The third argument to linkaddr_string is one of the LINKADDR_ enums.

[tcpdump] / tcpdump.1.in

diff --git a/tcpdump.1.in b/tcpdump.1.in
index 2314bc8cd79ced4818fdbd245c4fc023cce71e4c..c977e06f1bb58d08635bec8395ad02c279b50132 100644 (file)
--- a/tcpdump.1.in
+++ b/tcpdump.1.in
@@ -20,14 +20,14 @@
 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 .\"
 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 .\"

-.TH TCPDUMP 1  "11 July 2014"
+.TH TCPDUMP 1  "2 Apr 2019"

 .SH NAME
 tcpdump \- dump traffic on a network
 .SH SYNOPSIS
 .na
 .B tcpdump
 [
 .SH NAME
 tcpdump \- dump traffic on a network
 .SH SYNOPSIS
 .na
 .B tcpdump
 [

-.B \-AbdDefhHIJKlLnNOpqRStuUvxX#
+.B \-AbdDefhHIJKlLnNOpqStuUvxX#

 ] [
 .B \-B
 .I buffer_size
 ] [
 .B \-B
 .I buffer_size


@@ -38,24 +38,32 @@ tcpdump \- dump traffic on a network
 .B \-c
 .I count
 ]
 .B \-c
 .I count
 ]

-.br
-.ti +8

 [
 .B \-C
 .I file_size
 [
 .B \-C
 .I file_size

-] [
-.B \-G
-.I rotate_seconds
-] [
+]
+.ti +8
+[
+.B \-E
+.I spi@ipaddr algo:secret,...
+]
+.ti +8
+[

 .B \-F
 .I file
 ]
 .B \-F
 .I file
 ]

-.br
-.ti +8
+[
+.B \-G
+.I rotate_seconds
+]

 [
 .B \-i
 .I interface
 ]
 [
 .B \-i
 .I interface
 ]

+.ti +8
+[
+.B \-\-immediate\-mode
+]

 [
 .B \-j
 .I tstamp_type
 [
 .B \-j
 .I tstamp_type


@@ -64,16 +72,18 @@ tcpdump \- dump traffic on a network
 .B \-m
 .I module
 ]
 .B \-m
 .I module
 ]

+.ti +8

 [
 .B \-M
 .I secret
 ]
 [
 .B \-M
 .I secret
 ]

-.br
-.ti +8

 [
 .B \-\-number
 ]
 [
 [
 .B \-\-number
 ]
 [

+.B \-\-print
+]
+[

 .B \-Q
 .I in|out|inout
 ]
 .B \-Q
 .I in|out|inout
 ]


@@ -83,10 +93,6 @@ tcpdump \- dump traffic on a network
 .I file
 ]
 [
 .I file
 ]
 [

-.B \-V
-.I file
-]
-[

 .B \-s
 .I snaplen
 ]
 .B \-s
 .I snaplen
 ]


@@ -95,27 +101,26 @@ tcpdump \- dump traffic on a network
 .I type
 ]
 [
 .I type
 ]
 [

+.B \-\-version
+]
+.ti +8
+[
+.B \-V
+.I file
+]
+[

 .B \-w
 .I file
 ]
 .B \-w
 .I file
 ]

-.br
-.ti +8

 [
 .B \-W
 .I filecount
 ]
 [
 .B \-W
 .I filecount
 ]

-.br
-.ti +8
-[
-.B \-E
-.I spi@ipaddr algo:secret,...
-]
-.br
-.ti +8

 [
 .B \-y
 .I datalinktype
 ]
 [
 .B \-y
 .I datalinktype
 ]

+.ti +8

 [
 .B \-z
 .I postrotate-command
 [
 .B \-z
 .I postrotate-command


@@ -130,13 +135,6 @@ tcpdump \- dump traffic on a network
 ]
 .ti +8
 [
 ]
 .ti +8
 [

-.B \-\-immediate\-mode
-]
-[
-.B \-\-version
-]
-.ti +8
-[

 .I expression
 ]
 .br
 .I expression
 ]
 .br


@@ -204,17 +202,23 @@ is running, if the OS reports that information to applications; if not,
 it will be reported as 0).
 .LP
 On platforms that support the SIGINFO signal, such as most BSDs
 it will be reported as 0).
 .LP
 On platforms that support the SIGINFO signal, such as most BSDs

-(including Mac OS X) and Digital/Tru64 UNIX, it will report those counts
+(including macOS) and Digital/Tru64 UNIX, it will report those counts

 when it receives a SIGINFO signal (generated, for example, by typing
 your ``status'' character, typically control-T, although on some
 when it receives a SIGINFO signal (generated, for example, by typing
 your ``status'' character, typically control-T, although on some

-platforms, such as Mac OS X, the ``status'' character is not set by
+platforms, such as macOS, the ``status'' character is not set by

 default, so you must set it with
 .BR stty (1)
 default, so you must set it with
 .BR stty (1)

-in order to use it) and will continue capturing packets.
+in order to use it) and will continue capturing packets. On platforms that
+do not support the SIGINFO signal, the same can be achieved by using the
+SIGUSR1 signal.
+.LP
+Using the SIGUSR2 signal along with the
+.B \-w
+flag will forcibly flush the packet buffer into the output file.

