I'm getting the message [Packet size limited during capture] and than on the tcp stream content i can see this[xxx bytes missing in capture file]. does anyone solved this issue or have an suggestion. thanks 2x2i asked 25 Aug '14, 11:40  2x2i edited 25 Aug '14, 13:28  Guy Harris ♦♦ showing 5 of 6 show 1 more comments |
One Answer:
If you can't change the slice size, this is an unfixable problem; "Slice Size: 64 Bytes" is nGenius Performance Manager's way of saying what, in the Wireshark GUI, is said as "Limit each packet to 64 bytes" - or it's way of saying "the slice size that was specified at capture time is 64 bytes and can't be changed when you save it, because it's too late". I.e., it's saying "Packet size limited during capture" because the packet size was limited, to at most 64 bytes per packet, during the capture. If there's some way for you, or somebody else, to change the slice size - or completely disable packet slicing - that would be the only way not to get "Packet size limited during capture" and "[xxx bytes missing in capture file]". answered 25 Aug '14, 14:09 Guy Harris ♦♦ Thank you Guy for all your help, I'm going to see with netscout admin if we can change packet slicing or if its safe we may disable completely. thanks 2x2i (26 Aug '14, 05:31) 2x2i |
Did you capture this traffic with Wireshark or with some other program?
On what OS did you capture it, and on what network device did you capture it?
If you captured it with Wireshark, did you specify the "Limit each packet to ... bytes" option?
If you captured it with some other program, what program was that, and what options did you use with that program?
I have used net scout to capture traffic.
NetScout have a lot of products; which particular one did you use?
nGenius Performance Manager, my bed i was in the hurry...
This document from HP says that nGenius Performance Manager can "Save, share, import and export capture files in standard formats (dat, cap, dmp, pcap)". What format did you save it in in order to read it into Wireshark?
When you read it into Wireshark, the packet detail display should show "''N'' bytes on wire" and "''M'' bytes captured", where ''M'' could be less than ''N''. Are there any packets in which ''M'' is less than ''N'', such as "1514 bytes on wire, 128 bytes captured" - or "1514 bytes on wire (12112 bits), 128 bytes captured (1024 bits)" ?
i have save it as Tcpdump.pcap buffer size is 64 MB Slice size is 64 Bytes ( i cant change this one)