From fdd80e7fd9faa6e17f3ee5c675bf27c2eae6a2c2 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Fri, 31 May 2013 15:37:41 +0200 Subject: man: netsniff-ng: update man page to document when -J is needed --jumbo-support is now not always needed anymore. So document when one needs it and when not. Signed-off-by: Daniel Borkmann --- netsniff-ng.8 | 29 ++++++++++++++++------------- 1 file changed, 16 insertions(+), 13 deletions(-) (limited to 'netsniff-ng.8') diff --git a/netsniff-ng.8 b/netsniff-ng.8 index 08fe192..ced6da1 100644 --- a/netsniff-ng.8 +++ b/netsniff-ng.8 @@ -104,11 +104,13 @@ following values are accepted \[lq]KiB/MiB/GiB\[rq]; As time parameter, it can be \[lq]s/sec/min/hrs\[rq]. .PP .SS -J, --jumbo-support -By default, netsniff-ng's ring buffer frames are a fixed size of 2048 bytes. -This means that if you are expecting jumbo frames or even super jumbo frames to -pass through your network, then you need to enable support for that by using -this option. However, this has the disadvantage of performance degradation -and a bigger memory footprint for the ring buffer. +By default, in pcap replay or redirect mode, netsniff-ng's ring buffer frames +are a fixed size of 2048 bytes. This means that if you are expecting jumbo +frames or even super jumbo frames to pass through your network, then you need +to enable support for that by using this option. However, this has the +disadvantage of performance degradation and a bigger memory footprint for the +ring buffer. Note that this doesn't affect (pcap) capturing mode, since tpacket +in version 3 is used! .PP .SS -R, --rfraw In case the input or output networking device is a wireless device, it is @@ -260,12 +262,13 @@ traffic. Randomize the order of packets for the outgoing device and do not print any packet contents to the terminal. Also, pin the process and NIC IRQ affinity to CPU 0. .PP -.SS netsniff-ng --in team0 --out /opt/probe/ -s -m -J --interval 100MiB -b 0 +.SS netsniff-ng --in team0 --out /opt/probe/ -s -m --interval 100MiB -b 0 Capture on an aggregated team0 networking device and dump packets into multiple pcap files that are split into 100MiB each. Use mmap(2) I/O as a pcap write -method, enable support for super jumbo frames up to 64KB, and do not print -the captured data to the terminal. Pin netsniff-ng and NIC IRQ affinity to -CPU 0. The default pcap magic type is 0xa1b2c3d4 (tcpdump-capable pcap). +method, support for super jumbo frames is built-in (does not need to be +configured here), and do not print the captured data to the terminal. Pin +netsniff-ng and NIC IRQ affinity to CPU 0. The default pcap magic type is +0xa1b2c3d4 (tcpdump-capable pcap). .PP .SS netsniff-ng --in vlan0 --out dump.pcap -c -u `id -u bob` -g `id -g bob` Capture network traffic on device wlan0 into a pcap file called dump.pcap @@ -274,12 +277,12 @@ latency). Also, after setting up the RX_RING for capture, drop privileges from root to the user and group \[lq]bob\[rq]. Invoke the packet dissector and print packet contents to the terminal for further analysis. .PP -.SS netsniff-ng --in any --filter http.bpf -B --jumbo-support --ascii -V +.SS netsniff-ng --in any --filter http.bpf -B --ascii -V Capture from all available networking interfaces and install a low-level filter that was previously compiled by bpfc(8) into http.bpf in order to -filter HTTP traffic. Enable super jumbo frame support and only print -human readable packet data to the terminal, and also be more verbose during -setup phase. Moreover, dump a BPF disassembly of http.bpf. +filter HTTP traffic. Super jumbo frame support is automatically enabled and +only print human readable packet data to the terminal, and also be more +verbose during setup phase. Moreover, dump a BPF disassembly of http.bpf. .PP .SS netsniff-ng --in dump.pcap --out dump.cfg --silent Convert the pcap file dump.pcap into a trafgen(8) configuration file dump.cfg. -- cgit v1.2.3-54-g00ecf