From 1a51e034090e7dcfa128c57d3313ae7f72e99c66 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Fri, 22 Jan 2010 04:43:07 +0000 Subject: [PATCH] Clarify tcpdump's default snapshot length a bit - and recommend 65535 as the argument to "-s" (1500 is too small even for Ethernet, as the maximum size of packets on Ethernet is 1514 bytes if you don't count the FCS and 1518 bytes if you do). svn path=/trunk/; revision=31615 --- docbook/wsug_src/WSUG_app_tools.xml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docbook/wsug_src/WSUG_app_tools.xml b/docbook/wsug_src/WSUG_app_tools.xml index 0e6074bd1f..f8229817ff 100644 --- a/docbook/wsug_src/WSUG_app_tools.xml +++ b/docbook/wsug_src/WSUG_app_tools.xml @@ -37,14 +37,14 @@ However, the default tcpdump parameters result in a - capture file where each packet is truncated, because - tcpdump, by default, only captures the first 68 - bytes of each packet. + capture file where each packet is truncated, because most versions of + tcpdump, will, by default, only capture the first + 68 or 96 bytes of each packet. To ensure that you capture complete packets, use the following command: -tcpdump -i <interface> -s 1500 -w <some-file> +tcpdump -i <interface> -s 65535 -w <some-file> You will have to specify the correct interface and the name of a file to save into. In addition,