From 05c6ecbeff759c44ad6a61d8fa6b33be7471b4d7 Mon Sep 17 00:00:00 2001
From: Marcel Holtmann <marcel@holtmann.org>
Date: Sun, 10 Aug 2014 12:48:40 -0700
Subject: [PATCH] README: Mention the possibility to capture traces using
 tcpdump

---
 README | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/README b/README
index e74267b7..ac9fbfdb 100644
--- a/README
+++ b/README
@@ -93,6 +93,19 @@ needs to be created:
 For now it is important that the netlink monitor interace is actually
 named nlmon. Future version might relax this requirement.
 
+It is possible to create netlink traces in PCAP format using tcpdump
+and then read them via iwmon utility:
+
+	tcpdump -i nlmon -w trace-file.pcap
+
+The resulting PCAP files will use Linux cooked packet format containing
+packets with ARPHRD_NETLINK type. They can be read using iwmon:
+
+	iwmon -r trace-file.pcap
+
+At this time iwmon is not able to write PCAP files by itself. This might
+change in future versions.
+
 
 Simulating devices
 ==================