Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] RE : RE : Truncated field in XML detailed export result

From: "Olivier LENORMAND" <Olivier.Lenormand@xxxxxxxxxxx>
Date: Thu, 9 Nov 2006 12:14:51 +0100
Hi Ulf, thx for your explanation.

So the "show" field is something like a "preview" that will only display
the beginning of an ASCII field?
This way it's usefull, please keep it :)
Don't get me wrong, I'm not denigrating anyone's implementation choice
here, WS is a wonderfull tool and the people behind it deserve our daily
thanks.
In this case, it's just that I never imagined that the "show" field was
not completed, so the lazy man I am used it while parsing the XML export
in order to avoid decoding the value field by myself.
As a conclusion, should the WS documentation just specify that this
field may not be complete, both on the screen an in the exported file?

Thanks, Olivier.

Olivier LENORMAND wrote:
> If it's a "feature", I guess we'll have to do with it by never 
> trusting the "show" field and always decoding the "value" field.
>   
You can trust the show field that it will contain what you will see on 
the screen. This is something completely different (tm) from the value 
field.
> But I do agree with you, it's at least disturbing :)
> My two cents: let's not export the "show" field in the XML file, imho 
> no information is better than unannonced truncaded one. Anyone has a 
> better idea about this problem?
>   
Just because you can't use it in the way you use it, doesn't mean that 
it's useless for others.

Regards, ULFL
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users