Question: What exactly does the Deep Scan option do?

[marek22k]

Hello,

I would like to add pcapfix to tldr. I came across a discrepancy in the Deep Scan documentation with a reviewer.

In the deep scan option it says:

This option will force pcapfix to scan for any packet inside the whole file (instead of the first 262144 (max snaplen) bytes only).

But in the note section it says:

In classic pcap files, pcapfix will only scan the first 65536 bytes (maximum packet length) for a proper first packet.

Did I understand correctly that pcapng files are always repaired completely and pcap files only partially? And if so, how big is this part?

[vitorhcl]

I've found the code :) Since https://github.com/Rup0rt/pcapfix/commit/cf16a134e3342c933e74902fa5c7b22d8d0c5391, the max snaplen is 262144. See the following code snippet: https://github.com/Rup0rt/pcapfix/blob/00b278a0f3c4a9f57759e2f9eca0d5110296768f/pcap.h#L27