parsed.org
Ethernet Snaplen by xinu on Aug 09, 2006 04:43 PM

When you're doing a packet capture for the purpose of examining the frame payload, you'll want to extend the snaplen (snapshot length) to 1515. That's long enough to accomodate the 1500 MTU and should give you a pretty good look at what you're after.

For example:

# tcpdump -s1515 -X -ieth0 -w sample.cap

Note: This applies to 'ethereal' and 'wireshark' but their defaults are to capture max(INT) by default.

capturedebuggingetherealethernetframemonitoringmtunetworkpackettcpdumpwireshark
RSS