Re: I've a question about capture result, please help.

[Guy Harris <guy () alum mit edu>]

On Mar 31, 2011, at 11:18 PM, Sake Blok wrote:

> Different systems use different snaplengths by default.

And different versions of tcpdump have different default snaplengths - 4.1.0 and later versions have a default of 
65535, but earlier versions have a default of 68 if built without IPv6 support and 96 if built with IPv6 support, so, 
as you note, you need "-s 0" (or, with *really* old versions, "-s 65535") to get the entire packet with those earlier 
versions.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.