Question: What exactly does the Deep Scan option do?

[marek22k]

Hello,

I would like to add pcapfix to tldr. I came across a discrepancy in the Deep Scan documentation with a reviewer.

In the deep scan option it says:

This option will force pcapfix to scan for any packet inside the whole file (instead of the first 262144 (max snaplen) bytes only).

But in the note section it says:

In classic pcap files, pcapfix will only scan the first 65536 bytes (maximum packet length) for a proper first packet.

Did I understand correctly that pcapng files are always repaired completely and pcap files only partially? And if so, how big is this part?

[vitorhcl]

I've found the code :) Since cf16a13, the max snaplen is 262144. See the following code snippet:

pcapfix/pcap.h

Line 27 in 00b278a

#define PCAP_MAX_SNAPLEN 262144 /* the maximum snap length, should be 256K instead of 64K nowadays */