Re: -e vs. -x, revisited

[Andrew Brown <atatat () atatdot net>]

> > Unless somebody comes up with a good reason *NOT* to make "-e" cause
> > "-x" and "-X" to dump the link-layer header,
>
> Actually, I can think of a reason why we might not want to to it - it
> might break scripts that parse the result of "tcpdump -e -x" *and* that
> expect the hex dump not to include the link-layer header.
>
> The "link-layer header isn't dumped" is documented going back at least
> as far as tcpdump 3.4:
>
>     -x    Print each packet (minus its  link  level  header)  in
>                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>          hex.  The smaller of the entire packet or snaplen bytes
>          will be printed.
>
> so perhaps we should add a new command-line flag to handle that (or,
> along the lines of "-t" vs. "-tt" and "-v" vs. "-vv", have "-xx" and
> "-XX" cause the link-layer header to be printed).

excellent point, imo, and an elegant solution.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior () daemon org             * "ah!  i see you have the internet
twofsonet () graffiti com (Andrew Brown)                that goes *ping*!"
werdna () squooshy com       * "information is power -- share the wealth."
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe