Wireshark-users: [Wireshark-users] capture short packets in tcpdump/tshark?

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Mathias Koerber <mathias@xxxxxxxxxxx>
Date: Tue, 27 Jan 2015 13:25:58 +0800
On one system, we see a few

UDP: short packet: From a.b.c.d:xx 50/44 to
e.f.g.h:yy

which then apparently the kernel drops.

If I capture all traffic on that NIC (using tcpdump or
tshark) will these show up in the capture, or will the kernel
drop them before the libpcap lib even sees them?

If they are captured, how to I filter for these in wireshark/tshark?

This is RedHat Linux 6

thanks