Re: bin/34733: tcpdump(8) requires default snaplen > 68 for pflog(4)

[David Young <dyoung%pobox.com@localhost>]

On Thu, Sep 18, 2008 at 04:39:44PM -0400, Brian A. Seklecki wrote:
> Since I'm on a roll this week, I'd like to revisit this ticket as well.
> 
> Would it be possible to bump the default snaplen variables in
> src/dist/tcpdump/interface.h to something more pf(4)-friendly
> (independent of INET6)
> 
> Other suggestions include modifying the default snaplen on a
> per-interface-type basis.

"Interface type" ?  IFT_xxx, or something else?

Note that an 802.11 interface may have a radiotap (DLT_IEEE802_11_RADIO),
and the length of a radiotap header is variable, so no snap length is
universally sufficient.

Dave

-- 
David Young             OJC Technologies
dyoung%ojctech.com@localhost      Urbana, IL * (217) 278-3933 ext 24