Wireshark · Wireshark-dev: Re: [Wireshark-dev] the feature of limiting packet size

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 20, 2009, at 3:41 PM, Joshua (Shiwei) Zhao wrote:

> I believe it's a bug there, at least in 1.0.4 I'm using.
> I don't believe all packets have that big headers over 500 bytes.

What matters is whether all the data dissected in the packet is bigger  
than the snapshot length; in an SMB request or response, for example,  
that would include any radio header the packet has, the 802.11 header,  
the IP header, the TCP header, the NetBIOS-over-TCP or SMB-over-TCP  
header, and the entire SMB message, with the possible exception of  
data in a read reply or write request.

> The code must checked the whole data payload size, instead of only  
> checking the header length when it tries to dissect and throw an  
> execption.
> I'll try to debug. Meanwhile any hints/suggestions are welcome.

Could you extract from the capture file one of the packets that's  
claimed to have been cut short and send it to us?