3 ms·
The "-nn" explanation seems wrong. Neither libpcap's tcpdump nor BSD's need more than one "-n" to not translate port. Even in their examples, we can spot that u
by vbernat 8y ago
The "-nn" explanation seems wrong. Neither libpcap's tcpdump nor BSD's need more than one "-n" to not translate port. Even in their examples, we can spot that using a single "-n" do not translate port names.
Additionally, it's always better to always use "-p" if you don't want to accidentally attract additional traffic to the host (additional VLAN on a 802.1q interface, or additional multicast traffic).
- georgyo 8y agoI have always had to use -nn to not translate ports. If what you say is true, it must be recent.
- isostatic 8y agoI've always used -nn (or -n -n), it's really annoying - usually I want to resolve IPs, but not ports.
- tlynchpin 8y agoReally annoying, in the common case you don't want /etc/services names since they're always wrong for the ephemeral >1024 client side port. Also, not to be confused with `lsof -n -P`!