Snaplen is an abbreviation for snapshot length. Snaplen equals the number of bytes captured for each packet. Having a snaplen smaller than the maximum packet size on the network might allow you to store more packets. However, you are likely limited in your ability to inspect and extract the full packet content.

In most cases, you want to configure the NetShark to capture full packets. If this is your case, do not adjust the default snaplen parameter. Full packet analysis within Packet Analyzer can require the entire packet be captured. If you adjust the snaplen to be smaller, some Packet Analyzer views might not be able to fully analyze the data. For example, volumes of data represented can appear to be smaller than they actually are, and more detailed views do not contain all the data necessary for full analysis.