 .LP
 Reading packets from a network interface may require that you have
 special privileges; see the
 .LP
 Reading packets from a network interface may require that you have
 special privileges; see the

-.B pcap (3PCAP)
+.BR pcap (3PCAP)

 man page for details.  Reading a saved packet file doesn't require
 special privileges.
 .SH OPTIONS
 man page for details.  Reading a saved packet file doesn't require
 special privileges.
 .SH OPTIONS


@@ -288,7 +292,7 @@ flag will not be supported if
 was built with an older version of
 .I libpcap
 that lacks the
 was built with an older version of
 .I libpcap
 that lacks the

-.B pcap_findalldevs()
+.BR pcap_findalldevs(3PCAP)

 function.
 .TP
 .B \-e
 function.
 .TP
 .B \-e


@@ -357,6 +361,9 @@ Savefiles will have the name specified by
 which should include a time format as defined by
 .BR strftime (3).
 If no time format is specified, each new file will overwrite the previous.
 which should include a time format as defined by
 .BR strftime (3).
 If no time format is specified, each new file will overwrite the previous.

+Whenever a generated filename is not unique, tcpdump will overwrite the
+preexisting data; providing a time specification that is coarser than the
+capture period is therefore not advised.

 .IP
 If used in conjunction with the
 .B \-C
 .IP
 If used in conjunction with the
 .B \-C


@@ -398,7 +405,7 @@ If the
 flag is supported, an interface number as printed by that flag can be
 used as the
 .I interface
 flag is supported, an interface number as printed by that flag can be
 used as the
 .I interface

-argument.
+argument, if no interface on the system has that number as a name.

 .TP
 .B \-I
 .PD 0
 .TP
 .B \-I
 .PD 0


@@ -439,7 +446,7 @@ terminal rather than to a file or pipe.
 .PD
 Set the time stamp type for the capture to \fItstamp_type\fP.  The names
 to use for the time stamp types are given in
 .PD
 Set the time stamp type for the capture to \fItstamp_type\fP.  The names
 to use for the time stamp types are given in

-.BR pcap-tstamp (@MAN_MISC_INFO@);
+.BR \%pcap-tstamp (@MAN_MISC_INFO@);

 not all the types listed there will necessarily be valid for any given
 interface.
 .TP
 not all the types listed there will necessarily be valid for any given
 interface.
 .TP


@@ -461,16 +468,29 @@ accuracy to a savefile, the time stamps are written with nanosecond
 resolution, and the file is written with a different magic number, to
 indicate that the time stamps are in seconds and nanoseconds; not all
 programs that read pcap savefiles will be able to read those captures.
 resolution, and the file is written with a different magic number, to
 indicate that the time stamps are in seconds and nanoseconds; not all
 programs that read pcap savefiles will be able to read those captures.

-.LP
+.IP

 When reading a savefile, convert time stamps to the precision specified
 by \fItimestamp_precision\fP, and display them with that resolution.  If
 the precision specified is less than the precision of time stamps in the
 file, the conversion will lose precision.
 When reading a savefile, convert time stamps to the precision specified
 by \fItimestamp_precision\fP, and display them with that resolution.  If
 the precision specified is less than the precision of time stamps in the
 file, the conversion will lose precision.

-.LP
+.IP

 The supported values for \fItimestamp_precision\fP are \fBmicro\fP for
 microsecond resolution and \fBnano\fP for nanosecond resolution.  The
 default is microsecond resolution.
 .TP
 The supported values for \fItimestamp_precision\fP are \fBmicro\fP for
 microsecond resolution and \fBnano\fP for nanosecond resolution.  The
 default is microsecond resolution.
 .TP

+.B \-\-micro
+.PD 0
+.TP
+.B \-\-nano
+.PD
+Shorthands for \fB\-\-time\-stamp\-precision=micro\fP or
+\fB\-\-time\-stamp\-precision=nano\fP, adjusting the time stamp
+precision accordingly.  When reading packets from a savefile, using
+\fB\-\-micro\fP truncates time stamps if the savefile was created with
+nanosecond precision.  In contrast, a savefile created with microsecond
+precision will have trailing zeroes added to the time stamp when
+\fB\-\-nano\fP is used.
+.TP

