On Fri, Sep 22, 2006 at 09:29:38AM -0400, Brian A. Seklecki wrote:
> Perhaps it has something to do with the underlying protocol?  Was your 
> tcpdump on ethernet?   OpenBSD has made the snarf length of 96 hard coded 
> into thier in-tree tcpdump src.

Sounds like a reasonable theory - my loginterface is a pppoe(4) device.

> Perhaps a note could be installed into the example tcpdump(8) in 
> src/dist/pf/share/man/man4/pflog.4 with flag "-s 96".

Sounds good to me.

-mj
-- 
Michael-John Turner | http://mjturner.net/
mj@turner.org.za    | Open Source in WC ZA - http://www.clug.org.za/