Wireshark-users: Re: [Wireshark-users] Capturing Giant Packets Only

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 02 Jul 2008 10:01:20 -0700

Sheahan, John wrote:

I just discovered that some of my trunks are clocking lots of giant packets and I wanted to know if there is a way to filter just for giants?

If giant packets are Ethernet frames > 1514 bytes (if you don't count the FCS)/1518 bytes (if you count the FCS), a capture filter such as "greater 1515" (confusingly, the "greater" operation in the libpcap/WinPcap filter parser is defined to mean "greater than or equal to") or "greater 1519", depending on whether your adapter supplies the FCS when capturing, should work.