Wireshark-dev: Re: [Wireshark-dev] Packet Size limited during capture message
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 23 Mar 2010 17:27:44 -0700
On Mar 21, 2010, at 9:14 PM, Brian Oleksa wrote:

> But I was able to run the pcap file and stop the loading process before 
> it crashed and one thing that I noticed
> was in the info column it said "Packet Size limited during capture".

In the detail view for the packet that has "Packet Size limited during capture", the topmost line ("Frame {N}") should say "{N} bytes on wire, {M} bytes captured" (it might also give some numbers of bits).  Is {N} greater than {M}?  If so, that's the problem - the packets were captured with a snapshot length specified, so that at most the first {M} bytes of the packet were saved to the file.