| -d <interface> |
| | Set the interface name to be the name supplied. This is useful with the -P, -S, -T and -E options, where it is not otherwise possible to associate a packet with an interface. Normal "text packets" can override this setting. |
| -g <gateway> |
| | Specify the hostname of the gateway through which to route packets. This is required whenever the destination host isn’t directly attached to the same network as the host from which you’re sending. |
| -m <MTU> | Specify the MTU to be used when sending out packets. This option allows you to set a fake MTU, allowing the simulation of network interfaces with small MTU’s without setting them so. |
| -r <filename> |
| | Specify the filename from which to take input. Default is stdin. |
| -E | The input file is to be text output from etherfind. The text formats which are currently supported are those which result from the following etherfind option combinations: |
etherfind -n
etherfind -n -t
|
| -H | The input file is to be hex digits, representing the binary makeup of the packet. No length correction is made, if an incorrect length is put in the IP header. |
| -P | The input file specified by -i is a binary file produced using libpcap (i.e., tcpdump version 3). Packets are read from this file as being input (for rule purposes). |
| -R | When sending packets out, send them out "raw" (the way they came in). The only real significance here is that it will expect the link layer (i.e. ethernet) headers to be prepended to the IP packet being output. |
| -S | The input file is to be in "snoop" format (see RFC 1761). Packets are read from this file and used as input from any interface. This is perhaps the most useful input type, currently. |
| -T | The input file is to be text output from tcpdump. The text formats which are currently supported are those which result from the following tcpdump option combinations: |
tcpdump -n
tcpdump -nq
tcpdump -nqt
tcpdump -nqtt
tcpdump -nqte
|
| -X | The input file is composed of text descriptions of IP packets. |
|