 .B \-K
 .PD 0
 .TP
 .B \-K
 .PD 0
 .TP


@@ -577,6 +597,12 @@ Note that the interface might be in promiscuous
 mode for some other reason; hence, `-p' cannot be used as an abbreviation for
 `ether host {local-hw-addr} or ether broadcast'.
 .TP
 mode for some other reason; hence, `-p' cannot be used as an abbreviation for
 `ether host {local-hw-addr} or ether broadcast'.
 .TP

+.BI \-\-print
+Print parsed packet output, even if the raw packets are being saved to a
+file with the
+.B \-w
+flag.
+.TP

 .BI \-Q " direction"
 .PD 0
 .TP
 .BI \-Q " direction"
 .PD 0
 .TP


@@ -591,16 +617,10 @@ Quick (quiet?) output.
 Print less protocol information so output
 lines are shorter.
 .TP
 Print less protocol information so output
 lines are shorter.
 .TP

-.B \-R
-Assume ESP/AH packets to be based on old specification (RFC1825 to RFC1829).
-If specified, \fItcpdump\fP will not print replay prevention field.
-Since there is no protocol version field in ESP/AH specification,
-\fItcpdump\fP cannot deduce the version of ESP/AH protocol.
-.TP

 .BI \-r " file"
 Read packets from \fIfile\fR (which was created with the
 .B \-w
 .BI \-r " file"
 Read packets from \fIfile\fR (which was created with the
 .B \-w

-option or by other tools that write pcap or pcap-ng files).
+option or by other tools that write pcap or pcapng files).

 Standard input is used if \fIfile\fR is ``-''.
 .TP
 .B \-S
 Standard input is used if \fIfile\fR is ``-''.
 .TP
 .B \-S


@@ -616,19 +636,26 @@ Print absolute, rather than relative, TCP sequence numbers.
 .BI \-\-snapshot\-length= snaplen
 .PD
 Snarf \fIsnaplen\fP bytes of data from each packet rather than the
 .BI \-\-snapshot\-length= snaplen
 .PD
 Snarf \fIsnaplen\fP bytes of data from each packet rather than the

-default of 65535 bytes.
+default of 262144 bytes.

 Packets truncated because of a limited snapshot
 are indicated in the output with ``[|\fIproto\fP]'', where \fIproto\fP
 is the name of the protocol level at which the truncation has occurred.
 Packets truncated because of a limited snapshot
 are indicated in the output with ``[|\fIproto\fP]'', where \fIproto\fP
 is the name of the protocol level at which the truncation has occurred.

+.IP

 Note that taking larger snapshots both increases
 the amount of time it takes to process packets and, effectively,
 decreases the amount of packet buffering.
 This may cause packets to be
 lost.
 Note that taking larger snapshots both increases
 the amount of time it takes to process packets and, effectively,
 decreases the amount of packet buffering.
 This may cause packets to be
 lost.

-You should limit \fIsnaplen\fP to the smallest number that will
-capture the protocol information you're interested in.
-Setting
-\fIsnaplen\fP to 0 sets it to the default of 65535,
+Note also that taking smaller snapshots will discard data from protocols
+above the transport layer, which loses information that may be
+important.  NFS and AFS requests and replies, for example, are very
+large, and much of the detail won't be available if a too-short snapshot
+length is selected.
+.IP
+If you need to reduce the snapshot size below the default, you should
+limit \fIsnaplen\fP to the smallest number that will capture the
+protocol information you're interested in.  Setting
+\fIsnaplen\fP to 0 sets it to the default of 262144,

 for backwards compatibility with recent older versions of
 .IR tcpdump .
 .TP
 for backwards compatibility with recent older versions of
 .IR tcpdump .
 .TP


@@ -642,6 +669,7 @@ Currently known types are
 \fBlmp\fR (Link Management Protocol),
 \fBpgm\fR (Pragmatic General Multicast),
 \fBpgm_zmtp1\fR (ZMTP/1.0 inside PGM/EPGM),
 \fBlmp\fR (Link Management Protocol),
 \fBpgm\fR (Pragmatic General Multicast),
 \fBpgm_zmtp1\fR (ZMTP/1.0 inside PGM/EPGM),

