[Guy Harris <gharris@xxxxxxxxx>]

Jonathan Sanders wrote:
> Can't you throw in a -e for link level info?

You can, if by "for link level info" you mean "to make tcpdump print 
link-layer information" - "-e" has no effect on the interpretation of 
"-s" and, just like "-v", it has no effect if "-w" is being used.

> And you're right about the 
> -s 0, I just throw 1500 down there out of an old bad habit and haven't 
> changed to -s 0 yet.

Well, "-s 0" is, as noted, not supported by older versions - I *think* 
it first showed up in tcpdump 3.6.