Index | Thread | Search

From:
"Theo de Raadt" <deraadt@openbsd.org>
Subject:
Re: tcpdump(8) DEFAULT_SNAPLEN
To:
Lloyd <ng2d68@proton.me>
Cc:
"tech@openbsd.org" <tech@openbsd.org>
Date:
Mon, 04 Aug 2025 01:56:35 -0600

Download raw body.

Thread
The manual page goes through excruciating effort to explain the decision.

     -s snaplen
               Analyze at most the first snaplen bytes of data from each
               packet rather than the default of 116.  116 bytes is adequate
               for IPv6, ICMP, TCP, and UDP, but may truncate protocol
               information from name server and NFS packets (see below).
               Packets truncated because of a limited snaplen are indicated in
               the output with "[|proto]", where proto is the name of the
               protocol level at which the truncation has occurred.  Taking
               larger snapshots both increases the amount of time it takes to
               process packets and, effectively, decreases the amount of
               packet buffering.  This may cause packets to be lost.  You
               should limit snaplen to the smallest number that will capture
               the protocol information you're interested in.