Ethereal-dev: Re: [ethereal-dev] Bug in Data-count and Hex-Dump from ethereal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Thu, 23 Mar 2000 08:15:24 -0600
On Thu, Mar 23, 2000 at 05:22:58AM -0600, mario.wolff@xxxxxxxxx wrote:
> 
> - i captured the dataflow from a RAS to a WAP-Gateway with: tcpdump -i eth0
> -w dump.log.

Without the -s option, tcpdump only captures a portion ("snaplen", or
"snapshot length") of the packet. The default is 68 bytes, which is
just enough to capture the headers in a packet, but not the data portion.

Make -s big enough to capture the entire frame. Are you capturing on
ethernet? -s 1500 should do.  It's okay if you you're feeling lazy
and round it up to "-s 2000"... tcpdump doesn't care that the snaplen is
greater than the MTU of the interface.

> Mario Wolff (wolff@xxxxxxxxxxxxx)
> 
> P.S.: Sorry for my "spezial" way of writing english. I now that´s buggy but
>  its not my language.

Don't apologize ... your English is much better than my German, which I'm assuming
from the *.de domain.

--gilbert