Wireshark displays [truncated] preceding the HTTP Cookie header. How can I make it capture and display the entire Cookie header? asked 27 Oct '10, 08:07  matthewlmcclure |
One Answer:
Wireshark DID capture the whole Cookie Header (assuming that no snaplength was used during capture). However, it has a limit on the length of text to show for one particular item in the protocol detail pane. When you select the Cookie Header, you can see the whole Cookie Header in HEX & Ascii in the packet bytes pane. Or you can use "Copy Value" to extract the whole Cookie Header into the copy buffer and paste it in a text editor of your choice to view. answered 28 Oct '10, 15:40  SYN-bit ♦♦ |
Can you use http.cookie as a display filter to see all packets that contain an HTTP cookie and then right-click on one of those packets and select Follow TCP stream? Do you see the entire cookie now?