4 wireshark - Interactively dump and analyze network traffic
9 S<[ B<-a> E<lt>capture autostop conditionE<gt> ] ...>
10 S<[ B<-b> E<lt>capture ring buffer optionE<gt> ] ...>
11 S<[ B<-B> E<lt>capture buffer size (Win32 only)E<gt> ] >
12 S<[ B<-c> E<lt>capture packet countE<gt> ]>
13 S<[ B<-C> E<lt>configuration profileE<gt> ]>
15 S<[ B<--display=>E<lt>X display to useE<gt> ] >
16 S<[ B<-f> E<lt>capture filterE<gt> ]>
17 S<[ B<-g> E<lt>packet numberE<gt> ]>
20 S<[ B<-i> E<lt>capture interfaceE<gt>|- ]>
22 S<[ B<-J> E<lt>jump filterE<gt> ]>
25 S<[ B<-K> E<lt>keytabE<gt> ]>
28 S<[ B<-m> E<lt>fontE<gt> ]>
30 S<[ B<-N> E<lt>name resolving flagsE<gt> ] >
31 S<[ B<-o> E<lt>preference/recent settingE<gt> ] ...>
33 S<[ B<-P> E<lt>path settingE<gt>]>
35 S<[ B<-r> E<lt>infileE<gt> ]>
36 S<[ B<-R> E<lt>read (display) filterE<gt> ]>
38 S<[ B<-s> E<lt>capture snaplenE<gt> ]>
39 S<[ B<-t> ad|a|r|d|dd|e ]>
41 S<[ B<-w> E<lt>outfileE<gt> ]>
42 S<[ B<-y> E<lt>capture link typeE<gt> ]>
43 S<[ B<-X> E<lt>eXtension optionE<gt> ]>
44 S<[ B<-z> E<lt>statisticsE<gt> ]>
45 S<[ E<lt>infileE<gt> ]>
49 B<Wireshark> is a GUI network protocol analyzer. It lets you
50 interactively browse packet data from a live network or from a
51 previously saved capture file. B<Wireshark>'s native capture file format
52 is B<libpcap> format, which is also the format used by B<tcpdump> and
55 B<Wireshark> can read / import the following file formats:
60 libpcap, tcpdump and various other tools using tcpdump's capture format
63 B<snoop> and B<atmsnoop>
66 Shomiti/Finisar B<Surveyor> captures
69 Novell B<LANalyzer> captures
72 Microsoft B<Network Monitor> captures
75 AIX's B<iptrace> captures
78 Cinco Networks B<NetXRay> captures
81 Network Associates Windows-based B<Sniffer> captures
84 Network General/Network Associates DOS-based B<Sniffer> (compressed or uncompressed) captures
87 AG Group/WildPackets B<EtherPeek>/B<TokenPeek>/B<AiroPeek>/B<EtherHelp>/B<PacketGrabber> captures
90 B<RADCOM>'s WAN/LAN analyzer captures
93 Network Instruments B<Observer> version 9 captures
96 B<Lucent/Ascend> router debug output
99 files from HP-UX's B<nettl>
102 B<Toshiba's> ISDN routers dump output
105 the output from B<i4btrace> from the ISDN4BSD project
108 traces from the B<EyeSDN> USB S0.
111 the output in B<IPLog> format from the Cisco Secure Intrusion Detection System
114 B<pppd logs> (pppdump format)
117 the output from VMS's B<TCPIPtrace>/B<TCPtrace>/B<UCX$TRACE> utilities
120 the text output from the B<DBS Etherwatch> VMS utility
123 Visual Networks' B<Visual UpTime> traffic capture
126 the output from B<CoSine> L2 debug
129 the output from Accellent's B<5Views> LAN agents
132 Endace Measurement Systems' ERF format captures
135 Linux Bluez Bluetooth stack B<hcidump -w> traces
138 Catapult DCT2000 .out files
141 TamoSoft CommView files
144 Apple PacketLogger files
148 There is no need to tell B<Wireshark> what type of
149 file you are reading; it will determine the file type by itself.
150 B<Wireshark> is also capable of reading any of these file formats if they
151 are compressed using gzip. B<Wireshark> recognizes this directly from
152 the file; the '.gz' extension is not required for this purpose.
154 Like other protocol analyzers, B<Wireshark>'s main window shows 3 views
155 of a packet. It shows a summary line, briefly describing what the
156 packet is. A packet details display is shown, allowing you to drill
157 down to exact protocol or field that you interested in. Finally, a hex
158 dump shows you exactly what the packet looks like when it goes over the
161 In addition, B<Wireshark> has some features that make it unique. It can
162 assemble all the packets in a TCP conversation and show you the ASCII
163 (or EBCDIC, or hex) data in that conversation. Display filters in
164 B<Wireshark> are very powerful; more fields are filterable in B<Wireshark>
165 than in other protocol analyzers, and the syntax you can use to create
166 your filters is richer. As B<Wireshark> progresses, expect more and more
167 protocol fields to be allowed in display filters.
169 Packet capturing is performed with the pcap library. The capture filter
170 syntax follows the rules of the pcap library. This syntax is different
171 from the display filter syntax.
173 Compressed file support uses (and therefore requires) the zlib library.
174 If the zlib library is not present, B<Wireshark> will compile, but will
175 be unable to read compressed files.
177 The pathname of a capture file to be read can be specified with the
178 B<-r> option or can be specified as a command-line argument.
182 Most users will want to start B<Wireshark> without options and configure
183 it from the menus instead. Those users may just skip this section.
187 =item -a E<lt>capture autostop conditionE<gt>
189 Specify a criterion that specifies when B<Wireshark> is to stop writing
190 to a capture file. The criterion is of the form I<test>B<:>I<value>,
191 where I<test> is one of:
193 B<duration>:I<value> Stop writing to a capture file after I<value> seconds have
196 B<filesize>:I<value> Stop writing to a capture file after it reaches a size of
197 I<value> kilobytes (where a kilobyte is 1024 bytes). If this option is used
198 together with the -b option, Wireshark will stop writing to the current
199 capture file and switch to the next one if filesize is reached.
201 B<files>:I<value> Stop writing to capture files after I<value> number of files
204 =item -b E<lt>capture ring buffer optionE<gt>
206 Cause B<Wireshark> to run in "multiple files" mode. In "multiple files" mode,
207 B<Wireshark> will write to several capture files. When the first capture file
208 fills up, B<Wireshark> will switch writing to the next file and so on.
210 The created filenames are based on the filename given with the B<-w> flag,
211 the number of the file and on the creation date and time,
212 e.g. outfile_00001_20050604120117.pcap, outfile_00002_20050604120523.pcap, ...
214 With the I<files> option it's also possible to form a "ring buffer".
215 This will fill up new files until the number of files specified,
216 at which point B<Wireshark> will discard the data in the first file and start
217 writing to that file and so on. If the I<files> option is not set,
218 new files filled up until one of the capture stop conditions match (or
219 until the disk is full).
221 The criterion is of the form I<key>B<:>I<value>,
222 where I<key> is one of:
224 B<duration>:I<value> switch to the next file after I<value> seconds have
225 elapsed, even if the current file is not completely filled up.
227 B<filesize>:I<value> switch to the next file after it reaches a size of
228 I<value> kilobytes (where a kilobyte is 1024 bytes).
230 B<files>:I<value> begin again with the first file after I<value> number of
231 files were written (form a ring buffer). This value must be less than 100000.
232 Caution should be used when using large numbers of files: some filesystems do
233 not handle many files in a single directory well. The B<files> criterion
234 requires either B<duration> or B<filesize> to be specified to control when to
235 go to the next file. It should be noted that each B<-b> parameter takes exactly
236 one criterion; to specify two criterion, each must be preceded by the B<-b>
239 Example: B<-b filesize:1024 -b files:5> results in a ring buffer of five files
240 of size one megabyte.
