Wireshark · Wireshark-dev: Re: [Wireshark-dev] the feature of limiting packet size

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 17, 2009, at 6:21 PM, Joshua (Shiwei) Zhao wrote:

> There is an option to "Limit each packet to XX bytes" in the  
> "Capture Options" panel. I tried to enable it while capturing  
> ethernet types of packets and it works pretty good. This is nice as  
> it saves big amount of data storage and improves performance.
> However, when I enable it while capturing 802.11 wifi traffic, no  
> packets cannot be dissected and it shows "Packet size limited during  
> capture". It seems that BoundsErrors were throwed.
>
> Is there a way to make it work same as ethernet dissectors instead  
> of throwing an exception?

The way it works with Ethernet dissectors is that, eventually, it will  
throw an exception if the packet was bigger than XX bytes and  
Wireshark tries to dissect all the bytes in the packet, so it *is*  
working the same way as Ethernet dissectors.

However, 802.11 headers are a bit larger than Ethernet headers, and  
802.11 headers plus radio headers can be significantly larger than  
Ethernet headers, so the minimum value of XX necessary in order to get  
a reasonable amount of dissection done is larger.

Try making XX bigger when capturing on 802.11 (or, if possible, try  
turning off radio headers, if you don't care about the information in  
them).