Wireshark got wrong packet length displayed if I open a k12 text file that was I exported to k12 from a stripped pcap file (ex: using tcpdump -s <small_len>).
Is that a bug? Or would you wanna implement a parameter in editcap or checkbox in Wireshark to fill more |00| to k12 for a stripped capture file?
Just a suggestion. Or is there any other solution to my problem?
Or is there any other solution to my problem?
Export the file to a format that supports the notion of a packet having an "actual length" and a "captured length".
k12 text files are NOT such a format. That is the cause of your problem; it is not something that the Wireshark developer's can fix (we don't define that format, Tektronix did).
One such format is called "pcap format". Another such format is called "pcapng format". Wireshark is capable of reading and writing both those formats.
Asked: 2021-12-22 07:31:01 +0000
Seen: 220 times
Last updated: Dec 24 '21
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
