Re: [Ethereal-users] tethereal vs tcpdump

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 3, 2003, at 6:58 AM, MH wrote:

> Try tcpdump -s 1500 -w your_pcap.cap ip[21]==89

No, "-s 1514" - the snapshot length is the length of the entire packet, 
including the link-layer header.

But "-s 65535" works as well, and you don't have to worry about the 
maximum packet size of particular network types.