First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Wireshark display column is truncated

Hi,

I have two questions below, please help,

  1. How can I fix the data is truncated issue?

I display the 1024 bytes custom data on the Wireshark,

the error message is displayed below,

data [TRUNCATED ]: 333333333333333333333333333

another question, how can I display the hex array on the Wireshark?

Thanks, Chuan

chuanlu66's avatar
1
chuanlu66
asked 2023-10-09 16:22:30 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

There is a limit of 240 characters per line in the Tree View pane. Only the tree view is truncated, not the data itself. It should be completely visible in the Packet Byte pane -- also as a hex dump.

Also tshark will print the complete field when using the options -T fields -e <field name here>

André's avatar
176
André
answered 2023-10-09 17:16:54 +0000
edit flag offensive 0 remove flag delete link
more

Comments

How can I display hex array? FT_STRING?

chuanlu66's avatar chuanlu66 (2023-10-09 17:23:57 +0000) edit
more
  • delete

For example tshark -r file.pcap -Tfields -e tcp.payload -Y tcp outputs the tcp payload as a hexdump.

tcp.payload is defined as field_type FT_BYTES.

André's avatar André (2023-10-09 18:39:24 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer