On Wed, Sep 01, 2021 at 08:28:14PM +0200, Denis Fondras wrote: > Le Wed, Sep 01, 2021 at 06:42:54PM +0100, Jason McIntyre a ?crit : > > On Wed, Sep 01, 2021 at 06:15:04PM +0200, Denis Fondras wrote: > > > I was searching for the sampling command of tcpdump but could not find it > > > in the > > > manual. In fact it is missing some primitives compared to pcap-filter > > > manual. > > > > > > > hi. > > > > it looks like there's a whole heap of duplication going on here. does > > tcpdump support just a subset of the syntax in pcap-filter(3), or are > > they exactly the same? > > > > i wonder if we can whack all the tcpdump text, or just inline the exact > > text of pcap-filter.3 if it really needs to be there (or vice-versa if > > tcpdump.8 is more authorative). > > > > or do they differ? > > > > tcpdump uses libpcap to decode the filter so as far as I can tell, they are > the > same. > > I would find it good to have only a pointer to pcap-filter manual in tcpdump > manual instead of the full list of primitives. >
then i guess i would propose doing exactly that: removing the bulk of the text describing primitives and qualifiers and leave a pointer to pcap-filter.3. we could leave a brief description of the main qualifiers, and perhaps just a list of valid keywords for the other primitives. do you want to take a shot at that? then we can see whether it's an improvement. jmc
