On Thu, 11 Apr 2013 09:53:21 +0200 Jorgen Grahn <grahn+...@snipabacken.se> wrote: > > 2. The annotated example printouts include things like: > > > rtsg.1023 > csam.login: P 2:21(19) ack 1 win 4096 > > The notation is 'first:last(nbytes)' which means 'sequence numbers > > first up to but not including last which is nbytes bytes of user data'. > > This is indeed what tcpdump used to do -- it corresponds with what Stevens > shows in "TCP/IP Illustrated". But in the current tcpdump (and the one in > stable), > the (nbytes) part is not present, and there is no obvious option to enable it. > Not even -v makes a difference. > > I must assume that nbytes, being last-first, was deemed superfluous at some > point > and removed, without a corresponding update to the documentation.
The output format description was out of date in many places. It has been updated in tcpdump commit e48f4ca6ca99cab11eba2dec7dcb4915fa5533dc.
