Glossary
Snaplen (snapshot length)
The snaplen is the maximum number of bytes a capture keeps from each packet; anything past it is discarded at capture time and cannot be recovered.
The snaplen (snapshot length) is the maximum number of bytes a capture tool stores for each packet. When a packet is longer, only the first snaplen bytes are written, and the record keeps both the captured length and the original length so a reader can tell the packet was cut. In pcap the snaplen is set once in the file header; in pcapng it is set per interface.
A small snaplen keeps files small and captures only headers, but it breaks TCP reassembly and file extraction because payload bytes are missing. With tcpdump, -s 0 asks for full packets. PCAP Parser reports how many packets the snaplen cut, as described in how to use PCAP Parser.