.\" -*- nroff -*-
.\" ovs.tmac
.\"
.\" Open vSwitch troff macro library
.
.
.\" Continuation line for .IP.
.de IQ
.  br
.  ns
.  IP "\\$1"
..
.
.\" Introduces a sub-subsection
.de ST
.  PP
.  RS -0.15in
.  I "\\$1"
.  RE
..
.
.\" The content between the lines below is from an-ext.tmac in groff
.\" 1.21, with some modifications.
.\" ----------------------------------------------------------------------
.\" an-ext.tmac
.\"
.\" Written by Eric S. Raymond <esr@thyrsus.com>
.\"            Werner Lemberg <wl@gnu.org>
.\"
.\" Version 2007-Feb-02
.\"
.\" Copyright (C) 2007, 2009, 2011 Free Software Foundation, Inc.
.\" You may freely use, modify and/or distribute this file.
.\"
.\"
.\" The code below provides extension macros for the `man' macro package.
.\" Care has been taken to make the code portable; groff extensions are
.\" properly hidden so that all troff implementations can use it without
.\" changes.
.\"
.\" With groff, this file is sourced by the `man' macro package itself.
.\" Man page authors who are concerned about portability might add the
.\" used macros directly to the prologue of the man page(s).
.
.
.\" Convention: Auxiliary macros and registers start with `m' followed
.\"             by an uppercase letter or digit.
.
.
.\" Declare start of command synopsis.  Sets up hanging indentation.
.de SY
.  ie !\\n(mS \{\
.    nh
.    nr mS 1
.    nr mA \\n(.j
.    ad l
.    nr mI \\n(.i
.  \}
.  el \{\
.    br
.    ns
.  \}
.
.  HP \w'\fB\\$1\fP\ 'u
.  B "\\$1"
..
.
.
.\" End of command synopsis.  Restores adjustment.
.de YS
.  in \\n(mIu
.  ad \\n(mA
.  hy \\n(HY
.  nr mS 0
..
.
.
.\" Declare optional option.
.de OP
.  ie \\n(.$-1 \
.    RI "[\fB\\$1\fP" "\ \\$2" "]"
.  el \
.    RB "[" "\\$1" "]"
..
.
.
.\" Start URL.
.de UR
.  ds m1 \\$1\"
.  nh
.  if \\n(mH \{\
.    \" Start diversion in a new environment.
.    do ev URL-div
.    do di URL-div
.  \}
..
.
.
.\" End URL.
.de UE
.  ie \\n(mH \{\
.    br
.    di
.    ev
.
.    \" Has there been one or more input lines for the link text?
.    ie \\n(dn \{\
.      do HTML-NS "<a href=""\\*(m1"">"
.      \" Yes, strip off final newline of diversion and emit it.
.      do chop URL-div
.      do URL-div
\c
.      do HTML-NS </a>
.    \}
.    el \
.      do HTML-NS "<a href=""\\*(m1"">\\*(m1</a>"
\&\\$*\"
.  \}
.  el \
\\*(la\\*(m1\\*(ra\\$*\"
.
.  hy \\n(HY
..
.
.
.\" Start email address.
.de MT
.  ds m1 \\$1\"
.  nh
.  if \\n(mH \{\
.    \" Start diversion in a new environment.
.    do ev URL-div
.    do di URL-div
.  \}
..
.
.
.\" End email address.
.de ME
.  ie \\n(mH \{\
.    br
.    di
.    ev
.
.    \" Has there been one or more input lines for the link text?
.    ie \\n(dn \{\
.      do HTML-NS "<a href=""mailto:\\*(m1"">"
.      \" Yes, strip off final newline of diversion and emit it.
.      do chop URL-div
.      do URL-div
\c
.      do HTML-NS </a>
.    \}
.    el \
.      do HTML-NS "<a href=""mailto:\\*(m1"">\\*(m1</a>"
\&\\$*\"
.  \}
.  el \
\\*(la\\*(m1\\*(ra\\$*\"
.
.  hy \\n(HY
..
.
.
.\" Continuation line for .TP header.
.de TQ
.  br
.  ns
.  TP \\$1\" no doublequotes around argument!
..
.
.
.\" Start example.
.de EX
.  nr mE \\n(.f
.  nf
.  nh
.  ft CW
..
.
.
.\" End example.
.de EE
.  ft \\n(mE
.  fi
.  hy \\n(HY
..
.
.\" EOF
.\" ----------------------------------------------------------------------
.TH ovs\-tcpdump 8 "2.12.0" "Open vSwitch" "Open vSwitch Manual"
.
.SH NAME
ovs\-tcpdump \- Dump traffic from an Open vSwitch port using \fBtcpdump\fR.
.
.SH SYNOPSIS
\fBovs\-tcpdump\fR \fB\-i\fR \fIport\fR \fBtcpdump options...\fR
.
.SH DESCRIPTION
\fBovs\-tcpdump\fR creates switch mirror ports in the \fBovs\-vswitchd\fR
daemon and executes \fBtcpdump\fR to listen against those ports. When the
\fBtcpdump\fR instance exits, it then cleans up the mirror port it created.
.PP
\fBovs\-tcpdump\fR will not allow multiple mirrors for the same port. It has
some logic to parse the current configuration and prevent duplicate mirrors.
.PP
The \fB\-i\fR option may not appear multiple times.
.PP
It is important to note that under \fBLinux\fR based kernels, tap devices do
not receive packets unless the specific tuntap device has been opened by an
application. This requires \fBCAP_NET_ADMIN\fR privileges, so the
\fBovs-tcpdump\fR command must be run as a user with such permissions (this
is usually a super-user).
.
.SH "OPTIONS"
.IP "\fB\-h\fR"
.IQ "\fB\-\-help\fR"
Prints a brief help message to the console.
.
.IP "\fB\-V\fR"
.IQ "\fB\-\-version\fR"
Prints version information to the console.
.
.IP "\fB\-\-db\-sock\fR"
The Open vSwitch database socket connection string. The default is
\fIunix:/var/run/openvswitch/db.sock\fR
.
.IP "\fB\-\-dump\-cmd\fR"
The command to run instead of \fBtcpdump\fR.
.
.IP "\fB\-i\fR"
.IQ "\fB\-\-interface\fR"
The interface for which a mirror port should be created, and packets should
be dumped.
.
.IP "\fB\-\-mirror\-to\fR"
The name of the interface which should be the destination of the mirrored
packets. The default is miINTERFACE
.
.IP "\fB\-\-span\fR"
If specified, mirror all ports (optional).
.
.SH "SEE ALSO"
.
.BR ovs\-appctl (8),
.BR ovs\-vswitchd (8),
.BR ovs\-pcap (1),
.BR ovs\-tcpundump (1),
.BR tcpdump (8),
.BR wireshark (8).