Wireshark · Ethereal-users: Re: [Ethereal-users] Hex Dump w/ multiple packets in "Follow TCP Stream" window

[Guy Harris <gharris@xxxxxxxxx>]

On Fri, Aug 23, 2002 at 02:44:24PM -0400, Roth, Kevin P. wrote:
> Don't know if this has been reported or not...  I'm using Ethereal
> 0.9.6 on Windows 2000 server.  If I do a "Follow TCP Stream" for a
> stream with two packets, and then click the "Hex Dump" button, I see the
> first packet dumped just fine, but the second packet's dump skips the
> first 76 columns,

In hex dump mode, data going in the other direction from the first byte
of the connection is indented so that it's entirely to the right of data
going in the same direction as the first byte of the connection; that's
what the "skipping" is doing.

> and as such it wraps around to the next line on my
> 1024x768 screen.

Resize the window (standard left-button drag should do it).  The GTK+
1.x text widget, unfortunately, can't be told to add a scroll bar,
rather than wrapping lines, if the lines are too long.