bgp: Parse BGP extended message support capability

[tcpdump] / tcpdump.1.in

diff --git a/tcpdump.1.in b/tcpdump.1.in
index eb0599e542a222829b7ddaf0285aa79d4ee34a9c..de5db9955b9cc7ce2535a1e80aa5105914c2849a 100644 (file)
--- a/tcpdump.1.in
+++ b/tcpdump.1.in
@@ -20,7 +20,7 @@
 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 .\"
 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 .\"

-.TH TCPDUMP 1  "2 February 2017"
+.TH TCPDUMP 1  "29 November 2021"

 .SH NAME
 tcpdump \- dump traffic on a network
 .SH SYNOPSIS
 .SH NAME
 tcpdump \- dump traffic on a network
 .SH SYNOPSIS


@@ -39,6 +39,9 @@ tcpdump \- dump traffic on a network
 .I count
 ]
 [
 .I count
 ]
 [

+.B \-\-count
+]
+[

 .B \-C
 .I file_size
 ]
 .B \-C
 .I file_size
 ]


@@ -135,6 +138,13 @@ tcpdump \- dump traffic on a network
 ]
 .ti +8
 [
 ]
 .ti +8
 [

+.BI \-\-micro
+]
+[
+.BI \-\-nano
+]
+.ti +8
+[

 .I expression
 ]
 .br
 .I expression
 ]
 .br


@@ -142,7 +152,7 @@ tcpdump \- dump traffic on a network
 .SH DESCRIPTION
 .LP
 \fITcpdump\fP prints out a description of the contents of packets on a
 .SH DESCRIPTION
 .LP
 \fITcpdump\fP prints out a description of the contents of packets on a

-network interface that match the boolean \fIexpression\fP; the
+network interface that match the Boolean \fIexpression\fP; the

 description is preceded by a time stamp, printed, by default, as hours,
 minutes, seconds, and fractions of a second since midnight.  It can also
 be run with the
 description is preceded by a time stamp, printed, by default, as hours,
 minutes, seconds, and fractions of a second since midnight.  It can also
 be run with the


@@ -202,19 +212,23 @@ is running, if the OS reports that information to applications; if not,
 it will be reported as 0).
 .LP
 On platforms that support the SIGINFO signal, such as most BSDs
 it will be reported as 0).
 .LP
 On platforms that support the SIGINFO signal, such as most BSDs

-(including Mac OS X) and Digital/Tru64 UNIX, it will report those counts
+(including macOS) and Digital/Tru64 UNIX, it will report those counts

 when it receives a SIGINFO signal (generated, for example, by typing
 your ``status'' character, typically control-T, although on some
 when it receives a SIGINFO signal (generated, for example, by typing
 your ``status'' character, typically control-T, although on some

-platforms, such as Mac OS X, the ``status'' character is not set by
+platforms, such as macOS, the ``status'' character is not set by

 default, so you must set it with
 .BR stty (1)
 in order to use it) and will continue capturing packets. On platforms that
 do not support the SIGINFO signal, the same can be achieved by using the
 SIGUSR1 signal.
 .LP
 default, so you must set it with
 .BR stty (1)
 in order to use it) and will continue capturing packets. On platforms that
 do not support the SIGINFO signal, the same can be achieved by using the
 SIGUSR1 signal.
 .LP

+Using the SIGUSR2 signal along with the
+.B \-w
+flag will forcibly flush the packet buffer into the output file.
+.LP

 Reading packets from a network interface may require that you have
 special privileges; see the
 Reading packets from a network interface may require that you have
 special privileges; see the

-.B pcap (3PCAP)
+.BR pcap (3PCAP)

 man page for details.  Reading a saved packet file doesn't require
 special privileges.
 .SH OPTIONS
 man page for details.  Reading a saved packet file doesn't require
 special privileges.
 .SH OPTIONS


@@ -238,6 +252,12 @@ units of KiB (1024 bytes).
 .BI \-c " count"
 Exit after receiving \fIcount\fP packets.
 .TP
 .BI \-c " count"
 Exit after receiving \fIcount\fP packets.
 .TP

+.BI \-\-count
+Print only on stdout the packet count when reading capture file(s) instead
+of parsing/printing the packets. If a filter is specified on the command
+line, \fItcpdump\fP counts only packets that were matched by the filter
+expression.
+.TP

 .BI \-C " file_size"
 Before writing a raw packet to a savefile, check whether the file is
 currently larger than \fIfile_size\fP and, if so, close the current
 .BI \-C " file_size"
 Before writing a raw packet to a savefile, check whether the file is
 currently larger than \fIfile_size\fP and, if so, close the current


@@ -245,12 +265,43 @@ savefile and open a new one.  Savefiles after the first savefile will
 have the name specified with the
 .B \-w
 flag, with a number after it, starting at 1 and continuing upward.
 have the name specified with the
 .B \-w
 flag, with a number after it, starting at 1 and continuing upward.

-The units of \fIfile_size\fP are millions of bytes (1,000,000 bytes,
+The default unit of \fIfile_size\fP is millions of bytes (1,000,000 bytes,

 not 1,048,576 bytes).
 not 1,048,576 bytes).

