From bbcf95dca4121e5e25db0f7cb0eae6f25c35ca1d Mon Sep 17 00:00:00 2001
From: Justin Azoff <jazoff@illinois.edu>
Date: Wed, 20 Sep 2017 15:31:06 -0400
Subject: [PATCH] problem: default snaplen is too small for jumbo frames

Jumbo frames start at 9000 bytes and can be up to 9216 bytes
---
 scripts/base/init-bare.bro | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro
index f2a6816d9d..e54225159f 100644
--- a/scripts/base/init-bare.bro
+++ b/scripts/base/init-bare.bro
@@ -4409,7 +4409,7 @@ export {
 module Pcap;
 export {
 	## Number of bytes per packet to capture from live interfaces.
-	const snaplen = 8192 &redef;
+	const snaplen = 9216 &redef;
 
 	## Number of Mbytes to provide as buffer space when capturing from live
 	## interfaces.