Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] the feature of limiting packet size

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 17 Jul 2009 18:28:22 -0700

On Jul 17, 2009, at 6:21 PM, Joshua (Shiwei) Zhao wrote:

There is an option to "Limit each packet to XX bytes" in the "Capture Options" panel. I tried to enable it while capturing ethernet types of packets and it works pretty good. This is nice as it saves big amount of data storage and improves performance. However, when I enable it while capturing 802.11 wifi traffic, no packets cannot be dissected and it shows "Packet size limited during capture". It seems that BoundsErrors were throwed.

Is there a way to make it work same as ethernet dissectors instead of throwing an exception?

The way it works with Ethernet dissectors is that, eventually, it will throw an exception if the packet was bigger than XX bytes and Wireshark tries to dissect all the bytes in the packet, so it *is* working the same way as Ethernet dissectors.

However, 802.11 headers are a bit larger than Ethernet headers, and 802.11 headers plus radio headers can be significantly larger than Ethernet headers, so the minimum value of XX necessary in order to get a reasonable amount of dissection done is larger.

Try making XX bigger when capturing on 802.11 (or, if possible, try turning off radio headers, if you don't care about the information in them).