"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "tcpdump.1.in" between
tcpdump-4.99.0.tar.gz and tcpdump-4.99.1.tar.gz

About: tcpdump is a tool for network monitoring and data acquisition.

tcpdump.1.in  (tcpdump-4.99.0):tcpdump.1.in  (tcpdump-4.99.1)
skipping to change at line 1611 skipping to change at line 1611
This says that port \fIwho\fP on host \fIactinide\fP sent a UDP This says that port \fIwho\fP on host \fIactinide\fP sent a UDP
datagram to port \fIwho\fP on host \fIbroadcast\fP, the Internet datagram to port \fIwho\fP on host \fIbroadcast\fP, the Internet
broadcast address. broadcast address.
The packet contained 84 bytes of user data. The packet contained 84 bytes of user data.
.LP .LP
Some UDP services are recognized (from the source or destination Some UDP services are recognized (from the source or destination
port number) and the higher level protocol information printed. port number) and the higher level protocol information printed.
In particular, Domain Name service requests (RFC-1034/1035) and Sun In particular, Domain Name service requests (RFC-1034/1035) and Sun
RPC calls (RFC-1050) to NFS. RPC calls (RFC-1050) to NFS.
.HD .HD
UDP Name Server Requests TCP or UDP Name Server Requests
.LP .LP
\fI(N.B.:The following description assumes familiarity with \fI(N.B.:The following description assumes familiarity with
the Domain Service protocol described in RFC-1035. the Domain Service protocol described in RFC-1035.
If you are not familiar If you are not familiar
with the protocol, the following description will appear to be written with the protocol, the following description will appear to be written
in Greek.)\fP in Greek.)\fP
.LP .LP
Name server requests are formatted as Name server requests are formatted as
.RS .RS
.nf .nf
skipping to change at line 1634 skipping to change at line 1634
.sp .5 .sp .5
\f(CWh2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37)\fR \f(CWh2opolo.1538 > helios.domain: 3+ A? ucbvax.berkeley.edu. (37)\fR
.sp .5 .sp .5
.fi .fi
.RE .RE
Host \fIh2opolo\fP asked the domain server on \fIhelios\fP for an Host \fIh2opolo\fP asked the domain server on \fIhelios\fP for an
address record (qtype=A) associated with the name \fIucbvax.berkeley.edu.\fP address record (qtype=A) associated with the name \fIucbvax.berkeley.edu.\fP
The query id was `3'. The query id was `3'.
The `+' indicates the \fIrecursion desired\fP flag The `+' indicates the \fIrecursion desired\fP flag
was set. was set.
The query length was 37 bytes, not including the UDP and The query length was 37 bytes, excluding the TCP or UDP and
IP protocol headers. IP protocol headers.
The query operation was the normal one, \fIQuery\fP, The query operation was the normal one, \fIQuery\fP,
so the op field was omitted. so the op field was omitted.
If the op had been anything else, it would If the op had been anything else, it would
have been printed between the `3' and the `+'. have been printed between the `3' and the `+'.
Similarly, the qclass was the normal one, Similarly, the qclass was the normal one,
\fIC_IN\fP, and omitted. \fIC_IN\fP, and omitted.
Any other qclass would have been printed Any other qclass would have been printed
immediately after the `A'. immediately after the `A'.
.LP .LP
skipping to change at line 1658 skipping to change at line 1658
.IR ancount , .IR ancount ,
.IR nscount , .IR nscount ,
or or
.I arcount .I arcount
are printed as `[\fIn\fPa]', `[\fIn\fPn]' or `[\fIn\fPau]' where \fIn\fP are printed as `[\fIn\fPa]', `[\fIn\fPn]' or `[\fIn\fPau]' where \fIn\fP
is the appropriate count. is the appropriate count.
If any of the response bits are set (AA, RA or rcode) or any of the If any of the response bits are set (AA, RA or rcode) or any of the
`must be zero' bits are set in bytes two and three, `[b2&3=\fIx\fP]' `must be zero' bits are set in bytes two and three, `[b2&3=\fIx\fP]'
is printed, where \fIx\fP is the hex value of header bytes two and three. is printed, where \fIx\fP is the hex value of header bytes two and three.
.HD .HD
UDP Name Server Responses TCP or UDP Name Server Responses
.LP .LP
Name server responses are formatted as Name server responses are formatted as
.RS .RS
.nf .nf
.sp .5 .sp .5
\fIsrc > dst: id op rcode flags a/n/au type class data (len)\fP \fIsrc > dst: id op rcode flags a/n/au type class data (len)\fP
.sp .5 .sp .5
\f(CWhelios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273) \f(CWhelios.domain > h2opolo.1538: 3 3/3/7 A 128.32.137.3 (273)
helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97)\fR helios.domain > h2opolo.1537: 2 NXDomain* 0/1/0 (97)\fR
.sp .5 .sp .5
.fi .fi
.RE .RE
In the first example, \fIhelios\fP responds to query id 3 from \fIh2opolo\fP In the first example, \fIhelios\fP responds to query id 3 from \fIh2opolo\fP
with 3 answer records, 3 name server records and 7 additional records. with 3 answer records, 3 name server records and 7 additional records.
The first answer record is type A (address) and its data is internet The first answer record is type A (address) and its data is internet
address 128.32.137.3. address 128.32.137.3.
The total size of the response was 273 bytes, The total size of the response was 273 bytes,
excluding UDP and IP headers. excluding TCP or UDP and IP headers.
The op (Query) and response code The op (Query) and response code
(NoError) were omitted, as was the class (C_IN) of the A record. (NoError) were omitted, as was the class (C_IN) of the A record.
.LP .LP
In the second example, \fIhelios\fP responds to query 2 with a In the second example, \fIhelios\fP responds to query 2 with a
response code of non-existent domain (NXDomain) with no answers, response code of non-existent domain (NXDomain) with no answers,
one name server and no authority records. one name server and no authority records.
The `*' indicates that The `*' indicates that
the \fIauthoritative answer\fP bit was set. the \fIauthoritative answer\fP bit was set.
Since there were no Since there were no
answers, no type, class or data were printed. answers, no type, class or data were printed.
skipping to change at line 1708 skipping to change at line 1708
Some primitive decoding of IPX and Some primitive decoding of IPX and
NetBEUI SMB data is also done. NetBEUI SMB data is also done.
.LP .LP
By default a fairly minimal decode is done, with a much more detailed By default a fairly minimal decode is done, with a much more detailed
decode done if -v is used. decode done if -v is used.
Be warned that with -v a single SMB packet Be warned that with -v a single SMB packet
may take up a page or more, so only use -v if you really want all the may take up a page or more, so only use -v if you really want all the
gory details. gory details.
.LP .LP
For information on SMB packet formats and what all the fields mean see For information on SMB packet formats and what all the fields mean see
www.cifs.org or the pub/samba/specs/ directory on your favorite \%https://download.samba.org/pub/samba/specs/ and other online resources.
samba.org mirror site.
The SMB patches were written by Andrew Tridgell The SMB patches were written by Andrew Tridgell
(tridge@samba.org). (tridge@samba.org).
.HD .HD
NFS Requests and Replies NFS Requests and Replies
.LP .LP
Sun NFS (Network File System) requests and replies are printed as: Sun NFS (Network File System) requests and replies are printed as:
.RS .RS
.nf .nf
.sp .5 .sp .5
\fIsrc.sport > dst.nfs: NFS request xid xid len op args\fP \fIsrc.sport > dst.nfs: NFS request xid xid len op args\fP
 End of changes. 5 change blocks. 
6 lines changed or deleted 5 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)