Home page logo
/

wireshark logo Wireshark mailing list archives

Why does text2pcap use 102400 for the snaplen?
From: Christopher Maynard <Christopher.Maynard () gtech com>
Date: Thu, 4 Apr 2013 01:55:28 +0000 (UTC)

At the top of text2pcap.c:

 * This converter cannot read a single packet greater than 64K. Packet
 * snaplength is automatically set to 64K.

... yet since its inception[1][2], text2pcap has used 102400 for the
snaplen.  That value seems quite strange to me.  I guess this question is
mainly directed at Ashok Narayanan (if you are still listening?), who
originally wrote text2pcap, but is there some particular reason that 102400
was chosen?  If not or if there's no feedback, then I intend to change it to
65535, at least as the default snaplen.  If anyone wants a different
snaplen, then perhaps an option could be added to text2pap to be able to
specify a different snaplen, but then I would propose an enhancement bug
request for that.

Thanks.
- Chris

[1]: http://www.wireshark.org/lists/ethereal-dev/200105/msg00106.html
[2]:
http://web.archive.org/web/20010610044423/http://www.ethereal.com/distribution/nightly-builds/


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


  By Date           By Thread  

Current thread:
  • Why does text2pcap use 102400 for the snaplen? Christopher Maynard (Apr 04)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]