Wireshark-bugs: [Wireshark-bugs] [Bug 2731] tshark/wireshark don't allow snaplen < 68
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2731
--- Comment #6 from Guy Harris <guy@xxxxxxxxxxxx> 2009-02-23 10:24:37 PDT ---
The lower bound needs to be 1, at minimum; a snapshot length of 0 is not only
useless, as you get no packet data whatsoever (tcpdump treats 0 as meaning
65535, so you can just do "-s 0" to get the entire packet), it also means that,
on systems using BPF as the capture mechanism, all packets will be dropped, as
the snapshot length is the return value of the BPF program, and a return value
of 0 means "drop the packet".
Other than that, there shouldn't be a problem with a lower minimum bound. 68
just happens to be the default length for tcpdump without IPv6 support, but
it's not otherwise meaningful.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
