# \- change default MTU for pcaps processing

**URL:** <https://community.zeek.org/t/change-default-mtu-for-pcaps-processing/5019>\
**Category:** Zeek\
**Created:** [September 14, 2017, 7:55am UTC](https://community.zeek.org/t/change-default-mtu-for-pcaps-processing/5019 "2017-09-14T07:55:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![william\_de\_ping](https://avatars.discourse-cdn.com/v4/letter/w/b19c9b/32.png) [@william\_de\_ping](https://community.zeek.org/u/william_de_ping)\
**Post date:** [September 14, 2017, 7:55am UTC](https://community.zeek.org/t/change-default-mtu-for-pcaps-processing/5019/1 "2017-09-14T07:55:43Z")

</div>

Hi,

Does anyone know how can I change the default MTU for bro ?

This is relevant for pcap parsing and not for interface monitoring (for the latter, I assume bro will use the MTU for this NIC itself).

Thanks  
B

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [September 15, 2017, 7:23pm UTC](https://community.zeek.org/t/change-default-mtu-for-pcaps-processing/5019/2 "2017-09-15T19:23:41Z")

</div>

Hi,

the way to do this is to redef Pcap::snaplen to a desired value. If you  
use broctl, you might have to set pcapsnaplen in broctl.cfg (I think  
broctl might overwrite the value otherwhise).

Note that this is also used for interface monitoring - as far as I am  
aware, Bro does not just use the NIC MTU. The default snaplen of Bro is  
8192.

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/change-default-mtu-for-pcaps-processing/5019/3 "2022-05-06T15:45:16Z")

</div>