Dismiss Notice
Join Physics Forums Today!
The friendliest, high quality science and math community on the planet! Everyone who loves science is here!

Why does tcpdump only capture the first 68 bytes of a packet?

  1. Sep 22, 2011 #1
    By default TCPDUMP limits the number of bytes it captures to 68. Why did they select 68 bytes? Does anyone know why?
  2. jcsd
  3. Sep 22, 2011 #2
    68 bytes is just the default value. You can set it to capture the whole packet by using the "-s 0" option. It's set to that by default because it's just enough to capture packet header information without revealing content; making it a useful network diagnostic without snooping through user data.
Share this great discussion with others via Reddit, Google+, Twitter, or Facebook