On Mar 31, 2011, at 11:18 PM, Sake Blok wrote: > Different systems use different snaplengths by default.
And different versions of tcpdump have different default snaplengths - 4.1.0 and later versions have a default of 65535, but earlier versions have a default of 68 if built without IPv6 support and 96 if built with IPv6 support, so, as you note, you need "-s 0" (or, with *really* old versions, "-s 65535") to get the entire packet with those earlier versions. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
