At the top of text2pcap.c:
* This converter cannot read a single packet greater than 64K. Packet
* snaplength is automatically set to 64K.
... yet since its inception[1][2], text2pcap has used 102400 for the
snaplen. That value seems quite strange to me. I guess this question is
mainly directed at Ashok Narayanan (if you are still listening?), who
originally wrote text2pcap, but is there some particular reason that 102400
was chosen? If not or if there's no feedback, then I intend to change it to
65535, at least as the default snaplen. If anyone wants a different
snaplen, then perhaps an option could be added to text2pap to be able to
specify a different snaplen, but then I would propose an enhancement bug
request for that.
Thanks.
- Chris
[1]: http://www.wireshark.org/lists/ethereal-dev/200105/msg00106.html
[2]:
http://web.archive.org/web/20010610044423/http://www.ethereal.com/distribution/nightly-builds/