from man tcpdump:
[snip]
If the snapshot was small enough that tcpdump didn't cap-
ture the full TCP header, it interprets as much of the
header as it can and then reports `[|tcp]'' to indicate
the remainder could not be interpreted. [snip]
Use '-s 1518' to capture the whole packet, or '-s 128' or whatever to
capture as much as needed.
-Chris
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu