-D [bind_address:]port
             Specifies a local ``dynamic'' application-level port forwarding.  This
             works by allocating a socket to listen to port on the local side, option-
             ally bound to the specified bind_address.  Whenever a connection is made
             to this port, the connection is forwarded over the secure channel, and the
             application protocol is then used to determine where to connect to from
             the remote machine.  Currently the SOCKS4 and SOCKS5 protocols are sup-
             ported, and ssh will act as a SOCKS server.  Only root can forward privi-
             leged ports.  Dynamic port forwardings can also be specified in the con-
             figuration file.