4 tshark - Dump and analyze network traffic
9 S<[ B<-a> E<lt>capture autostop conditionE<gt> ] ...>
10 S<[ B<-b> E<lt>capture ring buffer optionE<gt>] ...>
11 S<[ B<-B> E<lt>capture buffer size (Win32 only)E<gt> ] >
12 S<[ B<-c> E<lt>capture packet countE<gt> ]>
13 S<[ B<-C> E<lt>configuration profileE<gt> ]>
14 S<[ B<-d> E<lt>layer typeE<gt>==E<lt>selectorE<gt>,E<lt>decode-as protocolE<gt> ]>
16 S<[ B<-e> E<lt>fieldE<gt> ]>
17 S<[ B<-E> E<lt>field print optionE<gt> ]>
18 S<[ B<-f> E<lt>capture filterE<gt> ]>
19 S<[ B<-F> E<lt>file formatE<gt> ]>
21 S<[ B<-i> E<lt>capture interfaceE<gt>|- ]>
22 S<[ B<-K> E<lt>keytabE<gt> ]>
26 S<[ B<-N> E<lt>name resolving flagsE<gt> ]>
27 S<[ B<-o> E<lt>preference settingE<gt> ] ...>
30 S<[ B<-r> E<lt>infileE<gt> ]>
31 S<[ B<-R> E<lt>read (display) filterE<gt> ]>
32 S<[ B<-s> E<lt>capture snaplenE<gt> ]>
34 S<[ B<-t> ad|a|r|d|e ]>
35 S<[ B<-T> pdml|psml|ps|text|fields ]>
38 S<[ B<-w> E<lt>outfileE<gt>|- ]>
40 S<[ B<-X> E<lt>eXtension optionE<gt>]>
41 S<[ B<-y> E<lt>capture link typeE<gt> ]>
42 S<[ B<-z> E<lt>statisticsE<gt> ]>
43 S<[ E<lt>capture filterE<gt> ]>
47 B<TShark> is a network protocol analyzer. It lets you capture packet
48 data from a live network, or read packets from a previously saved
49 capture file, either printing a decoded form of those packets to the
50 standard output or writing the packets to a file. B<TShark>'s native
51 capture file format is B<libpcap> format, which is also the format used
52 by B<tcpdump> and various other tools.
54 Without any options set, B<TShark> will work much like B<tcpdump>. It will
55 use the pcap library to capture traffic from the first available network
56 interface and displays a summary line on stdout for each received packet.
58 B<TShark> is able to detect, read and write the same capture files that
59 are supported by B<Wireshark>.
60 The input file doesn't need a specific filename extension; the file
61 format and an optional gzip compression will be automatically detected.
62 Near the beginning of the DESCRIPTION section of wireshark(1) or
63 L<http://www.wireshark.org/docs/man-pages/wireshark.html>
64 is a detailed description of the way B<Wireshark> handles this, which is
65 the same way B<Tshark> handles this.
67 Compressed file support uses (and therefore requires) the zlib library.
68 If the zlib library is not present, B<TShark> will compile, but will
69 be unable to read compressed files.
71 If the B<-w> option is not specified, B<TShark> writes to the standard
72 output the text of a decoded form of the packets it captures or reads.
73 If the B<-w> option is specified, B<TShark> writes to the file
74 specified by that option the raw data of the packets, along with the
77 When writing a decoded form of packets, B<TShark> writes, by
78 default, a summary line containing the fields specified by the
79 preferences file (which are also the fields displayed in the packet list
80 pane in B<Wireshark>), although if it's writing packets as it captures
81 them, rather than writting packets from a saved capture file, it won't
82 show the "frame number" field. If the B<-V> option is specified, it
83 writes instead a view of the details of the packet, showing all the
84 fields of all protocols in the packet.
86 If you want to write the decoded form of packets to a file, run
87 B<TShark> without the B<-w> option, and redirect its standard output to
88 the file (do I<not> use the B<-w> option).
90 When writing packets to a file, B<TShark>, by default, writes the
91 file in B<libpcap> format, and writes all of the packets it sees to the
92 output file. The B<-F> option can be used to specify the format in which
93 to write the file. This list of available file formats is displayed by
94 the B<-F> flag without a value. However, you can't specify a file format
97 Read filters in B<TShark>, which allow you to select which packets
98 are to be decoded or written to a file, are very powerful; more fields
99 are filterable in B<TShark> than in other protocol analyzers, and the
100 syntax you can use to create your filters is richer. As B<TShark>
101 progresses, expect more and more protocol fields to be allowed in read
104 Packet capturing is performed with the pcap library. The capture filter
105 syntax follows the rules of the pcap library. This syntax is different
106 from the read filter syntax. A read filter can also be specified when
107 capturing, and only packets that pass the read filter will be displayed
108 or saved to the output file; note, however, that capture filters are much
109 more efficient than read filters, and it may be more difficult for
110 B<TShark> to keep up with a busy network if a read filter is
111 specified for a live capture.
