Hello! > > For mmaped socket snap length is set separately. BTW it is not > > universal solution, it is good only for small snap sizes. > Ugh, sorry, I missed that option. BTW: Is there an updated packet(7) > manpage? If not I would volunteer to write one I have to understand > that stuff anyway. Ask Andi. Seems, you misunderstood me. I tell not about option, I tell about big _drawback_. Unlike BPF, mmapped packet socket uses array of slots of fixed size. Hence, when if you want to see all the data, you have to preallocate lots of memory and it remains not used when small packets are catched. Well, it is possible to combine both ways, f.e. to preallocate space for small packets and if packet size exceeds threshould not to truncate them, as mmapped socket does now, but to feed them to recvmsg(), setting some flag in ring, showing that this packet should be recvmsg()ed. But it has not yet been made, mea culpa. > Hmm, we need another option to tcpdump to tell it "capture all header data > from each packet". I think that would be a nice addition but it would=20 > require to extend all dissectors... Exactly! As rule, for TCP we need all the header with options but need not data etc. I have to hold hundreds of magabytes of dumps (I would hold more, but disk space does not allow), each packet eating 60 useless data bytes because options are absent as rule. It would be really very useful option. Alexey - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.rutgers.edu