+.IP
+By adding a suffix of k/K, m/M or g/G to the value, the unit
+can be changed to 1,024 (KiB), 1,048,576 (MiB), or 1,073,741,824 (GiB)
+respectively.

 .TP
 .B \-d
 Dump the compiled packet-matching code in a human readable form to
 standard output and stop.
 .TP
 .B \-d
 Dump the compiled packet-matching code in a human readable form to
 standard output and stop.

+.IP
+Please mind that although code compilation is always DLT-specific,
+typically it is impossible (and unnecessary) to specify which DLT to use
+for the dump because \fItcpdump\fP uses either the DLT of the input pcap
+file specified with
+.BR -r ,
+or the default DLT of the network interface specified with
+.BR -i ,
+or the particular DLT of the network interface specified with
+.B -y
+and
+.B -i
+respectively. In these cases the dump shows the same exact code that
+would filter the input file or the network interface without
+.BR -d .
+.IP
+However, when neither
+.B -r
+nor
+.B -i
+is specified, specifying
+.B -d
+prevents \fItcpdump\fP from guessing a suitable network interface (see
+.BR -i ).
+In this case the DLT defaults to EN10MB and can be set to another valid
+value manually with
+.BR -y .

 .TP
 .B \-dd
 Dump packet-matching code as a
 .TP
 .B \-dd
 Dump packet-matching code as a


@@ -270,7 +321,7 @@ which
 .I tcpdump
 can capture packets.  For each network interface, a number and an
 interface name, possibly followed by a text description of the
 .I tcpdump
 can capture packets.  For each network interface, a number and an
 interface name, possibly followed by a text description of the

-interface, is printed.  The interface name or the number can be supplied
+interface, are printed.  The interface name or the number can be supplied

 to the
 .B \-i
 flag to specify an interface on which to capture.
 to the
 .B \-i
 flag to specify an interface on which to capture.


@@ -288,7 +339,7 @@ flag will not be supported if
 was built with an older version of
 .I libpcap
 that lacks the
 was built with an older version of
 .I libpcap
 that lacks the

-.B pcap_findalldevs()
+.BR pcap_findalldevs (3PCAP)

 function.
 .TP
 .B \-e
 function.
 .TP
 .B \-e


@@ -317,7 +368,7 @@ with cryptography enabled.
 \fIsecret\fP is the ASCII text for ESP secret key.
 If preceded by 0x, then a hex value will be read.
 .IP
 \fIsecret\fP is the ASCII text for ESP secret key.
 If preceded by 0x, then a hex value will be read.
 .IP

-The option assumes RFC2406 ESP, not RFC1827 ESP.
+The option assumes RFC 2406 ESP, not RFC 1827 ESP.

 The option is only for debugging purposes, and
 the use of this option with a true `secret' key is discouraged.
 By presenting IPsec secret key onto command line
 The option is only for debugging purposes, and
 the use of this option with a true `secret' key is discouraged.
 By presenting IPsec secret key onto command line


@@ -357,6 +408,9 @@ Savefiles will have the name specified by
 which should include a time format as defined by
 .BR strftime (3).
 If no time format is specified, each new file will overwrite the previous.
 which should include a time format as defined by
 .BR strftime (3).
 If no time format is specified, each new file will overwrite the previous.

+Whenever a generated filename is not unique, tcpdump will overwrite the
+pre-existing data; providing a time specification that is coarser than the
+capture period is therefore not advised.

 .IP
 If used in conjunction with the
 .B \-C
 .IP
 If used in conjunction with the
 .B \-C


@@ -382,10 +436,13 @@ Attempt to detect 802.11s draft mesh headers.
 .TP
 .BI \-\-interface= interface
 .PD
 .TP
 .BI \-\-interface= interface
 .PD

-Listen on \fIinterface\fP.
-If unspecified, \fItcpdump\fP searches the system interface list for the
-lowest numbered, configured up interface (excluding loopback), which may turn
-out to be, for example, ``eth0''.
+Listen, report the list of link-layer types, report the list of time
+stamp types, or report the results of compiling a filter expression on
+\fIinterface\fP.  If unspecified and if the
+.B -d
+flag is not given, \fItcpdump\fP searches the system
+interface list for the lowest numbered, configured up interface
+(excluding loopback), which may turn out to be, for example, ``eth0''.

