What does double n mean in tcpdump command?

Question

The tcpdump manual shows:

-n     Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

I have seen double n in a tcpdump command:
https://danielmiessler.com/study/tcpdump/

tcpdump -nnSX port 443

What does double n mean in tcpdump command?

Answer 1

I believe this depends on the version of tcpdump you are using.

The following reference https://linux.die.net/man/8/tcpdump is a man page to a version which uses "-nn":

-n

Don't convert host addresses to names. This can be used to avoid DNS lookups.

-nn

Don't convert protocol and port numbers etc. to names either.

Thanks, Deric

Answer 2

It doesn't seem to mean anything of it's own for tcpdump, so in this case it's equivalent to a single n.

For some networking tools it used to be/is that a single n disabled conversion that (might have) required network traffic (e.g. host name lookups) while two disabled every such conversion (i.e. post numbers are usually converted by looking in /etc/services). I don't remember if that was also the case for tcpdump, but else it might just be a habbit to use two n's.

But the only way to be sure in any particular case, is to ask whoever wrote the command why they use a double n.