Incomplete data acquisition

[ZhengPeng-CSU]

I'm using pyshark to parse SOME/IP packets from a pcap, with use_json set to True. Because SOME/IP packets are subpacketized, I'm using the combined data, which likely corresponds to the "reassemble data" method used in Wireshark. However, when the combined packet is particularly large, I don't get the complete data. Instead, it displays "...," seemingly omitting the data. How can I resolve this issue? I need the complete data.

[meeas]

I'm not a developer here, but that sounds like a Wireshark library issue. You get the same when you show large data fields in a column.

You should be able to get the byte offset in the packet for that field, then extract it from the raw hex dump of the packet. It is definitely a sub-optimal method, but might be the only way.