Wireshark · Wireshark-users: Re: [Wireshark-users] Truncated field in XML detailed export result

["Hans Nilsson" <hasse_gg@xxxxxxxx>]

I reported something similar a while ago. Isn't this the same thing?
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=682

QUOTE: "That behaviour is intentional, caused by the internal
implementation, and won't
be fixed."


On Wed, 8 Nov 2006 17:36:35 +0100, "Olivier LENORMAND"
<Olivier.Lenormand@xxxxxxxxxxx> said:
> Hi,
> 
> I came across what seems to be a bug when exporting a WS capture session
> to an XML file (PDML, aka a detailed XML file).
> 
> Here is an extract of the xml file enlighting the problem (this is the
> DATA section of an HTTP POST request for curious people :)):
> 
>  <proto name="data-text-lines" showname="Line-based text data:
> application/x-www-form-urlencoded" size="641" pos="1735">
>     <field
> show="%7EMenuitem=&amp;%7EFocusfield=@%24@OBJ00001%5B1%5D&amp;%7EOkCode=
> %2F0&amp;%7EFKey=4&amp;%7ESearchhelp=&amp;%7EControl=&amp;%7EEvent=&amp;
> %7EEventParameter=&amp;%7EwebguiUserAreaHeight=717&amp;%7EwebguiUserArea
> Width=1094&amp;%7EwebguiRenderTime=234&amp;%7EwebguiRequestTime=0&amp;%7
> Ewebg" size="641" pos="1735"
> value="2537454d656e756974656d3d26253745466f6375736669656c643d40253234404
> f424a303030303125354231253544262537454f6b436f64653d2532463026253745464b6
> 5793d342625374553656172636868656c703d26253745436f6e74726f6c3d26253745457
> 6656e743d262537454576656e74506172616d657465723d2625374577656267756955736
> 572417265614865696768743d37313726253745776562677569557365724172656157696
> 474683d313039342625374577656267756952656e64657254696d653d323334262537457
> 765626775695265717565737454696d653d3026253745776562677569537461727452657
> 17565737454696d653d31313632393136333330383536262537457072696e74646174615
> f636c6f73653d262537457765626775694d6f64616c506978656c4c6566743d262537457
> 765626775694d6f64616c506978656c546f703d262537457765626775695f747970655f6
> 4796e70726f646174613d262537457765626775695f6d6f64616c77696e646f773d26253
> 7457765626775695f637572736f726f626a3d262537457765626775695f637572736f726
> 36f6c3d262537456374786d656e75726571756573743d262537456374786d656e7573656
> c65637465643d2625374577656267756957696e646f774865696768743d2625374577656
> 267756957696e646f7757696474683d26253745546f6f6c6261724f6b436f64655669736
> 9626c653d2625374577656267756944796e70726f4d65747269633d312640253234404f4
> 24a3030303031253542312535443d2640253234404f424a3030303033253542312535443
> d2664796e70726f7363726f6c6c783d302664796e70726f7363726f6c6c793d30"/>
>   </proto>
> 
> As you can see, though the "size" field is correct (regarding the length
> of the "value" field), the "show" field is too small and only shows the
> first 287 chars.
> 
> When ASCII-zed, the "value" field is
> 
> %7EMenuitem=&%7EFocusfield=@%24@OBJ00001%5B1%5D&%7EOkCode=%2F0&%7EFKey=4
> &%7ESearchhelp=&%7EControl=&%7EEvent=&%7EEventParameter=&%7EwebguiUserAr
> eaHeight=717&%7EwebguiUserAreaWidth=1094&%7EwebguiRenderTime=234&%7Ewebg
> uiRequestTime=0&%7EwebguiStartRequestTime=1162916330856&%7Eprintdata_clo
> se=&%7EwebguiModalPixelLeft=&%7EwebguiModalPixelTop=&%7Ewebgui_type_dynp
> rodata=&%7Ewebgui_modalwindow=&%7Ewebgui_cursorobj=&%7Ewebgui_cursorcol=
> &%7Ectxmenurequest=&%7Ectxmenuselected=&%7EwebguiWindowHeight=&%7Ewebgui
> WindowWidth=&%7EToolbarOkCodeVisible=&%7EwebguiDynproMetric=1&@%24@OBJ00
> 001%5B1%5D=&@%24@OBJ00003%5B1%5D=&dynproscrollx=0&dynproscrolly=0
> 
> And that's what the "show" field is supposed to store, am I wrong?
> 
> This occurs with WS 99-4, and the latest nightly build (19868).
> I can't tell if it was working before 99-4, because 99-3 failed to
> export detailed XML files.
> 
> Btw, no all "data-text-lines"'s "show" fields seem to be trucated, but
> because of the huge size of my XML file, I haven't checked all them
> manually :)
> 
> If I did not misunderstood the meaning of the "show" field (seems quite
> obvious to me), is there any chance that the XML-export guru will fix
> this bug in the next nightlies?
> 
> Thanks in advance, Olivier.
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users
-- 
  Hans Nilsson
  hasse_gg@xxxxxxxx

-- 
http://www.fastmail.fm - Access your email from home and the web