snaplen vs number of bytes actually saved

[Aaron Turner <aturner () pobox com>]

So I've got an old pcap file which I don't remember the actual snaplen used.
Now I know the pcap_file_header keeps a record of this (in my case 144
bytes).  What is strange though, is that the file actually has a maximum
of 158 bytes stored (I can see the extra bytes in ethereal).

Can anyone explain the discrepancy?  This is libpcap 0.7.2.

Thanks,
Aaron

-- 
Aaron Turner <aturner at pobox.com|synfin.net>  http://synfin.net/
They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety. -- Benjamin Franklin
All emails are PGP signed; a lack of a signature indicates a forgery.

Attachment: _bin
Description: