HTTP header truncated

[Alexander Koeppe]

Hello list,

I have a HTTP request having a very big Authorization Header field.
If I click on the field, the complete data is being selected in the
bytes view. But in the detail view (where I clicked on) the word
[truncated] is prepended.

Question: Can I increase that "limit" over the GUI or ony withing the
source code?
I already had a look but didn't found the position where this truncation
is being performed.

I want to increase that setting on my local workingcopy. This will help
me with arguing with a vendor prooving that's "his" issue.

If I'd tell the whole story I could write a book.

So would be great if you guys could give me a short hint.


Cheers Alex

___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Chris Maynard]

Post by Alexander Koeppe
If I click on the field, the complete data is being selected in the
bytes view. But in the detail view (where I clicked on) the word
[truncated] is prepended.
Question: Can I increase that "limit" over the GUI or ony withing the
source code?
I already had a look but didn't found the position where this truncation
is being performed.
So would be great if you guys could give me a short hint.

The limitation is imposed by ITEM_LABEL_LENGTH, currently defined in
epan/proto.h as 240.


___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Sake Blok]

Post by Chris Maynard

Post by Alexander Koeppe
If I click on the field, the complete data is being selected in the
bytes view. But in the detail view (where I clicked on) the word
[truncated] is prepended.
Question: Can I increase that "limit" over the GUI or ony withing the
source code?
I already had a look but didn't found the position where this truncation
is being performed.
So would be great if you guys could give me a short hint.

The limitation is imposed by ITEM_LABEL_LENGTH, currently defined in
epan/proto.h as 240.
___________________________________________________________________________
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Sake Blok]

Post by Chris Maynard

Post by Alexander Koeppe
If I click on the field, the complete data is being selected in the
bytes view. But in the detail view (where I clicked on) the word
[truncated] is prepended.
Question: Can I increase that "limit" over the GUI or ony withing the
source code?
I already had a look but didn't found the position where this truncation
is being performed.
So would be great if you guys could give me a short hint.

The limitation is imposed by ITEM_LABEL_LENGTH, currently defined in
epan/proto.h as 240.

(and now without premature sending)

A workaround without having to recompile Wireshark might be one of these options:

- Use follow TCP stream to get the full Authentication header
- Use rightclick -> copy -> value and then paste in a separate text file

Cheers,


Sake
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Alexander Koeppe]

Post by Sake Blok

Post by Chris Maynard

Post by Alexander Koeppe
If I click on the field, the complete data is being selected in the
bytes view. But in the detail view (where I clicked on) the word
[truncated] is prepended.
Question: Can I increase that "limit" over the GUI or ony withing the
source code?
I already had a look but didn't found the position where this truncation
is being performed.
So would be great if you guys could give me a short hint.

The limitation is imposed by ITEM_LABEL_LENGTH, currently defined in
epan/proto.h as 240.

(and now without premature sending)
- Use follow TCP stream to get the full Authentication header
- Use rightclick -> copy -> value and then paste in a separate text file
Cheers,
Sake
___________________________________________________________________________
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

Thanks Sake,

But you maybe also know vendor's support people.
If they see a "truncated" they even don't believe anything.
If they see nothing, they believe everything.

I'll go the recompile way and increase the value of ITEM_LABEL_LENGTH
(thanks to Chris). it's not so costy for me.

Cheers Alex

___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Sake Blok]

Post by Alexander Koeppe
But you maybe also know vendor's support people.
If they see a "truncated" they even don't believe anything.
If they see nothing, they believe everything.
I'll go the recompile way and increase the value of ITEM_LABEL_LENGTH
(thanks to Chris). it's not so costy for me.

If you need to recompile Wireshark to get the Vendor to believe the data in the trace file, I think it's about way over time to call their escalation manager :-)

Good luck!


Sake
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Alexander Koeppe]

Post by Sake Blok

Post by Alexander Koeppe
But you maybe also know vendor's support people.
If they see a "truncated" they even don't believe anything.
If they see nothing, they believe everything.
I'll go the recompile way and increase the value of ITEM_LABEL_LENGTH
(thanks to Chris). it's not so costy for me.

If you need to recompile Wireshark to get the Vendor to believe the data in the trace file, I think it's about way over time to call their escalation manager :-)
Good luck!
Sake
___________________________________________________________________________
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

Well that's exactly what we're struggeling with.
We already reached the highest level of escalation. At least they tell
us so. The vendor is famous for never ever sending a specialist to any
customer.

Cheers Alex

___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Anders Broman]

Post by Alexander Koeppe

Post by Sake Blok

Post by Alexander Koeppe
But you maybe also know vendor's support people.
If they see a "truncated" they even don't believe anything.
If they see nothing, they believe everything.
I'll go the recompile way and increase the value of ITEM_LABEL_LENGTH
(thanks to Chris). it's not so costy for me.

If you need to recompile Wireshark to get the Vendor to believe the data in the trace file, I think it's about way over time to call their escalation manager :-)
Good luck!
Sake
___________________________________________________________________________
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

Well that's exactly what we're struggeling with.
We already reached the highest level of escalation. At least they tell
us so. The vendor is famous for never ever sending a specialist to any
customer.
Cheers Alex

First time I saw it - [Truncated] i found it a bit ambiguous perhaps it
should say
[Display Truncated] even if that's a bit longish.
Regards
Anders

Post by Alexander Koeppe
___________________________________________________________________________
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Sake Blok]

First time I saw it - [Truncated] i found it a bit ambiguous perhaps it should say
[Display Truncated] even if that's a bit longish.

Or we should put the [truncated] at the end instead of the beginning? Than it is also not to bad to make it longer, so we could even make it [truncated to 240 bytes].

Sake

___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Anders Broman]

Post by Sake Blok

First time I saw it - [Truncated] i found it a bit ambiguous perhaps it should say
[Display Truncated] even if that's a bit longish.

Or we should put the [truncated] at the end instead of the beginning? Than it is also not to bad to make it longer, so we could even make it [truncated to 240 bytes].
Sake

I think the important thing is the distinction that the thing truncated
is the display of the line

[Display truncated to 240 bytes]
or
[Display limited to 240 bytes]
Regards
Anders

Post by Sake Blok
___________________________________________________________________________
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe

[Alexander Koeppe]

Post by Sake Blok

First time I saw it - [Truncated] i found it a bit ambiguous perhaps it should say
[Display Truncated] even if that's a bit longish.

Or we should put the [truncated] at the end instead of the beginning? Than it is also not to bad to make it longer, so we could even make it [truncated to 240 bytes].
Sake
___________________________________________________________________________
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev

I think the way this is being done is quite good. For most cases I don't
see the necessity to change this. I just wanted to clearly know about
the meaning in a quite special and particular case.

Recompiling with 0xFFFF helped to fully display the authorization header
token.

Greetings

___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev-IZ8446WsY0/***@public.gmane.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request-IZ8446WsY0/***@public.gmane.org?subject=unsubscribe