summaryrefslogtreecommitdiffstats
path: root/usr.sbin/tcpdump
diff options
context:
space:
mode:
authorru <ru@FreeBSD.org>2004-07-02 23:13:00 +0000
committerru <ru@FreeBSD.org>2004-07-02 23:13:00 +0000
commit6294018a208cf7742b1c021a9b75c26962505571 (patch)
tree502f17eb951b74c914af346cd4dbff252350c082 /usr.sbin/tcpdump
parent3f44360851448f8816c22f6b72e8dd5c9924c27f (diff)
downloadFreeBSD-src-6294018a208cf7742b1c021a9b75c26962505571.zip
FreeBSD-src-6294018a208cf7742b1c021a9b75c26962505571.tar.gz
Mechanically kill hard sentence breaks.
Diffstat (limited to 'usr.sbin/tcpdump')
-rw-r--r--usr.sbin/tcpdump/tcpslice/tcpslice.162
1 files changed, 41 insertions, 21 deletions
diff --git a/usr.sbin/tcpdump/tcpslice/tcpslice.1 b/usr.sbin/tcpdump/tcpslice/tcpslice.1
index d804cf6..2efecc7 100644
--- a/usr.sbin/tcpdump/tcpslice/tcpslice.1
+++ b/usr.sbin/tcpdump/tcpslice/tcpslice.1
@@ -46,8 +46,10 @@ The basic operation of
is to copy to
.Pa stdout
all packets from its input file(s) whose timestamps fall
-within a given range. The starting and ending times of the range
-may be specified on the command line. All ranges are inclusive.
+within a given range.
+The starting and ending times of the range
+may be specified on the command line.
+All ranges are inclusive.
The starting time defaults
to the time of the first packet in the first input file; we call
this the
@@ -63,7 +65,8 @@ to
(assuming the file does not include more than
ten years' worth of data).
.Pp
-There are a number of ways to specify times. The first is using
+There are a number of ways to specify times.
+The first is using
Unix timestamps of the form
.Em sssssssss.uuuuuu
(this is the format specified by
@@ -73,7 +76,7 @@ flag).
For example,
.Em 654321098.7654
specifies 38 seconds and 765,400 microseconds
-after 8:51PM PDT, Sept. 25, 1990.
+after 8:51PM PDT, Sept.\& 25, 1990.
.Pp
All examples in this manual are given
for PDT times, but when displaying times and interpreting times symbolically
@@ -81,8 +84,10 @@ as discussed below,
.Nm
uses the local timezone, regardless of the timezone in which the
.Xr tcpdump 1
-file was generated. The daylight-savings setting used is that which is
-appropriate for the local timezone at the date in question. For example,
+file was generated.
+The daylight-savings setting used is that which is
+appropriate for the local timezone at the date in question.
+For example,
times associated with summer months will usually include daylight-savings
effects, and those with winter months will not.
.Pp
@@ -104,13 +109,15 @@ through 500 seconds after the
.Em first time .
.Pp
Times may also be specified in terms of years (y), months (m), days (d),
-hours (h), minutes (m), seconds (s), and microseconds(u). For example,
+hours (h), minutes (m), seconds (s), and microseconds(u).
+For example,
the Unix timestamp 654321098.7654 discussed above could also be expressed
as
.Em 90y9m25d20h51m38s765400u .
.Pp
When specifying times using this style, fields that are omitted default
-as follows. If the omitted field is a unit
+as follows.
+If the omitted field is a unit
.Em greater
than that of the first specified field, then its value defaults to
the corresponding value taken from either
@@ -123,7 +130,8 @@ than that of the first specified field, then it defaults to zero.
For example, suppose that the input file has a
.Em first time
of the Unix timestamp mentioned above, i.e., 38 seconds and 765,400 microseconds
-after 8:51PM PDT, Sept. 25, 1990. To specify 9:36PM PDT (exactly) on the
+after 8:51PM PDT, Sept.\& 25, 1990.
+To specify 9:36PM PDT (exactly) on the
same date we could use
.Em 21h36m .
To specify a range from 9:36PM PDT through 1:54AM PDT the next day we
@@ -132,21 +140,24 @@ could use
.Pp
Relative times can also be specified when using the
.Em ymdhmsu
-format. Omitted fields then default to 0 if the unit of the field is
+format.
+Omitted fields then default to 0 if the unit of the field is
.Em greater
than that of the first specified field, and to the corresponding value
taken from either the
.Em first time
or the starting time if the omitted field's unit is
.Em less
-than that of the first specified field. Given a
+than that of the first specified field.
+Given a
.Em first time
of the Unix timestamp mentioned above,
.Em 22h +1h10m
specifies a range from 10:00PM PDT on that date through 11:10PM PDT, and
.Em +1h +1h10m
specifies a range from 38.7654 seconds after 9:51PM PDT through 38.7654
-seconds after 11:01PM PDT. The first hour of the file could be extracted
+seconds after 11:01PM PDT.
+The first hour of the file could be extracted
using
.Em +0 +1h .
.Pp
@@ -154,7 +165,8 @@ Note that with the
.Em ymdhmsu
format there is an ambiguity between using
.Em m
-for `month' or for `minute'. The ambiguity is resolved as follows: if an
+for `month' or for `minute'.
+The ambiguity is resolved as follows: if an
.Em m
field is followed by a
.Em d
@@ -166,11 +178,14 @@ If more than one input file is specified then
first copies packets lying in the given range from the first file; it
then increases the starting time of the range to lie just beyond the
timestamp of the last packet in the first file, repeats the process
-with the second file, and so on. Thus files with interleaved packets
+with the second file, and so on.
+Thus files with interleaved packets
are
.Em not
-merged. For a given file, only packets that are newer than any in the
-preceding files will be considered. This mechanism avoids any possibility
+merged.
+For a given file, only packets that are newer than any in the
+preceding files will be considered.
+This mechanism avoids any possibility
of a packet occurring more than once in the output.
.Sh OPTIONS
If any of
@@ -181,14 +196,17 @@ or
are specified then
.Nm
reports the timestamps of the first and last packets in each input file
-and exits. Only one of these three options may be specified.
+and exits.
+Only one of these three options may be specified.
.Pp
The following options are available:
.Bl -tag -width indent
.It Fl d
Dump the start and end times specified by the given range and
-exit. This option is useful for checking that the given range actually
-specifies the times you think it does. If one of
+exit.
+This option is useful for checking that the given range actually
+specifies the times you think it does.
+If one of
.Fl R ,
.Fl r
or
@@ -228,7 +246,8 @@ rather than
of Lawrence Berkeley Laboratory, University of California, Berkeley, CA.
.Sh BUGS
An input filename that beings with a digit or a `+' can be confused
-with a start/end time. Such filenames can be specified with a
+with a start/end time.
+Such filenames can be specified with a
leading `./'; for example, specify the file `04Jul76.trace' as
`./04Jul76.trace'.
.Pp
@@ -260,7 +279,8 @@ files spanning more than one year;
with files containing portions of packets whose original length was
more than 65,535 bytes; nor with files containing fewer than three packets.
Such files result in
-the error message: `couldn't find final packet in file'. These problems
+the error message: `couldn't find final packet in file'.
+These problems
are due to the interpolation scheme used by
.Nm
to greatly speed up its processing when dealing with large trace files.
OpenPOWER on IntegriCloud