Hi, In tcpdump.c, at line 471 :
i = pcap_snapshot(pd); if (snaplen < i) { warning("snaplen raised from %d to %d", snaplen, i); snaplen = i; } is only useful when reading a pcap file. In other cases, pd->snapshot = snaplen (set in priv_pcap_live()). Here is a diff to move this test closer to priv_cap_offline. Index: tcpdump.c =================================================================== RCS file: /cvs/src/usr.sbin/tcpdump/tcpdump.c,v retrieving revision 1.90 diff -u -p -r1.90 tcpdump.c --- tcpdump.c 26 May 2019 22:42:42 -0000 1.90 +++ tcpdump.c 9 Jun 2019 17:52:50 -0000 @@ -449,6 +449,12 @@ main(int argc, char **argv) netmask = 0; if (fflag != 0) error("-f and -r options are incompatible"); + + i = pcap_snapshot(pd); + if (snaplen < i) { + warning("snaplen raised from %d to %d", snaplen, i); + snaplen = i; + } } else { if (device == NULL) { device = pcap_lookupdev(ebuf); @@ -467,11 +473,6 @@ main(int argc, char **argv) localnet = 0; netmask = 0; } - } - i = pcap_snapshot(pd); - if (snaplen < i) { - warning("snaplen raised from %d to %d", snaplen, i); - snaplen = i; } if (Lflag) {