为什么 tcpdump -dd 接受数据包指令恰好选择 0x4000 作为大小？

Question

为什么tcpdump -dd 在接受情况下总是使用0x4000 作为到return 的数据包大小？我知道它足够 return 整个数据包。但为什么正是这个值而不是例如 65536

Answer 1

如有疑问，只需在源代码中搜索值，在我们的示例中为 in libpcap（顺便说一句：它是 0x40000）。

/*
 * Maximum snapshot length.
 *
 * Somewhat arbitrary, but chosen to be:
 *
 *    1) big enough for maximum-size Linux loopback packets (65549)
 *       and some USB packets captured with USBPcap:
 *
 *           http://desowin.org/usbpcap/
 *
 *       (> 131072, < 262144)
 *
 * and
 *
 *    2) small enough not to cause attempts to allocate huge amounts of
 *       memory; some applications might use the snapshot length in a
 *       savefile header to control the size of the buffer they allocate,
 *       so a size of, say, 2^31-1 might not work well.
 *
 * We don't enforce this in pcap_set_snaplen(), but we use it internally.
 */
#define MAXIMUM_SNAPLEN     262144

为什么 tcpdump -dd 接受数据包指令恰好选择 0x4000 作为大小？

Why tcpdump -dd accepting packet instruction choosese exactly 0x4000 as size?

packet

bpf