 | 1 | initial version |
From your output:
Frame 71: 314 bytes on wire (2512 bits), 314 bytes captured (2512 bits)
This tells Wireshark that the capture file contains all 314 bytes that were transmitted, hence it gets upset when they aren't actually there. When packets are correctly sliced and written to a pcap (or pcapng) file the frame will show that less bytes were captured:
Frame 34: 1131 bytes on wire (9048 bits), 256 bytes captured (2048 bits)
and when it reads such a packet Wireshark shows the helpful info in the info column:
34 25.810280 1.2.3.4 5.6.7.8 TLSv1.2 1131 Application Data[Packet size limited during capture]
The issue would appear to be with your capture file generation.
| | 2 | No.2 Revision |
From your output:
Frame 71: 314 bytes on wire (2512 bits), 314 bytes captured (2512 bits)
This tells Wireshark that the capture file contains all 314 bytes that were transmitted, hence it gets upset when they aren't actually there. When packets are correctly sliced and written to a pcap (or pcapng) file the frame will show that less bytes were captured:
Frame 34: 1131 bytes on wire (9048 bits), 256 bytes captured (2048 bits)
and when it reads such a packet Wireshark shows the helpful info in the info column:
34 25.810280 1.2.3.4 5.6.7.8 TLSv1.2 1131 Application Data[Packet size limited during capture]
The issue would appear to be with your capture file generation.