Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] RE : RE : Truncated field in XML detailed export result

From: "Hans Nilsson" <hasse_gg@xxxxxxxx>
Date: Thu, 09 Nov 2006 08:03:41 -1100
Personally I did misunderstand how that field works, which seems pretty
easy to do to me. I captured some traffic and exported it as a
plain-text file but unfortunately all the data wasn't exported (as has
been mentioned because of the way that function works) so I lost some
data I needed.

On Thu, 9 Nov 2006 12:14:51 +0100, "Olivier LENORMAND"
<Olivier.Lenormand@xxxxxxxxxxx> said:
> Hi Ulf, thx for your explanation.
> 
> So the "show" field is something like a "preview" that will only display
> the beginning of an ASCII field?
> This way it's usefull, please keep it :)
> Don't get me wrong, I'm not denigrating anyone's implementation choice
> here, WS is a wonderfull tool and the people behind it deserve our daily
> thanks.
> In this case, it's just that I never imagined that the "show" field was
> not completed, so the lazy man I am used it while parsing the XML export
> in order to avoid decoding the value field by myself.
> As a conclusion, should the WS documentation just specify that this
> field may not be complete, both on the screen an in the exported file?
> 
> Thanks, Olivier.
> 
> Olivier LENORMAND wrote:
> > If it's a "feature", I guess we'll have to do with it by never 
> > trusting the "show" field and always decoding the "value" field.
> >   
> You can trust the show field that it will contain what you will see on 
> the screen. This is something completely different (tm) from the value 
> field.
> > But I do agree with you, it's at least disturbing :)
> > My two cents: let's not export the "show" field in the XML file, imho 
> > no information is better than unannonced truncaded one. Anyone has a 
> > better idea about this problem?
> >   
> Just because you can't use it in the way you use it, doesn't mean that 
> it's useless for others.
> 
> Regards, ULFL
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users
-- 
  Hans Nilsson
  hasse_gg@xxxxxxxx

-- 
http://www.fastmail.fm - Accessible with your email software
                          or over the web