I am capturing network traffic by using tcpdump. The problem is, I can't see all capture data when the package is too long. For example, when the tcp frame length more than 500,I just see 100-200 or less. How to display all frame data(500+)? I have tried add -vv and -vvv parameter. This is my command:

tcpdump -i eth1 tcp and host and port 6973 -vv -X -c 1000
  • Does adding -s0 capture all that you need? – clk Jul 13 '16 at 4:19
  • @clk I have added but don't pay attention at that time,it works,thank you! – Dolphin Jul 13 '16 at 4:46
  • 2
    s0 may help or not depending on the type of traffic and what you are doing; while it might apply for this case, please see unix.stackexchange.com/questions/254280/tcpdump-lost-packets ; @clk would you write a proper answer to get points? – Rui F Ribeiro Jul 13 '16 at 7:54

You can use the -s snaplen flag to specify the size of each packet.

-s 0 sets the default packet size to 65535 bytes, which increases how long it takes to process packets and decreases the amount of packet buffering, according to the man page. Though this might work here, it may not be appropriate in other cases as it can cause packets to be lost.

A better practice would be to set the snaplen flag to the smallest value needed to capture what's needed. Another answer suggests 1500 bytes to see the whole packet and 160 bytes if you're only interested in the headers.

So, while -s 0 may work here, for future use it would be a better idea to start with -s 1500 and adjust as needed.

From man tcpdump:

Note that taking larger snap-shots both increases the amount of time it takes to process packets and, effectively, decreases the amount of packet buffering. This may cause packets to be lost. You should limit snaplen to the smallest number that will capture the protocol information you're interested in. Setting snaplen to 0 sets it to the default of 65535, for backwards compatibility with recent older versions of tcpdump.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.