Request packets have referer field but sometimes there are like this "[truncated] Referer" Does [truncated] shows something? asked 11 Mar '11, 12:07  A B |
One Answer:
When Wireshark puts [truncated] on a protocol tree item (such as the HTTP Referer field), it means that the field is longer than Wireshark's internal display limit (ITEM_LABEL_LENGTH==240) so the display (in the protocol tree) has been truncated. In other words, if the Referer field is, say, 300 characters long, it will be truncated to 240 minus the length of the field description ("[truncated] Referer:"). [Update] Don't forget to drop by and Accept this answer if it answered your question. answered 11 Mar '11, 15:08  JeffMorriss ♦ edited 09 Mar '12, 07:04 |
