search

mozillazg / ptcpdump

Process-aware, eBPF-based tcpdump
MIT License
613 stars 43 forks source link

New option to display TCP options #149

Closed matttbe closed 2 months ago

matttbe commented 2 months ago

Hello,

Since #67, the TCP options are no longer displayed by default.

These TCP options can be very useful. Using -v shows them, but then 2 more lines about processes are also printed, which makes the analysis harder.

Could it eventually possible to have a new dedicated option to display only the TCP options, similar to what TCPDump prints by default?

mozillazg commented 2 months ago

@matttbe Thanks for your suggestion! I'll check the output of tcpdump. You can use -v --oneline as workaround before I finished it.

matttbe commented 2 months ago

Thank you for your reply!

You can use -v --oneline as workaround before I finished it.

Thanks, that's helping indeed!

Instead of displaying the TCP options only when -v or something else is passed, it might be interesting to display just the option type, without the details, in the default view, e.g. TS in data packages. In the SYNs, I think it is still important to show what is being negotiated (MSS, SACK, MPTCP, etc.), but that's maybe because I'm mostly interested in the TCP packets :)