["Justin C. Walker" <justin@xxxxxxx>]

On Sunday, October 5, 2003, at 07:49 PM, #YANG YONG# wrote:

> When I captured a TPKT packet, ethereal said it contained a Q.931 
> message, and the length was 200. But in fact ethereal captured nothing 
> of the payload of the TPKT packet. The record is attached for your 
> information. I wonder why. Thank you.

At a guess, you didn't change the "snaplen" (the number of bytes of 
each packet to save) from its default (which is roughly 64 bytes, as I 
recall).  Check the doc to find out how to change that.  You'll want to 
set that value to something at most the MTU for the device you are 
'sniffing' (e.g., 1500 bytes for ethernet).

Regards,

Justin

--
Justin C. Walker, Curmudgeon-At-Large  *
Institute for General Semantics        |    Men are from Earth.
                                       |    Women are from Earth.
                                       |       Deal with it.
*--------------------------------------*-------------------------------*