build-manpage.py

#!/usr/bin/env uv run
# /// script
# dependencies = ["mistune"]
# ///
import mistune
import sys

class ManPageRenderer(mistune.HTMLRenderer):
    def paragraph(self, text):
        return f'.LP\n{text}\n'

    def block_code(self, code, info=None):
        code = code.strip()
        return f'.RS\n.nf\n.B\n{code}\n.fi\n.RE\n'

    def emphasis(self, text):
        return f'\\fI{text}\\fP'

    def strong(self, text):
        return f'\\fB{text}\\fP'

    def text(self, text):
        return text

if __name__ == "__main__":
    renderer = ManPageRenderer()
    md = mistune.create_markdown(renderer=renderer)

    with open(sys.argv[1], 'r') as f:
        markdown_text = f.read()

    result = md(markdown_text)
    print(result.rstrip())

build.sh

render-manpage.py examples.md > out
cat before out after > tcpdump.1.in

examples.md

To print packets on all network interfaces (it's often best to pass -n to display IP addresses rather than hostnames):

tcpdump -ni any

To print all packets on port 8080:

tcpdump port 8080

To print all sent to or from 192.0.2.1:

tcpdump host 192.0.2.1

To print all packets sent from 192.0.2.1, excluding on port 22:

tcpdump src host 192.0.2.1 and not port 22

To write all packets on port 8080 to out.pcap:

tcpdump port 8080 -w out.pcap

To print the start and end packets (the SYN and FIN packets) of each TCP conversation.

tcpdump 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'

To print all IPv4 HTTP packets to and from port 80, i.e. print only packets that contain data, not, for example, SYN and FIN packets and ACK-only packets.

tcpdump 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'