113 A capture or read filter can either be specified with the B<-f> or B<-R>
114 option, respectively, in which case the entire filter expression must be
115 specified as a single argument (which means that if it contains spaces,
116 it must be quoted), or can be specified with command-line arguments
117 after the option arguments, in which case all the arguments after the
118 filter arguments are treated as a filter expression. Capture filters
119 are supported only when doing a live capture; read filters are supported
120 when doing a live capture and when reading a capture file, but require
121 TShark to do more work when filtering, so you might be more likely to
122 lose packets under heavy load if you're using a read filter. If the
123 filter is specified with command-line arguments after the option
124 arguments, it's a capture filter if a capture is being done (i.e., if no
125 B<-r> option was specified) and a read filter if a capture file is being
126 read (i.e., if a B<-r> option was specified).
132 =item -a E<lt>capture autostop conditionE<gt>
134 Specify a criterion that specifies when B<TShark> is to stop writing
135 to a capture file. The criterion is of the form I<test>B<:>I<value>,
136 where I<test> is one of:
138 B<duration>:I<value> Stop writing to a capture file after I<value> seconds have elapsed.
140 B<filesize>:I<value> Stop writing to a capture file after it reaches a size of I<value>
141 kilobytes (where a kilobyte is 1024 bytes). If this option
142 is used together with the -b option, B<TShark> will stop writing to the
143 current capture file and switch to the next one if filesize is reached. When reading a capture file,
144 B<TShark> will stop reading the file after the number of bytes read exceeds this number
145 (the complete packet will be read, so more bytes than this number may be read).
147 B<files>:I<value> Stop writing to capture files after I<value> number of files were written.
149 =item -b E<lt>capture ring buffer optionE<gt>
151 Cause B<TShark> to run in "multiple files" mode. In "multiple files" mode,
152 B<TShark> will write to several capture files. When the first capture file
153 fills up, B<TShark> will switch writing to the next file and so on.
155 The created filenames are based on the filename given with the B<-w> option, the number of
156 the file and on the creation date and time,
157 e.g. outfile_00001_20050604120117.pcap, outfile_00001_20050604120523.pcap, ...
159 With the I<files> option it's also possible to form a "ring buffer".
160 This will fill up new files until the number of files specified,
161 at which point B<TShark> will discard the data in the first file and start
162 writing to that file and so on. If the I<files> option is not set,
163 new files filled up until one of the capture stop conditions match (or
164 until the disk if full).
166 The criterion is of the form I<key>B<:>I<value>,
167 where I<key> is one of:
169 B<duration>:I<value> switch to the next file after I<value> seconds have
170 elapsed, even if the current file is not completely filled up.
172 B<filesize>:I<value> switch to the next file after it reaches a size of
173 I<value> kilobytes (where a kilobyte is 1024 bytes).
175 B<files>:I<value> begin again with the first file after I<value> number of
176 files were written (form a ring buffer).
178 =item -B E<lt>capture buffer size (Win32 only)E<gt>
180 Win32 only: set capture buffer size (in MB, default is 1MB). This is used by the
181 the capture driver to buffer packet data until that data can be written to
182 disk. If you encounter packet drops while capturing, try to increase this size.
184 =item -c E<lt>capture packet countE<gt>
186 Set the maximum number of packets to read when capturing live
187 data. If reading a capture file, set the maximum number of packets to read.
189 =item -C E<lt>configuration profileE<gt>
191 Run with the given configuration profile.
193 =item -d E<lt>layer typeE<gt>==E<lt>selectorE<gt>,E<lt>decode-as protocolE<gt>
195 Like Wireshark's B<Decode As...> feature, this lets you specify how a
196 layer type should be dissected. If the layer type in question (for example,
197 B<tcp.port> or B<udp.port> for a TCP or UDP port number) has the specified
198 selector value, packets should be dissected as the specified protocol.
200 Example: B<-d tcp.port==8888,http> will decode any traffic running over
201 TCP port 8888 as HTTP.
203 Using an invalid selector or protocol will print out a list of valid selectors
204 and protocol names, respectively.
206 Example: B<-d .> is a quick way to get a list of valid selectors.
208 Example: B<-d ethertype==0x0800.> is a quick way to get a list of protocols that can be
209 selected with an ethertype.
