X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/d75ee07998ef8ac0fc1a9a6beea2e15a3ca1f726..fb8b947488c7f22b518de1df1a91e663dc7ab33c:/tcpdump.1

diff --git a/tcpdump.1 b/tcpdump.1
index 077534d4..5f55299f 100644
--- a/tcpdump.1
+++ b/tcpdump.1
@@ -1,3 +1,5 @@
+.\" @(#) $Header: /tcpdump/master/tcpdump/Attic/tcpdump.1,v 1.163 2004-06-12 08:51:23 guy Exp $ (LBL)
+.\"
 .\"	$NetBSD: tcpdump.8,v 1.9 2003/03/31 00:18:17 perry Exp $
 .\"
 .\" Copyright (c) 1987, 1988, 1989, 1990, 1991, 1992, 1994, 1995, 1996, 1997
@@ -20,7 +22,7 @@
 .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
 .\"
-.TH TCPDUMP 1  "1 July 2003"
+.TH TCPDUMP 1  "22 March 2004"
 .SH NAME
 tcpdump \- dump traffic on a network
 .SH SYNOPSIS
@@ -52,12 +54,16 @@ tcpdump \- dump traffic on a network
 .I module
 ]
 [
-.B \-r
-.I file
+.B \-M
+.I secret
 ]
 .br
 .ti +8
 [
+.B \-r
+.I file
+]
+[
 .B \-s
 .I snaplen
 ]
@@ -72,6 +78,12 @@ tcpdump \- dump traffic on a network
 .br
 .ti +8
 [
+.B \-W
+.I filecount
+]
+.br
+.ti +8
+[
 .B \-E
 .I spi@ipaddr algo:secret,...
 ]
@@ -81,6 +93,10 @@ tcpdump \- dump traffic on a network
 .B \-y
 .I datalinktype
 ]
+[
+.B \-Z
+.I user
+]
 .ti +8
 [
 .I expression
@@ -118,14 +134,23 @@ When
 .I tcpdump
 finishes capturing packets, it will report counts of:
 .IP
+packets ``captured'' (this is the number of packets that
+.I tcpdump
+has received and processed);
+.IP
 packets ``received by filter'' (the meaning of this depends on the OS on
 which you're running
 .IR tcpdump ,
 and possibly on the way the OS was configured - if a filter was
 specified on the command line, on some OSes it counts packets regardless
-of whether they were matched by the filter expression, and on other OSes
-it counts only packets that were matched by the filter expression and
-were processed by
+of whether they were matched by the filter expression and, even if they
+were matched by the filter expression, regardless of whether
+.I tcpdump
+has read and processed them yet, on other OSes it counts only packets that were
+matched by the filter expression regardless of whether
+.I tcpdump
+has read and processed them yet, and on other OSes it counts only
+packets that were matched by the filter expression and were processed by
 .IR tcpdump );
 .IP
 packets ``dropped by kernel'' (this is the number of packets that were
@@ -135,10 +160,14 @@ in the OS on which
 is running, if the OS reports that information to applications; if not,
 it will be reported as 0).
 .LP
-On platforms that support the SIGINFO signal, such as most BSDs, it will
-report those counts when it receives a SIGINFO signal (generated, for
-example, by typing your ``status'' character, typically control-T) and
-will continue capturing packets.
+On platforms that support the SIGINFO signal, such as most BSDs
+(including Mac OS X) and Digital/Tru64 UNIX, it will report those counts
+when it receives a SIGINFO signal (generated, for example, by typing
+your ``status'' character, typically control-T, although on some
+platforms, such as Mac OS X, the ``status'' character is not set by
+default, so you must set it with
+.BR stty (1)
+in order to use it) and will continue capturing packets.
 .LP
 Reading packets from a network interface may require that you have
 special privileges:
@@ -185,7 +214,7 @@ CAP_NET_ADMIN to enumerate network devices with, for example, the
 .B \-D
 flag).
 .TP
-.B Under Ultrix and Digital UNIX/Tru64 UNIX:
+.B Under ULTRIX and Digital UNIX/Tru64 UNIX:
 Any user may capture network traffic with
 .IR tcpdump .
 However, no user (not even the super-user) can capture in promiscuous
@@ -228,7 +257,7 @@ currently larger than \fIfile_size\fP and, if so, close the current
 savefile and open a new one.  Savefiles after the first savefile will
 have the name specified with the
 .B \-w
-flag, with a number after it, starting at 2 and continuing upward.
+flag, with a number after it, starting at 1 and continuing upward.
 The units of \fIfile_size\fP are millions of bytes (1,000,000 bytes,
 not 1,048,576 bytes).
 .TP
@@ -362,6 +391,10 @@ Load SMI MIB module definitions from file \fImodule\fR.
 This option
 can be used several times to load several MIB modules into \fItcpdump\fP.
 .TP
+.B \-M
+Use \fIsecret\fP as a shared secret for validating the digests found in
+TCP segments with the TCP-MD5 option (RFC 2385), if present.
+.TP
 .B \-n
 Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.
 .TP
@@ -426,6 +459,7 @@ Setting
 Force packets selected by "\fIexpression\fP" to be interpreted the
 specified \fItype\fR.
 Currently known types are
+\fBaodv\fR (Ad-hoc On-demand Distance Vector protocol),
 \fBcnfp\fR (Cisco NetFlow protocol),
 \fBrpc\fR (Remote Procedure Call),
 \fBrtp\fR (Real-Time Applications protocol),
@@ -470,11 +504,15 @@ that lacks the
 function.
 .TP
 .B \-v
-(Slightly more) verbose output.
+When parsing and printing, produce (slightly more) verbose output.
 For example, the time to live,
 identification, total length and options in an IP packet are printed.
