Re: Should the default snapshot length in tcpdump be 65535?

[Arien Vijn <arien.vijn () ams-ix net>]

On 10 Mar. 2009, at 2:01 AM, Eloy Paris wrote:

> On Mon, Mar 09, 2009 at 11:52:50PM +0100, Arien Vijn wrote:


> > Therefore it would be a good idea to make this an option during  
> > compile
> > time.
>
> Hmmm. Wouldn't this be a bit overkill? And even if we went down this
> path, I don't think that recompiling with the option to revert to
> the shorter snapshot length by default will be that much easier for
> administrators than editing legacy scripts to add "-s 68" to tcpdump
> invokations.

I meant it the other way around :) I suggested to leave the defaults  
to what they are. From experience I know that changing defaults are  
often not appreciated by the many administrators with lots of things  
on their minds.

For those who don't like to type "-s 0" it would be nice to have the  
option to get rid of that under compile time.

Things should not be static for ever though. IMO the default can be  
changed in the next major release (5), not in any 4.x.x release.

Cheers, Arien


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.