242 =item -B E<lt>capture buffer sizeE<gt>
244 Set capture buffer size (in MB, default is 1MB). This is used by the
245 the capture driver to buffer packet data until that data can be written
246 to disk. If you encounter packet drops while capturing, try to increase
247 this size. Note that, while B<Tshark> attempts to set the buffer size
248 to 1MB by default, and can be told to set it to a larger value, the
249 system or interface on which you're capturing might silently limit the
250 capture buffer size to a lower value or raise it to a higher value.
252 This is available on UNIX systems with libpcap 1.0.0 or later and on
253 Windows. It is not available on UNIX systems with earlier versions of
256 This option can occur multiple times. If used before the first
257 occurrence of the B<-i> option, it sets the default capture buffer size.
258 If used after an B<-i> option, it sets the capture buffer size for
259 the interface specified by the last B<-i> option occurring before
260 this option. If the capture buffer size is not set specifically,
261 the default capture buffer size is used if provided.
263 =item -c E<lt>capture packet countE<gt>
265 Set the maximum number of packets to read when capturing live
268 =item -C E<lt>configuration profileE<gt>
270 Start with the given configuration profile.
274 Print a list of the interfaces on which B<Wireshark> can capture, and
275 exit. For each network interface, a number and an
276 interface name, possibly followed by a text description of the
277 interface, is printed. The interface name or the number can be supplied
278 to the B<-i> flag to specify an interface on which to capture.
280 This can be useful on systems that don't have a command to list them
281 (e.g., Windows systems, or UNIX systems lacking B<ifconfig -a>);
282 the number can be useful on Windows 2000 and later systems, where the
283 interface name is a somewhat complex string.
285 Note that "can capture" means that B<Wireshark> was able to open
286 that device to do a live capture; if, on your system, a program doing a
287 network capture must be run from an account with special privileges (for
288 example, as root), then, if B<Wireshark> is run with the B<-D> flag and
289 is not run from such an account, it will not list any interfaces.
291 =item --display=E<lt>X display to useE<gt>
293 Specifies the X display to use. A hostname and screen (otherhost:0.0)
294 or just a screen (:0.0) can be specified. This option is not available
297 =item -f E<lt>capture filterE<gt>
299 Set the capture filter expression.
301 This option can occur multiple times. If used before the first
302 occurrence of the B<-i> option, it sets the default capture filter expression.
303 If used after an B<-i> option, it sets the capture filter expression for
304 the interface specified by the last B<-i> option occurring before
305 this option. If the capture filter expression is not set specifically,
306 the default capture filter expression is used if provided.
308 =item -g E<lt>packet numberE<gt>
310 After reading in a capture file using the B<-r> flag, go to the given I<packet number>.
314 Print the version and options and exit.
318 Hide the capture info dialog during live packet capture.
320 =item -i E<lt>capture interfaceE<gt>|-
322 Set the name of the network interface or pipe to use for live packet
325 Network interface names should match one of the names listed in
326 "B<wireshark -D>" (described above); a number, as reported by
327 "B<wireshark -D>", can also be used. If you're using UNIX, "B<netstat
328 -i>" or "B<ifconfig -a>" might also work to list interface names,
329 although not all versions of UNIX support the B<-a> flag to B<ifconfig>.
331 If no interface is specified, B<Wireshark> searches the list of
332 interfaces, choosing the first non-loopback interface if there are any
333 non-loopback interfaces, and choosing the first loopback interface if
334 there are no non-loopback interfaces. If there are no interfaces at all,
335 B<Wireshark> reports an error and doesn't start the capture.
337 Pipe names should be either the name of a FIFO (named pipe) or ``-'' to
338 read data from the standard input. On Windows systems, pipe names must be
339 of the form ``\\pipe\.\B<pipename>''. Data read from pipes must be in
340 standard libpcap format.
342 This option can occur multiple times. When capturing from multiple
343 interfaces, the capture file will be saved in pcap-ng format.
347 Put the interface in "monitor mode"; this is supported only on IEEE
348 802.11 Wi-Fi interfaces, and supported only on some operating systems.
350 Note that in monitor mode the adapter might disassociate from the
351 network with which it's associated, so that you will not be able to use
352 any wireless networks with that adapter. This could prevent accessing
353 files on a network server, or resolving host names or network addresses,
354 if you are capturing in monitor mode and are not connected to another
355 network with another adapter.
357 This option can occur multiple times. If used before the first
358 occurrence of the B<-i> option, it enables the monitor mode for all interfaces.
359 If used after an B<-i> option, it enables the monitor mode for
360 the interface specified by the last B<-i> option occurring before
363 =item -J E<lt>jump filterE<gt>
365 After reading in a capture file using the B<-r> flag, jump to the packet
366 matching the filter (display filter syntax). If no exact match is found
367 the first packet after that is selected.
371 Use after B<-J> to change the behavior when no exact match is found for
372 the filter. With this option select the first packet before.
376 Start the capture session immediately. If the B<-i> flag was
377 specified, the capture uses the specified interface. Otherwise,
378 B<Wireshark> searches the list of interfaces, choosing the first
379 non-loopback interface if there are any non-loopback interfaces, and
380 choosing the first loopback interface if there are no non-loopback
381 interfaces; if there are no interfaces, B<Wireshark> reports an error and
382 doesn't start the capture.
384 =item -K E<lt>keytabE<gt>
386 Load kerberos crypto keys from the specified keytab file.
387 This option can be used multiple times to load keys from several files.
389 Example: B<-K krb5.keytab>
393 Turn on automatic scrolling if the packet display is being updated
394 automatically as packets arrive during a capture (as specified by the
399 List the data link types supported by the interface and exit.
401 =item -m E<lt>fontE<gt>
403 Set the name of the font used by B<Wireshark> for most text. B<Wireshark>
404 will construct the name of the bold font used for the data in the byte
405 view pane that corresponds to the field selected in the packet details
406 pane from the name of the main text font.
410 Disable network object name resolution (such as hostname, TCP and UDP port
411 names), the B<-N> flag might override this one.
413 =item -N E<lt>name resolving flagsE<gt>
415 Turn on name resolving only for particular types of addresses and port
416 numbers, with name resolving for other types of addresses and port
417 numbers turned off. This flag overrides B<-n> if both B<-N> and B<-n> are
418 present. If both B<-N> and B<-n> flags are not present, all name resolutions are
421 The argument is a string that may contain the letters:
423 B<m> to enable MAC address resolution
425 B<n> to enable network address resolution
427 B<t> to enable transport-layer port number resolution
429 B<C> to enable concurrent (asynchronous) DNS lookups
431 =item -o E<lt>preference/recent settingE<gt>
433 Set a preference or recent value, overriding the default value and any value
434 read from a preference/recent file. The argument to the flag is a string of
435 the form I<prefname>B<:>I<value>, where I<prefname> is the name of the
436 preference/recent value (which is the same name that would appear in the
437 preference/recent file), and I<value> is the value to which it should be set.
438 Since B<Ethereal> 0.10.12, the recent settings replaces the formerly used
439 -B, -P and -T flags to manipulate the GUI dimensions.
441 If I<prefname> is "uat", you can override settings in various user access
442 tables using the form uatB<:>I<uat filename>:I<uat record>. I<uat filename>
443 must be the name of a UAT file, e.g. I<user_dlts>. I<uat_record> must be in
444 the form of a valid record for that file, including quotes. For instance, to
445 specify a user DLT from the command line, you would use
449 -o "uat:user_dlts:\"User 0 (DLT=147)\",\"cops\",\"0\",\"\",\"0\",\"\""
455 I<Don't> put the interface into promiscuous mode. Note that the
456 interface might be in promiscuous mode for some other reason; hence,
457 B<-p> cannot be used to ensure that the only traffic that is captured is
458 traffic sent to or from the machine on which B<Wireshark> is running,
459 broadcast traffic, and multicast traffic to addresses received by that
462 This option can occur multiple times. If used before the first
463 occurrence of the B<-i> option, no interface will be put into the
465 If used after an B<-i> option, the interface specified by the last B<-i>
466 option occurring before this option will not be put into the
469 =item -P E<lt>path settingE<gt>
471 Special path settings usually detected automatically. This is used for
472 special cases, e.g. starting Wireshark from a known location on an USB stick.
