Wireshark-users: [Wireshark-users] capture short packets in tcpdump/tshark?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Mathias Koerber <mathias@xxxxxxxxxxx>
Date: Tue, 27 Jan 2015 13:25:58 +0800
On one system, we see a few

UDP: short packet: From a.b.c.d:xx 50/44 to
e.f.g.h:yy

which then apparently the kernel drops.

If I capture all traffic on that NIC (using tcpdump or
tshark) will these show up in the capture, or will the kernel
drop them before the libpcap lib even sees them?

If they are captured, how to I filter for these in wireshark/tshark?

This is RedHat Linux 6

thanks