At the top of text2pcap.c: * This converter cannot read a single packet greater than 64K. Packet * snaplength is automatically set to 64K.
... yet since its inception[1][2], text2pcap has used 102400 for the snaplen. That value seems quite strange to me. I guess this question is mainly directed at Ashok Narayanan (if you are still listening?), who originally wrote text2pcap, but is there some particular reason that 102400 was chosen? If not or if there's no feedback, then I intend to change it to 65535, at least as the default snaplen. If anyone wants a different snaplen, then perhaps an option could be added to text2pap to be able to specify a different snaplen, but then I would propose an enhancement bug request for that. Thanks. - Chris [1]: http://www.wireshark.org/lists/ethereal-dev/200105/msg00106.html [2]: http://web.archive.org/web/20010610044423/http://www.ethereal.com/distribution/nightly-builds/ ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
