<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>James,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>by default windump, exactly like tcpdump, captures only the first bytes of every packet (if I remember well, only the first 96 bytes). To capture the whole packet, you need to use parameter –s <snaplen> with a big snaplen value, e.g. 65535.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Have a nice day<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>GV<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> windump-bounces@winpcap.org [mailto:windump-bounces@winpcap.org] <b>On Behalf Of </b>James Zu<br><b>Sent:</b> Monday, March 21, 2011 12:31 PM<br><b>To:</b> windump@winpcap.org<br><b>Subject:</b> [Windump] windump capture udp packets all shorterned<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi, <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Running into some problem trying to use windump to capture completed data on a Intel NIC team. I have both wireshark and windump installed. However the packets that’s captured by wireshark are all complete. But the UDP packets captured by windump are all truncated. The box has 16G of RAM and 8 cores, so it’s not a hardware slow issue. Any ideas?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here is my command<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>WinDump.exe -i \Device\NPF_{CAFA7E67-9901-4762-9069-CAA9B9AC754E} -n -vvv -U -C 100 -w 20110321_P2_GW -B 5000 <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b><span lang=EN-CA>James Zu</span></b><b><span style='font-size:12.0pt'><o:p></o:p></span></b></p></div></body></html>