I am using tshark to dump bittorrent.piece.data and appear to have hit some internal limit within tshark.
tshark -r 2-live.pcap -R "bittorrent.piece.data and ip.dst_host == 192.168.3.14" -T fields bittorrent.piece.data > dumped
This should dump the piece data (32Kbyte pieces) as colon separated bytes in hex without leading 0x so for example: 7f:00:ab:cd.... and so on for 32Kbytes.
One piece is written to the stdout per line which I am simply redirecting to a file, but the piece data is truncated somehow to a line length of 65540, where I am expecting 90-100KBytes per line/piece, given the 3 characters-per-byte required by the output format chosen by tshark (7f: == 1 byte)
Running with strace I can see that tshark is writing 4096 bytes and then 61444 for each piece.
I don't know if this is a hard-wired limitation of tshark with regard to outputing fields of a protocol read from a pcap file, or whether my Linux configuration is limiting this at a lower-level. I strongly expect it is the former but would welcome advice.
Do I need to patch wireshark/tshark code or is there command-line or configuration option I am missing?
Note: I can successfully dump 32768 KBytes payload data from the GUI wireshark tool so the data is definitely in the pcap file. But I am keen to automate this process and need tshark to give me all the bytes...