Hi,
In tcpdump.c, at line 471 :
i = pcap_snapshot(pd);
if (snaplen < i) {
warning("snaplen raised from %d to %d", snaplen, i);
snaplen = i;
}
is only useful when reading a pcap file. In other cases, pd->snapshot = snaplen
(set in priv_pcap_live()).
Here is a diff to move this test closer to priv_cap_offline.
Index: tcpdump.c
===================================================================
RCS file: /cvs/src/usr.sbin/tcpdump/tcpdump.c,v
retrieving revision 1.90
diff -u -p -r1.90 tcpdump.c
--- tcpdump.c 26 May 2019 22:42:42 -0000 1.90
+++ tcpdump.c 9 Jun 2019 17:52:50 -0000
@@ -449,6 +449,12 @@ main(int argc, char **argv)
netmask = 0;
if (fflag != 0)
error("-f and -r options are incompatible");
+
+ i = pcap_snapshot(pd);
+ if (snaplen < i) {
+ warning("snaplen raised from %d to %d", snaplen, i);
+ snaplen = i;
+ }
} else {
if (device == NULL) {
device = pcap_lookupdev(ebuf);
@@ -467,11 +473,6 @@ main(int argc, char **argv)
localnet = 0;
netmask = 0;
}
- }
- i = pcap_snapshot(pd);
- if (snaplen < i) {
- warning("snaplen raised from %d to %d", snaplen, i);
- snaplen = i;
}
if (Lflag) {