+\fBresp\fR (REdis Serialization Protocol),

 \fBradius\fR (RADIUS),
 \fBrpc\fR (Remote Procedure Call),
 \fBrtp\fR (Real-Time Applications protocol),
 \fBradius\fR (RADIUS),
 \fBrpc\fR (Remote Procedure Call),
 \fBrtp\fR (Real-Time Applications protocol),


@@ -672,16 +700,20 @@ Print the timestamp, as seconds since January 1, 1970, 00:00:00, UTC, and
 fractions of a second since that time, on each dump line.
 .TP
 .B \-ttt
 fractions of a second since that time, on each dump line.
 .TP
 .B \-ttt

-Print a delta (micro-second resolution) between current and previous line
-on each dump line.
+Print a delta (microsecond or nanosecond resolution depending on the
+.B \-\-time\-stamp-precision
+option) between current and previous line on each dump line.
+The default is microsecond resolution.

 .TP
 .B \-tttt
 Print a timestamp, as hours, minutes, seconds, and fractions of a second
 since midnight, preceded by the date, on each dump line.
 .TP
 .B \-ttttt
 .TP
 .B \-tttt
 Print a timestamp, as hours, minutes, seconds, and fractions of a second
 since midnight, preceded by the date, on each dump line.
 .TP
 .B \-ttttt

-Print a delta (micro-second resolution) between current and first line
-on each dump line.
+Print a delta (microsecond or nanosecond resolution depending on the
+.B \-\-time\-stamp-precision
+option) between current and first line on each dump line.
+The default is microsecond resolution.

 .TP
 .B \-u
 Print undecoded NFS handles.
 .TP
 .B \-u
 Print undecoded NFS handles.


@@ -693,7 +725,9 @@ Print undecoded NFS handles.
 .PD
 If the
 .B \-w
 .PD
 If the
 .B \-w

-option is not specified, make the printed packet output
+option is not specified, or if it is specified but the
+.B \-\-print
+flag is also specified, make the printed packet output

 ``packet-buffered''; i.e., as the description of the contents of each
 packet is printed, it will be written to the standard output, rather
 than, when not writing to a terminal, being written only when the output
 ``packet-buffered''; i.e., as the description of the contents of each
 packet is printed, it will be written to the standard output, rather
 than, when not writing to a terminal, being written only when the output


@@ -713,7 +747,7 @@ flag will not be supported if
 was built with an older version of
 .I libpcap
 that lacks the
 was built with an older version of
 .I libpcap
 that lacks the

-.B pcap_dump_flush()
+.BR pcap_dump_flush(3PCAP)

 function.
 .TP
 .B \-v
 function.
 .TP
 .B \-v


@@ -725,7 +759,7 @@ IP and ICMP header checksum.
 .IP
 When writing to a file with the
 .B \-w
 .IP
 When writing to a file with the
 .B \-w

-option, report, every 10 seconds, the number of packets captured.
+option, report, once per second, the number of packets captured.

 .TP
 .B \-vv
 Even more verbose output.
 .TP
 .B \-vv
 Even more verbose output.


@@ -783,9 +817,15 @@ files, allowing them to sort correctly.
 Used in conjunction with the
 .B \-G
 option, this will limit the number of rotated dump files that get
 Used in conjunction with the
 .B \-G
 option, this will limit the number of rotated dump files that get

-created, exiting with status 0 when reaching the limit. If used with
+created, exiting with status 0 when reaching the limit.
+.IP
+If used in conjunction with both

 .B \-C
 .B \-C

-as well, the behavior will result in cyclical files per timeslice.
+and
+.B \-G,
+the
+.B \-W
+option will currently be ignored, and will only affect the file name.

 .TP
 .B \-x
 When parsing and printing,
 .TP
 .B \-x
 When parsing and printing,


@@ -988,6 +1028,27 @@ gives a brief description and examples of most of the formats.
 .B
 ..
 .HD
 .B
 ..
 .HD

+Timestamps
+.LP
+By default, all output lines are preceded by a timestamp.
+The timestamp
+is the current clock time in the form
+.RS
+.nf
+\fIhh:mm:ss.frac\fP
+.fi
+.RE
+and is as accurate as the kernel's clock.
+The timestamp reflects the time the kernel applied a time stamp to the packet.
+No attempt is made to account for the time lag between when the network
+interface finished receiving the packet from the network and when the
+kernel applied a time stamp to the packet; that time lag could include a
+delay between the time when the network interface finished receiving a
+packet from the network and the time when an interrupt was delivered to
+the kernel to get it to read the packet and a delay between the time
+when the kernel serviced the `new packet' interrupt and the time when it
+applied a time stamp to the packet.
+.HD

 Link Level Headers
 .LP
 If the '-e' option is given, the link level header is printed out.
 Link Level Headers
 .LP
 If the '-e' option is given, the link level header is printed out.


