Discuss buffering when describing the -w flag.

Mention that the output of tcpdump -w is buffered, and note that this
means packets won't necessarily show up in the output as soon as they're
received, so programs reading that output won't see them immediately,
and note that the -U flag forces "packet buffering" so that a reader
will see the packets as soon as they're received.

diff --git a/tcpdump.1.in b/tcpdump.1.in
index aabda7714900066f2a606b0dca8bc4023a981658..3491ba89b5bea918f4d500001cca68b3b6f50bfb 100644 (file)
--- a/tcpdump.1.in
+++ b/tcpdump.1.in
@@ -557,6 +557,13 @@ Write the raw packets to \fIfile\fR rather than parsing and printing
 them out.
 They can later be printed with the \-r option.
 Standard output is used if \fIfile\fR is ``-''.
+.IP
+This output will be buffered if written to a file or pipe, so a program
+reading from the file or pipe may not see packets for an arbitrary
+amount of time after they are received.  Use the
+.B \-U
+flag to cause packets to be written as soon as they are received.
+.IP
 See
 .BR pcap-savefile (@MAN_FILE_FORMATS@)
 for a description of the file format.