 Also enables additional packet integrity checks such as verifying the
 IP and ICMP header checksum.
+.IP
+When writing to a file with the
+.B \-w
+option, report, every 10 seconds, the number of packets captured.
 .TP
 .B \-vv
 Even more verbose output.
@@ -496,6 +534,16 @@ them out.
 They can later be printed with the \-r option.
 Standard output is used if \fIfile\fR is ``-''.
 .TP
+.B \-W
+Used in conjunction with the 
+.I \-C 
+option, this will limit the number
+of files created to the specified number, and begin overwriting files
+from the beginning, thus creating a 'rotating' buffer. 
+In addition, it will name
+the files with enough leading 0s to support the maximum number of
+files, allowing them to sort correctly.
+.TP
 .B \-x
 Print each packet (minus its link level header) in hex.
 The smaller of the entire packet or
@@ -521,6 +569,14 @@ its link level header, in hex and ASCII.
 .TP
 .B \-y
 Set the data link type to use while capturing packets to \fIdatalinktype\fP.
+.TP
+.B \-Z
+Drops privileges (if root) and changes user ID to
+.I user
+and the group ID to the primary group of
+.IR user .
+.IP
+This behavior can also be enabled by default at compile time.
 .IP "\fI expression\fP"
 .RS
 selects which packets will be dumped.
@@ -835,7 +891,7 @@ In the case of Ethernet, \fItcpdump\fR checks the Ethernet type field
 for most of those protocols.  The exceptions are:
 .RS
 .TP
-\fBiso\fP, \fBsap\fP, and \fBnetbeui\fP
+\fBiso\fP, \fBstp\fP, and \fBnetbeui\fP
 \fItcpdump\fR checks for an 802.3 frame and then checks the LLC header as
 it does for FDDI, Token Ring, and 802.11;
 .TP
@@ -857,7 +913,7 @@ True if the DECNET source address is
 .IR host ,
 which may be an address of the form ``10.123'', or a DECNET host
 name.
-[DECNET host name support is only available on Ultrix systems
+[DECNET host name support is only available on ULTRIX systems
 that are configured to run DECNET.]
 .IP "\fBdecnet dst \fIhost\fR"
 True if the DECNET destination address is
@@ -893,6 +949,22 @@ and
 .B memory
 (applies only to packets logged by OpenBSD's
 .BR pf (4)).
+.IP "\fBrset \fIname\fR"
+True if the packet was logged as matching the specified PF ruleset
+name of an anchored ruleset (applies only to packets logged by
+.BR pf (4)).
+.IP "\fBruleset \fIname\fR"
+Synonomous with the
+.B rset
+modifier.
+.IP "\fBsrnr \fInum\fR"
+True if the packet was logged as matching the specified PF rule number
+of an anchored ruleset (applies only to packets logged by
+.BR pf (4)).
+.IP "\fBsubrulenum \fInum\fR"
+Synonomous with the
+.B srnr
+modifier.
 .IP "\fBaction \fIact\fR"
 True if PF took the specified action when the packet was logged.  Known actions
 are:
@@ -900,7 +972,7 @@ are:
 and
 .B block
 (applies only to packets logged by OpenBSD's
-.BR pf(4)).
+.BR pf (4)).
 .IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fInetbeui\fP"
 Abbreviations for:
 .in +.5i
@@ -1001,10 +1073,11 @@ True if the packet is an ATM packet, for SunATM on Solaris, and is
 on a meta signaling circuit and is a Q.2931 Setup, Call Proceeding, Connect,
 Release, or Release Done message.
 .IP  "\fIexpr relop expr\fR"
-True if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =, !=,
-and \fIexpr\fR is an arithmetic expression composed of integer constants
-(expressed in standard C syntax), the normal binary operators
-[+, -, *, /, &, |], a length operator, and special packet data accessors.
+True if the relation holds, where \fIrelop\fR is one of >, <, >=, <=, =,
+!=, and \fIexpr\fR is an arithmetic expression composed of integer
+constants (expressed in standard C syntax), the normal binary operators
+[+, -, *, /, &, |, <<, >>], a length operator, and special packet data
+accessors.
 To access
 data inside the packet, use the following syntax:
 .in +.5i
@@ -1899,7 +1972,7 @@ and dumped as DDP packets (i.e., all the UDP header information is
 discarded).
 The file
 .I /etc/atalk.names
-is used to translate appletalk net and node numbers to names.
+is used to translate AppleTalk net and node numbers to names.
 Lines in this file have the form
 .RS
 .nf
@@ -1912,7 +1985,7 @@ Lines in this file have the form
 .sp .5
 .fi
 .RE
-The first two lines give the names of appletalk networks.
+The first two lines give the names of AppleTalk networks.
 The third
 line gives the name of a particular host (a host is distinguished
 from a net by the 3rd octet in the number \-
@@ -1938,7 +2011,7 @@ jssmag.149.235 > icsd-net.2\fR
 .RE
 (If the
 .I /etc/atalk.names
-doesn't exist or doesn't contain an entry for some appletalk
+doesn't exist or doesn't contain an entry for some AppleTalk
 host/net number, addresses are printed in numeric form.)
 In the first example, NBP (DDP port 2) on net 144.1 node 209
 is sending to whatever is listening on port 220 of net icsd node 112.
@@ -2090,7 +2163,7 @@ is made to account for the time lag between when the
 ethernet interface removed the packet from the wire and when the kernel
 serviced the `new packet' interrupt.
 .SH "SEE ALSO"
-traffic(1C), nit(4P), bpf(4), pcap(3)
+stty(1), pcap(3), bpf(4), nit(4P), pfconfig(8)
 .SH AUTHORS
 The original authors are:
 .LP