 417.B \-l 418is specified. 419.IP 420.B \-U 421is similar to 422.B \-l 423in its behavior, but it will cause output to be ``packet-buffered'', so 424that the output is written to stdout at the end of each packet rather 425than at the end of each line; this is buffered on all platforms, 426including Windows. |
| 398.TP 399.B \-L 400List the known data link types for the interface, in the specified mode, 401and exit. The list of known data link types may be dependent on the 402specified mode; for example, on some platforms, a Wi-Fi interface might 403support one set of data link types when not in monitor mode (for 404example, it might support only fake Ethernet headers, or might support 405802.11 headers but not support 802.11 headers with radio information) --- 100 unchanged lines hidden (view full) --- 506.B \-ttttt 507Print a delta (micro-second resolution) between current and first line 508on each dump line. 509.TP 510.B \-u 511Print undecoded NFS handles. 512.TP 513.B \-U | 427.TP 428.B \-L 429List the known data link types for the interface, in the specified mode, 430and exit. The list of known data link types may be dependent on the 431specified mode; for example, on some platforms, a Wi-Fi interface might 432support one set of data link types when not in monitor mode (for 433example, it might support only fake Ethernet headers, or might support 434802.11 headers but not support 802.11 headers with radio information) --- 100 unchanged lines hidden (view full) --- 535.B \-ttttt 536Print a delta (micro-second resolution) between current and first line 537on each dump line. 538.TP 539.B \-u 540Print undecoded NFS handles. 541.TP 542.B \-U |
| 514Make output saved via the | 543If the |
| 515.B \-w | 544.B \-w |
| 516option ``packet-buffered''; i.e., as each packet is saved, it will be 517written to the output file, rather than being written only when the 518output buffer fills. | 545option is not specified, make the printed packet output 546``packet-buffered''; i.e., as the description of the contents of each 547packet is printed, it will be written to the standard output, rather 548than, when not writing to a terminal, being written only when the output 549buffer fills. |
| 519.IP | 550.IP |
| 551If the 552.B \-w 553option is specified, make the saved raw packet output 554``packet-buffered''; i.e., as each packet is saved, it will be written 555to the output file, rather than being written only when the output 556buffer fills. 557.IP |
|
| 520The 521.B \-U 522flag will not be supported if 523.I tcpdump 524was built with an older version of 525.I libpcap 526that lacks the 527.B pcap_dump_flush() --- 24 unchanged lines hidden (view full) --- 552.B \-X 553Telnet options are printed in hex as well. 554.TP 555.B \-w 556Write the raw packets to \fIfile\fR rather than parsing and printing 557them out. 558They can later be printed with the \-r option. 559Standard output is used if \fIfile\fR is ``-''. | 558The 559.B \-U 560flag will not be supported if 561.I tcpdump 562was built with an older version of 563.I libpcap 564that lacks the 565.B pcap_dump_flush() --- 24 unchanged lines hidden (view full) --- 590.B \-X 591Telnet options are printed in hex as well. 592.TP 593.B \-w 594Write the raw packets to \fIfile\fR rather than parsing and printing 595them out. 596They can later be printed with the \-r option. 597Standard output is used if \fIfile\fR is ``-''. |
| 598.IP 599This output will be buffered if written to a file or pipe, so a program 600reading from the file or pipe may not see packets for an arbitrary 601amount of time after they are received. Use the 602.B \-U 603flag to cause packets to be written as soon as they are received. 604.IP |
|
| 560See 561.BR pcap-savefile (@MAN_FILE_FORMATS@) 562for a description of the file format. 563.TP 564.B \-W 565Used in conjunction with the 566.B \-C 567option, this will limit the number --- 1177 unchanged lines hidden --- | 605See 606.BR pcap-savefile (@MAN_FILE_FORMATS@) 607for a description of the file format. 608.TP 609.B \-W 610Used in conjunction with the 611.B \-C 612option, this will limit the number --- 1177 unchanged lines hidden --- |