|
than the default of 65535 bytes. Packets truncated
because of a limited snapshot are indicated in the
output with ``[|proto]'', where proto is the name of
the protocol level at which the truncation has
occurred. Note that taking larger snapshots both
increases the amount of time it takes to process
packets and, effectively, decreases the amount of
packet buffering. This may cause packets to be lost.
You should limit snaplen to the smallest number that
will capture the protocol information you're interested
in. Setting snaplen to 0 sets it to the default of
65535, for backwards compatibility with recent older
versions of tcpdump.
|