474 The criterion is of the form I<key>B<:>I<path>, where I<key> is one of:
476 B<persconf>:I<path> path of personal configuration files, like the
479 B<persdata>:I<path> path of personal data files, it's the folder initially
480 opened. After the very first initialization, the recent file will keep the
485 Cause B<Wireshark> to exit after the end of capture session (useful in
486 batch mode with B<-c> option for instance); this option requires the
487 B<-i> and B<-w> parameters.
489 =item -r E<lt>infileE<gt>
491 Read packet data from I<infile>, can be any supported capture file format
492 (including gzipped files). It's not possible to use named pipes or stdin
495 =item -R E<lt>read (display) filterE<gt>
497 When reading a capture file specified with the B<-r> flag, causes the
498 specified filter (which uses the syntax of display filters, rather than
499 that of capture filters) to be applied to all packets read from the
500 capture file; packets not matching the filter are discarded.
504 Automatically update the packet display as packets are coming in.
506 =item -s E<lt>capture snaplenE<gt>
508 Set the default snapshot length to use when capturing live data.
509 No more than I<snaplen> bytes of each network packet will be read into
510 memory, or saved to disk. A value of 0 specifies a snapshot length of
511 65535, so that the full packet is captured; this is the default.
513 This option can occur multiple times. If used before the first
514 occurrence of the B<-i> option, it sets the default snapshot length.
515 If used after an B<-i> option, it sets the snapshot length for
516 the interface specified by the last B<-i> option occurring before
517 this option. If the snapshot length is not set specifically,
518 the default snapshot length is used if provided.
520 =item -t ad|a|r|d|dd|e
522 Set the format of the packet timestamp displayed in the packet list
523 window. The format can be one of:
525 B<ad> absolute with date: The absolute date and time is the actual time and
526 date the packet was captured
528 B<a> absolute: The absolute time is the actual time the packet was captured,
529 with no date displayed
531 B<r> relative: The relative time is the time elapsed between the first packet
532 and the current packet
534 B<d> delta: The delta time is the time since the previous packet was
537 B<dd> delta_displayed: The delta_displayed time is the time since the
538 previous displayed packet was captured
540 B<e> epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00)
542 The default format is relative.
546 Print the version and exit.
548 =item -w E<lt>outfileE<gt>
550 Set the default capture file name.
552 =item -y E<lt>capture link typeE<gt>
554 If a capture is started from the command line with B<-k>, set the data
555 link type to use while capturing packets. The values reported by B<-L>
556 are the values that can be used.
558 This option can occur multiple times. If used before the first
559 occurrence of the B<-i> option, it sets the default capture link type.
560 If used after an B<-i> option, it sets the capture link type for
561 the interface specified by the last B<-i> option occurring before
562 this option. If the capture link type is not set specifically,
563 the default capture link type is used if provided.
565 =item -X E<lt>eXtension optionsE<gt>
567 Specify an option to be passed to an B<Wireshark> module. The eXtension option
568 is in the form I<extension_key>B<:>I<value>, where I<extension_key> can be:
570 B<lua_script>:I<lua_script_filename> tells B<Wireshark> to load the given script in addition to the
573 B<stdin_descr>:I<description> tells B<Wireshark> to use the given description when
574 capturing from standard input (B<-i ->).
576 =item -z E<lt>statisticsE<gt>
578 Get B<Wireshark> to collect various types of statistics and display the result
579 in a window that updates in semi-real time.
581 Currently implemented statistics are:
585 =item B<-z> dcerpc,srt,I<uuid>,I<major>.I<minor>[,I<filter>]
587 Collect call/reply SRT (Service Response Time) data for DCERPC interface I<uuid>,
588 version I<major>.I<minor>.
589 Data collected is the number of calls for each procedure, MinSRT, MaxSRT
592 Example: S<B<-z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0>> will collect data for the CIFS SAMR Interface.
594 This option can be used multiple times on the command line.
596 If the optional I<filter> is provided, the stats will only be calculated
597 on those calls that match that filter.
599 Example: S<B<-z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4>> will collect SAMR
600 SRT statistics for a specific host.
604 Collect packet/bytes statistics for the capture in intervals of 1 second.
605 This option will open a window with up to 5 color-coded graphs where
606 number-of-packets-per-second or number-of-bytes-per-second statistics
607 can be calculated and displayed.
609 This option can be used multiple times on the command line.
611 This graph window can also be opened from the Analyze:Statistics:Traffic:IO-Stat
614 =item B<-z> rpc,srt,I<program>,I<version>[,<filter>]
616 Collect call/reply SRT (Service Response Time) data for I<program>/I<version>. Data collected
617 is the number of calls for each procedure, MinSRT, MaxSRT and AvgSRT.
619 Example: B<-z rpc,srt,100003,3> will collect data for NFS v3.
621 This option can be used multiple times on the command line.
623 If the optional I<filter> is provided, the stats will only be calculated
624 on those calls that match that filter.
626 Example: S<B<-z rpc,srt,100003,3,nfs.fh.hash==0x12345678>> will collect NFS v3
627 SRT statistics for a specific file.
629 =item B<-z> rpc,programs
631 Collect call/reply SRT data for all known ONC-RPC programs/versions.
632 Data collected is the number of calls for each protocol/version, MinSRT,
635 =item B<-z> scsi,srt,I<cmdset>[,<filter>]
637 Collect call/reply SRT (Service Response Time) data for SCSI commandset <cmdset>.
639 Commandsets are 0:SBC 1:SSC 5:MMC
642 is the number of calls for each procedure, MinSRT, MaxSRT and AvgSRT.
644 Example: B<-z scsi,srt,0> will collect data for SCSI BLOCK COMMANDS (SBC).
646 This option can be used multiple times on the command line.
648 If the optional I<filter> is provided, the stats will only be calculated
649 on those calls that match that filter.
651 Example: B<-z scsi,srt,0,ip.addr==1.2.3.4> will collect SCSI SBC
652 SRT statistics for a specific iscsi/ifcp/fcip host.
654 =item B<-z> smb,srt[,I<filter>]
656 Collect call/reply SRT (Service Response Time) data for SMB. Data collected
657 is the number of calls for each SMB command, MinSRT, MaxSRT and AvgSRT.
659 Example: B<-z smb,srt>
661 The data will be presented as separate tables for all normal SMB commands,
662 all Transaction2 commands and all NT Transaction commands.
663 Only those commands that are seen in the capture will have their stats
665 Only the first command in a xAndX command chain will be used in the
666 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
667 only the SessionSetupAndX call will be used in the statistics.
668 This is a flaw that might be fixed in the future.
670 This option can be used multiple times on the command line.
672 If the optional I<filter> is provided, the stats will only be calculated
673 on those calls that match that filter.
675 Example: B<-z "smb,srt,ip.addr==1.2.3.4"> will collect stats only for
676 SMB packets exchanged by the host at IP address 1.2.3.4 .
678 =item B<-z> fc,srt[,I<filter>]
680 Collect call/reply SRT (Service Response Time) data for FC. Data collected
681 is the number of calls for each Fibre Channel command, MinSRT, MaxSRT and AvgSRT.
683 Example: B<-z fc,srt>
684 will calculate the Service Response Time as the time delta between the
685 First packet of the exchange and the Last packet of the exchange.
687 The data will be presented as separate tables for all normal FC commands,
688 Only those commands that are seen in the capture will have its stats
691 This option can be used multiple times on the command line.
693 If the optional I<filter> is provided, the stats will only be calculated
694 on those calls that match that filter.
696 Example: B<-z "fc,srt,fc.id==01.02.03"> will collect stats only for
697 FC packets exchanged by the host at FC address 01.02.03 .
699 =item B<-z> ldap,srt[,I<filter>]
701 Collect call/reply SRT (Service Response Time) data for LDAP. Data collected
702 is the number of calls for each implemented LDAP command, MinSRT, MaxSRT and AvgSRT.
