On Thu, Sep 02, 2021 at 03:33:17AM -0600, Theo de Raadt wrote: > Jason McIntyre <[email protected]> wrote: > > > On Thu, Sep 02, 2021 at 12:44:56AM -0600, Theo de Raadt wrote: > > > Jason McIntyre <[email protected]> wrote: > > > > > > > then i guess i would propose doing exactly that: removing the bulk of > > > > the text describing primitives and qualifiers and leave a pointer to > > > > pcap-filter.3. we could leave a brief description of the main > > > > qualifiers, and perhaps just a list of valid keywords for the other > > > > primitives. > > > > > > I think that will be very annoying. > > > > > > When I want to use tcpdump, I don't want to go reading a manual page > > > which isn't called tcpdump. Why should people need to jump another step. > > > > > > Why should the tcpdump option become just a stub about the getopt options. > > > > > > I believe most people run 'man tcpdump' not to read about the getopt > > > options, > > > but to remind themselves of the pcap grammar they are about to use. > > > Making > > > them run the man command twice is inserting a distraction into the > > > process. > > > > > > I recognize the tcpdump manual page doesn't describe the full grammer, but > > > it is still useful as-is. > > > > > > > why not just paste in the body of pcap-filter in then and we can try and > > keep them in sync thereafter? > > that might work >
a paste in would be simple, but i guess i'd want someone to authoratively say that the text in pcap-filter is the correct one, or vice versa. i.e. i'm not familiar with the gubbins. tcpdump talks about proto ah and atalk, but pcap-filter does not. pcap-filter talks about tr as an alias for ether, but tcpdump does not. and so on. perhaps it is not so simple. jmc
