On Tue, 20 Aug 2002, Guy Harris wrote: > On Wed, Aug 21, 2002 at 04:38:37PM +0930, Richard Sharpe wrote: > > I tend to avoid [t]ethereal when capturing on GigE and use tcpdump with -s > > 200 or some such (unless I need all 1500 bytes, which is not often), so I > > can avoid any dropped packets. > > Is there a difference between "tethereal -s 200" and "tcpdump -s 200" if > you're using "-w" in both cases? (Yes, the code path is longer, as we > do more stuff.)
tcpdump is always packaged on the machine, while [t]ethereal is not :-) Regards ----- Richard Sharpe, [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED]
