On Fri, 22 Sep 2006, Michael-John Turner wrote:

> On Fri, Sep 22, 2006 at 09:29:38AM -0400, Brian A. Seklecki wrote:
>> Perhaps it has something to do with the underlying protocol?  Was your
>> tcpdump on ethernet?   OpenBSD has made the snarf length of 96 hard coded
>> into thier in-tree tcpdump src.
>
> Sounds like a reasonable theory - my loginterface is a pppoe(4) device.
>
>> Perhaps a note could be installed into the example tcpdump(8) in
>> src/dist/pf/share/man/man4/pflog.4 with flag "-s 96".
>
> Sounds good to me.

 	Would it make sense for NetBSD to default to 96 also?

-- 
 		David/absolute       -- www.NetBSD.org: No hype required --