This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

(apologies if this is a repost, but I think the forum lost my initial post after I signed up)

I'm debugging an application which sends websocket JSON packets up to 20MB in size. I'm filtering on (websocket). With unmasked (outbound) packets, unmasking appears to truncate the packet.


Outbound (masked) packet

In the tabs below the dump:

Frame (620 bytes) | Reassembled TCP (1483458 bytes) | Unmasked data (262144 bytes)

In the Websocket header:

Extended Payload length (64 bits): 1483444

"Javascript Object Notation" can't be expanded.


Inbound (unmasked) packet

In contrast, when I view an unmasked (inbound) packet:

Tabs:

Frame (1040 bytes) | Reassembled TCP (1477944)

Websocket header:

Extended Payload length (64 bits): 1477934

"Javascript Object Notation" can be expanded.


I'm actually debugging a problem whereby my Java application cannot receive large messages (but is sending them OK), so this doesn't impede my work - but in case it's a bug, I figured I should post here.

asked 24 Nov '16, 07:26

markkc's gravatar image

markkc
6112
accept rate: 0%


It's actually not a bug. The Websocket dissector intentionally limits the unmasked data to 256 kbytes:

#define MAX_UNMASKED_LEN (1024 * 256)

I suppose it could be made more obvious that this is what has happened--maybe an expert info would be useful here.

permanent link

answered 04 Jan '17, 11:42

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×13
×9
×7

question asked: 24 Nov '16, 07:26

question was seen: 2,069 times

last updated: 04 Jan '17, 11:42

p​o​w​e​r​e​d by O​S​Q​A