Re: [Wireshark-users] Filtering both vlan-tagged

[Guy Harris <guy () alum mit edu>]

Joerg Mayer wrote:

> Well, it's not a bug per se, but I really think that the capture syntax
> manpage should be part of libpcap and not of tcpdump. I know of a few
> systems that have wireshark installed but not tcpdump. Also, it is
> possible to build tcpdump with older versions of libpcap where the
> capture syntax might be different.

It's always bothered me that it's part of a man page for an application 
that's just one of the apps that support libpcap-style filters.

However, I'm not sure the libpcap man page is the right place, either, 
as it'll be lost amidst a bunch of details of interest only to people 
writing code that uses libpcap.

Wireshark has a "wireshark-filter(4)" man page for its display filter; 
would it make sense to have something like a "pcap-filter" man page, to 
which the tcpdump/WinDump, libpcap/WinPcap, Wireshark, TShark, and any 
other application man pages could refer?

Looking at the FreeBSD man page sections (treating FreeBSD as an example 
of the "Version 7/BSD" style of man page sections), pcap-filter - and 
wireshark-filter - arguably belong, in systems using the V7/BSD style, 
in section 7 ("miscellaneous information pages", or "Macros and 
conventions"), rather than section 4 ("introduction to devices and 
device drivers", or "Special files").

Looking at the names that Solaris uses for the sections (treating 
Solaris as an example of the "System V" style of man page sections), the 
appropriate section would probably be section 5 ("Standards, 
Environments, and Macros", or "miscellany"), although section 4 ("file 
formats") might not be *too* off-base.

Unfortunately, I don't know of any easy way to determine which 
convention applies on the target host - I'll see if I can find configure 
scripts that install "administrative" tools, and see if they figure out 
whether to install the man page in section 8 (on V7/BSD-style systems) 
or section 1M (for SV-style systems).

We can probably just pick a section for now, and worry about getting 
into the right section later.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.