tailscale/tailscale
FR: add snapshot length flag to "tailscale debug capture" command
开放
#20,708 创建于 2026年7月31日
frgood first issue
仓库指标
- 星标
- (31,565 个星标)
- PR 合并指标
- (平均合并 5天 22小时) (30 天内合并 173 个 PR)
描述
tcpdump(1) has a flag for snapshot length (-s snaplen) to control how many bytes from each packet are actually copied and written into the packet buffer. This is pretty useful for a lot of network troubleshooting where we only care about protocol headers, not the thousands of bytes of payload under said headers.
We should add this flag to our packet capture utility as well.
-s snaplen
--snapshot-length=snaplen
Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes. Packets truncated because
of a limited snapshot are indicated in the output with ``[|proto]'', where proto is the name of the protocol level
at which the truncation has occurred.
Note that taking larger snapshots both increases the amount of time it takes to process packets and, effectively,
decreases the amount of packet buffering. This may cause packets to be lost. Note also that taking smaller
snapshots will discard data from protocols above the transport layer, which loses information that may be
important. NFS and AFS requests and replies, for example, are very large, and much of the detail won't be
available if a too-short snapshot length is selected.
If you need to reduce the snapshot size below the default, you should limit snaplen to the smallest number that
will capture the protocol information you're interested in. Setting snaplen to 0 sets it to the default of
262144, for backwards compatibility with recent older versions of tcpdump.