213 Print a list of the interfaces on which B<TShark> can capture, and
214 exit. For each network interface, a number and an
215 interface name, possibly followed by a text description of the
216 interface, is printed. The interface name or the number can be supplied
217 to the B<-i> option to specify an interface on which to capture.
219 This can be useful on systems that don't have a command to list them
220 (e.g., Windows systems, or UNIX systems lacking B<ifconfig -a>);
221 the number can be useful on Windows 2000 and later systems, where the
222 interface name is a somewhat complex string.
224 Note that "can capture" means that B<TShark> was able to open that
225 device to do a live capture. Depending on your system you may need to
226 run tshark from an account with special privileges (for example, as
227 root) to be able to capture network traffic. If B<TShark -D> is not run
228 from such an account, it will not list any interfaces.
230 =item -e E<lt>fieldE<gt>
232 Add a field to the list of fields to display if B<-T fields> is
233 selected. This option can be used multiple times on the command line.
234 At least one field must be provided if the B<-T fields> option is
237 Example: B<-e frame.number -e ip.addr -e udp>
239 Giving a protocol rather than a single field will print multiple items
240 of data about the protocol as a single field. Fields are separated by
241 tab characters by default. B<-E> controls the format of the printed
244 =item -E E<lt>field print optionE<gt>
246 Set an option controlling the printing of fields when B<-T fields> is
251 B<header=y|n> If B<y>, print a list of the field names given using B<-e>
252 as the first line of the output; the field name will be separated using
253 the same character as the field values. Defaults to B<n>.
255 B<separator=/t|/s|>E<lt>characterE<gt> Set the separator character to
256 use for fields. If B</t> tab will be used (this is the default), if
257 B</s>, s single space will be used. Otherwise any character that can be
258 accepted by the command line as part of the option may be used.
260 B<quote=d|s|n> Set the quote character to use to surround fields. B<d>
261 uses double-quotes, B<s> single-quotes, B<n> no quotes (the default).
263 =item -f E<lt>capture filterE<gt>
265 Set the capture filter expression.
267 =item -F E<lt>file formatE<gt>
269 Set the file format of the output capture file written using the B<-w>
270 option. The output written with the B<-w> option is raw packet data, not
271 text, so there is no B<-F> option to request text output. The option B<-F>
272 without a value will list the available formats.
276 Print the version and options and exits.
278 =item -i E<lt>capture interfaceE<gt>|-
280 Set the name of the network interface or pipe to use for live packet
283 Network interface names should match one of the names listed in
284 "B<tshark -D>" (described above); a number, as reported by
285 "B<tshark -D>", can also be used. If you're using UNIX, "B<netstat
286 -i>" or "B<ifconfig -a>" might also work to list interface names,
287 although not all versions of UNIX support the B<-a> option to B<ifconfig>.
289 If no interface is specified, B<TShark> searches the list of
290 interfaces, choosing the first non-loopback interface if there are any
291 non-loopback interfaces, and choosing the first loopback interface if
292 there are no non-loopback interfaces. If there are no interfaces at all,
293 B<TShark> reports an error and doesn't start the capture.
295 Pipe names should be either the name of a FIFO (named pipe) or ``-'' to
296 read data from the standard input. Data read from pipes must be in
297 standard libpcap format.
299 Note: the Win32 version of B<TShark> doesn't support capturing from
302 =item -K E<lt>keytabE<gt>
304 Load kerberos crypto keys from the specified keytab file.
305 This option can be used multiple times to load keys from several files.
307 Example: B<-K krb5.keytab>
311 Flush the standard output after the information for each packet is
312 printed. (This is not, strictly speaking, line-buffered if B<-V>
313 was specified; however, it is the same as line-buffered if B<-V> wasn't
314 specified, as only one line is printed for each packet, and, as B<-l> is
315 normally used when piping a live capture to a program or script, so that
316 output for a packet shows up as soon as the packet is seen and
317 dissected, it should work just as well as true line-buffering. We do
318 this as a workaround for a deficiency in the Microsoft Visual C++ C
321 This may be useful when piping the output of B<TShark> to another
322 program, as it means that the program to which the output is piped will
323 see the dissected data for a packet as soon as B<TShark> sees the
324 packet and generates that output, rather than seeing it only when the
325 standard output buffer containing that data fills up.
329 List the data link types supported by the interface and exit. The reported
330 link types can be used for the B<-y> option.
334 Disable network object name resolution (such as hostname, TCP and UDP port
335 names), the B<-N> flag might override this one.
