Latha G wrote:
what is the reason for this behaviour?
The reason is that somebody decided to make one of the checking for snapshot truncation report "truncated-arp" rather than the usual "[|arp]". I don't know why they decided to do that; "truncated-ip", for example, is printed if the length from the IP header is shorter than the minimum IP header length (i.e., the problem reported with "truncate-ip" is that the packet is corrupt, not that the snapshot length cut the packet off in the middle of the IP header).
The most recent update to the ARP printing code (which isn't yet in a release) prints "[|ARP]" for all the truncation cases.
- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
