From: Lloyd <ng2d68@proton.me>
Subject: tcpdump(8)  DEFAULT_SNAPLEN
To: "tech@openbsd.org" <tech@openbsd.org>
Date: Sun, 03 Aug 2025 00:57:16 +0000

tcpdump on OpenBSD is unique in that it uses a very small default snaplen value of 116 bytes. That current default was committed in 2009 and hasn't changed since. This often results in truncated protocol info from packets when running with default options.

tcpdump on NetBSD, FreeBSD, Apple, and Linux all use a default of 262144 (256 KiB).

Before I submit a patch I'd like to understand if there is a technical reason why this value is kept so small and if it's worthy of another bump 16 years later to bring it in line with mainstream tcpdump implementations.

Regards
Lloyd