On Mon, Feb 18, 2008 at 05:52:40PM +0300, Alexander Pilugin wrote:
> Hello! Please advise the value in bytes (default 68 bytes is too
> small) to which limit captured packet so that on the one hand don`t
> lose any headers, and on the other to save the space on the hard disk.
> Thanks in advance!
It depends on the protocols you expect to see in the capture. 500 bytes
would most likely capture all headers and some of the traffic and still
cut your capture file down by as much as 1/3 (assuming 1500 byte
packets).
Steve
