This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark displays [truncated] preceding the HTTP Cookie header. How can I make it capture and display the entire Cookie header?

asked 27 Oct '10, 08:07

matthewlmcclure's gravatar image

matthewlmcclure
16223
accept rate: 0%

Can you use http.cookie as a display filter to see all packets that contain an HTTP cookie and then right-click on one of those packets and select Follow TCP stream? Do you see the entire cookie now?

(27 Oct '10, 20:16) lchappell ♦

Wireshark DID capture the whole Cookie Header (assuming that no snaplength was used during capture). However, it has a limit on the length of text to show for one particular item in the protocol detail pane.

When you select the Cookie Header, you can see the whole Cookie Header in HEX & Ascii in the packet bytes pane. Or you can use "Copy Value" to extract the whole Cookie Header into the copy buffer and paste it in a text editor of your choice to view.

permanent link

answered 28 Oct '10, 15:40

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×293
×40
×14
×13

question asked: 27 Oct '10, 08:07

question was seen: 33,433 times

last updated: 28 Oct '10, 15:40

p​o​w​e​r​e​d by O​S​Q​A