@@ -1097,39 +1158,84 @@ For the first packet this says the Ethernet source address is RTSG, the
 destination is the Ethernet broadcast address, the type field
 contained hex 0806 (type ETHER_ARP) and the total length was 64 bytes.
 .HD
 destination is the Ethernet broadcast address, the type field
 contained hex 0806 (type ETHER_ARP) and the total length was 64 bytes.
 .HD

+IPv4 Packets
+.LP
+If the link-layer header is not being printed, for IPv4 packets,
+\fBIP\fP is printed after the time stamp.
+.LP
+If the
+.B \-v
+flag is specified, information from the IPv4 header is shown in
+parentheses after the \fBIP\fP or the link-layer header.
+The general format of this information is:
+.RS
+.nf
+.sp .5
+tos \fItos\fP, ttl \fIttl\fP, id \fIid\fP, offset \fIoffset\fP, flags [\fIflags\fP], proto \fIproto\fP, length \fIlength\fP, options (\fIoptions\fP)
+.sp .5
+.fi
+.RE
+\fItos\fP is the type of service field; if the ECN bits are non-zero,
+those are reported as \fBECT(1)\fP, \fBECT(0)\fP, or \fBCE\fP.
+\fIttl\fP is the time-to-live; it is not reported if it is zero.
+\fIid\fP is the IP identification field.
+\fIoffset\fP is the fragment offset field; it is printed whether this is
+part of a fragmented datagram or not.
+\fIflags\fP are the MF and DF flags; \fB+\fP is reported if MF is set,
+and \fBDF\fP is reported if F is set.  If neither are set, \fB.\fP is
+reported.
+\fIproto\fP is the protocol ID field.
+\fIlength\fP is the total length field.
+\fIoptions\fP are the IP options, if any.
+.LP
+Next, for TCP and UDP packets, the source and destination IP addresses
+and TCP or UDP ports, with a dot between each IP address and its
+corresponding port, will be printed, with a > separating the source and
+destination.  For other protocols, the addresses will be printed, with
+a > separating the source and destination.  Higher level protocol
+information, if any, will be printed after that.
+.LP
+For fragmented IP datagrams, the first fragment contains the higher
+level protocol header; fragments after the first contain no higher level
+protocol header.  Fragmentation information will be printed only with
+the
+.B \-v
+flag, in the IP header information, as described above.
+.HD

 TCP Packets
 .LP
 \fI(N.B.:The following description assumes familiarity with
 the TCP protocol described in RFC-793.
 If you are not familiar
 TCP Packets
 .LP
 \fI(N.B.:The following description assumes familiarity with
 the TCP protocol described in RFC-793.
 If you are not familiar

-with the protocol, neither this description nor \fItcpdump\fP will
+with the protocol, this description will not

 be of much use to you.)\fP
 .LP
 be of much use to you.)\fP
 .LP

-The general format of a tcp protocol line is:
+The general format of a TCP protocol line is:

 .RS
 .nf
 .sp .5
 .RS
 .nf
 .sp .5

-\fIsrc > dst: flags data-seqno ack window urgent options\fP
+\fIsrc\fP > \fIdst\fP: Flags [\fItcpflags\fP], seq \fIdata-seqno\fP, ack \fIackno\fP, win \fIwindow\fP, urg \fIurgent\fP, options [\fIopts\fP], length \fIlen\fP

 .sp .5
 .fi
 .RE
 \fISrc\fP and \fIdst\fP are the source and destination IP
 addresses and ports.
 .sp .5
 .fi
 .RE
 \fISrc\fP and \fIdst\fP are the source and destination IP
 addresses and ports.

-\fIFlags\fP are some combination of S (SYN),
+\fITcpflags\fP are some combination of S (SYN),

 F (FIN), P (PUSH), R (RST), U (URG), W (ECN CWR), E (ECN-Echo) or
 `.' (ACK), or `none' if no flags are set.
 \fIData-seqno\fP describes the portion of sequence space covered
 by the data in this packet (see example below).
 F (FIN), P (PUSH), R (RST), U (URG), W (ECN CWR), E (ECN-Echo) or
 `.' (ACK), or `none' if no flags are set.
 \fIData-seqno\fP describes the portion of sequence space covered
 by the data in this packet (see example below).

