Hi,

In tcpdump.c, at line 471 :

        i = pcap_snapshot(pd);
        if (snaplen < i) {
                warning("snaplen raised from %d to %d", snaplen, i);
                snaplen = i;
        }

is only useful when reading a pcap file. In other cases, pd->snapshot = snaplen
(set in priv_pcap_live()).

Here is a diff to move this test closer to priv_cap_offline.

Index: tcpdump.c
===================================================================
RCS file: /cvs/src/usr.sbin/tcpdump/tcpdump.c,v
retrieving revision 1.90
diff -u -p -r1.90 tcpdump.c
--- tcpdump.c   26 May 2019 22:42:42 -0000      1.90
+++ tcpdump.c   9 Jun 2019 17:52:50 -0000
@@ -449,6 +449,12 @@ main(int argc, char **argv)
                netmask = 0;
                if (fflag != 0)
                        error("-f and -r options are incompatible");
+
+               i = pcap_snapshot(pd);
+               if (snaplen < i) {
+                       warning("snaplen raised from %d to %d", snaplen, i);
+                       snaplen = i;
+               }
        } else {
                if (device == NULL) {
                        device = pcap_lookupdev(ebuf);
@@ -467,11 +473,6 @@ main(int argc, char **argv)
                        localnet = 0;
                        netmask = 0;
                }
-       }
-       i = pcap_snapshot(pd);
-       if (snaplen < i) {
-               warning("snaplen raised from %d to %d", snaplen, i);
-               snaplen = i;
        }
 
        if (Lflag) {

Reply via email to