Wireshark-users: Re: [Wireshark-users] tcpdump with snaplen set to 128
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 15 Oct 2012 17:17:44 -0700
On Oct 15, 2012, at 5:13 PM, Perry Smith <pedzsan@xxxxxxxxx> wrote:

> I'm wondering if maybe the iptrace format doesn't have both fields.

From what we've been able to determine, it doesn't.  There *are* some fields in the iptrace per-packet header that we haven't figured out yet; I don't know whether one of them happens to be the length of the packet on the wire or not - if you could supply us with one of those captures, we could try to see whether the length on the wire is in one of those fields.