[Guy Harris <guy@xxxxxxxxxxxx>]

On Thursday, September 4, 2003, at 7:19 AM, Distribution Lists wrote:

> yes, P is < than M, and this was a tcpdump (on Linux) captured into a
> file,

tcpdump defaults to a snapshot length of 68 (or maybe 96 or so if it's 
built with IPv6 support).  If you want to capture all of the packet, 
use "-s 65535" or, on more recent versions of tcpdump, "-s 0" (more 
recent versions of tcpdump treat a snapshot length of 0 as meaning 
65535).

>  and read through Ethereal then I assume that 3. doesn't count.

Given that the capturing machine wasn't running Windows, it's 
definitely not 3.