Wireshark · Wireshark-users: Re: [Wireshark-users] What does [truncated] mean and is it possible to 'fix' it?

[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

Gavin Donald wrote:
> Hello,
>
> I am almost completely new to using Wireshark and am hoping that someone 
> can assist as I haven't managed to find out any information about my 
> problem.
>
> I am trying to prove that some jabber instant messenger packets are 
> encrypted when they leave my machine but Wireshark is showing them as 
> follows:
>
> [truncated] 
> \027\003\001\000\327\353\242&i\347\325\v\363\354\263\351\202\350\360\325Nbf\3358\371\031^\017`o\037N|\331\366\206\277\341j\275U~6\002\253\250\036\243\031\t9\236\265xR\220\347\255I7"^z\342:\034R\272\210\257\033\360c\025\E\315[\2
> [ ERROR: Unrecognized text ]
>
> I am sure that in the past I had been able to see the full plain text or 

That "[truncated]" looks like what I put in for:

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2009

Specifically, the complaint in that bug was that very long text strings 
were being silently truncated.  Not truncating the text seemed very 
intrusive and difficult so I added the "[truncated]" part in order to 
make it obvious that you weren't seeing all of the text string.

That is to say, I suspect previously you /thought/ you were seeing all 
of the text but in actuality it was being silently truncated.