ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: [Wireshark-users] RE : Truncated field in XML detailed export result

From: "Olivier LENORMAND" <Olivier.Lenormand@xxxxxxxxxxx>
Date: Thu, 9 Nov 2006 09:37:55 +0100
Hi, thx for your quick answer!

> I reported something similar a while ago. Isn't this the same thing?
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=682

Yes, I missed it in bugzilla but that's the same problem, yours just
seems explained better :)
Sorry for double-posting it.

> QUOTE: "That behaviour is intentional, caused by the internal
implementation, and won't be fixed."

If it's a "feature", I guess we'll have to do with it by never trusting
the "show" field and always decoding the "value" field.
But I do agree with you, it's at least disturbing :)
My two cents: let's not export the "show" field in the XML file, imho no
information is better than unannonced truncaded one.
Anyone has a better idea about this problem?

Thanks, Olivier.

------------------------------------------

>> I came across what seems to be a bug when exporting a WS capture 
>> session to an XML file (PDML, aka a detailed XML file). 
>> Though the "size" field is correct (regarding the 
>> length of the "value" field), the "show" field is too small and only 
>> shows the first 287 chars.