Re: Should the default snapshot length in

[Eloy Paris <peloy () chapus net>]

On Mon, Mar 09, 2009 at 11:52:50PM +0100, Arien Vijn wrote:

> On 5 Mar. 2009, at 10:20 AM, Guy Harris wrote:
>
> > > Would it make sense to have tcpdump default to the maximum snapshot  
> > > length, rather than 68 (without IPv6 support) or 96 (with IPv6  
> > > support)?
> >
> > I've checked in a change to make the default snapshot length 65535.
>
> Suddenly* changing this default may couse some inconveniences for those 
> who use tcpdump in scripts to archive and/or process headers only. People 
> may not expect a full packtet from tcpdump after all these years. Short 
> snap lengths may be wanted because of legal reasons or because the 
> payload is just not interesting.
>
> Therefore it would be a good idea to make this an option during compile 
> time.

Hmmm. Wouldn't this be a bit overkill? And even if we went down this
path, I don't think that recompiling with the option to revert to
the shorter snapshot length by default will be that much easier for
administrators than editing legacy scripts to add "-s 68" to tcpdump
invokations.

Cheers,

Eloy Paris.-

> The default should be what it always was until at least the next 
> major version (5.0.0).
>
> Just my thoughts for what they are worth without code :)
>
> -- Arien
>
> * from an enduser perspective.
>
> -
> This is the tcpdump-workers list.
> Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.