Ethereal-users: Re: [Ethereal-users] Problem

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Fri, 8 Nov 2002 19:37:28 +0100
>On Thu, Nov 07, 2002 at 06:02:02PM -0500, Oleg Zolotykh wrote:
>> I have encounter a problem while using Ethereal Network Analyzer. It deals
>> with long values of the attributes in LDAP protocol. The values which are
>> longer than approximately 150 characters are not displayed.
>
>> I'd like to know if there is a way to change this limitation. It would be
>> nice to set a number of characters to be displayed and truncate the others
>> for instance.
>> Looks like the problem has to do with proto_tree_set_string() function in
>> proto.c file.


Guy Harris wrote:
>The truncation is the result of the way the buffer for the
>displayable/printable string for a field is allocated; they are
>fixed-length buffers, allocated from a GLib "memory chunk", and are
>ITEM_LABEL_LENGTH, or 240, bytes long.
>
>See "proto_tree_set_representation()".
>
>The way to change the limitation is to change the value for
>ITEM_LABEL_LENGTH in "proto.c" and recompile.


When I loaded the capture file (Ethereal 0.9.7, 0.9.5 - Windows 98) the decoding looked OK 
for frame 51 (or actually the desegmentation of frame 14, 15, 17 .... to 51) the first time when I looked 
at it. Lines are truncated.

I got several GDK warnings when clicking on the packet
Gdk-WARNING **: gdk_text_size: gdk_nmbstowchar_ts failed

When I later checked frame 51 again all lines that where longer than X bytes was totally empty,
i.e. the lines were not truncated, but totally blank.
I could see only less than one third of the lines.
When printing to file I always get all lines (but truncated), but it seems that it is only the first time after starting Ethereal that all lines
sometimes are visible.

I have seen some similar problems before where lines has been empty in the Ethereal, but visible
in printouts. However what I remember the lines were not so long as in this case, so it might have been some other problem.

I think I have seen some messages from others about similar problems a while ago, but I cannot find those
messages right now.

Regards,
 Martin