Wireshark-dev: Re: [Wireshark-dev] the feature of limiting packet size

From: "Joshua (Shiwei) Zhao" <swzhao@xxxxxxxxx>
Date: Fri, 17 Jul 2009 22:21:23 -0700
I did try to set the limit to big value, such as 200 or even 400 bytes, but it still fails.  I can double check again to confirm.

Thanks,
Joshua


On Fri, Jul 17, 2009 at 6:28 PM, Guy Harris <guy@xxxxxxxxxxxx> wrote:

On Jul 17, 2009, at 6:21 PM, Joshua (Shiwei) Zhao wrote:

> There is an option to "Limit each packet to XX bytes" in the
> "Capture Options" panel. I tried to enable it while capturing
> ethernet types of packets and it works pretty good. This is nice as
> it saves big amount of data storage and improves performance.
> However, when I enable it while capturing 802.11 wifi traffic, no
> packets cannot be dissected and it shows "Packet size limited during
> capture". It seems that BoundsErrors were throwed.
>
> Is there a way to make it work same as ethernet dissectors instead
> of throwing an exception?

The way it works with Ethernet dissectors is that, eventually, it will
throw an exception if the packet was bigger than XX bytes and
Wireshark tries to dissect all the bytes in the packet, so it *is*
working the same way as Ethernet dissectors.

However, 802.11 headers are a bit larger than Ethernet headers, and
802.11 headers plus radio headers can be significantly larger than
Ethernet headers, so the minimum value of XX necessary in order to get
a reasonable amount of dissection done is larger.

Try making XX bigger when capturing on 802.11 (or, if possible, try
turning off radio headers, if you don't care about the information in
them).
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe