# "Trailing stray characters" warning

Hi all,

Could you please tell what is the meaning of "Trailing stray characters" WS Expert system warning?

The packet is a part of TCP stream containing clear text request-response type of conversation (SQL-type protocol).

There's no issue, I'm just curious about what could have caused this warning.

Wireshark Version 3.1.0rc0-163-g7a482205, Windows 10 x64

edit retag close merge delete

Sort by » oldest newest most voted

You have configured Show data as text in the Data dissector. The data you are showing as text is zero terminated inside the string so you will not see all the data as text. The warning is trying to tell you this, you have trailing characters which is not shown.

The warning is useful when found in a protocol having data which is text strings. It's not that useful in this case where you are "forcing" whatever data is found to be shown as text.

Maybe the text should be updated to be more clear what happened.

more

Thank you for explanation! Indeed, the error is gone after I disabled Show data as text setting.

( 2019-03-01 14:17:19 +0000 )edit

This has come in with this change. It warns about text which is contained in the protocol item, but does not normally appear on a display due to NULL character(s) in the string.

more

( 2019-02-27 17:34:00 +0000 )edit

That data does not, in fact, appear to be text; either:

1. the protocol is not, in fact, a clear-text protocol;
2. it is a clear-text protocol, but it's encrypted, and the encrypted text is being displayed as if it were plaintext;
3. not all of the protocol is in clear text, but you're displaying the non-clear-text part as clear text;
4. the packet is being dissected by the dissector for that protocol, but it is, in fact, not traffic for that protocol;

etc..

more

Thank you all for the answers! Indeed the protocol contains clear-text parts (usually requests) followed by mixed clear- and non-clear-text (responses). Unfortunately I can't demonstrate it because of confidential content. But know I understand the idea.

( 2019-02-27 19:37:13 +0000 )edit

So perhaps the "Trailing stray characters" warning should be "Trailing stray characters or non-text displayed as text", or something such as that.

( 2019-02-27 19:42:52 +0000 )edit

This appears to be the result of the following 2 commits:

The implementation would appear to be flawed and a Wireshark bug report would seem to be in order here.

more