Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-25 Thread Francois-Xavier Le Bail
gt; to add options to the command line ? > > Best Regards, > > Francois-Xavier Le Bail > > > --- On Tue, 3/10/09, Arien Vijn > wrote: > > > From: Arien Vijn > > Subject: Re: [tcpdump-workers] Should the default > snapshot length in tcpdump be 65535? &

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-22 Thread Francois-Xavier Le Bail
Hello, Why not an environment variable like TCPDUMP="-s 68" to add options to the command line ? Best Regards, Francois-Xavier Le Bail --- On Tue, 3/10/09, Arien Vijn wrote: > From: Arien Vijn > Subject: Re: [tcpdump-workers] Should the default snapshot length in tcpdump

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-09 Thread Arien Vijn
On 10 Mar. 2009, at 2:01 AM, Eloy Paris wrote: On Mon, Mar 09, 2009 at 11:52:50PM +0100, Arien Vijn wrote: Therefore it would be a good idea to make this an option during compile time. Hmmm. Wouldn't this be a bit overkill? And even if we went down this path, I don't think that recompil

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-09 Thread Arien Vijn
On 5 Mar. 2009, at 10:20 AM, Guy Harris wrote: Would it make sense to have tcpdump default to the maximum snapshot length, rather than 68 (without IPv6 support) or 96 (with IPv6 support)? I've checked in a change to make the default snapshot length 65535. Suddenly* changing this default

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-03-09 Thread Guy Harris
On Feb 20, 2009, at 7:08 PM, Guy Harris wrote: The "tcp" in "tcpdump" is a bit old - people use it for doing more than just looking at TCP headers these days - and it sounds as if the problem Torsten Krah had tring to decrypt ipsec traffic was due to the packets being cut short by a snapsh

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-02-23 Thread Francois-Xavier Le Bail
--- On Sat, 2/21/09, Ken Bantoft wrote: > [...] > Back on topic, I'd be happy to see the default snaplen > changed to 65535. +1 for me. Francois-Xavier - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-02-21 Thread Ken Bantoft
On 21-Feb-09, at 4:49 PM, Michael Richardson wrote: "Guy" == Guy Harris writes: Guy> The "tcp" in "tcpdump" is a bit old - people use it for doing Guy> more than just looking at TCP headers these days - and it I wanted to release a program called "netdump" which would use libnetdiss

Re: [tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-02-21 Thread Michael Richardson
> "Guy" == Guy Harris writes: Guy> The "tcp" in "tcpdump" is a bit old - people use it for doing Guy> more than just looking at TCP headers these days - and it I wanted to release a program called "netdump" which would use libnetdissect, and start anew option-wise. We have lots of

Re: [tcpdump-workers] Should the default snapshot length in tcpdump

2009-02-21 Thread Eloy Paris
On Fri, Feb 20, 2009 at 09:46:25PM -0800, Aaron Turner wrote: > On Fri, Feb 20, 2009 at 7:08 PM, Guy Harris wrote: > > > The "tcp" in "tcpdump" is a bit old - people use it for doing more > > than just looking at TCP headers these days - and it sounds as if > > the problem Torsten Krah had tring

Re: [tcpdump-workers] Should the default snapshot length in tcpdump

2009-02-20 Thread Aaron Turner
On Fri, Feb 20, 2009 at 7:08 PM, Guy Harris wrote: > The "tcp" in "tcpdump" is a bit old - people use it for doing more than just > looking at TCP headers these days - and it sounds as if the problem Torsten > Krah had tring to decrypt ipsec traffic was due to the packets being cut > short by a sn

[tcpdump-workers] Should the default snapshot length in tcpdump be 65535?

2009-02-20 Thread Guy Harris
The "tcp" in "tcpdump" is a bit old - people use it for doing more than just looking at TCP headers these days - and it sounds as if the problem Torsten Krah had tring to decrypt ipsec traffic was due to the packets being cut short by a snapshot length. Would it make sense to have tcpdump d