 .IP
 On Linux systems with 2.2 or later kernels, an
 .I interface
 .IP
 On Linux systems with 2.2 or later kernels, an
 .I interface


@@ -439,7 +496,7 @@ terminal rather than to a file or pipe.
 .PD
 Set the time stamp type for the capture to \fItstamp_type\fP.  The names
 to use for the time stamp types are given in
 .PD
 Set the time stamp type for the capture to \fItstamp_type\fP.  The names
 to use for the time stamp types are given in

-.BR pcap-tstamp (@MAN_MISC_INFO@);
+.BR \%pcap-tstamp (@MAN_MISC_INFO@);

 not all the types listed there will necessarily be valid for any given
 interface.
 .TP
 not all the types listed there will necessarily be valid for any given
 interface.
 .TP


@@ -471,6 +528,19 @@ The supported values for \fItimestamp_precision\fP are \fBmicro\fP for
 microsecond resolution and \fBnano\fP for nanosecond resolution.  The
 default is microsecond resolution.
 .TP
 microsecond resolution and \fBnano\fP for nanosecond resolution.  The
 default is microsecond resolution.
 .TP

+.B \-\-micro
+.PD 0
+.TP
+.B \-\-nano
+.PD
+Shorthands for \fB\-\-time\-stamp\-precision=micro\fP or
+\fB\-\-time\-stamp\-precision=nano\fP, adjusting the time stamp
+precision accordingly.  When reading packets from a savefile, using
+\fB\-\-micro\fP truncates time stamps if the savefile was created with
+nanosecond precision.  In contrast, a savefile created with microsecond
+precision will have trailing zeroes added to the time stamp when
+\fB\-\-nano\fP is used.
+.TP

 .B \-K
 .PD 0
 .TP
 .B \-K
 .PD 0
 .TP


@@ -600,7 +670,7 @@ lines are shorter.
 .BI \-r " file"
 Read packets from \fIfile\fR (which was created with the
 .B \-w
 .BI \-r " file"
 Read packets from \fIfile\fR (which was created with the
 .B \-w

-option or by other tools that write pcap or pcap-ng files).
+option or by other tools that write pcap or pcapng files).

 Standard input is used if \fIfile\fR is ``-''.
 .TP
 .B \-S
 Standard input is used if \fIfile\fR is ``-''.
 .TP
 .B \-S


@@ -620,14 +690,21 @@ default of 262144 bytes.
 Packets truncated because of a limited snapshot
 are indicated in the output with ``[|\fIproto\fP]'', where \fIproto\fP
 is the name of the protocol level at which the truncation has occurred.
 Packets truncated because of a limited snapshot
 are indicated in the output with ``[|\fIproto\fP]'', where \fIproto\fP
 is the name of the protocol level at which the truncation has occurred.

+.IP

 Note that taking larger snapshots both increases
 the amount of time it takes to process packets and, effectively,
 decreases the amount of packet buffering.
 This may cause packets to be
 lost.
 Note that taking larger snapshots both increases
 the amount of time it takes to process packets and, effectively,
 decreases the amount of packet buffering.
 This may cause packets to be
 lost.

-You should limit \fIsnaplen\fP to the smallest number that will
-capture the protocol information you're interested in.
-Setting
+Note also that taking smaller snapshots will discard data from protocols
+above the transport layer, which loses information that may be
+important.  NFS and AFS requests and replies, for example, are very
+large, and much of the detail won't be available if a too-short snapshot
+length is selected.
+.IP
+If you need to reduce the snapshot size below the default, you should
+limit \fIsnaplen\fP to the smallest number that will capture the
+protocol information you're interested in.  Setting

 \fIsnaplen\fP to 0 sets it to the default of 262144,
 for backwards compatibility with recent older versions of
 .IR tcpdump .
 \fIsnaplen\fP to 0 sets it to the default of 262144,
 for backwards compatibility with recent older versions of
 .IR tcpdump .


@@ -639,21 +716,25 @@ Currently known types are
 \fBaodv\fR (Ad-hoc On-demand Distance Vector protocol),
 \fBcarp\fR (Common Address Redundancy Protocol),
 \fBcnfp\fR (Cisco NetFlow protocol),
 \fBaodv\fR (Ad-hoc On-demand Distance Vector protocol),
 \fBcarp\fR (Common Address Redundancy Protocol),
 \fBcnfp\fR (Cisco NetFlow protocol),

+\fBdomain\fR (Domain Name System),

 \fBlmp\fR (Link Management Protocol),
 \fBpgm\fR (Pragmatic General Multicast),
 \fBpgm_zmtp1\fR (ZMTP/1.0 inside PGM/EPGM),
 \fBlmp\fR (Link Management Protocol),
 \fBpgm\fR (Pragmatic General Multicast),
 \fBpgm_zmtp1\fR (ZMTP/1.0 inside PGM/EPGM),

-\fBresp\fR (REdis Serialization Protocol),
+\fBptp\fR (Precision Time Protocol),
+\fBquic\fR (QUIC),

 \fBradius\fR (RADIUS),
 \fBradius\fR (RADIUS),

+\fBresp\fR (REdis Serialization Protocol),

 \fBrpc\fR (Remote Procedure Call),
 \fBrpc\fR (Remote Procedure Call),

-\fBrtp\fR (Real-Time Applications protocol),

 \fBrtcp\fR (Real-Time Applications control protocol),
 \fBrtcp\fR (Real-Time Applications control protocol),

+\fBrtp\fR (Real-Time Applications protocol),

 \fBsnmp\fR (Simple Network Management Protocol),
 \fBsnmp\fR (Simple Network Management Protocol),

+\fBsomeip\fR (SOME/IP),

 \fBtftp\fR (Trivial File Transfer Protocol),
 \fBvat\fR (Visual Audio Tool),
 \fBtftp\fR (Trivial File Transfer Protocol),
 \fBvat\fR (Visual Audio Tool),

-\fBwb\fR (distributed White Board),
-\fBzmtp1\fR (ZeroMQ Message Transport Protocol 1.0)
+\fBvxlan\fR (Virtual eXtensible Local Area Network),
+\fBwb\fR (distributed White Board)

 and
 and

-\fBvxlan\fR (Virtual eXtensible Local Area Network).
+\fBzmtp1\fR (ZeroMQ Message Transport Protocol 1.0).

