Wireshark · Ethereal-users: Re: [Ethereal-users] How to capture the NetBIOS data over 802.2 network

[Guy Harris <gharris@xxxxxxxxx>]

On Sun, May 23, 2004 at 12:10:48PM +0200, Martin Regner wrote:
> By default tcpdump uses a snapshot length of 68 bytes, I think.

Versions built with IPv6 support use 96, others use 68 - but, as you
note, in both cases that means that only the first 68 or 96 bytes of the
packet are captured and saved by tcpdump, so you need to increase the
snapshot length to a value large enough to capture the entire packet.

Ethereal and Tethereal default to a large value, and only use a smaller
value if requested to do so.