704 Example: B<-z ldap,srt>
705 will calculate the Service Response Time as the time delta between the
706 Request and the Response.
708 The data will be presented as separate tables for all implemented LDAP commands,
709 Only those commands that are seen in the capture will have its stats
712 This option can be used multiple times on the command line.
714 If the optional I<filter> is provided, the stats will only be calculated
715 on those calls that match that filter.
717 Example: use B<-z "ldap,srt,ip.addr==10.1.1.1"> will collect stats only for
718 LDAP packets exchanged by the host at IP address 10.1.1.1 .
720 The only LDAP commands that are currently implemented and for which the stats will be available are:
730 =item B<-z> mgcp,srt[I<,filter>]
732 Collect request/response SRT (Service Response Time) data for MGCP.
733 (This is similar to B<-z smb,srt>). Data collected is the number of calls
734 for each known MGCP Type, Minimum SRT, Maximum SRT and Average SRT.
736 Example: B<-z mgcp,srt>
738 This option can be used multiple times on the command line.
740 If the optional I<filter> is provided, the stats will only be calculated
741 on those calls that match that filter.
743 Example: B<-z "mgcp,srt,ip.addr==1.2.3.4"> will collect stats only for
744 MGCP packets exchanged by the host at IP address 1.2.3.4 .
746 =item B<-z> megaco,srt[I<,filter>]
748 Collect request/response SRT (Service Response Time) data for MEGACO.
749 (This is similar to B<-z smb,srt>). Data collected is the number of calls
750 for each known MEGACO Command, Minimum SRT, Maximum SRT and Average SRT.
752 Example: B<-z megaco,srt>
754 This option can be used multiple times on the command line.
756 If the optional I<filter> is provided, the stats will only be calculated
757 on those calls that match that filter.
759 Example: B<-z "megaco,srt,ip.addr==1.2.3.4"> will collect stats only for
760 MEGACO packets exchanged by the host at IP address 1.2.3.4 .
762 =item B<-z> conv,I<type>[,I<filter>]
764 Create a table that lists all conversations that could be seen in the
765 capture. I<type> specifies the conversation endpoint types for which we
766 want to generate the statistics; currently the supported ones are:
768 "eth" Ethernet addresses
769 "fc" Fibre Channel addresses
770 "fddi" FDDI addresses
772 "ipv6" IPv6 addresses
774 "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported
775 "tr" Token Ring addresses
776 "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported
778 If the optional I<filter> is specified, only those packets that match the
779 filter will be used in the calculations.
781 The table is presented with one line for each conversation and displays
782 the number of packets/bytes in each direction as well as the total
783 number of packets/bytes. By default, the table is sorted according to
784 the total number of packets.
786 These tables can also be generated at runtime by selecting the appropriate
787 conversation type from the menu "Tools/Statistics/Conversation List/".
789 =item B<-z> h225,counter[I<,filter>]
791 Count ITU-T H.225 messages and their reasons. In the first column you get a
792 list of H.225 messages and H.225 message reasons which occur in the current
793 capture file. The number of occurrences of each message or reason is displayed
794 in the second column.
796 Example: B<-z h225,counter>
798 This option can be used multiple times on the command line.
800 If the optional I<filter> is provided, the stats will only be calculated
801 on those calls that match that filter.
803 Example: B<-z "h225,counter,ip.addr==1.2.3.4"> will collect stats only for
804 H.225 packets exchanged by the host at IP address 1.2.3.4 .
806 =item B<-z> h225,srt[I<,filter>]
808 Collect request/response SRT (Service Response Time) data for ITU-T H.225 RAS.
809 Data collected is the number of calls of each ITU-T H.225 RAS Message Type,
810 Minimum SRT, Maximum SRT, Average SRT, Minimum in Packet, and Maximum in Packet.
811 You will also get the number of Open Requests (Unresponded Requests),
812 Discarded Responses (Responses without matching request) and Duplicate Messages.
814 Example: B<-z h225,srt>
816 This option can be used multiple times on the command line.
818 If the optional I<filter> is provided, the stats will only be calculated
819 on those calls that match that filter.
821 Example: B<-z "h225,srt,ip.addr==1.2.3.4"> will collect stats only for
822 ITU-T H.225 RAS packets exchanged by the host at IP address 1.2.3.4 .
824 =item B<-z> sip,stat[I<,filter>]
826 This option will activate a counter for SIP messages. You will get the number
827 of occurrences of each SIP Method and of each SIP Status-Code. Additionally you
828 also get the number of resent SIP Messages (only for SIP over UDP).
830 Example: B<-z sip,stat>
832 This option can be used multiple times on the command line.
834 If the optional I<filter> is provided, the stats will only be calculated
835 on those calls that match that filter.
837 Example: B<-z "sip,stat,ip.addr==1.2.3.4"> will collect stats only for
838 SIP packets exchanged by the host at IP address 1.2.3.4 .
840 =item B<-z> voip,calls
842 This option will show a window that shows VoIP calls found in the capture file.
843 This is the same window shown as when you go to the Statistics Menu and choose
846 Example: B<-z voip,calls>
860 =item File:Open Recent
864 Merge another capture file to the currently loaded one. The I<File:Merge>
865 dialog box allows the merge "Prepended", "Chronologically" or "Appended",
866 relative to the already loaded one.
870 Open or close a capture file. The I<File:Open> dialog box
871 allows a filter to be specified; when the capture file is read, the
872 filter is applied to all packets read from the file, and packets not
873 matching the filter are discarded. The I<File:Open Recent> is a submenu
874 and will show a list of previously opened files.
880 Save the current capture, or the packets currently displayed from that
881 capture, to a file. Check boxes let you select whether to save all
882 packets, or just those that have passed the current display filter and/or
883 those that are currently marked, and an option menu lets you select (from
884 a list of file formats in which at particular capture, or the packets
885 currently displayed from that capture, can be saved), a file format in
888 =item File:File Set:List Files
890 Show a dialog box that lists all files of the file set matching the currently
891 loaded file. A file set is a compound of files resulting from a capture using
892 the "multiple files" / "ringbuffer" mode, recognizable by the filename pattern,
893 e.g.: Filename_00001_20050604101530.pcap.
895 =item File:File Set:Next File
897 =item File:File Set:Previous File
899 If the currently loaded file is part of a file set (see above), open the
900 next / previous file in that set.
904 Export captured data into an external format. Note: the data cannot be
905 imported back into Wireshark, so be sure to keep the capture file.
909 Print packet data from the current capture. You can select the range of
910 packets to be printed (which packets are printed), and the output format of
911 each packet (how each packet is printed). The output format will be similar
912 to the displayed values, so a summary line, the packet details view, and/or
913 the hex dump of the packet can be printed.
915 Printing options can be set with the I<Edit:Preferences> menu item, or in the
916 dialog box popped up by this menu item.
920 Exit the application.
922 =item Edit:Copy:Description
924 Copies the description of the selected field in the protocol tree to
927 =item Edit:Copy:Fieldname
929 Copies the fieldname of the selected field in the protocol tree to
932 =item Edit:Copy:Value
934 Copies the value of the selected field in the protocol tree to
937 =item Edit:Copy:As Filter
939 Create a display filter based on the data currently highlighted in the
940 packet details and copy that filter to the clipboard.
942 If that data is a field that can be tested in a display filter
943 expression, the display filter will test that field; otherwise, the
944 display filter will be based on the absolute offset within the packet.
945 Therefore it could be unreliable if the packet contains protocols with
946 variable-length headers, such as a source-routed token-ring packet.
948 =item Edit:Find Packet
950 Search forward or backward, starting with the currently selected packet
951 (or the most recently selected packet, if no packet is selected). Search
952 criteria can be a display filter expression, a string of hexadecimal
953 digits, or a text string.
955 When searching for a text string, you can search the packet data, or you
956 can search the text in the Info column in the packet list pane or in the
959 Hexadecimal digits can be separated by colons, periods, or dashes.
960 Text string searches can be ASCII or Unicode (or both), and may be
965 =item Edit:Find Previous
967 Search forward / backward for a packet matching the filter from the previous
968 search, starting with the currently selected packet (or the most recently
969 selected packet, if no packet is selected).
