tailscale/tailscale

FR: add snapshot length flag to "tailscale debug capture" command

开放

#20,708 创建于 2026年7月31日

 (4 条评论) (0 个反应) (0 位负责人)Go (2,554 个派生)batch import
frgood first issue

仓库指标

星标
 (31,565 个星标)
PR 合并指标
 (平均合并 5天 22小时) (30 天内合并 173 个 PR)

描述

tcpdump(1) has a flag for snapshot length (-s snaplen) to control how many bytes from each packet are actually copied and written into the packet buffer. This is pretty useful for a lot of network troubleshooting where we only care about protocol headers, not the thousands of bytes of payload under said headers.

We should add this flag to our packet capture utility as well.

       -s snaplen
       --snapshot-length=snaplen
              Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes.  Packets truncated because
              of a limited snapshot are indicated in the output with ``[|proto]'', where proto is the name of the protocol level
              at which the truncation has occurred.

              Note that taking larger snapshots both increases the amount of time it takes to process packets and, effectively,
              decreases the amount of packet buffering.  This may cause packets to be lost.  Note also that taking smaller
              snapshots will discard data from protocols above the transport layer, which loses information that may be
              important.  NFS and AFS requests and replies, for example, are very large, and much of the detail won't be
              available if a too-short snapshot length is selected.

              If you need to reduce the snapshot size below the default, you should limit snaplen to the smallest number that
              will capture the protocol information you're interested in.  Setting snaplen to 0 sets it to the default of
              262144, for backwards compatibility with recent older versions of tcpdump.

贡献者指南