ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] "File has packet larger than file's snapshot length." warnin

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 14 Jul 2013 10:10:16 -0700
On Jul 13, 2013, at 12:45 PM, "Turney, Cal" <cal.turney@xxxxxxx> wrote:

> On Jul 10, 2013, at 10:09 AM, "Turney, Cal" <cal.turney@xxxxxxx> wrote:

	...

> It is on Ethernet jumbo-capable Intel, Broadcom, and some others.  It looks like the original tcpdump developer hard-coded 1516 when he probably meant 1514.

So jumbo frames appear to be larger than the snapshot length?

> Are you saying that rather than adding an option to ignore snapshot_length/packet size discrepancies it might be best to not generate these warnings?

Yes.  I.e., it might be best to just hardwire in the "ignore those discrepancies" option.