Why does tcpdump only capture the first 68 bytes of a packet?

[SpiffyEh]

By default TCPDUMP limits the number of bytes it captures to 68. Why did they select 68 bytes? Does anyone know why?

 

[Shovel]

68 bytes is just the default value. You can set it to capture the whole packet by using the "-s 0" option. It's set to that by default because it's just enough to capture packet header information without revealing content; making it a useful network diagnostic without snooping through user data.