Date: Wed, 20 Feb 2002 11:45:56 -0800 From: Benjamin Krueger <benjamin@macguire.net> To: Peter Brezny <peter@skyrunner.net> Cc: freebsd-questions@freebsd.org Subject: Re: snap length Message-ID: <20020220114556.A12253@rain.macguire.net> In-Reply-To: <NEBBIGLHNDFEJMMIEGOOGEKOEIAA.peter@skyrunner.net>; from peter@skyrunner.net on Wed, Feb 20, 2002 at 11:24:00AM -0500 References: <NEBBIGLHNDFEJMMIEGOOGEKOEIAA.peter@skyrunner.net>
next in thread | previous in thread | raw e-mail | index | archive | help
* Peter Brezny (peter@skyrunner.net) [020220 10:22]: > What is snap lenght? > > In watching a tcp dump between a smb client/server, i keep seeing: > > >>> NBT UDP PACKET(138) Res=0x1102 ID=0x34 IP=172 (0xac).18 (0x12).2 > (0x2).107 (0x6b) Port=138 (0x8a) Length=216 > (0xd8) Res2=0x0 > SourceName=NOC LAP 1 NameType=0x00 (Workstation) > DestName= > WARNING: Short packet. Try increasing the snap length Peter, Snap should be short for snapshot, which is the length of the packet that tcpdump will capture for analysis and display to you. If the size of the packet is larger than the default snap length, you will recieve the above warning. From the tcpdump(1) manpage: -s Snarf snaplen bytes of data from each packet rather than the default of 68 (with SunOS's NIT, the mini- mum is actually 96). 68 bytes is adequate for IP, ICMP, TCP and UDP but may truncate protocol infor- ... -- Benjamin Krueger "From the moment I picked up your book until I laid it down, I was convulsed with laughter. Some day I intend reading it." - Groucho Marx ---------------------------------------------------------------- Send mail w/ subject 'send public key' or query for (0x251A4B18) Fingerprint = A642 F299 C1C1 C828 F186 A851 CFF0 7711 251A 4B18 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020220114556.A12253>