pflogd: default snaplen
hi, -s snaplen Analyze at most the first snaplen bytes of data from each packet rather than the default of 116. The default of 116 is adequate for IP, ICMP, TCP, and UDP headers but may truncate protocol information for other protocols. Other file parsers may desire a higher snaplen. it seems to me that the default is 160. am I wrong? #define DEF_SNAPLEN 160 /* pfloghdr + ip hdr + proto hdr fit usually */ -- see ya, giovanni
Re: pflogd: default snaplen
oops :-) On Wed, Oct 12, 2011 at 11:56 AM, giovanni wrote: > hi, > >-s snaplen > Analyze at most the first snaplen bytes of data from each packet > rather than the default of 116. The default of 116 is adequate > for IP, ICMP, TCP, and UDP headers but may truncate protocol > information for other protocols. Other file parsers may desire a > higher snaplen. > > it seems to me that the default is 160. am I wrong? > > #define DEF_SNAPLEN 160 /* pfloghdr + ip hdr + proto hdr fit usually */ > > -- > see ya, > giovanni > -- see ya, giovanni
Re: pflogd: default snaplen
* giovanni [2011-10-12 11:58]: > hi, > > -s snaplen > Analyze at most the first snaplen bytes of data from each packet > rather than the default of 116. The default of 116 is adequate > for IP, ICMP, TCP, and UDP headers but may truncate protocol > information for other protocols. Other file parsers may desire a > higher snaplen. > > it seems to me that the default is 160. am I wrong? > > #define DEF_SNAPLEN 160 /* pfloghdr + ip hdr + proto hdr fit usually > */ correct, fixed, thanks -- Henning Brauer, h...@bsws.de, henn...@openbsd.org BS Web Services, http://bsws.de, Full-Service ISP Secure Hosting, Mail and DNS Services. Dedicated Servers, Root to Fully Managed Henning Brauer Consulting, http://henningbrauer.com/