From: Francois-Xavier Le Bail Date: Sat, 21 Oct 2023 06:33:07 +0000 (+0200) Subject: man: Fix an example by quoting a filter expression X-Git-Tag: tcpdump-4.99.5~162 X-Git-Url: https://git.tcpdump.org/tcpdump/commitdiff_plain/d35e4bf44447a68fb45caa8d048b4b2511be944e?ds=sidebyside man: Fix an example by quoting a filter expression It's to prevent the shell from (mis-)interpreting the square brackets. e.g. if there is a file named tcp1 in the current directory, with tcp[13] == 2, the executed command will be: tcpdump -i xl0 tcp1 == 2 Result: tcpdump: can't parse filter expression: syntax error (cherry picked from commit 5db1dbf206cadf0d063334fa849746f74e42c588) [skip ci] --- diff --git a/tcpdump.1.in b/tcpdump.1.in index 79be0344..fc9d4706 100644 --- a/tcpdump.1.in +++ b/tcpdump.1.in @@ -20,7 +20,7 @@ .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. .\" -.TH TCPDUMP 1 "09 Sep 2023" +.TH TCPDUMP 1 "21 October 2023" .SH NAME tcpdump \- dump traffic on a network .SH SYNOPSIS @@ -1508,7 +1508,7 @@ We can use this expression as the filter for \fItcpdump\fP in order to watch packets which have only SYN set: .RS .B -tcpdump -i xl0 tcp[13] == 2 +tcpdump -i xl0 'tcp[13] == 2' .RE .PP The expression says "let the 13th octet of a TCP datagram have