Use immediate mode if available.

If libpcap has pcap_set_immediate_mode(), then default to immediate mode
if we're printing packets to a terminal, and use immediate mode if
--immediate-mode is specified.

1 files changed, 11 insertions, 0 deletions

diff --git a/tcpdump.1.in b/tcpdump.1.in
index 6db259e9..2314bc8c 100644
--- a/tcpdump.1.in
+++ b/tcpdump.1.in
@@ -128,6 +128,10 @@ tcpdump \- dump traffic on a network
 [
 .BI \-\-time\-stamp\-precision= tstamp_precision
 ]
+.ti +8
+[
+.B \-\-immediate\-mode
+]
 [
 .B \-\-version
 ]
@@ -421,6 +425,13 @@ monitor mode will be shown; if
 is specified, only those link-layer types available when in monitor mode
 will be shown.
 .TP
+.BI \-\-immediate\-mode
+Capture in "immediate mode".  In this mode, packets are delivered to
+tcpdump as soon as they arrive, rather than being buffered for
+efficiency.  This is the default when printing packets rather than
+saving packets to a ``savefile'' if the packets are being printed to a
+terminal rather than to a file or pipe.
+.TP
 .BI \-j " tstamp_type"
 .PD 0
 .TP