Re: How to snoop on Solaris for Ethereal

-------------------
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to [email protected].
Don't forget to unsubscribe from this list at
http://www.ethereal.com/mailman/listinfo/ethereal-users
-------------------

Zubairi, Shahbaz wrote:
> -------------------
> The Ethereal project is being continued at a new site.  Please go to
> http://www.wireshark.org and subscribe to [email protected].
> Don't forget to unsubscribe from this list at
> http://www.ethereal.com/mailman/listinfo/ethereal-users
> -------------------
> Hi All,
> 
> What is the right command to snoop on Solaris platform to capture the 
> packets and import them into Ethereal?

The same as the right command for Wireshark (see the note above, added 
automatically to your mail):

	snoop -o {filename}

with "-d", etc. flags added as necessary.

Wireshark does, of course, also run on Solaris, as does the command-line 
variant TShark and the Wireshark capture utility dumpcap.

> I have noticed that Linux tcpdump truncates data on some packets.

Tcpdump/WinDump, on *all* platforms, truncates data *by default* to 68 
or 96 bytes, so you have to specify "-s 0" (or, on older versions, "-s 
65535") to get it not to truncate packets.

> I don’t want to truncate anything.

Snoop doesn't truncate by default; you have to explicitly specify a "-s" 
flag to get it to truncate.  (Wireshark, TShark, and dumpcap don't 
truncate by default, either.)

Tcpdump/WinDump does truncate by default; you have to explicitly specify 
a "-s" flag to get it *not* to truncate (or to get it to truncate to a 
length other than the default).