Tcpdump | Episode 3: Packet Truncation(SnapLength)
If you are troubleshooting a problem that occurs randomly and you need to capture all packets till the event re-occurs without filling up disk space, then you should consider using the snaplength(or packet truncation) feature in tcpdump.