So I've got an old pcap file which I don't remember the actual snaplen used. Now I know the pcap_file_header keeps a record of this (in my case 144 bytes). What is strange though, is that the file actually has a maximum of 158 bytes stored (I can see the extra bytes in ethereal).
Can anyone explain the discrepancy? This is libpcap 0.7.2. Thanks, Aaron -- Aaron Turner <aturner at pobox.com|synfin.net> http://synfin.net/ They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. -- Benjamin Franklin All emails are PGP signed; a lack of a signature indicates a forgery.
pgp00000.pgp
Description: PGP signature
