 | 1 | initial version |
The maximum snapshot length for D-Bus captures is 128MB, and that might also be the maximum snapshot length for Windows USBPcap captures.
We could make the default maximum snapshot length also be 128MB.
We cannot raise it above 2^32-1 bytes, as neither pcap nor pcapng file can handle packets larger than that (and, for pcapng, there's other overhead that would further limit it) and a snapshot length that large would cause at least some code that reads pcap and pcapng files to attempt to allocate a buffer of that size, which will probably fail on a 32-bit platform and eat up excess address space on a 64-bit platform, so that's probably not going to happen.
A larger snapshot length would require a larger in-kernel buffer for most packet capture mechanisms, so I'm not inclined to go to 128MB; perhaps 512KB would be sufficient.
