Wireshark got wrong packet length displayed if I open a k12 text file that was I exported to k12 from a stripped pcap file (ex: using tcpdump -s <small_len>).
Is that a bug? Or would you wanna implement a parameter in editcap or checkbox in Wireshark to fill more |00| to k12 for a stripped capture file?
Just a suggestion. Or is there any other solution to my problem?
Or is there any other solution to my problem?
Export the file to a format that supports the notion of a packet having an "actual length" and a "captured length".
k12 text files are NOT such a format. That is the cause of your problem; it is not something that the Wireshark developer's can fix (we don't define that format, Tektronix did).
One such format is called "pcap format". Another such format is called "pcapng format". Wireshark is capable of reading and writing both those formats.
If I wanna fill many 0x00 in it to keep Wireshark can reload K12 file correctly. (I mean, use 0x00 to keep captured length = 'actual' length) What can I do? To write a program by myself?
Comments