 .IP
 Note that the \fBpgm\fR type above affects UDP interpretation only, the native
 PGM is always recognised as IP protocol 113 regardless. UDP-encapsulated PGM is
 .IP
 Note that the \fBpgm\fR type above affects UDP interpretation only, the native
 PGM is always recognised as IP protocol 113 regardless. UDP-encapsulated PGM is


@@ -673,16 +754,20 @@ Print the timestamp, as seconds since January 1, 1970, 00:00:00, UTC, and
 fractions of a second since that time, on each dump line.
 .TP
 .B \-ttt
 fractions of a second since that time, on each dump line.
 .TP
 .B \-ttt

-Print a delta (micro-second resolution) between current and previous line
-on each dump line.
+Print a delta (microsecond or nanosecond resolution depending on the
+.B \-\-time\-stamp-precision
+option) between current and previous line on each dump line.
+The default is microsecond resolution.

 .TP
 .B \-tttt
 Print a timestamp, as hours, minutes, seconds, and fractions of a second
 since midnight, preceded by the date, on each dump line.
 .TP
 .B \-ttttt
 .TP
 .B \-tttt
 Print a timestamp, as hours, minutes, seconds, and fractions of a second
 since midnight, preceded by the date, on each dump line.
 .TP
 .B \-ttttt

-Print a delta (micro-second resolution) between current and first line
-on each dump line.
+Print a delta (microsecond or nanosecond resolution depending on the
+.B \-\-time\-stamp-precision
+option) between current and first line on each dump line.
+The default is microsecond resolution.

 .TP
 .B \-u
 Print undecoded NFS handles.
 .TP
 .B \-u
 Print undecoded NFS handles.


@@ -716,7 +801,7 @@ flag will not be supported if
 was built with an older version of
 .I libpcap
 that lacks the
 was built with an older version of
 .I libpcap
 that lacks the

-.B pcap_dump_flush()
+.BR pcap_dump_flush (3PCAP)

 function.
 .TP
 .B \-v
 function.
 .TP
 .B \-v


@@ -728,7 +813,12 @@ IP and ICMP header checksum.
 .IP
 When writing to a file with the
 .B \-w
 .IP
 When writing to a file with the
 .B \-w

-option, report, every 10 seconds, the number of packets captured.
+option and at the same time not reading from a file with the
+.B \-r
+option, report to stderr, once per second, the number of packets captured. In
+Solaris, FreeBSD and possibly other operating systems this periodic update
+currently can cause loss of captured packets on their way from the kernel to
+tcpdump.

 .TP
 .B \-vv
 Even more verbose output.
 .TP
 .B \-vv
 Even more verbose output.


@@ -770,10 +860,10 @@ operating systems and applications will use the extension if it is
 present and adding one (e.g. .pcap) is recommended.
 .IP
 See
 present and adding one (e.g. .pcap) is recommended.
 .IP
 See

-.BR pcap-savefile (@MAN_FILE_FORMATS@)
+.BR \%pcap-savefile (@MAN_FILE_FORMATS@)

 for a description of the file format.
 .TP
 for a description of the file format.
 .TP

-.B \-W
+.BI \-W " filecount"

 Used in conjunction with the
 .B \-C
 option, this will limit the number
 Used in conjunction with the
 .B \-C
 option, this will limit the number


@@ -786,9 +876,15 @@ files, allowing them to sort correctly.
 Used in conjunction with the
 .B \-G
 option, this will limit the number of rotated dump files that get
 Used in conjunction with the
 .B \-G
 option, this will limit the number of rotated dump files that get

-created, exiting with status 0 when reaching the limit. If used with
+created, exiting with status 0 when reaching the limit.
+.IP
+If used in conjunction with both

 .B \-C
 .B \-C

-as well, the behavior will result in cyclical files per timeslice.
+and
+.B \-G,
+the
+.B \-W
+option will currently be ignored, and will only affect the file name.

 .TP
 .B \-x
 When parsing and printing,
 .TP
 .B \-x
 When parsing and printing,


@@ -800,6 +896,9 @@ bytes will be printed.  Note that this is the entire link-layer
 packet, so for link layers that pad (e.g. Ethernet), the padding bytes
 will also be printed when the higher layer packet is shorter than the
 required padding.
 packet, so for link layers that pad (e.g. Ethernet), the padding bytes
 will also be printed when the higher layer packet is shorter than the
 required padding.