-\fIAck\fP is sequence number of the next data expected the other
+\fIAckno\fP is sequence number of the next data expected the other

 direction on this connection.
 \fIWindow\fP is the number of bytes of receive buffer space available
 the other direction on this connection.
 \fIUrg\fP indicates there is `urgent' data in the packet.
 direction on this connection.
 \fIWindow\fP is the number of bytes of receive buffer space available
 the other direction on this connection.
 \fIUrg\fP indicates there is `urgent' data in the packet.

-\fIOptions\fP are tcp options enclosed in angle brackets (e.g., <mss 1024>).
+\fIOpts\fP are TCP options (e.g., mss 1024).
+\fILen\fP is the length of payload data.

 .LP
 .LP

-\fISrc, dst\fP and \fIflags\fP are always present.
+\fIIptype\fR, \fISrc\fP, \fIdst\fP, and \fIflags\fP are always present.

 The other fields
 The other fields

-depend on the contents of the packet's tcp protocol header and
+depend on the contents of the packet's TCP protocol header and

 are output only if appropriate.
 .LP
 Here is the opening portion of an rlogin from host \fIrtsg\fP to
 are output only if appropriate.
 .LP
 Here is the opening portion of an rlogin from host \fIrtsg\fP to


@@ -1137,26 +1243,26 @@ host \fIcsam\fP.
 .RS
 .nf
 .sp .5
 .RS
 .nf
 .sp .5

-\s-2\f(CWrtsg.1023 > csam.login: S 768512:768512(0) win 4096 <mss 1024>
-csam.login > rtsg.1023: S 947648:947648(0) ack 768513 win 4096 <mss 1024>
-rtsg.1023 > csam.login: . ack 1 win 4096
-rtsg.1023 > csam.login: P 1:2(1) ack 1 win 4096
-csam.login > rtsg.1023: . ack 2 win 4096
-rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096
-csam.login > rtsg.1023: P 1:2(1) ack 21 win 4077
-csam.login > rtsg.1023: P 2:3(1) ack 21 win 4077 urg 1
-csam.login > rtsg.1023: P 3:4(1) ack 21 win 4077 urg 1\fR\s+2
+\f(CWIP rtsg.1023 > csam.login: Flags [S], seq 768512:768512, win 4096, opts [mss 1024]
+IP csam.login > rtsg.1023: Flags [S.], seq, 947648:947648, ack 768513, win 4096, opts [mss 1024]
+IP rtsg.1023 > csam.login: Flags [.], ack 1, win 4096
+IP rtsg.1023 > csam.login: Flags [P.], seq 1:2, ack 1, win 4096, length 1
+IP csam.login > rtsg.1023: Flags [.], ack 2, win 4096
+IP rtsg.1023 > csam.login: Flags [P.], seq 2:21, ack 1, win 4096, length 19
+IP csam.login > rtsg.1023: Flags [P.], seq 1:2, ack 21, win 4077, length 1
+IP csam.login > rtsg.1023: Flags [P.], seq 2:3, ack 21, win 4077, urg 1, length 1
+IP csam.login > rtsg.1023: Flags [P.], seq 3:4, ack 21, win 4077, urg 1, length 1\fR

 .sp .5
 .fi
 .RE
 .sp .5
 .fi
 .RE

-The first line says that tcp port 1023 on rtsg sent a packet
+The first line says that TCP port 1023 on rtsg sent a packet

 to port \fIlogin\fP
 on csam.
 The \fBS\fP indicates that the \fISYN\fP flag was set.
 The packet sequence number was 768512 and it contained no data.
 to port \fIlogin\fP
 on csam.
 The \fBS\fP indicates that the \fISYN\fP flag was set.
 The packet sequence number was 768512 and it contained no data.

-(The notation is `first:last(nbytes)' which means `sequence
+(The notation is `first:last' which means `sequence

 numbers \fIfirst\fP
 numbers \fIfirst\fP

-up to but not including \fIlast\fP which is \fInbytes\fP bytes of user data'.)
+up to but not including \fIlast\fP'.)

 There was no piggy-backed ack, the available receive window was 4096
 bytes and there was a max-segment-size option requesting an mss of
 1024 bytes.
 There was no piggy-backed ack, the available receive window was 4096
 bytes and there was a max-segment-size option requesting an mss of
 1024 bytes.


@@ -1165,11 +1271,11 @@ Csam replies with a similar packet except it includes a piggy-backed
 ack for rtsg's SYN.
 Rtsg then acks csam's SYN.
 The `.' means the ACK flag was set.
 ack for rtsg's SYN.
 Rtsg then acks csam's SYN.
 The `.' means the ACK flag was set.

-The packet contained no data so there is no data sequence number.
+The packet contained no data so there is no data sequence number or length.

