Wireshark-users: [Wireshark-users] What does [truncated] mean and is it possible to 'fix' it?
From: Gavin Donald <gavin@xxxxxxxxxxxx>
Date: Fri, 19 Sep 2008 11:30:46 +0100
Hello,

I am almost completely new to using Wireshark and am hoping that someone can assist as I haven't managed to find out any information about my problem.

I am trying to prove that some jabber instant messenger packets are encrypted when they leave my machine but Wireshark is showing them as follows:

[truncated] \027\003\001\000\327\353\242&i\347\325\v\363\354\263\351\202\350\360\325Nbf\3358\371\031^\017`o\037N|\331\366\206\277\341j\275U~6\002\253\250\036\243\031\t9\236\265xR\220\347\255I7"^z\342:\034R\272\210\257\033\360c\025\E\315[\2
[ ERROR: Unrecognized text ]

I am sure that in the past I had been able to see the full plain text or SSL encrypted packets (depending upon my settings) using Wireshark but now, for some reason I can't. I am not limiting the packet length captured (though I have tried). I have checked this on Linux and Windows on both wired and wireless connections. The Wireshark output is always the same.

I would appreciate any help/suggestions that anyone can make as to the meaning of the above.