971 =item Edit:Mark Packet (toggle)
973 Mark (or unmark if currently marked) the selected packet. The field
974 "frame.marked" is set for packets that are marked, so that, for example,
975 a display filters can be used to display only marked packets, and so that
976 the L<Edit:Find Packet|/item_edit_3afind_packet> dialog can be used to find the next or previous
979 =item Edit:Find Next Mark
981 =item Edit:Find Previous Mark
983 Find next/previous marked packet.
985 =item Edit:Mark All Packets
987 =item Edit:Unmark All Packets
989 Mark / Unmark all packets that are currently displayed.
991 =item Edit:Time Reference:Set Time Reference (toggle)
993 Set (or unset if currently set) the selected packet as a Time Reference packet.
994 When a packet is set as a Time Reference packet, the timestamps in the packet
995 list pane will be replaced with the string "*REF*".
996 The relative time timestamp in later packets will then be calculated relative
997 to the timestamp of this Time Reference packet and not the first packet in
1000 Packets that have been selected as Time Reference packets will always be
1001 displayed in the packet list pane. Display filters will not affect or
1004 If there is a column displayed for "Cumulative Bytes" this counter will
1005 be reset at every Time Reference packet.
1007 =item Edit:Time Reference:Find Next
1009 =item Edit:Time Reference:Find Previous
1011 Search forward / backward for a time referenced packet.
1013 =item Edit:Configuration Profiles
1015 Manage configuration profiles to be able to use more than one set of
1016 preferences and configurations.
1018 =item Edit:Preferences
1020 Set the GUI, capture, printing and protocol options
1021 (see L<Preferences|/item_preferences> dialog below).
1023 =item View:Main Toolbar
1025 =item View:Filter Toolbar
1027 =item View:Statusbar
1029 Show or hide the main window controls.
1031 =item View:Packet List
1033 =item View:Packet Details
1035 =item View:Packet Bytes
1037 Show or hide the main window panes.
1039 =item View:Time Display Format
1041 Set the format of the packet timestamp displayed in the packet list window.
1043 =item View:Name Resolution:Resolve Name
1045 Try to resolve a name for the currently selected item.
1047 =item View:Name Resolution:Enable for ... Layer
1049 Enable or disable translation of addresses to names in the display.
1051 =item View:Colorize Packet List
1053 Enable or disable the coloring rules. Disabling will improve performance.
1055 =item View:Auto Scroll in Live Capture
1057 Enable or disable the automatic scrolling of the
1058 packet list while a live capture is in progress.
1064 Zoom into / out of the main window data (by changing the font size).
1066 =item View:Normal Size
1068 Reset the zoom factor of zoom in / zoom out back to normal font size.
1070 =item View:Resize All Columns
1072 Resize all columns to best fit the current packet display.
1074 =item View:Expand Subtrees
1076 Expands the currently selected item and it's subtrees in the packet details.
1078 =item View:Expand All
1080 =item View:Collapse All
1082 Expand / Collapse all branches of the packet details.
1084 =item View:Colorize Conversation
1086 Select color for a conversation.
1088 =item View:Reset Coloring 1-10
1090 Reset Color for a conversation.
1092 =item View:Coloring Rules
1094 Change the foreground and background colors of the packet information in
1095 the list of packets, based upon display filters. The list of display
1096 filters is applied to each packet sequentially. After the first display
1097 filter matches a packet, any additional display filters in the list are
1098 ignored. Therefore, if you are filtering on the existence of protocols,
1099 you should list the higher-level protocols first, and the lower-level
1104 =item How Colorization Works
1106 Packets are colored according to a list of color filters. Each filter
1107 consists of a name, a filter expression and a coloration. A packet is
1108 colored according to the first filter that it matches. Color filter
1109 expressions use exactly the same syntax as display filter expressions.
1111 When Wireshark starts, the color filters are loaded from:
1115 1. The user's personal color filters file or, if that does not exist,
1117 2. The global color filters file.
1121 If neither of these exist then the packets will not be colored.
1125 =item View:Show Packet In New Window
1127 Create a new window containing a packet details view and a hex dump
1128 window of the currently selected packet; this window will continue to
1129 display that packet's details and data even if another packet is
1134 Reload a capture file. Same as I<File:Close> and I<File:Open> the same
1139 Go back in previously visited packets history.
1143 Go forward in previously visited packets history.
1145 =item Go:Go To Packet
1147 Go to a particular numbered packet.
1149 =item Go:Go To Corresponding Packet
1151 If a field in the packet details pane containing a packet number is
1152 selected, go to the packet number specified by that field. (This works
1153 only if the dissector that put that entry into the packet details put it
1154 into the details as a filterable field rather than just as text.) This
1155 can be used, for example, to go to the packet for the request
1156 corresponding to a reply, or the reply corresponding to a request, if
1157 that packet number has been put into the packet details.
1159 =item Go:Previous Packet
1161 =item Go:Next Packet
1163 =item Go:First Packet
1165 =item Go:Last Packet
1167 Go to the previous / next / first / last packet in the capture.
1169 =item Go:Previous Packet In Conversation
1171 =item Go:Next Packet In Conversation
1173 Go to the previous / next packet of the converation (TCP, UDP or IP)
1175 =item Capture:Interfaces
1177 Shows a dialog box with all currently known interfaces and displaying the
1178 current network traffic amount. Capture sessions can be started from here.
1179 Beware: keeping this box open results in high system load!
1181 =item Capture:Options
1183 Initiate a live packet capture (see L<Capture Options|/item_capture_options>
1184 dialog below). If no filename is specified, a temporary file will be created
1185 to hold the capture. The location of the file can be chosen by setting your
1186 TMPDIR environment variable before starting B<Wireshark>. Otherwise, the
1187 default TMPDIR location is system-dependent, but is likely either F</var/tmp>
1192 Start a live packet capture with the previously selected options. This won't
1193 open the options dialog box, and can be convenient for repeatedly capturing
1194 with the same options.
1198 Stop a running live capture.
1200 =item Capture:Restart
1202 While a live capture is running, stop it and restart with the same options
1203 again. This can be convenient to remove irrelevant packets, if no valuable
1204 packets were captured so far.
1206 =item Capture:Capture Filters
1208 Edit the saved list of capture filters, allowing filters to be added,
1209 changed, or deleted.
1211 =item Analyze:Display Filters
1213 Edit the saved list of display filters, allowing filters to be added,
1214 changed, or deleted.
1216 =item Analyze:Display Filter Macros
1218 Create shortcuts for complex macros
1220 =item Analyze:Apply as Filter
1222 Create a display filter based on the data currently highlighted in the
1223 packet details and apply the filter.
1225 If that data is a field that can be tested in a display filter
1226 expression, the display filter will test that field; otherwise, the
1227 display filter will be based on the absolute offset within the packet.
1228 Therefore it could be unreliable if the packet contains protocols with
1229 variable-length headers, such as a source-routed token-ring packet.
1231 The B<Selected> option creates a display filter that tests for a match
1232 of the data; the B<Not Selected> option creates a display filter that
1233 tests for a non-match of the data. The B<And Selected>, B<Or Selected>,
1234 B<And Not Selected>, and B<Or Not Selected> options add to the end of
1235 the display filter in the strip at the top (or bottom) an AND or OR
1236 operator followed by the new display filter expression.
1238 =item Analyze:Prepare a Filter
1240 Create a display filter based on the data currently highlighted in the
1241 packet details. The filter strip at the top (or bottom) is updated but
1242 it is not yet applied.
1244 =item Analyze:Enabled Protocols
1246 Allow protocol dissection to be enabled or disabled for a specific
1247 protocol. Individual protocols can be enabled or disabled by clicking
1248 on them in the list or by highlighting them and pressing the space bar.
1249 The entire list can be enabled, disabled, or inverted using the buttons
1252 When a protocol is disabled, dissection in a particular packet stops
1253 when that protocol is reached, and Wireshark moves on to the next packet.
