Wireshark-users: Re: [Wireshark-users] nfs attrs
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 18 Feb 2010 17:42:21 -0800
On Feb 18, 2010, at 5:34 PM, Mag Gam wrote:

> I am currently doing a tcpdump (tcpdump -i eth1 -w /tmp/out).

Try

	tcpdump -i eth1 -s 65535 -w /tmp/out

instead.  Otherwise, you will be capturing only the first 68 or 96 bytes of the packet, so Wireshark won't be able to see very much of the NFS request or response.