337 =item -N E<lt>name resolving flagsE<gt>
339 Turn on name resolving only for particular types of addresses and port
340 numbers, with name resolving for other types of addresses and port
341 numbers turned off. This flag overrides B<-n> if both B<-N> and B<-n> are
342 present. If both B<-N> and B<-n> flags are not present, all name resolutions are
345 The argument is a string that may contain the letters:
347 B<m> to enable MAC address resolution
349 B<n> to enable network address resolution
351 B<t> to enable transport-layer port number resolution
353 B<C> to enable concurrent (asynchronous) DNS lookups
355 =item -o E<lt>preferenceE<gt>:E<lt>valueE<gt>
357 Set a preference value, overriding the default value and any value read
358 from a preference file. The argument to the option is a string of the
359 form I<prefname>B<:>I<value>, where I<prefname> is the name of the
360 preference (which is the same name that would appear in the preference
361 file), and I<value> is the value to which it should be set.
365 I<Don't> put the interface into promiscuous mode. Note that the
366 interface might be in promiscuous mode for some other reason; hence,
367 B<-p> cannot be used to ensure that the only traffic that is captured is
368 traffic sent to or from the machine on which B<TShark> is running,
369 broadcast traffic, and multicast traffic to addresses received by that
374 When capturing packets, don't display the continuous count of packets
375 captured that is normally shown when saving a capture to a file;
376 instead, just display, at the end of the capture, a count of packets
377 captured. On systems that support the SIGINFO signal, such as various
378 BSDs, you can cause the current count to be displayed by typing your
379 "status" character (typically control-T, although it
380 might be set to "disabled" by default on at least some BSDs, so you'd
381 have to explicitly set it to use it).
383 When reading a capture file, or when capturing and not saving to a file,
384 don't print packet information; this is useful if you're using a B<-z>
385 option to calculate statistics and don't want the packet information
386 printed, just the statistics.
388 =item -r E<lt>infileE<gt>
390 Read packet data from I<infile>, can be any supported capture file format
391 (including gzipped files). It's B<not> possible to use named pipes
394 =item -R E<lt>read (display) filterE<gt>
396 Cause the specified filter (which uses the syntax of read/display filters,
397 rather than that of capture filters) to be applied before printing a
398 decoded form of packets or writing packets to a file; packets not
399 matching the filter are discarded rather than being printed or written.
401 =item -s E<lt>capture snaplenE<gt>
403 Set the default snapshot length to use when capturing live data.
404 No more than I<snaplen> bytes of each network packet will be read into
405 memory, or saved to disk.
409 Decode and display packets even while writing raw packet data using the
414 Set the format of the packet timestamp printed in summary lines, the default
415 is relative. The format can be one of:
417 B<ad> absolute with date: The absolute date and time is the actual time and
418 date the packet was captured
420 B<a> absolute: The absolute time is the actual time the packet was captured,
421 with no date displayed
423 B<r> relative: The relative time is the time elapsed between the first packet
424 and the current packet
426 B<d> delta: The delta time is the time since the previous packet was
429 B<e> epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00)
431 =item -T pdml|psml|ps|text|fields
433 Set the format of the output when viewing decoded packet data. The
436 B<pdml> Packet Details Markup Language, an XML-based format for the details of
437 a decoded packet. This information is equivalent to the packet details
438 printed with the B<-V> flag.
440 B<psml> Packet Summary Markup Language, an XML-based format for the summary
441 information of a decoded packet. This information is equivalent to the
442 information shown in the one-line summary printed by default.
444 B<ps> PostScript for a human-readable one-line summary of each of the packets,
445 or a multi-line view of the details of each of the packets, depending on
446 whether the B<-V> flag was specified.
448 B<text> Text of a human-readable one-line summary of each of the packets, or a
449 multi-line view of the details of each of the packets, depending on
450 whether the B<-V> flag was specified. This is the default.
452 B<fields> The values of fields specified with the B<-e> option, in a
453 form specified by the B<-E> option.
457 Print the version and exit.
461 Cause B<TShark> to print a view of the packet details rather
462 than a one-line summary of the packet.
464 =item -w E<lt>outfileE<gt>|-
466 Write raw packet data to I<outfile> or to the standard output if
469 NOTE: -w provides raw packet data, not text. If you want text output
470 you need to redirect stdout (e.g. using '>'), don't use the B<-w>
475 Cause B<TShark> to print a hex and ASCII dump of the packet data
476 after printing the summary or details.
