Re: "truncated arp " message while using -s option

[Guy Harris <guy () alum mit edu>]

Latha G wrote:

> what is the reason for this behaviour?

The reason is that somebody decided to make one of the checking for 
snapshot truncation report "truncated-arp" rather than the usual 
"[|arp]".  I don't know why they decided to do that; "truncated-ip", for 
example, is printed if the length from the IP header is shorter than the 
minimum IP header length (i.e., the problem reported with "truncate-ip" 
is that the packet is corrupt, not that the snapshot length cut the 
packet off in the middle of the IP header).

The most recent update to the ARP printing code (which isn't yet in a 
release) prints "[|ARP]" for all the truncation cases.
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.