The Ethernet and IPv4 headers are usually fixed at 14 and 20 bytes, although there are exceptions.

The problem is that one size does not fit all. So the next question is what should the value of snaplen be? If the snapshot length is not set specifically, the defaultįigure 1 - man page extracts for tcpdump, tshark and dumpcap $ man dumpcap | grep -B 2 -A 10 'snaplen bytes' If the snapshot length is not set specifically, theĭefault snapshot length is used if provided. Interface specified by the last -i option occurring before this

If used after an -i option, it sets the snapshot length for the Occurrence of the -i option, it sets the default snapshot length. Of 65535, so that the full packet is captured this is the default. No more than snaplen bytes of each network packet will be read into Set the default snapshot length to use when capturing live data. $ man tshark | grep -B 2 -A 10 'snaplen bytes' Wards compatibility with recent older versions of tcpdump.

Setting snaplen to 0 sets it to the default of 262144, for backâ€ That will capture the protocol information you're interested in. You should limit snaplen to the smallest number The amount of time it takes to process packets and, effectively,ĭecreases the amount of packet buffering. Note that taking larger snapshots both increases Proto is the name of the protocol level at which the truncation Snapshot are indicated in the output with ``'', where Snarf snaplen bytes of data from each packet rather than theĭefault of 262144 bytes. $ man tcpdump | grep -B 1 -A 12 'snapshot-length' How can I capture the packet headers but not the data? This is a question I hear a lot.īoth tcpdump and tshark/dumpcap use the '-s' option to limit the amount of data captured (snap length). I need to run tcpdump or wireshark (tshark/dumpcap) or but the data is proprietary/personal/top secret. How can I capture the packet headers but not the data? How can I capture the packet headers but not the data?

Editcap examples