Ethereal-dev: Re: [ethereal-dev] Packets captured too long

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Fri, 21 Jan 2000 18:14:12 -0800
> when I do packet capturing with eth 0.8.1 all packets seem to be captured
> with a length of 1514 bytes (on the ethernet):
> Frame xxxx (1514 on wire, 1514 captured)

That's odd.  The capture code gets the packet length from libpcap, and
writes it out through "wtap_dump()" which calls "libpcap_dump()" which
writes those lengths out to the libpcap header of the capture file.  The
reading also should get those lengths.

What happens if you do a capture with "tcpdump -s 65535", and read the
capture file with Ethereal?