From owner-freebsd-questions Wed Feb 20 11:46:27 2002 Delivered-To: freebsd-questions@freebsd.org Received: from rain.macguire.net (sense-sea-MegaSub-1-125.oz.net [216.39.144.125]) by hub.freebsd.org (Postfix) with ESMTP id A1D5137B416 for ; Wed, 20 Feb 2002 11:46:17 -0800 (PST) Received: (from roo@localhost) by rain.macguire.net (8.11.6/8.11.6) id g1KJjuX12554; Wed, 20 Feb 2002 11:45:56 -0800 (PST) (envelope-from roo) Date: Wed, 20 Feb 2002 11:45:56 -0800 From: Benjamin Krueger To: Peter Brezny Cc: freebsd-questions@freebsd.org Subject: Re: snap length Message-ID: <20020220114556.A12253@rain.macguire.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from peter@skyrunner.net on Wed, Feb 20, 2002 at 11:24:00AM -0500 X-PGP-Key: http://www.macguire.net/benjamin/public_key.asc Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG * Peter Brezny (peter@skyrunner.net) [020220 10:22]: > What is snap lenght? > > In watching a tcp dump between a smb client/server, i keep seeing: > > >>> NBT UDP PACKET(138) Res=0x1102 ID=0x34 IP=172 (0xac).18 (0x12).2 > (0x2).107 (0x6b) Port=138 (0x8a) Length=216 > (0xd8) Res2=0x0 > SourceName=NOC LAP 1 NameType=0x00 (Workstation) > DestName= > WARNING: Short packet. Try increasing the snap length Peter, Snap should be short for snapshot, which is the length of the packet that tcpdump will capture for analysis and display to you. If the size of the packet is larger than the default snap length, you will recieve the above warning. From the tcpdump(1) manpage: -s Snarf snaplen bytes of data from each packet rather than the default of 68 (with SunOS's NIT, the mini- mum is actually 96). 68 bytes is adequate for IP, ICMP, TCP and UDP but may truncate protocol infor- ... -- Benjamin Krueger "From the moment I picked up your book until I laid it down, I was convulsed with laughter. Some day I intend reading it." - Groucho Marx ---------------------------------------------------------------- Send mail w/ subject 'send public key' or query for (0x251A4B18) Fingerprint = A642 F299 C1C1 C828 F186 A851 CFF0 7711 251A 4B18 To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message