3 files changed, 114 insertions, 0 deletions
diff --git a/Completion/Unix/Command/.distfiles b/Completion/Unix/Command/.distfiles
index ec4ac3975..da748708b 100644
--- a/Completion/Unix/Command/.distfiles
+++ b/Completion/Unix/Command/.distfiles
@@ -82,6 +82,7 @@ _gzip
 _iconv
 _id
 _ifconfig
+_iftop
 _imagemagick
 _init_d
 _ip
@@ -184,6 +185,7 @@ _surfraw
 _sysctl
 _tar
 _tardy
+_tcpdump
 _tcptraceroute
 _telnet
 _texinfo
diff --git a/Completion/Unix/Command/_iftop b/Completion/Unix/Command/_iftop
new file mode 100644
index 000000000..41ffb4ea1
--- /dev/null
+++ b/Completion/Unix/Command/_iftop
@@ -0,0 +1,20 @@
+#compdef iftop
+
+_interfaces () {
+	_wanted interfaces expl 'network interface' \
+		_net_interfaces
+	_values "Pseudo-device that captures on all interfaces" "any"
+}
+
+_arguments \
+  '(-h -n -N -p -b -B -P -i -f -F -c)'-h'[print a summary of usage]' \
+  -n"[don't do hostname lookups]" \
+  -N"[don't resolve port number to service names]" \
+  -p'[run in promiscuous mode]' \
+  -P'[turn on port display]' \
+  -b"[don't display bar graphs of traffic]" \
+  -B'[display bandwidth rates in bytes/sec rather than bits/sec]' \
+  -i'[interface]:network interface:_interfaces' \
+  -f'[filter]:BPF filter' \
+  -F'[net/mask]:network/mask' \
+  -c'[config file]:config file:_files'
diff --git a/Completion/Unix/Command/_tcpdump b/Completion/Unix/Command/_tcpdump
new file mode 100644
index 000000000..015cd8651
--- /dev/null
+++ b/Completion/Unix/Command/_tcpdump
@@ -0,0 +1,92 @@
+#compdef tcpdump
+
+typeset -A opt_args
+
+_interfaces () {
+	_wanted interfaces expl 'network interface' \
+		_net_interfaces
+	_values "Pseudo-device that captures on all interfaces" "any"
+}
+
+_esp_secrets () {
+	_values -S : 'ESP algorithm' \
+		'des-cbc:secret' \
+		'3des-cbc:secret' \
+		'blowfish-cbc:secret' \
+		'rc3-cbc:secret' \
+		'cast128-cbc:secret' \
+		none
+}
+
+_packet_types () {
+	_values 'Packets type' \
+		'aodv[Ad-hoc On-demand Distance Vector protocol]' \
+		'cnfp[Cisco NetFlow protocol]' \
+		'rpc[Remote Procedure Call]' \
+		'rtp[Real-Time  Applications  protocol]' \
+		'rtcp[Real-Time Applications control protocol]' \
+		'snmp[Simple Network Management Protocol]' \
+		'tftp[Trivial File Transfer Protocol]' \
+		'vat[Visual Audio Tool]' \
+		'wb[distributed White Board]'
+}
+
+_data_link_types () {
+	if (( $+opt_args[-i] )); then
+		vals=( ${${${(s:  :)"$(_call_program data-link-types tcpdump -L -i $opt_args[-i] 2>&1)"}[2,-1]}/ /:} )
+		_describe -t data-link-types "data link types ($opt_args[-i])" vals && ret=0
+	else
+		_values "Data link types (general)" \
+			"EN10MB" \
+			"LINUX_SLL"
+	fi
+}
+
+_bpf_filter () {
+}
+
+_arguments \
+  '()-A[Print each packet in ASCII]' \
+  -c'[Exit after receiving specified number of packets]:number of packets' \
+  -C'[Specify output file size in MB (10e6 bytes)]:output file size' \
+  '(-ddd)-d[Dump the compiled packet-matching code in a human readable form]' \
+  '(-ddd)-dd[Dump packet-matching code as a C program fragment]' \
+  '(-d -dd)-ddd[Dump packet-matching code as decimal numbers (preceded with a count)]' \
+  '(-A -c -C -d -dd -ddd -e -E -f -F -i -l -L -m -M -n -N -O -p -q -R -r -S -s -T -t -tt -ttt -tttt -u -U -v -vv -vvv -w -W -x -xx -X -XX -y -Z *)'-D'[Print the list of the network interfaces available on the system]' \
+  -e'[Print the link-level header on each dump line]' \
+  -E"[Decrypting IPsec ESP packets]:spi@ipaddr::algo\:secret:_esp_secrets" \
+  -f"[Print 'foreign' IPv4 addresses numerically]" \
+  -F'[input file for the filter expression]:filter expression file:_files' \
+  -i'[Interface]:interface:_interfaces' \
+  -l'[Make stdout line buffered]' \
+  '(-A -c -C -d -dd -ddd -e -E -f -F -l -D -m -M -n -N -O -p -q -R -r -S -s -T -t -tt -ttt -tttt -u -U -v -vv -vvv -w -W -x -xx -X -XX -y -Z *)'-L'[List the known data link types for the interface]' \
+  '*-m[Load SMI MIB module definitions]:SMI MIB module definitions:_files' \
+  -M'[shared secret for validating the digests in TCP segments with the TCP-MD5 option]:secret' \
+  -n"[Don't convert addresses to names]" \
+  -N"[Don't print domain name qualification of host names]" \
+  -O"[Don't run the packet-matching code optimizer]" \
+  -p"[Don't put the interface into promiscuous mode]" \
+  -q'[Quick (quiet?) output]' \
+  -R'[Assume ESP/AH packets to be based on old specification (RFC1825 to RFC1829)]' \
+  -r'[Read packets from file]:input file:_files' \
+  -S'[Print absolute TCP sequence numbers]' \
+  -s'[Specify number of bytes of data to snarf from each packet]:number of bytes to snap' \
+  -T'[Interpret captured packets as specified type]:packet type:_packet_types' \
+  "(-tttt)-t[Don't print a timestamp on each dump line]" \
+  '(-ttt -tttt)-tt[Print an unformatted timestamp on each dump line]' \
+  '(-tt -tttt)-ttt[Print a delta (in micro-seconds) between current and previous line on each dump line]' \
+  '(-t -tt -ttt)-tttt[Print a timestamp in default format proceeded by date on each dump line]' \
+  -u'[Print undecoded NFS handles]' \
+  -U'[Make output packet-buffered when saving to file (-w)]' \
+  '(-vvv)-v[slightly more verbose output]' \
+  '(-vvv)-vv[more verbose output]' \
+  '(-v -vv)-vvv[most verbose output]' \
+  -w'[Write the raw packets to file]:output file:_files' \
+  -W'[Limit the number of created files (-C)]:number of files' \
+  -x'[Print each packet (minus its link level header) in hex]' \
+  '(-x)-xx[Print each packet, including its link level header, in hex]' \
+  -X'[Print each packet (minus its link level header) in hex and ASCII]' \
+  '(-X)-XX[Print each packet, including its link level header, in hex and ASCII]' \
+  -y'[Set the data link type to use while capturing packets]:data link type:_data_link_types' \
+  -Z'[Drops privileges (if root) and changes user ID (along with primary group)]:user:_users' \
+  '*:BPF filter:_bpf_filter'