1254 Any higher-layer protocols that would otherwise have been processed will
1255 not be displayed. For example, disabling TCP will prevent the dissection
1256 and display of TCP, HTTP, SMTP, Telnet, and any other protocol exclusively
1259 The list of protocols can be saved, so that Wireshark will start up with
1260 the protocols in that list disabled.
1262 =item Analyze:Decode As
1264 If you have a packet selected, present a dialog allowing you to change
1265 which dissectors are used to decode this packet. The dialog has one
1266 panel each for the link layer, network layer and transport layer
1267 protocol/port numbers, and will allow each of these to be changed
1268 independently. For example, if the selected packet is a TCP packet to
1269 port 12345, using this dialog you can instruct Wireshark to decode all
1270 packets to or from that TCP port as HTTP packets.
1272 =item Analyze:User Specified Decodes
1274 Create a new window showing whether any protocol ID to dissector
1275 mappings have been changed by the user. This window also allows the
1276 user to reset all decodes to their default values.
1278 =item Analyze:Follow TCP Stream
1280 If you have a TCP packet selected, display the contents of the data
1281 stream for the TCP connection to which that packet belongs, as text, in
1282 a separate window, and leave the list of packets in a filtered state,
1283 with only those packets that are part of that TCP connection being
1284 displayed. You can revert to your old view by pressing ENTER in the
1285 display filter text box, thereby invoking your old display filter (or
1286 resetting it back to no display filter).
1288 The window in which the data stream is displayed lets you select:
1294 whether to display the entire conversation, or one or the other side of
1299 whether the data being displayed is to be treated as ASCII or EBCDIC
1300 text or as raw hex data;
1304 and lets you print what's currently being displayed, using the same
1305 print options that are used for the I<File:Print Packet> menu item, or
1306 save it as text to a file.
1308 =item Analyze:Follow UDP Stream
1310 =item Analyze:Follow SSL Stream
1312 (Similar to Analyze:Follow TCP Stream)
1314 =item Analyze:Expert Info
1316 =item Analyze:Expert Info Composite
1318 (Kind of) a log of anomalies found by Wireshark in a capture file.
1320 =item Analyze:Conversation Filter
1322 =item Statistics:Summary
1324 Show summary information about the capture, including elapsed time,
1325 packet counts, byte counts, and the like. If a display filter is in
1326 effect, summary information will be shown about the capture and about
1327 the packets currently being displayed.
1329 =item Statistics:Protocol Hierarchy
1331 Show the number of packets, and the number of bytes in those packets,
1332 for each protocol in the trace. It organizes the protocols in the same
1333 hierarchy in which they were found in the trace. Besides counting the
1334 packets in which the protocol exists, a count is also made for packets
1335 in which the protocol is the last protocol in the stack. These
1336 last-protocol counts show you how many packets (and the byte count
1337 associated with those packets) B<ended> in a particular protocol. In
1338 the table, they are listed under "End Packets" and "End Bytes".
1340 =item Statistics:Conversations
1342 Lists of conversations; selectable by protocol. See Statistics:Conversation List below.
1344 =item Statistics:End Points
1346 List of End Point Addresses by protocol with packets/bytes/.... counts.
1348 =item Statistics:Packet Lengths
1350 Grouped counts of packet lengths (0-19 bytes, 20-39 bytes, ...)
1352 =item Statistics:IO Graphs
1354 Open a window where up to 5 graphs in different colors can be displayed
1355 to indicate number of packets or number of bytes per second for all packets
1356 matching the specified filter.
1357 By default only one graph will be displayed showing number of packets per second.
1359 The top part of the window contains the graphs and scales for the X and
1360 Y axis. If the graph is too long to fit inside the window there is a
1361 horizontal scrollbar below the drawing area that can scroll the graphs
1362 to the left or the right. The horizontal axis displays the time into
1363 the capture and the vertical axis will display the measured quantity at
1366 Below the drawing area and the scrollbar are the controls. On the
1367 bottom left there will be five similar sets of controls to control each
1368 individual graph such as "Display:<button>" which button will toggle
1369 that individual graph on/off. If <button> is ticked, the graph will be
1370 displayed. "Color:<color>" which is just a button to show which color
1371 will be used to draw that graph (color is only available in Gtk2
1372 version) and finally "Filter:<filter-text>" which can be used to specify
1373 a display filter for that particular graph.
1375 If filter-text is empty then all packets will be used to calculate the
1376 quantity for that graph. If filter-text is specified only those packets
1377 that match that display filter will be considered in the calculation of
1380 To the right of the 5 graph controls there are four menus to control
1381 global aspects of the draw area and graphs. The "Unit:" menu is used to
1382 control what to measure; "packets/tick", "bytes/tick" or "advanced..."
1384 packets/tick will measure the number of packets matching the (if
1385 specified) display filter for the graph in each measurement interval.
1387 bytes/tick will measure the total number of bytes in all packets matching
1388 the (if specified) display filter for the graph in each measurement
1391 advanced... see below
1393 "Tick interval:" specifies what measurement intervals to use. The
1394 default is 1 second and means that the data will be counted over 1
1397 "Pixels per tick:" specifies how many pixels wide each measurement
1398 interval will be in the drawing area. The default is 5 pixels per tick.
1400 "Y-scale:" controls the max value for the y-axis. Default value is
1401 "auto" which means that B<Wireshark> will try to adjust the maxvalue
1404 "advanced..." If Unit:advanced... is selected the window will display
1405 two more controls for each of the five graphs. One control will be a
1406 menu where the type of calculation can be selected from
1407 SUM,COUNT,MAX,MIN,AVG and LOAD, and one control, textbox, where the name of a
1408 single display filter field can be specified.
1410 The following restrictions apply to type and field combinations:
1412 SUM: available for all types of integers and will calculate the SUM of
1413 all occurrences of this field in the measurement interval. Note that
1414 some field can occur multiple times in the same packet and then all
1415 instances will be summed up. Example: 'tcp.len' which will count the
1416 amount of payload data transferred across TCP in each interval.
1418 COUNT: available for all field types. This will COUNT the number of times
1419 certain field occurs in each interval. Note that some fields
1420 may occur multiple times in each packet and if that is the case
1421 then each instance will be counted independently and COUNT
1422 will be greater than the number of packets.
1424 MAX: available for all integer and relative time fields. This will calculate
1425 the max seen integer/time value seen for the field during the interval.
1426 Example: 'smb.time' which will plot the maximum SMB response time.
1428 MIN: available for all integer and relative time fields. This will calculate
1429 the min seen integer/time value seen for the field during the interval.
1430 Example: 'smb.time' which will plot the minimum SMB response time.
1432 AVG: available for all integer and relative time fields.This will
1433 calculate the average seen integer/time value seen for the field during
1434 the interval. Example: 'smb.time' which will plot the average SMB
1437 LOAD: available only for relative time fields (response times).
1439 Example of advanced:
1440 Display how NFS response time MAX/MIN/AVG changes over time:
1444 filter:nfs&&rpc.time
1449 filter:nfs&&rpc.time
1454 filter:nfs&&rpc.time
1457 Example of advanced:
1458 Display how the average packet size from host a.b.c.d changes over time.
1462 filter:ip.addr==a.b.c.d&&frame.pkt_len
1463 Calc:AVG frame.pkt_len
1466 The LOAD io-stat type is very different from anything you have ever seen
1467 before! While the response times themselves as plotted by MIN,MAX,AVG are
1468 indications on the Server load (which affects the Server response time),
1469 the LOAD measurement measures the Client LOAD.
1470 What this measures is how much workload the client generates,
1471 i.e. how fast will the client issue new commands when the previous ones
1473 i.e. the level of concurrency the client can maintain.
1474 The higher the number, the more and faster is the client issuing new
1475 commands. When the LOAD goes down, it may be due to client load making
1476 the client slower in issuing new commands (there may be other reasons as
1477 well, maybe the client just doesn't have any commands it wants to issue
1480 Load is measured in concurrency/number of overlapping i/o and the value
1481 1000 means there is a constant load of one i/o.