+In the current implementation this flag may have the same effect as
+.B \-xx
+if the packet is truncated.

 .TP
 .B \-xx
 When parsing and printing,
 .TP
 .B \-xx
 When parsing and printing,


@@ -813,6 +912,9 @@ When parsing and printing,
 in addition to printing the headers of each packet, print the data of
 each packet (minus its link level header) in hex and ASCII.
 This is very handy for analysing new protocols.
 in addition to printing the headers of each packet, print the data of
 each packet (minus its link level header) in hex and ASCII.
 This is very handy for analysing new protocols.

+In the current implementation this flag may have the same effect as
+.B \-XX
+if the packet is truncated.

 .TP
 .B \-XX
 When parsing and printing,
 .TP
 .B \-XX
 When parsing and printing,


@@ -826,7 +928,11 @@ its link level header, in hex and ASCII.
 .TP
 .BI \-\-linktype= datalinktype
 .PD
 .TP
 .BI \-\-linktype= datalinktype
 .PD

-Set the data link type to use while capturing packets to \fIdatalinktype\fP.
+Set the data link type to use while capturing packets (see
+.BR -L )
+or just compiling and dumping packet-matching code (see
+.BR -d )
+to \fIdatalinktype\fP.

 .TP
 .BI \-z " postrotate-command"
 Used in conjunction with the
 .TP
 .BI \-z " postrotate-command"
 Used in conjunction with the


@@ -876,7 +982,7 @@ Otherwise,
 only packets for which \fIexpression\fP is `true' will be dumped.
 .LP
 For the \fIexpression\fP syntax, see
 only packets for which \fIexpression\fP is `true' will be dumped.
 .LP
 For the \fIexpression\fP syntax, see

-.BR pcap-filter (@MAN_MISC_INFO@).
+.BR \%pcap-filter (@MAN_MISC_INFO@).

 .LP
 The \fIexpression\fP argument can be passed to \fItcpdump\fP as either a single
 Shell argument, or as multiple Shell arguments, whichever is more convenient.
 .LP
 The \fIexpression\fP argument can be passed to \fItcpdump\fP as either a single
 Shell argument, or as multiple Shell arguments, whichever is more convenient.


@@ -945,6 +1051,16 @@ tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net \fIlocal
 .fi
 .RE
 .LP
 .fi
 .RE
 .LP

+To print the TCP packets with flags RST and ACK both set.
+(i.e. select only the RST and ACK flags in the flags field, and if the result
+is "RST and ACK both set", match)
+.RS
+.nf
+.B
+tcpdump 'tcp[tcpflags] & (tcp-rst|tcp-ack) == (tcp-rst|tcp-ack)'
+.fi
+.RE
+.LP

 To print all IPv4 HTTP packets to and from port 80, i.e. print only
 packets that contain data, not, for example, SYN and FIN packets and
 ACK-only packets.  (IPv6 is left as an exercise for the reader.)
 To print all IPv4 HTTP packets to and from port 80, i.e. print only
 packets that contain data, not, for example, SYN and FIN packets and
 ACK-only packets.  (IPv6 is left as an exercise for the reader.)


@@ -1047,7 +1163,7 @@ As on FDDI networks,
 packets are assumed to contain an LLC packet.
 .LP
 \fI(N.B.: The following description assumes familiarity with
 packets are assumed to contain an LLC packet.
 .LP
 \fI(N.B.: The following description assumes familiarity with

-the SLIP compression algorithm described in RFC-1144.)\fP
+the SLIP compression algorithm described in RFC 1144.)\fP

 .LP
 On SLIP links, a direction indicator (``I'' for inbound, ``O'' for outbound),
 packet type, and compression information are printed out.
 .LP
 On SLIP links, a direction indicator (``I'' for inbound, ``O'' for outbound),
 packet type, and compression information are printed out.


@@ -1079,7 +1195,7 @@ data and 6 bytes of compressed header:
 .HD
 ARP/RARP Packets
 .LP
 .HD
 ARP/RARP Packets
 .LP

-Arp/rarp output shows the type of request and its arguments.
+ARP/RARP output shows the type of request and its arguments.

 The
 format is intended to be self explanatory.
 Here is a short sample taken from the start of an `rlogin' from
 The
 format is intended to be self explanatory.
 Here is a short sample taken from the start of an `rlogin' from


@@ -1092,7 +1208,7 @@ arp reply csam is-at CSAM\fR
 .sp .5
 .fi
 .RE
 .sp .5
 .fi
 .RE

-The first line says that rtsg sent an arp packet asking
+The first line says that rtsg sent an ARP packet asking

 for the Ethernet address of internet host csam.
 Csam
 replies with its Ethernet address (in this example, Ethernet addresses
 for the Ethernet address of internet host csam.
 Csam
 replies with its Ethernet address (in this example, Ethernet addresses


@@ -1145,7 +1261,7 @@ those are reported as \fBECT(1)\fP, \fBECT(0)\fP, or \fBCE\fP.
 \fIoffset\fP is the fragment offset field; it is printed whether this is
 part of a fragmented datagram or not.
 \fIflags\fP are the MF and DF flags; \fB+\fP is reported if MF is set,
 \fIoffset\fP is the fragment offset field; it is printed whether this is
 part of a fragmented datagram or not.
 \fIflags\fP are the MF and DF flags; \fB+\fP is reported if MF is set,

-and \fBDF\P is reported if F is set.  If neither are set, \fB.\fP is
+and \fBDF\fP is reported if F is set.  If neither are set, \fB.\fP is

 reported.
 \fIproto\fP is the protocol ID field.
 \fIlength\fP is the total length field.
 reported.
 \fIproto\fP is the protocol ID field.
 \fIlength\fP is the total length field.