 Note that the ack sequence
 number is a small integer (1).
 The first time \fItcpdump\fP sees a
 Note that the ack sequence
 number is a small integer (1).
 The first time \fItcpdump\fP sees a

-tcp `conversation', it prints the sequence number from the packet.
+TCP `conversation', it prints the sequence number from the packet.

 On subsequent packets of the conversation, the difference between
 the current packet's sequence number and this initial sequence number
 is printed.
 On subsequent packets of the conversation, the difference between
 the current packet's sequence number and this initial sequence number
 is printed.


@@ -1395,7 +1501,7 @@ Some offsets and field values may be expressed as names
 rather than as numeric values. For example tcp[13] may
 be replaced with tcp[tcpflags]. The following TCP flag
 field values are also available: tcp-fin, tcp-syn, tcp-rst,
 rather than as numeric values. For example tcp[13] may
 be replaced with tcp[tcpflags]. The following TCP flag
 field values are also available: tcp-fin, tcp-syn, tcp-rst,

-tcp-push, tcp-act, tcp-urg.
+tcp-push, tcp-ack, tcp-urg.

 .PP
 This can be demonstrated as:
 .RS
 .PP
 This can be demonstrated as:
 .RS


@@ -1606,11 +1712,6 @@ the file mode (in octal), the uid and gid, and the file size.
 .LP
 If the \-v flag is given more than once, even more details are printed.
 .LP
 .LP
 If the \-v flag is given more than once, even more details are printed.
 .LP

-Note that NFS requests are very large and much of the detail won't be printed
-unless \fIsnaplen\fP is increased.
-Try using `\fB\-s 192\fP' to watch
-NFS traffic.
-.LP

 NFS reply packets do not explicitly identify the RPC operation.
 Instead,
 \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the
 NFS reply packets do not explicitly identify the RPC operation.
 Instead,
 \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the


@@ -1674,11 +1775,6 @@ Error codes are printed for abort packets, with the exception of Ubik
 beacon packets (because abort packets are used to signify a yes vote
 for the Ubik protocol).
 .LP
 beacon packets (because abort packets are used to signify a yes vote
 for the Ubik protocol).
 .LP

-Note that AFS requests are very large and many of the arguments won't
-be printed unless \fIsnaplen\fP is increased.
-Try using `\fB-s 256\fP'
-to watch AFS traffic.
-.LP

 AFS reply packets do not explicitly identify the RPC operation.
 Instead,
 \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the
 AFS reply packets do not explicitly identify the RPC operation.
 Instead,
 \fItcpdump\fP keeps track of ``recent'' requests, and matches them to the


@@ -1756,9 +1852,9 @@ protocol) and packet size.
 .RS
 .nf
 .sp .5
 .RS
 .nf
 .sp .5

-\s-2\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"
+\f(CWicsd-net.112.220 > jssmag.2: nbp-lkup 190: "=:LaserWriter@*"

 jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250
 jssmag.209.2 > icsd-net.112.220: nbp-reply 190: "RM1140:LaserWriter@*" 250

-techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fR\s+2
+techpit.2 > icsd-net.112.220: nbp-reply 190: "techpit:LaserWriter@*" 186\fR

 .sp .5
 .fi
 .RE
 .sp .5
 .fi
 .RE


@@ -1776,7 +1872,7 @@ another reply to the same request saying host techpit has laserwriter
 .RS
 .nf
 .sp .5
 .RS
 .nf
 .sp .5

-\s-2\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001
+\f(CWjssmag.209.165 > helios.132: atp-req  12266<0-7> 0xae030001

 helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:0 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:1 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:2 (512) 0xae040000


@@ -1789,7 +1885,7 @@ jssmag.209.165 > helios.132: atp-req  12266<3,5> 0xae030001
 helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
 jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001
 helios.132 > jssmag.209.165: atp-resp 12266:3 (512) 0xae040000
 helios.132 > jssmag.209.165: atp-resp 12266:5 (512) 0xae040000
 jssmag.209.165 > helios.132: atp-rel  12266<0-7> 0xae030001

-jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fR\s+2
+jssmag.209.133 > helios.132: atp-req* 12267<0-7> 0xae030002\fR

 .sp .5
 .fi
 .RE
 .sp .5
 .fi
 .RE


@@ -1814,83 +1910,14 @@ jssmag.209 initiates the next request.
 The `*' on the request
 indicates that XO (`exactly once') was \fInot\fP set.
 
 The `*' on the request
 indicates that XO (`exactly once') was \fInot\fP set.
 

