Hi Guy. Yes, that (defaulting to the maximum allowed by the protocol/system) was what I'm referring to. Also, is it considered normal for Linux 2.6.25 and above (or libpcap, although I'm not sure exactly what to blame) to truncate large numbers of USB packets? (I assume this has been hashed to death on the list in the past, though).
Thanks. On Wed, Oct 29, 2008 at 6:58 PM, Guy Harris <[EMAIL PROTECTED]> wrote: > > On Oct 29, 2008, at 10:48 AM, Tyson Key wrote: > > It seems to work fine now, although I could probably do with automatically >> setting the "snaplen" somehow. >> > > I.e., defaulting to the maximum (65535) rather than the current default of > 64 (without IPv6) or 96 (with IPv6)? > > At least one OS that distributes tcpdump has considered making the default > 65535. Should the default be 65535, especially given that, the "tcp" in > "tcpdump" nonwithstanding, it's used to do more than just look at TCP > behavior? > > - > This is the tcpdump-workers list. > Visit https://cod.sandelman.ca/ to unsubscribe. > -- Fight Internet Censorship! http://www.eff.org ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Open-Source Community, and Technology Testbed: http://www.house404.co.uk/ - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
