From b3d6580b4f71f73c924af83ce503ad3420cc5d9d Mon Sep 17 00:00:00 2001 From: Jaap Keuter Date: Mon, 28 Dec 2020 18:26:16 +0100 Subject: [PATCH] editcap: clarify relation between -A/-B and -r Change wording so that the order of processing becomes more apparent. Closes #17109 --- doc/editcap.pod | 7 +++++-- editcap.c | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/doc/editcap.pod b/doc/editcap.pod index f94a49a1c2..dcd7aae81c 100644 --- a/doc/editcap.pod +++ b/doc/editcap.pod @@ -58,6 +58,9 @@ resulting packets to the capture I (or outfiles). By default, it reads all packets from the I and writes them to the I in pcapng file format. +The B<-A> and B<-B> option allow you to limit the time range from which packets +are read from the I. + An optional list of packet numbers can be specified on the command tail; individual packet numbers separated by whitespace and/or ranges of packet numbers can be specified as I-I, referring to all packets from @@ -97,13 +100,13 @@ strings that include spaces. =item -A Estart timeE -Saves only the packets whose timestamp is on or after start time. +Reads only the packets whose timestamp is on or after start time. The time is given in the following format YYYY-MM-DD HH:MM:SS[.nnnnnnnnn] (the decimal and fractional seconds are optional). =item -B Estop timeE -Saves only the packets whose timestamp is before stop time. +Reads only the packets whose timestamp is before stop time. The time is given in the following format YYYY-MM-DD HH:MM:SS[.nnnnnnnnn] (the decimal and fractional seconds are optional). diff --git a/editcap.c b/editcap.c index f004ffb210..2fa1959632 100644 --- a/editcap.c +++ b/editcap.c @@ -758,9 +758,9 @@ print_usage(FILE *output) fprintf(output, "\n"); fprintf(output, "Packet selection:\n"); fprintf(output, " -r keep the selected packets; default is to delete them.\n"); - fprintf(output, " -A only output packets whose timestamp is after (or equal\n"); + fprintf(output, " -A only read packets whose timestamp is after (or equal\n"); fprintf(output, " to) the given time (format as YYYY-MM-DD hh:mm:ss[.nnnnnnnnn]).\n"); - fprintf(output, " -B only output packets whose timestamp is before the\n"); + fprintf(output, " -B only read packets whose timestamp is before the\n"); fprintf(output, " given time (format as YYYY-MM-DD hh:mm:ss[.nnnnnnnnn]).\n"); fprintf(output, "\n"); fprintf(output, "Duplicate packet removal:\n");