@@ -1168,7 +1284,7 @@ flag, in the IP header information, as described above.
 TCP Packets
 .LP
 \fI(N.B.:The following description assumes familiarity with
 TCP Packets
 .LP
 \fI(N.B.:The following description assumes familiarity with

-the TCP protocol described in RFC-793.
+the TCP protocol described in RFC 793.

 If you are not familiar
 with the protocol, this description will not
 be of much use to you.)\fP
 If you are not familiar
 with the protocol, this description will not
 be of much use to you.)\fP


@@ -1206,7 +1322,7 @@ host \fIcsam\fP.
 .RS
 .nf
 .sp .5
 .RS
 .nf
 .sp .5

-\s-2\f(CWIP rtsg.1023 > csam.login: Flags [S], seq 768512:768512, win 4096, opts [mss 1024]
+\f(CWIP rtsg.1023 > csam.login: Flags [S], seq 768512:768512, win 4096, opts [mss 1024]

 IP csam.login > rtsg.1023: Flags [S.], seq, 947648:947648, ack 768513, win 4096, opts [mss 1024]
 IP rtsg.1023 > csam.login: Flags [.], ack 1, win 4096
 IP rtsg.1023 > csam.login: Flags [P.], seq 1:2, ack 1, win 4096, length 1
 IP csam.login > rtsg.1023: Flags [S.], seq, 947648:947648, ack 768513, win 4096, opts [mss 1024]
 IP rtsg.1023 > csam.login: Flags [.], ack 1, win 4096
 IP rtsg.1023 > csam.login: Flags [P.], seq 1:2, ack 1, win 4096, length 1


@@ -1214,7 +1330,7 @@ IP csam.login > rtsg.1023: Flags [.], ack 2, win 4096
 IP rtsg.1023 > csam.login: Flags [P.], seq 2:21, ack 1, win 4096, length 19
 IP csam.login > rtsg.1023: Flags [P.], seq 1:2, ack 21, win 4077, length 1
 IP csam.login > rtsg.1023: Flags [P.], seq 2:3, ack 21, win 4077, urg 1, length 1
 IP rtsg.1023 > csam.login: Flags [P.], seq 2:21, ack 1, win 4096, length 19
 IP csam.login > rtsg.1023: Flags [P.], seq 1:2, ack 21, win 4077, length 1
 IP csam.login > rtsg.1023: Flags [P.], seq 2:3, ack 21, win 4077, urg 1, length 1

-IP csam.login > rtsg.1023: Flags [P.], seq 3:4, ack 21, win 4077, urg 1, length 1\fR\s+2
+IP csam.login > rtsg.1023: Flags [P.], seq 3:4, ack 21, win 4077, urg 1, length 1\fR

 .sp .5
 .fi
 .RE
 .sp .5
 .fi
 .RE


@@ -1226,16 +1342,16 @@ The packet sequence number was 768512 and it contained no data.
 (The notation is `first:last' which means `sequence
 numbers \fIfirst\fP
 up to but not including \fIlast\fP'.)
 (The notation is `first:last' which means `sequence
 numbers \fIfirst\fP
 up to but not including \fIlast\fP'.)

-There was no piggy-backed ack, the available receive window was 4096
-bytes and there was a max-segment-size option requesting an mss of
+There was no piggy-backed ACK, the available receive window was 4096
+bytes and there was a max-segment-size option requesting an MSS of

 1024 bytes.
 .LP
 Csam replies with a similar packet except it includes a piggy-backed
 1024 bytes.
 .LP
 Csam replies with a similar packet except it includes a piggy-backed

-ack for rtsg's SYN.
-Rtsg then acks csam's SYN.
+ACK for rtsg's SYN.
+Rtsg then ACKs csam's SYN.

 The `.' means the ACK flag was set.
 The packet contained no data so there is no data sequence number or length.
 The `.' means the ACK flag was set.
 The packet contained no data so there is no data sequence number or length.

-Note that the ack sequence
+Note that the ACK sequence

 number is a small integer (1).
 The first time \fItcpdump\fP sees a
 TCP `conversation', it prints the sequence number from the packet.
 number is a small integer (1).
 The first time \fItcpdump\fP sees a
 TCP `conversation', it prints the sequence number from the packet.