479 =item -X E<lt>eXtension optionsE<gt>
481 Specify an option to be passed to a B<TShark> module. The eXtension option
482 is in the form I<extension_key>B<:>I<value>, where I<extension_key> can be:
484 B<lua_script>:I<lua_script_filename> tells B<Wireshark> to load the given script in addition to the
488 =item -y E<lt>capture link typeE<gt>
490 Set the data link type to use while capturing packets. The values
491 reported by B<-L> are the values that can be used.
493 =item -z E<lt>statisticsE<gt>
495 Get B<TShark> to collect various types of statistics and display the result
496 after finishing reading the capture file. Use the B<-q> flag if you're
497 reading a capture file and only want the statistics printed, not any
498 per-packet information.
500 Note that the B<-z proto> option is different - it doesn't cause
501 statistics to be gathered and printed when the capture is complete, it
502 modifies the regular packet summary output to include the values of
503 fields specified with the option. Therefore you must not use the B<-q>
504 option, as that option would suppress the printing of the regular packet
505 summary output, and must also not use the B<-V> option, as that would
506 cause packet detail information rather than packet summary information
509 Currently implemented statistics are:
511 B<-z> dcerpc,rtt,I<uuid>,I<major>.I<minor>[,I<filter>]
513 Collect call/reply RTT data for DCERPC interface I<uuid>,
514 version I<major>.I<minor>.
515 Data collected is number of calls for each procedure, MinRTT, MaxRTT
517 Example: use B<-z dcerpc,rtt,12345778-1234-abcd-ef00-0123456789ac,1.0> to collect data for CIFS SAMR Interface.
518 This option can be used multiple times on the command line.
520 If the optional filterstring is provided, the stats will only be calculated
521 on those calls that match that filter.
522 Example: use B<-z dcerpc,rtt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4> to collect SAMR
523 RTT statistics for a specific host.
526 B<-z> io,phs[,I<filter>]
528 Create Protocol Hierarchy Statistics listing both number of packets and bytes.
529 If no I<filter> is specified the statistics will be calculated for all packets.
530 If a I<filters> is specified statistics will be only calculated for those
531 packets that match the filter.
533 This option can be used multiple times on the command line.
536 B<-z> io,stat,I<interval>[,I<filter>][,I<filter>][,I<filter>]...
538 Collect packet/bytes statistics for the capture in intervals of
539 I<interval> seconds. I<Intervals> can be specified either as whole or
540 fractional seconds. Interval can be specified in ms resolution.
542 If no I<filter> is specified the statistics will be calculated for all packets.
543 If one or more I<filters> are specified statistics will be calculated for
544 all filters and presented with one column of statistics for each filter.
546 This option can be used multiple times on the command line.
549 Example: B<-z io,stat,1,ip.addr==1.2.3.4> to generate 1 second
550 statistics for all traffic to/from host 1.2.3.4.
552 Example: B<-z "io,stat,0.001,smb&&ip.addr==1.2.3.4"> to generate 1ms
553 statistics for all SMB packets to/from host 1.2.3.4.
555 The examples above all use the standard syntax for generating statistics
556 which only calculates the number of packets and bytes in each interval.
558 B<io,stat> can also do much more statistics and calculate COUNT(), SUM(),
559 MIN(), MAX(), and AVG() using a slightly different filter syntax:
561 [COUNT|SUM|MIN|MAX|AVG](<field>)<filter>
563 One important thing to note here is that the field that the calculation is
564 based on MUST also be part of the filter string or else the calculation will
567 So: B<-z io,stat,0.010,AVG(smb.time)> does not work. Use B<-z
568 io,stat,0.010,AVG(smb.time)smb.time> instead. Also be aware that a field
569 can exist multiple times inside the same packet and will then be counted
570 multiple times in those packets.
573 COUNT(<field>) can be used on any type which has a display filter name.
574 It will count how many times this particular field is encountered in the
575 filtered packet list.
577 Example: B<-z io,stat,0.010,COUNT(smb.sid)smb.sid>
578 This will count the total number of SIDs seen in each 10ms interval.
580 SUM(<field>) can only be used on named fields of integer type.
581 This will sum together every occurence of this fields value for each interval.
583 Example: B<-z io,stat,0.010,SUM(frame.pkt_len)frame.pkt_len>
584 This will report the total number of bytes seen in all the packets within
587 MIN/MAX/AVG(<field>) can only be used on named fields that are either
588 integers or relative time fields. This will calculate maximum/minimum
589 or average seen in each interval. If the field is a relative time field
590 the output will be presented in seconds and three digits after the
591 decimal point. The resolution for time calculations is 1ms and anything
592 smaller will be truncated.
