This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display data in raw

0

good morning, everyone

i need to display a message in à field , but it is too long , so when it is displayed , it is truncked , so i want to display this message like a raw data like in SIP protocol.

can someone tell me if a special type fot that existe ??

Thank you.

asked 22 Jul '13, 00:16

cruz's gravatar image

cruz
11446
accept rate: 0%

can you please post a screenshot with the truncated message and add more details about your protocol and where exactly the message was truncated (GUI, tshark, your own dissector)?

(22 Jul '13, 06:49) Kurt Knochner ♦

alt text

This is a screenshot, the msg is too long so it is tunked when it is displayed , i want to display this msg in raw data exactly like in SIP protocol , because i need to display all the information, but i don't know if " raw data" is a special type or not !!!

thank you

(22 Jul '13, 09:53) cruz

I cannot find a dissector with a field name "Filename:" !?! If this your own dissector code?

(22 Jul '13, 14:38) Kurt Knochner ♦

2 Answers:

2

@cruz, I deleted your duplicate "answer" and your answer has been converted to a comment as that's how this site works. Please read the FAQ for more information.

Have a look at the function tvb_raw_text_add in packet-sip.c.

answered 23 Jul '13, 06:21

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

thank you for your answer

(23 Jul '13, 07:15) cruz

@grahamb ♦ thank you very match it is the right function.

Thank you,

(24 Jul '13, 07:32) cruz

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(24 Jul '13, 08:11) grahamb ♦

1

After checking the code, I found that the item max length is defined as follows.

proto.h

/** the maximum length of a protocol field string representation */
#define ITEM_LABEL_LENGTH   240

If you try to add text that is larger than 240 chars, it will be truncated and the item/field will be marked with [truncated]. At least that's how I understand the code ;-)

i want to display this msg in raw data exactly like in SIP protocol

I'm not sure what you mean by raw data in SIP? Can you please add more details or a screenshot that shows it.

Regards
Kurt

answered 22 Jul '13, 16:36

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

thank's for your answer, this is a alt textscreenshot foa a SIP trace , i want to display my msg like that, i mean that the message should be displayed line by line and not on one line.

tahnk you.

(23 Jul '13, 05:37) cruz