Re: Should the default snapshot length in tcpdump be 65535?

[Arien Vijn <arien.vijn () ams-ix net>]

On 5 Mar. 2009, at 10:20 AM, Guy Harris wrote:

> > Would it make sense to have tcpdump default to the maximum snapshot  
> > length, rather than 68 (without IPv6 support) or 96 (with IPv6  
> > support)?
>
> I've checked in a change to make the default snapshot length 65535.

Suddenly* changing this default may couse some inconveniences for  
those who use tcpdump in scripts to archive and/or process headers  
only. People may not expect a full packtet from tcpdump after all  
these years. Short snap lengths may be wanted because of legal reasons  
or because the payload is just not interesting.

Therefore it would be a good idea to make this an option during  
compile time. The default should be what it always was until at least  
the next major version (5.0.0).

Just my thoughts for what they are worth without code :)

-- Arien

* from an enduser perspective.

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.