-D [bind_address:]port
Specifies a local ``dynamic'' application-level port forwarding. This
works by allocating a socket to listen to port on the local side, option-
ally bound to the specified bind_address. Whenever a connection is made
to this port, the connection is forwarded over the secure channel, and the
application protocol is then used to determine where to connect to from
the remote machine. Currently the SOCKS4 and SOCKS5 protocols are sup-
ported, and ssh will act as a SOCKS server. Only root can forward privi-
leged ports. Dynamic port forwardings can also be specified in the con-
figuration file.