594 Example: B<-z "io,stat,0.010,smb.time&&ip.addr==1.1.1.1,MIN(smb.time)smb.time&&ip.addr==1.1.1.1,MAX(smb.time)smb.time&&ip.addr==1.1.1.1,MAX(smb.time)smb.time&&ip.addr==1.1.1.1">
596 This will calculate statistics for all smb response times we see to/from
597 host 1.1.1.1 in 10ms intervals. The output will be displayed in 4
598 columns; number of packets/bytes, minimum response time, maximum response
599 time and average response time.
603 B<-z> conv,I<type>[,I<filter>]
605 Create a table that lists all conversations that could be seen in the capture.
606 I<type> specifies which type of conversation we want to generate the
607 statistics for; currently the supported ones are
614 "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported
616 "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported
618 If the optional filter string is specified, only those packets that match the
619 filter will be used in the calculations.
621 The table is presented with one line for each conversation and displays
622 number of packets/bytes in each direction as well as total number of
624 The table is sorted according to total number of bytes.
627 B<-z> proto,colinfo,I<filter>,I<field>
629 Append all I<field> values for the packet to the Info column of the
630 one-line summary output.
631 This feature can be used to append arbitrary fields to the Info column
632 in addition to the normal content of that column.
633 I<field> is the display-filter name of a field which value should be placed
635 I<filter> is a filter string that controls for which packets the field value
636 will be presented in the info column. I<field> will only be presented in the
637 Info column for the packets which match I<filter>.
639 NOTE: In order for B<TShark> to be able to extract the I<field> value
640 from the packet, I<field> MUST be part of the I<filter> string. If not,
641 B<TShark> will not be able to extract its value.
643 For a simple example to add the "nfs.fh.hash" field to the Info column
644 for all packets containing the "nfs.fh.hash" field, use
646 B<-z proto,colinfo,nfs.fh.hash,nfs.fh.hash>
649 To put "nfs.fh.hash" in the Info column but only for packets coming from
652 B<-z "proto,colinfo,nfs.fh.hash && ip.src==1.2.3.4,nfs.fh.hash">
654 This option can be used multiple times on the command line.
657 B<-z> rpc,rtt,I<program>,I<version>[,I<filter>]
659 Collect call/reply RTT data for I<program>/I<version>. Data collected
660 is number of calls for each procedure, MinRTT, MaxRTT and AvgRTT.
661 Example: use B<-z rpc,rtt,100003,3> to collect data for NFS v3. This
662 option can be used multiple times on the command line.
664 If the optional filterstring is provided, the stats will only be calculated
665 on those calls that match that filter.
666 Example: use B<-z rpc,rtt,100003,3,nfs.fh.hash==0x12345678> to collect NFS v3
667 RTT statistics for a specific file.
672 Collect call/reply RTT data for all known ONC-RPC programs/versions.
673 Data collected is number of calls for each protocol/version, MinRTT,
675 This option can only be used once on the command line.
679 Collect statistics for all RTP streams and calculate max. delta, max. and
680 mean jitter and packet loss percentages.
683 B<-z> smb,rtt[,I<filter>]
685 Collect call/reply RTT data for SMB. Data collected
686 is number of calls for each SMB command, MinRTT, MaxRTT and AvgRTT.
687 Example: use B<-z smb,rtt>.
688 The data will be presented as separate tables for all normal SMB commands,
689 all Transaction2 commands and all NT Transaction commands.
690 Only those commands that are seen in the capture will have its stats
692 Only the first command in a xAndX command chain will be used in the
693 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
694 only the SessionSetupAndX call will be used in the statistics.
695 This is a flaw that might be fixed in the future.
697 This option can be used multiple times on the command line.
699 If the optional filterstring is provided, the stats will only be calculated
700 on those calls that match that filter.
701 Example: use B<-z "smb,rtt,ip.addr==1.2.3.4"> to only collect stats for
702 SMB packets echanged by the host at IP address 1.2.3.4 .
706 When this feature is used B<TShark> will print a report with all the
707 discovered SID and account name mappings. Only those SIDs where the
708 account name is known will be presented in the table.
710 For this feature to work you will need to either to enable
711 "Edit/Preferences/Protocols/SMB/Snoop SID to name mappings" in the
712 preferences or you can override the preferences by specifying
713 B<-o "smb.sid_name_snooping:TRUE"> on the B<TShark> command line.
715 The current methods used by B<TShark> to find the SID->name mapping
716 is relatively restricted but is hoped to be expanded in the future.
