Full PCAP on all tiers — no headers-only, no tiered retention. 128GB+ with zstd-19 handles it.

BIGBROTHER_DESIGN.md

@@ -263,8 +263,8 @@ Scope is the operator's responsibility. An optional `scope.yaml` can be loaded t
   - Decompression on operator's workstation: `zstd -d` then open in Wireshark
   - CPU cost: zstd -19 on Pi 4 compresses at ~5-10MB/s (runs as background task after rotation, not inline)
   - Pi Zero: use zstd -3 (fast mode, still 5-8x compression, minimal CPU)
-- Snap length configurable: 96 bytes (headers only) for Pi Zero, 65535 (full) for Pi 4+
-- **Tiered retention**: Headers-only (snap=96) as default on all tiers for bulk traffic. Separate credential-protocol full-capture ring buffer (NTLM, Kerberos, HTTP auth ports only). Full PCAP is operator-opt-in for targeted sessions. A 100Mbps link generates ~45GB/hour at full snap — without tiering, 32GB fills in hours and auto-purge destroys historical data.
+- **Full packet capture (snap_length=65535) on all tiers.** With 128GB+ SD and zstd -19 compression (10-15x), effective storage is ~1.2TB. Full payloads are required for file carving, email reconstruction, print job extraction, database query capture, and credential extraction from protocol payloads. Headers-only would blind most surveillance modules.
+- Pi Zero 2W: full capture still applies but with fewer concurrent modules to stay within memory budget. Compression downgraded to zstd -3 to reduce CPU load.
 - Disk usage monitoring — auto-purge oldest PCAPs when threshold hit (bulk first, credential ring preserved)
 - PcapNG format support for metadata embedding (interface info, comments, timestamps)
 
@@ -1523,7 +1523,7 @@ capture:
   pcap_compression: "zstd"      # zstd max compression on rotation
   pcap_compression_level: 19    # 1-22, default 19 (max practical). Pi Zero: auto-downgrade to 3
   pcap_format: "pcapng"         # pcapng (preferred) or pcap
-  snap_length: "auto"           # auto (by hardware tier) | 96 | 65535
+  snap_length: 65535             # Always full capture — 128GB+ SD with zstd compression handles it
   bpf_filter: "full_capture"    # full_capture | credentials | dns | custom
   custom_bpf: ""
   disk_max_pct: 85              # Purge oldest PCAPs above this (128GB+ gives headroom)
@@ -1650,7 +1650,7 @@ When enabled: ARP spoof validates each target IP, DHCP spoof only responds to in
 |---|:---:|:---:|:---:|
 | **Max passive modules** | 4 | All 22 | All 22 |
 | **Max active modules** | 1 | 6 | Unlimited |
-| **Snap length** | 96 bytes | 65535 | 65535 |
+| **Snap length** | 65535 (full) | 65535 (full) | 65535 (full) |
 | **Flow table max** | 5,000 | 50,000 | 100,000 |
 | **PCAP compression** | zstd -3 (fast) | zstd -19 (max) | zstd -19 (max) |
 | **Key derivation** | pbkdf2 | argon2id | argon2id |