Capture the first few packets of a session?

[richard...@gmail.com]

Hi, is it possible to configure netsniff-ng to capture just the first few bytes of a session? Maybe like the first 10K bytes. Usually I don't need the entire payload (especially on encrypted traffic) but having the first few 10K bytes will give me the IPs/ports/cert info. I know that it is possible to only capture the header info with a BPF. Thanks in advance!