-.HD
-IP Fragmentation
-.LP
-Fragmented Internet datagrams are printed as
-.RS
-.nf
-.sp .5
-\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB+)\fR
-\fB(frag \fIid\fB:\fIsize\fB@\fIoffset\fB)\fR
-.sp .5
-.fi
-.RE
-(The first form indicates there are more fragments.
-The second
-indicates this is the last fragment.)
-.LP
-\fIId\fP is the fragment id.
-\fISize\fP is the fragment
-size (in bytes) excluding the IP header.
-\fIOffset\fP is this
-fragment's offset (in bytes) in the original datagram.
-.LP
-The fragment information is output for each fragment.
-The first
-fragment contains the higher level protocol header and the frag
-info is printed after the protocol info.
-Fragments
-after the first contain no higher level protocol header and the
-frag info is printed after the source and destination addresses.
-For example, here is part of an ftp from arizona.edu to lbl-rtsg.arpa
-over a CSNET connection that doesn't appear to handle 576 byte datagrams:
-.RS
-.nf
-.sp .5
-\s-2\f(CWarizona.ftp-data > rtsg.1170: . 1024:1332(308) ack 1 win 4096 (frag 595a:328@0+)
-arizona > rtsg: (frag 595a:204@328)
-rtsg.1170 > arizona.ftp-data: . ack 1536 win 2560\fP\s+2
-.sp .5
-.fi
-.RE
-There are a couple of things to note here:  First, addresses in the
-2nd line don't include port numbers.
-This is because the TCP
-protocol information is all in the first fragment and we have no idea
-what the port or sequence numbers are when we print the later fragments.
-Second, the tcp sequence information in the first line is printed as if there
-were 308 bytes of user data when, in fact, there are 512 bytes (308 in
-the first frag and 204 in the second).
-If you are looking for holes
-in the sequence space or trying to match up acks
-with packets, this can fool you.
-.LP
-A packet with the IP \fIdon't fragment\fP flag is marked with a
-trailing \fB(DF)\fP.
-.HD
-Timestamps
-.LP
-By default, all output lines are preceded by a timestamp.
-The timestamp
-is the current clock time in the form
-.RS
-.nf
-\fIhh:mm:ss.frac\fP
-.fi
-.RE
-and is as accurate as the kernel's clock.
-The timestamp reflects the time the kernel first saw the packet.
-No attempt
-is made to account for the time lag between when the
-Ethernet interface removed the packet from the wire and when the kernel
-serviced the `new packet' interrupt.

 .SH "SEE ALSO"
 .SH "SEE ALSO"

-stty(1), pcap(3PCAP), bpf(4), nit(4P), pcap-savefile(@MAN_FILE_FORMATS@),
-pcap-filter(@MAN_MISC_INFO@), pcap-tstamp(@MAN_MISC_INFO@)
+stty(1), pcap(3PCAP), bpf(4), nit(4P), \%pcap-savefile(@MAN_FILE_FORMATS@),
+\%pcap-filter(@MAN_MISC_INFO@), \%pcap-tstamp(@MAN_MISC_INFO@)

 .LP
 .RS
 .LP
 .RS

-.I http://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap
+.na
+.I https://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap
+.ad

 .RE
 .LP
 .SH AUTHORS
 .RE
 .LP
 .SH AUTHORS


@@ -1906,7 +1933,7 @@ It is currently being maintained by tcpdump.org.
 The current version is available via http:
 .LP
 .RS
 The current version is available via http:
 .LP
 .RS

-.I http://www.tcpdump.org/
+.I https://www.tcpdump.org/

 .RE
 .LP
 The original distribution is available via anonymous ftp:
 .RE
 .LP
 The original distribution is available via anonymous ftp:


@@ -1916,14 +1943,14 @@ The original distribution is available via anonymous ftp:
 .RE
 .LP
 IPv6/IPsec support is added by WIDE/KAME project.
 .RE
 .LP
 IPv6/IPsec support is added by WIDE/KAME project.

-This program uses Eric Young's SSLeay library, under specific configurations.
+This program uses OpenSSL/LibreSSL, under specific configurations.

 .SH BUGS
 .SH BUGS

-Please send problems, bugs, questions, desirable enhancements, patches
-etc. to:
+To report a security issue please send an e-mail to \%[email protected].

 .LP
 .LP

-.RS
[email protected]
-.RE
+To report bugs and other problems, contribute patches, request a
+feature, provide generic feedback etc please see the file
+.I CONTRIBUTING
+in the tcpdump source tree root.

 .LP
 NIT doesn't let you watch your own outbound traffic, BPF will.
 We recommend that you use the latter.
 .LP
 NIT doesn't let you watch your own outbound traffic, BPF will.
 We recommend that you use the latter.