tcpdump raw packet capture

Hi Brian,

 

 

The packets are being truncated because the default packet size capture is tiny. You can use -s 1500 or -s 0 on LTM to capture the full packets.

 

 

 

SOL411: Overview of packet tracing with the tcpdump utility

 

http://support.f5.com/kb/en-us/solutions/public/0000/400/sol411.html

 

 

Capturing Packet Data

 

 

The tcpdump utility provides an option which allows you to specify the amount of each packet to capture.

 

 

You can use the -s (snarf/snaplen) option to specify the amount of each packet to capture. To capture the entire packet, use a value of 0 (zero). For example:

 

 

tcpdump -s0 src host 172.16.101.20 and dst port 80

 

 

 

Aaron