diff options
Diffstat (limited to 'contrib/tcpdump/tcpdump.1.in')
| -rw-r--r-- | contrib/tcpdump/tcpdump.1.in | 31 |
1 files changed, 15 insertions, 16 deletions
diff --git a/contrib/tcpdump/tcpdump.1.in b/contrib/tcpdump/tcpdump.1.in index f9522cb..f04a579 100644 --- a/contrib/tcpdump/tcpdump.1.in +++ b/contrib/tcpdump/tcpdump.1.in @@ -20,14 +20,14 @@ .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. .\" -.TH TCPDUMP 1 "11 July 2014" +.TH TCPDUMP 1 "17 September 2015" .SH NAME tcpdump \- dump traffic on a network .SH SYNOPSIS .na .B tcpdump [ -.B \-AbdDefhHIJKlLnNOpqRStuUvxX# +.B \-AbdDefhHIJKlLnNOpqStuUvxX# ] [ .B \-B .I buffer_size @@ -400,7 +400,7 @@ If the flag is supported, an interface number as printed by that flag can be used as the .I interface -argument. +argument, if no interface on the system has that number as a name. .TP .B \-I .PD 0 @@ -593,12 +593,6 @@ Quick (quiet?) output. Print less protocol information so output lines are shorter. .TP -.B \-R -Assume ESP/AH packets to be based on old specification (RFC1825 to RFC1829). -If specified, \fItcpdump\fP will not print replay prevention field. -Since there is no protocol version field in ESP/AH specification, -\fItcpdump\fP cannot deduce the version of ESP/AH protocol. -.TP .BI \-r " file" Read packets from \fIfile\fR (which was created with the .B \-w @@ -618,7 +612,7 @@ Print absolute, rather than relative, TCP sequence numbers. .BI \-\-snapshot\-length= snaplen .PD Snarf \fIsnaplen\fP bytes of data from each packet rather than the -default of 65535 bytes. +default of 262144 bytes. Packets truncated because of a limited snapshot are indicated in the output with ``[|\fIproto\fP]'', where \fIproto\fP is the name of the protocol level at which the truncation has occurred. @@ -630,7 +624,7 @@ lost. You should limit \fIsnaplen\fP to the smallest number that will capture the protocol information you're interested in. Setting -\fIsnaplen\fP to 0 sets it to the default of 65535, +\fIsnaplen\fP to 0 sets it to the default of 262144, for backwards compatibility with recent older versions of .IR tcpdump . .TP @@ -644,6 +638,7 @@ Currently known types are \fBlmp\fR (Link Management Protocol), \fBpgm\fR (Pragmatic General Multicast), \fBpgm_zmtp1\fR (ZMTP/1.0 inside PGM/EPGM), +\fBresp\fR (REdis Serialization Protocol), \fBradius\fR (RADIUS), \fBrpc\fR (Remote Procedure Call), \fBrtp\fR (Real-Time Applications protocol), @@ -1882,11 +1877,15 @@ is the current clock time in the form .fi .RE and is as accurate as the kernel's clock. -The timestamp reflects the time the kernel first saw the packet. -No attempt -is made to account for the time lag between when the -Ethernet interface removed the packet from the wire and when the kernel -serviced the `new packet' interrupt. +The timestamp reflects the time the kernel applied a time stamp to the packet. +No attempt is made to account for the time lag between when the network +interface finished receiving the packet from the network and when the +kernel applied a time stamp to the packet; that time lag could include a +delay between the time when the network interface finished receiving a +packet from the network and the time when an interrupt was delivered to +the kernel to get it to read the packet and a delay between the time +when the kernel serviced the `new packet' interrupt and the time when it +applied a time stamp to the packet. .SH "SEE ALSO" stty(1), pcap(3PCAP), bpf(4), nit(4P), pcap-savefile(@MAN_FILE_FORMATS@), pcap-filter(@MAN_MISC_INFO@), pcap-tstamp(@MAN_MISC_INFO@) |
