[Winpcap-users] pcap_loop function problem

[Guy Harris]

On Aug 12, 2008, at 6:44 PM, David Chang wrote:

> I think the Winpcap doc states that you may want to set it to 65535  
> to make sure you get all packets.

Or, rather, to make sure that you get all of the data in the packets.   
The snaplen is *NOT* the MTU for the network, it's the maximum packet  
length, and the maximum packet length for Ethernet isn't 1500, it's  
1514 if you don't include the FCS and 1518 if you include the FCS (you  
don't get the FCS when capturing on Ethernet adapters on Windows, as  
far as I know, but you *do* get it in some other OSes).

Furthermore, there's no guarantee that you'll be capturing on  
Ethernet, so it's best to use 65535 if you want all of the packet data.