RADUS, Kevin wrote:
I've just started using Ethereal (on an SGI). I am getting getting
captures that report a packet size on the wire greater than 1514 bytes
and that 1514 bytes are captured. I've tried leaving the "limit each
packet" button unselected, I've tried setting it to a large number
(50000), but neither of these allows more than 1514 bytes to be
captured. I thought that ethereal allowed capture of packets up to 64k
It does, but libpcap on Irix might not. There's a comment in the
libpcap code for Irix:
/*
* XXX - IRIX appears to give you an error if you try to set the
* capture length to be greater than the MTU, so let's try to get
* the MTU first and, if that succeeds, trim the snap length
* to be no greater than the MTU.
*/
If
you are (as another reply noted) capturing on a network with jumbo frames;
the driver for the network adapter claims the MTU is 1514 bytes, even
though it handles jumbo frames;
libpcap won't set the snapshot length to more than 1514 bytes.
If you're on a network with jumbo frames, *and* you're in a position to
try compiling test versions of libpcap *and* rebuilding Ethereal from
source to use those test versions, I can see whether attempting to set
the snapshot length to 65535 (Ethereal's default) gets an error on your
adapter (in which case perhaps the fix is to have libpcap for Irix not
set the snapshot length if the user asks for 65535 bytes) or succeeds
(in which case perhaps the fix is to have libpcap for Irix only limit
the snapshot length to the MTU if using the unlimited snapshot length
fails).
Can anyone point out what I am doing wrong ?
(I'd be tempted to say "using Irix", given how irritating Irix has been
as a platform for libpcap....)
