Running /usr/sbin/tcpdump -n dst ${some_ip} and dst port 80
on two different but similar (distro, version) servers gives me different capture sizes (65535 bytes for one, 262144 bytes for another).
What might cause this difference in tcpdump capture size? What discrepencies might it cause in resulting data output?
EDIT: ldd $(which tcpdump)
has the same output on both servers:
linux-vdso.so.1 => (0xdeadbeef)
libcrypto.so.1.0.0 => /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 (0xdeadbeef)
libpcap.so.0.8 => /usr/lib/x86_64-linux-gnu/libpcap.so.0.8 (0xdeadbeef)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0xdeadbeef)
libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0xdeadbeef)
/lib64/ld-linux-x86-64.so.2 (0xdeadbeef)
Ah, but kernel versions differ, must be something to do with that...
capture size 65535:
Ubuntu 14.04.4, Linux 3.13.0-85-generic
capture size 262144:
Ubuntu 14.04.5, Linux 3.13.0-116-generic
Snapshot Length
Look at tcpdump.org and search for snapshot-length. The default is based on your version of libpcap or any custom capture driver you are using.
User contributions licensed under CC BY-SA 3.0