This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Good morning,

I see in the following captures message "packet size limited during capture sip truncated" and I do not know why, this did not happen to me with the previous version of WireShark. Please if anyone can tell me some tip about it.

Thanks and regards,

Camilo.

mmxvii

asked 21 Jun '17, 08:30

cbarbaste's gravatar image

cbarbaste
6112
accept rate: 0%

Did you capture directly in Wireshark or have you open using Wireshark a capture taken somewhere else?

If directly using Wireshark, go Capture -> Options, a window with a table of interface parameters will pop up. What values are there in the Snaplen column?

(21 Jun '17, 09:25) sindy

good afternoon Sindy.,

The capture was external, and the file generated with .cap after open with WireShark.,

Thanks and regards.,

Camilo.

(21 Jun '17, 11:05) cbarbaste

While Wireshark by default saves full size of captured frames, other tools (tcpdump at first place) don't - tcpdump saves only first 60 bytes of each frame unless asked to do otherwise. Information about original size of the frame is stored in the pcap or pcapng file. So your issue is most likely not related to Wireshark version but to the absence of -s 0 among tcpdump's command line parameters while taking that capture.

To be 100% sure, you'd have to inspect the pcap file, using e.g. hexdump on linux or some other binary file viewer. Or post the file somewhere and provide a link to it here.

permanent link

answered 21 Jun '17, 11:15

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×12

question asked: 21 Jun '17, 08:30

question was seen: 3,732 times

last updated: 21 Jun '17, 11:15

p​o​w​e​r​e​d by O​S​Q​A