Why does tcpdump only capture the first 68 bytes of a packet?

SpiffyEh

By default TCPDUMP limits the number of bytes it captures to 68. Why did they select 68 bytes? Does anyone know why?

Shovel

68 bytes is just the default value. You can set it to capture the whole packet by using the "-s 0" option. It's set to that by default because it's just enough to capture packet header information without revealing content; making it a useful network diagnostic without snooping through user data.

Similar Threads for: Why does tcpdump only capture the first 68 bytes of a packet?
Thread	Forum	Replies
Where are the bytes?	Electrical Engineering	2
Bytes for surfing the internet?	Computing & Technology	5
a googolplex YB is 10^124 bytes	Computing & Technology	16
xor of multiple bytes	General Engineering	2
Bits and Bytes	Computing & Technology	2

SpiffyEh	Why does tcpdump only capture the first 68 bytes of a packet? Tweet By default TCPDUMP limits the number of bytes it captures to 68. Why did they select 68 bytes? Does anyone know why?

Shovel	68 bytes is just the default value. You can set it to capture the whole packet by using the "-s 0" option. It's set to that by default because it's just enough to capture packet header information without revealing content; making it a useful network diagnostic without snooping through user data.