diff --git a/doc/ethereal.pod b/doc/ethereal.pod index 93ade4c7b3..d0665386e2 100644 --- a/doc/ethereal.pod +++ b/doc/ethereal.pod @@ -6,34 +6,34 @@ ethereal - Interactively browse network traffic =head1 SYNOPSYS B -S<[ B<-a> capture autostop condition ] ...> -S<[ B<-b> capture ring buffer option ] ...> -S<[ B<-B> capture buffer size (Win32 only) ] > -S<[ B<-c> capture packet count ]> +S<[ B<-a> Ecapture autostop conditionE ] ...> +S<[ B<-b> Ecapture ring buffer optionE ] ...> +S<[ B<-B> Ecapture buffer size (Win32 only)E ] > +S<[ B<-c> Ecapture packet countE ]> S<[ B<-D> ]> -S<[ B<-f> capture filter ]> -S<[ B<-g> packet number ]> +S<[ B<-f> Ecapture filterE ]> +S<[ B<-g> Epacket numberE ]> S<[ B<-h> ]> -S<[ B<-i> capture interface ]> +S<[ B<-i> Ecapture interfaceE|- ]> S<[ B<-k> ]> S<[ B<-l> ]> S<[ B<-L> ]> -S<[ B<-m> font ]> +S<[ B<-m> EfontE ]> S<[ B<-n> ]> -S<[ B<-N> name resolving flags ] > -S<[ B<-o> preference/recent setting ] ...> +S<[ B<-N> Ename resolving flagsE ] > +S<[ B<-o> Epreference/recent settingE ] ...> S<[ B<-p> ]> S<[ B<-Q> ]> -S<[ B<-r> infile ]> -S<[ B<-R> read (display) filter ]> +S<[ B<-r> EinfileE ]> +S<[ B<-R> Eread (display) filterE ]> S<[ B<-S> ]> -S<[ B<-s> capture snaplen ]> -S<[ B<-t> time stamp format ]> +S<[ B<-s> Ecapture snaplenE ]> +S<[ B<-t> Etime stamp formatE ]> S<[ B<-v> ]> -S<[ B<-w> savefile]> -S<[ B<-y> capture link type ]> -S<[ B<-z> statistics ]> -S<[ infile ]> +S<[ B<-w> EoutfileE ]> +S<[ B<-y> Ecapture link typeE ]> +S<[ B<-z> EstatisticsE ]> +S<[ EinfileE ]> =head1 DESCRIPTION @@ -166,7 +166,7 @@ B<-r> option or can be specified as a command-line argument. Most users will want to start B without options and configure it from the menus instead. Those users may just skip this section. -=item -a +=item -a Ecapture autostop conditionE Specify a criterion that specifies when B is to stop writing to a capture file. The criterion is of the form IB<:>I, @@ -181,7 +181,7 @@ current capture file and switch to the next one if filesize is reached. B:I Stop writing to capture files after I number of files were written. -=item -b +=item -b Ecapture ring buffer optionE Cause B to run in "multiple files" mode. In "multiple files" mode, B will write to several capture files. When the first capture file @@ -189,7 +189,7 @@ fills up, B will switch writing to the next file and so on. The created filenames are based on the filename given with the B<-w> flag, the number of the file and on the creation date and time, -e.g. savefile_00001_20050604120117.pcap, savefile_00001_20050604120523.pcap, ... +e.g. outfile_00001_20050604120117.pcap, outfile_00001_20050604120523.pcap, ... With the I option it's also possible to form a "ring buffer". This will fill up new files until the number of files specified, @@ -210,13 +210,13 @@ I kilobytes (where a kilobyte is 1024 bytes). B:I begin again with the first file after I number of files were written (form a ring buffer). -=item -B +=item -B Ecapture buffer size (Win32 only)E Win32 only: set capture buffer size (in MB, default is 1MB). This is used by the the capture driver to buffer packet data until that data can be written to disk. If you encounter packet drops while capturing, try to increase this size. -=item -c +=item -c Ecapture packet countE Set the maximum number of packets to read when capturing live data. @@ -240,11 +240,11 @@ network capture must be run from an account with special privileges (for example, as root), then, if B is run with the B<-D> flag and is not run from such an account, it will not list any interfaces. -=item -f +=item -f Ecapture filterE Set the capture filter expression. -=item -g +=item -g Epacket numberE After reading in a capture file using the B<-r> flag, go to the given I. @@ -252,7 +252,7 @@ After reading in a capture file using the B<-r> flag, go to the given Icapture interfaceE|- Set the name of the network interface or pipe to use for live packet capture. @@ -266,13 +266,16 @@ although not all versions of UNIX support the B<-a> flag to B. If no interface is specified, B searches the list of interfaces, choosing the first non-loopback interface if there are any non-loopback interfaces, and choosing the first loopback interface if -there are no non-loopback interfaces; if there are no interfaces, +there are no non-loopback interfaces. If there are no interfaces at all, B reports an error and doesn't start the capture. Pipe names should be either the name of a FIFO (named pipe) or ``-'' to read data from the standard input. Data read from pipes must be in standard libpcap format. +Note: the Win32 version of B doesn't support capturing from +pipes or stdin! + =item -k Start the capture session immediately. If the B<-i> flag was @@ -293,7 +296,7 @@ B<-S> flag). List the data link types supported by the interface and exit. -=item -m +=item -m EfontE Set the name of the font used by B for most text. B will construct the name of the bold font used for the data in the byte @@ -305,7 +308,7 @@ pane from the name of the main text font. Disable network object name resolution (such as hostname, TCP and UDP port names), the B<-N> flag might override this one. -=item -N +=item -N Ename resolving flagsE Turn on name resolving only for particular types of addresses and port numbers, with name resolving for other types of addresses and port @@ -323,7 +326,7 @@ B to enable transport-layer port number resolution B to enable concurrent (asynchronous) DNS lookups -=item -o +=item -o Epreference/recent settingE Set a preference or recent value, overriding the default value and any value read from a preference/recent file. The argument to the flag is a string of @@ -348,11 +351,13 @@ Cause B to exit after the end of capture session (useful in batch mode with B<-c> option for instance); this option requires the B<-i> and B<-w> parameters. -=item -r +=item -r EinfileE -Read packet data from I. +Read packet data from I, can be any supported capture file format +(including gzipped files). It's not possible to use named pipes or stdin +here! -=item -R +=item -R Eread (display) filterE When reading a capture file specified with the B<-r> flag, causes the specified filter (which uses the syntax of display filters, rather than @@ -363,13 +368,13 @@ capture file; packets not matching the filter are discarded. Automatically update the packet display as packets are coming in. -=item -s +=item -s Ecapture snaplenE Set the default snapshot length to use when capturing live data. No more than I bytes of each network packet will be read into memory, or saved to disk. -=item -t +=item -t Etime stamp formatE Set the format of the packet timestamp displayed in the packet list window, the default is relative. The format can be one of: @@ -390,17 +395,17 @@ captured Print the version and exit. -=item -w +=item -w EoutfileE Set the default capture file name. -=item -y +=item -y Ecapture link typeE If a capture is started from the command line with B<-k>, set the data link type to use while capturing packets. The values reported by B<-L> are the values that can be used. -=item -z +=item -z EstatisticsE Get B to collect various types of statistics and display the result in a window that updates in semi-real time.