From c44813eb1a7546f77b00ae9d1702d8f5c47b7d40 Mon Sep 17 00:00:00 2001 From: Tobias Klauser Date: Mon, 14 May 2018 14:07:24 +0200 Subject: man: netsniff-ng: document time formats for -o/--out Commit e3e8eea41966 ("netsniff-ng: add date format strings to --out.") introduced the possibility to specify time formats in the -o/--out parameter. Document this in netsniff-ng(8) Updates #158 Signed-off-by: Tobias Klauser --- netsniff-ng.8 | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/netsniff-ng.8 b/netsniff-ng.8 index b6758a5..d714853 100644 --- a/netsniff-ng.8 +++ b/netsniff-ng.8 @@ -67,7 +67,7 @@ netsniff-ng can also be used to debug netlink traffic. .PP .SS -i , -d , --in , --dev Defines an input device. This can either be a networking device, a pcap file -or stdin (\[lq]\-\[rq]). In case of a pcap file, the pcap type (\[lq]\-D\[rq] +or stdin (\[lq]\-\[rq]). In case of a pcap file, the pcap type (\fB\-D\fP option) is determined automatically by the pcap file magic. In case of stdin, it is assumed that the input stream is a pcap file. If the pcap link type is Netlink and pcap type is default format (usec or nsec), then each packet will @@ -75,21 +75,25 @@ be wrapped with pcap cooked header [2]. .PP .SS -o , --out Defines the output device. This can either be a networking device, a pcap file, -a folder, a trafgen(8) configuration file or stdout (\[lq]-\[rq]). In the case of a -pcap file that should not have the default pcap type (0xa1b2c3d4), the additional -option \[lq]\-T\[rq] must be provided. If a directory is given, then, instead of a -single pcap file, multiple pcap files are generated with rotation based on -maximum file size or a given interval (\[lq]\-F\[rq] option). Optionally, -sending the SIGHUP signal to the netsniff-ng process causes a premature rotation -of the file. A trafgen configuration file can currently only be specified if the -input device is a pcap file. To specify a pcap file as the output device, the -file name must have \[lq].pcap\[rq] as its extension. If stdout is given as a -device, then a trafgen configuration will be written to stdout if the input -device is a pcap file, or a pcap file if the input device is a networking -device. In case if the input device is a Netlink monitor device and pcap type -is default (usec or nsec) then each packet will be wrapped with pcap cooked -header [2] to keep Netlink family number (Kuznetzov's and netsniff-ng pcap types -already contain family number in protocol number field). +a folder, a trafgen(8) configuration file or stdout (\[lq]-\[rq]). If the output +device is a pcap or trafgen(8) configuration file, it may include a time format +as defined by +.BR strfime (3). +If used in conjunction with the \fB-F\fP option, each rotated file will have a +unique time stamp. In the case of a pcap file that should not have the default +pcap type (0xa1b2c3d4), the additional option \fB\-T\fP must be provided. If a +directory is given, then, instead of a single pcap file, multiple pcap files are +generated with rotation based on maximum file size or a given interval +(\fB\-F\fP option). Optionally, sending the SIGHUP signal to the netsniff-ng +process causes a premature rotation of the file. A trafgen configuration file +can currently only be specified if the input device is a pcap file. To specify a +pcap file as the output device, the file name must have \[lq].pcap\[rq] as its +extension. If stdout is given as a device, then a trafgen configuration will be +written to stdout if the input device is a pcap file, or a pcap file if the +input device is a networking device. If the input device is a Netlink monitor +device and pcap type is default (usec or nsec) then each packet will be wrapped +with pcap cooked header [2] to keep Netlink family number (Kuznetzov's and +netsniff-ng pcap types already contain family number in protocol number field). .PP .SS -C , --fanout-group If multiple netsniff-ng instances are being started that all have the same packet -- cgit v1.2.3-54-g00ecf