This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

packet size limited during capture sip truncated

Good morning,

I see in the following captures message "packet size limited during capture sip truncated" and I do not know why, this did not happen to me with the previous version of WireShark. Please if anyone can tell me some tip about it.

Thanks and regards,

Camilo.

mmxvii

captured

asked 21 Jun '17, 08:30

cbarbaste
6●1●1●2
accept rate: 0%

Did you capture directly in Wireshark or have you open using Wireshark a capture taken somewhere else?

If directly using Wireshark, go Capture -> Options, a window with a table of interface parameters will pop up. What values are there in the Snaplen column?

(21 Jun '17, 09:25) sindy

good afternoon Sindy.,

The capture was external, and the file generated with .cap after open with WireShark.,

Thanks and regards.,

Camilo.

(21 Jun '17, 11:05) cbarbaste

One Answer:

While Wireshark by default saves full size of captured frames, other tools (tcpdump at first place) don't - tcpdump saves only first 60 bytes of each frame unless asked to do otherwise. Information about original size of the frame is stored in the pcap or pcapng file. So your issue is most likely not related to Wireshark version but to the absence of -s 0 among tcpdump's command line parameters while taking that capture.

To be 100% sure, you'd have to inspect the pcap file, using e.g. hexdump on linux or some other binary file viewer. Or post the file somewhere and provide a link to it here.

answered 21 Jun '17, 11:15

sindy
6.0k●4●8●51
accept rate: 24%