1483 In each tick interval the amount of overlap is measured.
1484 See the graph below containing three commands:
1485 Below the graph are the LOAD values for each interval that would be calculated.
1489 | | o=====* | | | | | |
1491 | o========* | o============* | | |
1493 --------------------------------------------------> Time
1494 500 1500 500 750 1000 500 0 0
1496 =item Statistics:Conversation List
1498 This option will open a new window that displays a list of all
1499 conversations between two endpoints. The list has one row for each
1500 unique conversation and displays total number of packets/bytes seen as
1501 well as number of packets/bytes in each direction.
1503 By default the list is sorted according to the number of packets but by
1504 clicking on the column header; it is possible to re-sort the list in
1505 ascending or descending order by any column.
1507 By first selecting a conversation by clicking on it and then using the
1508 right mouse button (on those platforms that have a right
1509 mouse button) wireshark will display a popup menu offering several different
1510 filter operations to apply to the capture.
1512 These statistics windows can also be invoked from the Wireshark command
1513 line using the B<-z conv> argument.
1515 =item Statistics:Service Response Time
1531 Open a window to display Service Response Time statistics for an
1532 arbitrary DCE-RPC program
1533 interface and display B<Procedure>, B<Number of Calls>, B<Minimum SRT>,
1534 B<Maximum SRT> and B<Average SRT> for all procedures for that
1535 program/version. These windows opened will update in semi-real time to
1536 reflect changes when doing live captures or when reading new capture
1537 files into B<Wireshark>.
1539 This dialog will also allow an optional filter string to be used.
1540 If an optional filter string is used only such DCE-RPC request/response pairs
1541 that match that filter will be used to calculate the statistics. If no filter
1542 string is specified all request/response pairs will be used.
1552 Open a window to display Service Response Time statistics for Fibre Channel
1553 and display B<FC Type>, B<Number of Calls>, B<Minimum SRT>,
1554 B<Maximum SRT> and B<Average SRT> for all FC types.
1555 These windows opened will update in semi-real time to
1556 reflect changes when doing live captures or when reading new capture
1557 files into B<Wireshark>.
1558 The Service Response Time is calculated as the time delta between the
1559 First packet of the exchange and the Last packet of the exchange.
1561 This dialog will also allow an optional filter string to be used.
1562 If an optional filter string is used only such FC first/last exchange pairs
1563 that match that filter will be used to calculate the statistics. If no filter
1564 string is specified all request/response pairs will be used.
1574 Collect requests/response SRT (Service Response Time) data for ITU-T H.225 RAS.
1575 Data collected is B<number of calls> for each known ITU-T H.225 RAS Message Type,
1576 B<Minimum SRT>, B<Maximum SRT>, B<Average SRT>, B<Minimum in Packet>, and B<Maximum in Packet>.
1577 You will also get the number of B<Open Requests> (Unresponded Requests),
1578 B<Discarded Responses> (Responses without matching request) and Duplicate Messages.
1579 These windows opened will update in semi-real time to reflect changes when
1580 doing live captures or when reading new capture files into B<Wireshark>.
1582 You can apply an optional filter string in a dialog box, before starting
1583 the calculation. The statistics will only be calculated
1584 on those calls matching that filter.
1598 Collect requests/response SRT (Service Response Time) data for MGCP.
1599 Data collected is B<number of calls> for each known MGCP Type,
1600 B<Minimum SRT>, B<Maximum SRT>, B<Average SRT>, B<Minimum in Packet>, and B<Maximum in Packet>.
1601 These windows opened will update in semi-real time to reflect changes when
1602 doing live captures or when reading new capture files into B<Wireshark>.
1604 You can apply an optional filter string in a dialog box, before starting
1605 the calculation. The statistics will only be calculated
1606 on those calls matching that filter.
1616 Open a window to display statistics for an arbitrary ONC-RPC program interface
1617 and display B<Procedure>, B<Number of Calls>, B<Minimum SRT>, B<Maximum SRT> and B<Average SRT> for all procedures for that program/version.
1618 These windows opened will update in semi-real time to reflect changes when
1619 doing live captures or when reading new capture files into B<Wireshark>.
1621 This dialog will also allow an optional filter string to be used.
1622 If an optional filter string is used only such ONC-RPC request/response pairs
1623 that match that filter will be used to calculate the statistics. If no filter
1624 string is specified all request/response pairs will be used.
1626 By first selecting a conversation by clicking on it and then using the
1627 right mouse button (on those platforms that have a right
1628 mouse button) wireshark will display a popup menu offering several different
1629 filter operations to apply to the capture.
1643 Collect call/reply SRT (Service Response Time) data for SMB. Data collected
1644 is the number of calls for each SMB command, MinSRT, MaxSRT and AvgSRT.
1646 The data will be presented as separate tables for all normal SMB commands,
1647 all Transaction2 commands and all NT Transaction commands.
1648 Only those commands that are seen in the capture will have its stats
1650 Only the first command in a xAndX command chain will be used in the
1651 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
1652 only the SessionSetupAndX call will be used in the statistics.
1653 This is a flaw that might be fixed in the future.
1655 You can apply an optional filter string in a dialog box, before starting
1656 the calculation. The stats will only be calculated
1657 on those calls matching that filter.
1659 By first selecting a conversation by clicking on it and then using the
1660 right mouse button (on those platforms that have a right
1661 mouse button) wireshark will display a popup menu offering several different
1662 filter operations to apply to the capture.
1670 =item Statistics:BOOTP-DHCP
1674 =item Statistics:Compare
1676 Compare two Capture Files
1678 =item Statistics:Flow Graph
1680 Flow Graph: General/TCP
1682 =item Statistics:HTTP
1684 HTTP Load Distribution, Packet Counter & Requests
1686 =item Statistics:IP Addresses
1688 Count/Rate/Percent by IP Address
1690 =item Statistics:IP Destinations
1692 Count/Rate/Percent by IP Address/protocol/port
1694 =item Statistics:IP Protocol Types
1696 Count/Rate/Percent by IP Protocol Types
1698 =item Statistics:ONC-RPC Programs
1700 This dialog will open a window showing aggregated SRT statistics for all
1701 ONC-RPC Programs/versions that exist in the capture file.
1703 =item Statistics:TCP Stream Graph
1705 Graphs: Round Trip; Throughput; Time-Sequence (Stevens); Time-Sequence (tcptrace)
1707 =item Statistics:UDP Multicast streams
1709 Multicast Streams Counts/Rates/... by Source/Destination Address/Port pairs
1711 =item Statistics:WLAN Traffic
1713 WLAN Traffic Statistics
1715 =item Telephony:ITU-T H.225
1717 Count ITU-T H.225 messages and their reasons. In the first column you get a
1718 list of H.225 messages and H.225 message reasons, which occur in the current
1719 capture file. The number of occurrences of each message or reason will be displayed
1720 in the second column.
1721 This window opened will update in semi-real time to reflect changes when
1722 doing live captures or when reading new capture files into B<Wireshark>.
1724 You can apply an optional filter string in a dialog box, before starting
1725 the counter. The statistics will only be calculated
1726 on those calls matching that filter.
1730 Activate a counter for SIP messages. You will get the number of occurrences of each
1731 SIP Method and of each SIP Status-Code. Additionally you also get the number of
1732 resent SIP Messages (only for SIP over UDP).
1734 This window opened will update in semi-real time to reflect changes when
1735 doing live captures or when reading new capture files into B<Wireshark>.
1737 You can apply an optional filter string in a dialog box, before starting
1738 the counter. The statistics will only be calculated
1739 on those calls matching that filter.
1741 =item Tools:Firewall ACL Rules
1749 =item Help:Supported Protocols
1751 List of supported protocols and display filter protocol fields.
1753 =item Help:Manual Pages
1755 Display locally installed HTML versions of these manual pages in a web browser.
1757 =item Help:Wireshark Online
1759 Various links to online resources to be open in a web browser, like
1760 L<http://www.wireshark.org>.
1762 =item Help:About Wireshark
1764 See various information about Wireshark (see L<About|/item_about> dialog below), like the
1765 version, the folders used, the available plugins, ...
