tcpdump mailing list archives
snaplen vs number of bytes actually saved
From: Aaron Turner <aturner () pobox com>
Date: Thu, 30 Oct 2003 16:01:16 -0800
So I've got an old pcap file which I don't remember the actual snaplen used. Now I know the pcap_file_header keeps a record of this (in my case 144 bytes). What is strange though, is that the file actually has a maximum of 158 bytes stored (I can see the extra bytes in ethereal). Can anyone explain the discrepancy? This is libpcap 0.7.2. Thanks, Aaron -- Aaron Turner <aturner at pobox.com|synfin.net> http://synfin.net/ They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. -- Benjamin Franklin All emails are PGP signed; a lack of a signature indicates a forgery.
Attachment:
_bin
Description:
Current thread:
- snaplen vs number of bytes actually saved Aaron Turner (Oct 30)
- Re: snaplen vs number of bytes actually saved Guy Harris (Oct 30)