@@ -1487,23 +1603,23 @@ UDP format is illustrated by this rwho packet:
 .sp .5
 .fi
 .RE
 .sp .5
 .fi
 .RE

-This says that port \fIwho\fP on host \fIactinide\fP sent a udp
+This says that port \fIwho\fP on host \fIactinide\fP sent a UDP

 datagram to port \fIwho\fP on host \fIbroadcast\fP, the Internet
 broadcast address.
 The packet contained 84 bytes of user data.
 .LP
 Some UDP services are recognized (from the source or destination
 port number) and the higher level protocol information printed.
 datagram to port \fIwho\fP on host \fIbroadcast\fP, the Internet
 broadcast address.
 The packet contained 84 bytes of user data.
 .LP
 Some UDP services are recognized (from the source or destination
 port number) and the higher level protocol information printed.

-In particular, Domain Name service requests (RFC-1034/1035) and Sun
-RPC calls (RFC-1050) to NFS.
+In particular, Domain Name service requests (RFC 1034/1035) and Sun
+RPC calls (RFC 1050) to NFS.

 .HD
 .HD

-UDP Name Server Requests
+TCP or UDP Name Server Requests

 .LP
 \fI(N.B.:The following description assumes familiarity with
 .LP
 \fI(N.B.:The following description assumes familiarity with

-the Domain Service protocol described in RFC-1035.
+the Domain Service protocol described in RFC 1035.

 If you are not familiar
 with the protocol, the following description will appear to be written
 If you are not familiar
 with the protocol, the following description will appear to be written

-in greek.)\fP
+in Greek.)\fP

 .LP
 Name server requests are formatted as
 .RS
 .LP
 Name server requests are formatted as
 .RS


@@ -1520,7 +1636,7 @@ address record (qtype=A) associated with the name \fIucbvax.berkeley.edu.\fP
 The query id was `3'.
 The `+' indicates the \fIrecursion desired\fP flag
 was set.
 The query id was `3'.
 The `+' indicates the \fIrecursion desired\fP flag
 was set.

-The query length was 37 bytes, not including the UDP and
+The query length was 37 bytes, excluding the TCP or UDP and

 IP protocol headers.
 The query operation was the normal one, \fIQuery\fP,
 so the op field was omitted.
 IP protocol headers.
 The query operation was the normal one, \fIQuery\fP,
 so the op field was omitted.


@@ -1544,7 +1660,7 @@ If any of the response bits are set (AA, RA or rcode) or any of the
 `must be zero' bits are set in bytes two and three, `[b2&3=\fIx\fP]'
 is printed, where \fIx\fP is the hex value of header bytes two and three.
 .HD
 `must be zero' bits are set in bytes two and three, `[b2&3=\fIx\fP]'
 is printed, where \fIx\fP is the hex value of header bytes two and three.
 .HD

-UDP Name Server Responses
+TCP or UDP Name Server Responses

 .LP
 Name server responses are formatted as
 .RS
 .LP
 Name server responses are formatted as
 .RS


@@ -1562,7 +1678,7 @@ with 3 answer records, 3 name server records and 7 additional records.
 The first answer record is type A (address) and its data is internet
 address 128.32.137.3.
 The total size of the response was 273 bytes,
 The first answer record is type A (address) and its data is internet
 address 128.32.137.3.
 The total size of the response was 273 bytes,

-excluding UDP and IP headers.
+excluding TCP or UDP and IP headers.

 The op (Query) and response code
 (NoError) were omitted, as was the class (C_IN) of the A record.
 .LP
 The op (Query) and response code
 (NoError) were omitted, as was the class (C_IN) of the A record.
 .LP


@@ -1594,8 +1710,7 @@ may take up a page or more, so only use -v if you really want all the
 gory details.
 .LP
 For information on SMB packet formats and what all the fields mean see
 gory details.
 .LP
 For information on SMB packet formats and what all the fields mean see

-www.cifs.org or the pub/samba/specs/ directory on your favorite
-samba.org mirror site.
+\%https://download.samba.org/pub/samba/specs/ and other online resources.

 The SMB patches were written by Andrew Tridgell
 ([email protected]).
 .HD
 The SMB patches were written by Andrew Tridgell
 ([email protected]).
 .HD


@@ -1671,15 +1786,10 @@ printed, depending on the filter expression used).
 Because the \-v flag
 is given, some of the file attributes (which are returned in addition
 to the file data) are printed: the file type (``REG'', for regular file),
 Because the \-v flag
 is given, some of the file attributes (which are returned in addition
 to the file data) are printed: the file type (``REG'', for regular file),

-the file mode (in octal), the uid and gid, and the file size.
+the file mode (in octal), the UID and GID, and the file size.

