Re: 'tcpdump -s0' payload length limit?

[Guy Harris <guy () alum mit edu>]

David Front wrote:

> I notice that 'tcpdump -s0' truncates packets with payloads longer than
> (~1400 or) ~1500 bytes.
> Is there a way to get full long payloads (or is this due to a (Ethernet MTU)
> limit, or a tcpdump limitation/bug)?

Is this on Ethernet?  If so, why are there packets with payloads longer 
than 1500 bytes?  (Are they gigabit Ethernet jumbo frames?)

"-s 0" is equivalent to "-s 65535", which causes tcpdump to supply a 
snapshot length of 65535 to libpcap.  65535 is more than large enough 
for most if not all of the network types libpcap supports.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.