Thorsten Scherer <t.scherer@xxxxxxxxxxxx> writes: > From tcpdump(8): > > -dd Dump packet-matching code as a C program fragment. > > Fixes: 7924cd5e0b3a ("filter: doc: improve BPF documentation") > Signed-off-by: Thorsten Scherer <t.scherer@xxxxxxxxxxxx> > --- > Documentation/networking/filter.rst | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/Documentation/networking/filter.rst b/Documentation/networking/filter.rst > index 8eb9a5d40f31..06e244094f49 100644 > --- a/Documentation/networking/filter.rst > +++ b/Documentation/networking/filter.rst > @@ -49,7 +49,7 @@ assured that the filter will be kept until the socket is closed. > The biggest user of this construct might be libpcap. Issuing a high-level > filter command like `tcpdump -i em1 port 22` passes through the libpcap > internal compiler that generates a structure that can eventually be loaded > -via SO_ATTACH_FILTER to the kernel. `tcpdump -i em1 port 22 -ddd` > +via SO_ATTACH_FILTER to the kernel. `tcpdump -i em1 port 22 -dd` > displays what is being placed into this structure. So I suspect you may be right, but both are legal options. When you apply a Fixes tag to a patch, it's generally a good idea to copy the author of the patch you claim to be fixing. Let's do that now and see what Daniel has to say...? Thanks, jon