Wireshark · Ethereal-users: Re: [Ethereal-users] Ethereal & TCP dump

[Guy Harris <guy@xxxxxxxxxx>]

On Thu, Oct 24, 2002 at 07:50:30PM +0200, COLIN St�phane wrote:
> Juste open the file in ethereal (tcpdump format is supported dirrectly).

In fact, tcpdump format is Ethereal's *native* format (if you capture
with Ethereal, it saves the file in tcpdump format).

Note, however, that tcpdump defaults to a very short "snapshot length",
so only the first 68 or so octets of a packet are captured, by default;
the "-s" flag to tcpdump can be used to specify a larger snapshot
length, for example "-s 65535" should capture all the data in a packet
on most network types.