When capturing DHCP packets there is a specific field we wish to capture. This is being cut off at 24 characters so we cannot completely verify that it is correct. If we select the option -T pdml then it outputs the entire value but changing to XML would require a large amount of rework in some code we have. Is there a way to stop tshark truncating output? Notice the second last line in the capture below has ... on the end of it indicating the data has been truncated. We are using CentOS 6.2. This is just a basic TCP/IP capture, nothing fancy except that we are looking at DHCP traffic.
Our command line is this:
and output (which I've abbreviated) is like this:
asked 21 Jan '15, 20:53
Have you tried just printing the field itself instead of the whole packet? I don't think individual field output is truncated. In other words, do this (all in one line):
Or you can output multiple fields, if you need to see more than just that one per DHCP packet.
answered 22 Jan '15, 06:02