These days, tcpdump snaplen default is 96 bytes.

diff --git a/cap.c b/cap.c
index 043f2f3..67cd1a5 100644 (file)
--- a/cap.c
+++ b/cap.c
@@ -104,7 +104,7 @@ cap_init(const char *device, const char *filter, int promisc)
     *
     * Hack to set minimum snaplen to tcpdump's default:
     */
-   snaplen = max(snaplen, 68);
+   snaplen = max(snaplen, 96);
 #endif
    if (want_snaplen > -1)
       snaplen = want_snaplen;