718 B<-z> mgcp,rtd[I<,filter>]
720 Collect requests/response RTD (Response Time Delay) data for MGCP.
721 This is similar to B<-z smb,rtt>). Data collected is number of calls
722 for each known MGCP Type, MinRTD, MaxRTD and AvgRTD.
723 Additionally you get the number of duplicate requests/responses,
724 unresponded requests, responses ,which don't match with
726 Example: use B<-z mgcp,rtd>.
728 This option can be used multiple times on the command line.
730 If the optional filterstring is provided, the stats will only be calculated
731 on those calls that match that filter.
732 Example: use B<-z "mgcp,rtd,ip.addr==1.2.3.4"> to only collect stats for
733 MGCP packets exchanged by the host at IP address 1.2.3.4 .
735 B<-z> megaco,rtd[I<,filter>]
737 Collect requests/response RTD (Response Time Delay) data for MEGACO.
738 This is similar to B<-z smb,rtt>). Data collected is number of calls
739 for each known MEGACO Type, MinRTD, MaxRTD and AvgRTD.
740 Additionally you get the number of duplicate requests/responses,
741 unresponded requests, responses ,which don't match with
743 Example: use B<-z megaco,rtd>.
745 This option can be used multiple times on the command line.
747 If the optional filterstring is provided, the stats will only be calculated
748 on those calls that match that filter.
749 Example: use B<-z "megaco,rtd,ip.addr==1.2.3.4"> to only collect stats for
750 MEGACO packets exchanged by the host at IP address 1.2.3.4 .
752 B<-z> h225,counter[I<,filter>]
754 Count ITU-T H.225 messages and their reasons. In the first column you get a
755 list of H.225 messages and H.225 message reasons, which occur in the current
756 capture file. The number of occurences of each message or reason is displayed
757 in the second column.
759 Example: use B<-z h225,counter>.
761 This option can be used multiple times on the command line.
763 If the optional filterstring is provided, the stats will only be calculated
764 on those calls that match that filter.
765 Example: use B<-z "h225,counter,ip.addr==1.2.3.4"> to only collect stats for
766 H.225 packets exchanged by the host at IP address 1.2.3.4 .
768 B<-z> h225,srt[I<,filter>]
770 Collect requests/response SRT (Service Response Time) data for ITU-T H.225 RAS.
771 Data collected is number of calls of each ITU-T H.225 RAS Message Type,
772 Minimum SRT, Maximum SRT, Average SRT, Minimum in Frame, and Maximum in Frame.
773 You will also get the number of Open Requests (Unresponded Requests),
774 Discarded Responses (Responses without matching request) and Duplicate Messages.
775 Example: use B<-z h225,srt>.
777 This option can be used multiple times on the command line.
779 If the optional filterstring is provided, the stats will only be calculated
780 on those calls that match that filter.
781 Example: use B<-z "h225,srt,ip.addr==1.2.3.4"> to only collect stats for
782 ITU-T H.225 RAS packets exchanged by the host at IP address 1.2.3.4 .
784 B<-z> sip,stat[I<,filter>]
786 This option will activate a counter for SIP messages. You will get the number
787 of occurences of each SIP Method and of each SIP Status-Code. Additionally you
788 also get the number of resent SIP Messages (only for SIP over UDP).
790 Example: use B<-z sip,stat>.
792 This option can be used multiple times on the command line.
794 If the optional filter string is provided, the stats will only be calculated
795 on those calls that match that filter.
796 Example: use B<-z "sip,stat,ip.addr==1.2.3.4"> to only collect stats for
797 SIP packets exchanged by the host at IP address 1.2.3.4 .
801 =head1 CAPTURE FILTER SYNTAX
803 See the manual page of pcap-filter(4) or, if that doesn't exist, tcpdump(8).
805 =head1 READ FILTER SYNTAX
807 For a complete table of protocol and protocol fields that are filterable
808 in B<TShark> see the wireshark-filter(4) manual page.
812 These files contains various B<Wireshark> configuration values.
818 The F<preferences> files contain global (system-wide) and personal
819 preference settings. If the system-wide preference file exists, it is
820 read first, overriding the default settings. If the personal preferences
821 file exists, it is read next, overriding any previous values. Note: If
822 the command line option B<-o> is used (possibly more than once), it will
823 in turn override values from the preferences files.
825 The preferences settings are in the form I<prefname>B<:>I<value>,
827 where I<prefname> is the name of the preference
828 and I<value> is the value to
829 which it should be set; white space is allowed between B<:> and
830 I<value>. A preference setting can be continued on subsequent lines by
831 indenting the continuation lines with white space. A B<#> character
832 starts a comment that runs to the end of the line:
834 # Capture in promiscuous mode?
