1

The tcpdump manual shows:

-n     Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.

I have seen double n in a tcpdump command:
https://danielmiessler.com/study/tcpdump/

tcpdump -nnSX port 443

What does double n mean in tcpdump command?

1

2 Answers 2

2

I believe this depends on the version of tcpdump you are using.

The following reference https://linux.die.net/man/8/tcpdump is a man page to a version which uses "-nn":

-n

Don't convert host addresses to names. This can be used to avoid DNS lookups.

-nn

Don't convert protocol and port numbers etc. to names either.

Thanks, Deric

1

It doesn't seem to mean anything of it's own for tcpdump, so in this case it's equivalent to a single n.

For some networking tools it used to be/is that a single n disabled conversion that (might have) required network traffic (e.g. host name lookups) while two disabled every such conversion (i.e. post numbers are usually converted by looking in /etc/services). I don't remember if that was also the case for tcpdump, but else it might just be a habbit to use two n's.

But the only way to be sure in any particular case, is to ask whoever wrote the command why they use a double n.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.