Subject: Re: pflog on NetBSD
To: David Brownlee <abs@NetBSD.org>
From: Brian A. Seklecki <firstname.lastname@example.org>
Date: 11/03/2006 21:40:00
I vote for raising the default to 96 for v4 and v6 mode rather than trying
to do something absurd like conditional checking on the type of interface.
On Fri, 6 Oct 2006, Brian A. Seklecki wrote:
> I opened: bin/34733
> Also, I figured something else out while checking the upstream vendor:
> I may be the first person to notice/report this because I'm using NetBSD in
> an embedded environment with a highly profiled kernel (IPv6 stripped out and
> lots of mk.conf(5) flags). I was looking at the code and realized the
> default snaplen was a _compile time_ option. See below:
> Here's they're doing the 68 vs. 96 for a different reason other than
> * The default snapshot length. This value allows most printers to print
> * useful information while keeping the amount of unwanted data down.
> #ifndef INET6
> #define DEFAULT_SNAPLEN 68 /* ether + IPv4 + TCP + 14 */
> #define DEFAULT_SNAPLEN 96 /* ether + IPv6 + TCP + 22 */
> On Fri, 22 Sep 2006, David Brownlee wrote:
>> On Fri, 22 Sep 2006, Michael-John Turner wrote:
>>> On Fri, Sep 22, 2006 at 09:29:38AM -0400, Brian A. Seklecki wrote:
>>>> Perhaps it has something to do with the underlying protocol? Was your
>>>> tcpdump on ethernet? OpenBSD has made the snarf length of 96 hard coded
>>>> into thier in-tree tcpdump src.
>>> Sounds like a reasonable theory - my loginterface is a pppoe(4) device.
>>>> Perhaps a note could be installed into the example tcpdump(8) in
>>>> src/dist/pf/share/man/man4/pflog.4 with flag "-s 96".
>>> Sounds good to me.
>> Would it make sense for NetBSD to default to 96 also?
>> David/absolute -- www.NetBSD.org: No hype required --
> -lava (Brian A. Seklecki - Pittsburgh, PA, USA)
> "...from back in the heady days when "helpdesk" meant nothing, "diskquota"
> meant everything, and lives could be bought and sold for a couple of pages
> of laser printout - and frequently were."
-lava (Brian A. Seklecki - Pittsburgh, PA, USA)
"...from back in the heady days when "helpdesk" meant nothing, "diskquota"
meant everything, and lives could be bought and sold for a couple of pages
of laser printout - and frequently were."