835 # TRUE or FALSE (case-insensitive).
836 capture.prom_mode: TRUE
838 The global preferences file is looked for in the F<wireshark> directory
839 under the F<share> subdirectory of the main installation directory (for
840 example, F</usr/local/share/wireshark/preferences>) on UNIX-compatible
841 systems, and in the main installation directory (for example,
842 F<C:\Program Files\Wireshark\preferences>) on Windows systems.
844 The personal preferences file is looked for in
845 F<$HOME/.wireshark/preferences> on
846 UNIX-compatible systems and F<%APPDATA%\Wireshark\preferences> (or, if
847 %APPDATA% isn't defined, F<%USERPROFILE%\Application
848 Data\Wireshark\preferences>) on Windows systems.
850 =item Disabled (Enabled) Protocols
852 The F<disabled_protos> files contain system-wide and personal lists of
853 protocols that have been disabled, so that their dissectors are never
854 called. The files contain protocol names, one per line, where the
855 protocol name is the same name that would be used in a display filter
861 The global F<disabled_protos> file uses the same directory as the global
864 The personal F<disabled_protos> file uses the same directory as the
865 personal preferences file.
867 =item Name Resolution (hosts)
869 If the personal F<hosts> file exists, it is
870 used to resolve IPv4 and IPv6 addresses before any other
871 attempts are made to resolve them. The file has the standard F<hosts>
872 file syntax; each line contains one IP address and name, separated by
873 whitespace. The same directory as for the personal preferences file is
876 =item Name Resolution (ethers)
878 The F<ethers> files are consulted to correlate 6-byte hardware addresses to
879 names. First the personal F<ethers> file is tried and if an address is not
880 found there the global F<ethers> file is tried next.
882 Each line contains one hardware address and name, separated by
883 whitespace. The digits of the hardware address are separated by colons
884 (:), dashes (-) or periods (.). The same separator character must be
885 used consistently in an address. The following three lines are valid
886 lines of an F<ethers> file:
888 ff:ff:ff:ff:ff:ff Broadcast
889 c0-00-ff-ff-ff-ff TR_broadcast
890 00.00.00.00.00.00 Zero_broadcast
892 The global F<ethers> file is looked for in the F</etc> directory on
893 UNIX-compatible systems, and in the main installation directory (for
894 example, F<C:\Program Files\Wireshark>) on Windows systems.
896 The personal F<ethers> file is looked for in the same directory as the personal
899 =item Name Resolution (manuf)
901 The F<manuf> file is used to match the 3-byte vendor portion of a 6-byte
902 hardware address with the manufacturer's name; it can also contain well-known
903 MAC addresses and address ranges specified with a netmask. The format of the
904 file is the same as the F<ethers> files, except that entries of the form:
908 can be provided, with the 3-byte OUI and the name for a vendor, and
911 00-00-0C-07-AC/40 All-HSRP-routers
913 can be specified, with a MAC address and a mask indicating how many bits
914 of the address must match. The above entry, for example, has 40
915 significant bits, or 5 bytes, and would match addresses from
916 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
919 The F<manuf> file is looked for in the same directory as the global
922 =item Name Resolution (ipxnets)
924 The F<ipxnets> files are used to correlate 4-byte IPX network numbers to
925 names. First the global F<ipxnets> file is tried and if that address is not
926 found there the personal one is tried next.
928 The format is the same as the F<ethers>
929 file, except that each address is four bytes instead of six.
930 Additionally, the address can be represented as a single hexadecimal
931 number, as is more common in the IPX world, rather than four hex octets.
932 For example, these four lines are valid lines of an F<ipxnets> file:
936 00:00:BE:EF IT_Server1
939 The global F<ipxnets> file is looked for in the F</etc> directory on
940 UNIX-compatible systems, and in the main installation directory (for
941 example, F<C:\Program Files\Wireshark>) on Windows systems.
943 The personal F<ipxnets> file is looked for in the same directory as the
944 personal preferences file.
950 wireshark-filter(4), wireshark(1), editcap(1), pcap-filter(4), tcpdump(8),
951 pcap(3), dumpcap(1), text2pcap(1)
955 B<TShark> is part of the B<Wireshark> distribution. The latest version
956 of B<Wireshark> can be found at L<http://www.wireshark.org>.
958 HTML versions of the Wireshark project man pages are available at:
959 L<http://www.wireshark.org/docs/man-pages>.
963 B<TShark> uses the same packet dissection code that B<Wireshark> does,
964 as well as using many other modules from B<Wireshark>; see the list of
965 authors in the B<Wireshark> man page for a list of authors of that code.