Date: Fri, 2 May 2008 03:45:15 +0100 From: Drav Sloan <holborn-pf@real-life.tm> To: freebsd-pf@freebsd.org Subject: Re: a buildworld yeilds tcpdump oddness Message-ID: <20080502024515.GC70377@real-life.tm> In-Reply-To: <20080502023222.GC25833@verio.net> References: <20080502020537.GA70377@real-life.tm> <20080502023222.GC25833@verio.net>
next in thread | previous in thread | raw e-mail | index | archive | help
David DeSimone wrote: > When you see the [|xxx] syntax in tcpdump, that is its way of telling > you that the packet you captured is truncated, and it cannot show you > more information unless you capture a longer packet. >=20 > With recent changes to PF, the default capture size (68 bytes as seen > above) is insufficient. Try adding "-s128" to capture more of the > packets and you should see an improvement. Et volia! Been using tcpdump for years, never knew about that one!=20 Cheers Dave, (and appologies for multiple post, I thought the first one would of been rejected given it's return address...) Regards Drav.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20080502024515.GC70377>