 .LP
 If the \-v flag is given more than once, even more details are printed.
 .LP
 .LP
 If the \-v flag is given more than once, even more details are printed.
 .LP

-Note that NFS requests are very large and much of the detail won't be printed
-unless \fIsnaplen\fP is increased.
-Try using `\fB\-s 192\fP' to watch
-NFS traffic.
-.LP

 NFS reply packets do not explicitly identify the RPC operation.
 Instead,
 \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the
 NFS reply packets do not explicitly identify the RPC operation.
 Instead,
 \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the


@@ -1743,11 +1853,6 @@ Error codes are printed for abort packets, with the exception of Ubik
 beacon packets (because abort packets are used to signify a yes vote
 for the Ubik protocol).
 .LP
 beacon packets (because abort packets are used to signify a yes vote
 for the Ubik protocol).
 .LP

-Note that AFS requests are very large and many of the arguments won't
-be printed unless \fIsnaplen\fP is increased.
-Try using `\fB-s 256\fP'
-to watch AFS traffic.
-.LP

 AFS reply packets do not explicitly identify the RPC operation.
 Instead,
 \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the
 AFS reply packets do not explicitly identify the RPC operation.
 Instead,
 \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the


@@ -1825,9 +1930,9 @@ protocol) and packet size.
 .RS
 .nf
 .sp .5
 .RS
 .nf
 .sp .5

-\s-2\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"
+\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"

 jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250
 jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250

-techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fR\s+2
+techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fR

 .sp .5
 .fi
 .RE
 .sp .5
 .fi
 .RE


@@ -1845,7 +1950,7 @@ another reply to the same request saying host techpit has laserwriter
 .RS
 .nf
 .sp .5
 .RS
 .nf
 .sp .5

-\s-2\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001
+\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001

 helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000


@@ -1858,7 +1963,7 @@ jssmag.209.165 > helios.132: atp-req  12266<3,5> 0xae030001
 helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
 jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001
 helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
 jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001

-jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fR\s+2
+jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fR

 .sp .5
 .fi
 .RE
 .sp .5
 .fi
 .RE


@@ -1871,7 +1976,7 @@ Helios responds with 8 512-byte packets.
 The `:digit' following the
 transaction id gives the packet sequence number in the transaction
 and the number in parens is the amount of data in the packet,
 The `:digit' following the
 transaction id gives the packet sequence number in the transaction
 and the number in parens is the amount of data in the packet,

-excluding the atp header.
+excluding the ATP header.

 The `*' on packet 7 indicates that the
 EOM bit was set.
 .LP
 The `*' on packet 7 indicates that the
 EOM bit was set.
 .LP


@@ -1884,11 +1989,18 @@ The `*' on the request
 indicates that XO (`exactly once') was \fInot\fP set.
 
 .SH "SEE ALSO"
 indicates that XO (`exactly once') was \fInot\fP set.
 
 .SH "SEE ALSO"

-stty(1), pcap(3PCAP), bpf(4), nit(4P), pcap-savefile(@MAN_FILE_FORMATS@),
-pcap-filter(@MAN_MISC_INFO@), pcap-tstamp(@MAN_MISC_INFO@)
+.BR stty (1),
+.BR pcap (3PCAP),
+.BR bpf (4),
+.BR nit (4P),
+.BR \%pcap-savefile (@MAN_FILE_FORMATS@),
+.BR \%pcap-filter (@MAN_MISC_INFO@),
+.BR \%pcap-tstamp (@MAN_MISC_INFO@)

 .LP
 .RS
 .LP
 .RS

-.I http://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap
+.na
+.I https://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap
+.ad

 .RE
 .LP
 .SH AUTHORS
 .RE
 .LP
 .SH AUTHORS


@@ -1901,10 +2013,10 @@ Lawrence Berkeley National Laboratory, University of California, Berkeley, CA.
 .LP
 It is currently being maintained by tcpdump.org.
 .LP
 .LP
 It is currently being maintained by tcpdump.org.
 .LP

-The current version is available via http:
+The current version is available via HTTPS:

 .LP
 .RS
 .LP
 .RS

-.I http://www.tcpdump.org/
+.I https://www.tcpdump.org/

 .RE
 .LP
 The original distribution is available via anonymous ftp:
 .RE
 .LP
 The original distribution is available via anonymous ftp:


@@ -1919,7 +2031,7 @@ This program uses OpenSSL/LibreSSL, under specific configurations.
 To report a security issue please send an e-mail to \%[email protected].
 .LP
 To report bugs and other problems, contribute patches, request a
 To report a security issue please send an e-mail to \%[email protected].
 .LP
 To report bugs and other problems, contribute patches, request a

-feature, provide generic feedback etc please see the file
+feature, provide generic feedback etc. please see the file

 .I CONTRIBUTING
 in the tcpdump source tree root.
 .LP
 .I CONTRIBUTING
 in the tcpdump source tree root.
 .LP


@@ -1935,7 +2047,7 @@ be copied from the kernel in order to be filtered in user mode;
 .IP
 all of a packet, not just the part that's within the snapshot length,
 will be copied from the kernel (the 2.0[.x] packet capture mechanism, if
 .IP
 all of a packet, not just the part that's within the snapshot length,
 will be copied from the kernel (the 2.0[.x] packet capture mechanism, if

-asked to copy only part of a packet to userland, will not report the
+asked to copy only part of a packet to userspace, will not report the

 true length of the packet; this would cause most IP packets to get an
 error from
 .BR tcpdump );
 true length of the packet; this would cause most IP packets to get an
 error from
 .BR tcpdump );