1775 The main window contains the usual things like the menu, some toolbars, the
1776 main area and a statusbar. The main area is split into three panes, you can
1777 resize each pane using a "thumb" at the right end of each divider line.
1779 The main window is much more flexible than before. The layout of the main
1780 window can be customized by the I<Layout> page in the dialog box popped
1781 up by I<Edit:Preferences>, the following will describe the layout with the
1788 Some menu items are available for quick access here. There is no way to
1789 customize the items in the toolbar, however the toolbar can be hidden by
1790 I<View:Main Toolbar>.
1792 =item Filter Toolbar
1794 A display filter can be entered into the filter toolbar.
1795 A filter for HTTP, HTTPS, and DNS traffic might look like this:
1797 tcp.port == 80 || tcp.port == 443 || tcp.port == 53
1799 Selecting the I<Filter:> button lets you choose from a list of named
1800 filters that you can optionally save. Pressing the Return or Enter
1801 keys, or selecting the I<Apply> button, will cause the filter to be
1802 applied to the current list of packets. Selecting the I<Reset> button
1803 clears the display filter so that all packets are displayed (again).
1805 There is no way to customize the items in the toolbar, however the toolbar
1806 can be hidden by I<View:Filter Toolbar>.
1808 =item Packet List Pane
1810 The top pane contains the list of network packets that you can scroll
1811 through and select. By default, the packet number, packet timestamp,
1812 source and destination addresses, protocol, and description are
1813 displayed for each packet; the I<Columns> page in the dialog box popped
1814 up by I<Edit:Preferences> lets you change this (although, unfortunately,
1815 you currently have to save the preferences, and exit and restart
1816 Wireshark, for those changes to take effect).
1818 If you click on the heading for a column, the display will be sorted by
1819 that column; clicking on the heading again will reverse the sort order
1822 An effort is made to display information as high up the protocol stack
1823 as possible, e.g. IP addresses are displayed for IP packets, but the
1824 MAC layer address is displayed for unknown packet types.
1826 The right mouse button can be used to pop up a menu of operations.
1828 The middle mouse button can be used to mark a packet.
1830 =item Packet Details Pane
1832 The middle pane contains a display of the details of the
1833 currently-selected packet. The display shows each field and its value
1834 in each protocol header in the stack. The right mouse button can be
1835 used to pop up a menu of operations.
1837 =item Packet Bytes Pane
1839 The lowest pane contains a hex and ASCII dump of the actual packet data.
1840 Selecting a field in the packet details highlights the corresponding
1841 bytes in this section.
1843 The right mouse button can be used to pop up a menu of operations.
1847 The statusbar is divided into three parts, on the left some context dependent
1848 things are shown, like information about the loaded file, in the center the
1849 number of packets are displayed, and on the right the current configuration
1852 The statusbar can be hidden by I<View:Statusbar>.
1858 The I<Preferences> dialog lets you control various personal preferences
1859 for the behavior of B<Wireshark>.
1863 =item User Interface Preferences
1865 The I<User Interface> page is used to modify small aspects of the GUI to
1866 your own personal taste:
1870 =item Selection Bars
1872 The selection bar in the packet list and packet details can have either
1873 a "browse" or "select" behavior. If the selection bar has a "browse"
1874 behavior, the arrow keys will move an outline of the selection bar,
1875 allowing you to browse the rest of the list or details without changing
1876 the selection until you press the space bar. If the selection bar has a
1877 "select" behavior, the arrow keys will move the selection bar and change
1878 the selection to the new item in the packet list or packet details.
1880 =item Save Window Position
1882 If this item is selected, the position of the main Wireshark window will
1883 be saved when Wireshark exits, and used when Wireshark is started again.
1885 =item Save Window Size
1887 If this item is selected, the size of the main Wireshark window will
1888 be saved when Wireshark exits, and used when Wireshark is started again.
1890 =item Save Window Maximized state
1892 If this item is selected the maximize state of the main Wireshark window
1893 will be saved when Wireshark exists, and used when Wireshark is started again.
1895 =item File Open Dialog Behavior
1897 This item allows the user to select how Wireshark handles the listing
1898 of the "File Open" Dialog when opening trace files. "Remember Last
1899 Directory" causes Wireshark to automatically position the dialog in the
1900 directory of the most recently opened file, even between launches of Wireshark.
1901 "Always Open in Directory" allows the user to define a persistent directory
1902 that the dialog will always default to.
1906 Allows the user to specify a persistent File Open directory. Trailing
1907 slashes or backslashes will automatically be added.
1909 =item File Open Preview timeout
1911 This items allows the user to define how much time is spend reading the
1912 capture file to present preview data in the File Open dialog.
1914 =item Open Recent maximum list entries
1916 The File menu supports a recent file list. This items allows the user to
1917 specify how many files are kept track of in this list.
1919 =item Ask for unsaved capture files
1921 When closing a capture file or Wireshark itself if the file isn't saved yet
1922 the user is presented the option to save the file when this item is set.
1924 =item Wrap during find
1926 This items determines the behavior when reaching the beginning or the end
1927 of a capture file. When set the search wraps around and continues, otherwise
1930 =item Settings dialogs show a save button
1932 This item determines if the various dialogs sport an explicit Save button
1933 or that save is implicit in OK / Apply.
1935 =item Web browser command
1937 This entry specifies the command line to launch a web browser. It is used
1938 to access online content, like the Wiki and user guide. Use '%s' to place
1939 the request URL in the command line.
1943 =item Layout Preferences
1945 The I<Layout> page lets you specify the general layout of the main window.
1946 You can choose from six different layouts and fill the three panes with the
1953 The vertical scrollbars in the three panes can be set to be either on
1954 the left or the right.
1956 =item Alternating row colors
1960 The highlight method in the hex dump display for the selected protocol
1961 item can be set to use either inverse video, or bold characters.
1965 =item Filter toolbar placement
1967 =item Custom window title
1971 =item Column Preferences
1973 The I<Columns> page lets you specify the number, title, and format
1974 of each column in the packet list.
1976 The I<Column title> entry is used to specify the title of the column
1977 displayed at the top of the packet list. The type of data that the column
1978 displays can be specified using the I<Column format> option menu.
1979 The row of buttons on the left perform the following actions:
1985 Adds a new column to the list.
1989 Deletes the currently selected list item.
1993 Moves the selected list item up or down one position.
1997 =item Font Preferences
1999 The I<Font> page lets you select the font to be used for most text.
2001 =item Color Preferences
2003 The I<Colors> page can be used to change the color of the text
2004 displayed in the TCP stream window and for marked packets. To change a color,
2005 simply select an attribute from the "Set:" menu and use the color selector to
2006 get the desired color. The new text colors are displayed as a sample text.
2008 =item Capture Preferences
2010 The I<Capture> page lets you specify various parameters for capturing
2011 live packet data; these are used the first time a capture is started.
2013 The I<Interface:> combo box lets you specify the interface from which to
2014 capture packet data, or the name of a FIFO from which to get the packet
2017 The I<Data link type:> option menu lets you, for some interfaces, select
2018 the data link header you want to see on the packets you capture. For
2019 example, in some OSes and with some versions of libpcap, you can choose,
2020 on an 802.11 interface, whether the packets should appear as Ethernet
2021 packets (with a fake Ethernet header) or as 802.11 packets.
2023 The I<Limit each packet to ... bytes> check box lets you set the
2024 snapshot length to use when capturing live data; turn on the check box,
2025 and then set the number of bytes to use as the snapshot length.
2027 The I<Filter:> text entry lets you set a capture filter expression to be
2028 used when capturing.
2030 If any of the environment variables SSH_CONNECTION, SSH_CLIENT,
2031 REMOTEHOST, DISPLAY, or SESSIONNAME are set, Wireshark will create a
2032 default capture filter that excludes traffic from the hosts and ports
2033 defined in those variables.
2035 The I<Capture packets in promiscuous mode> check box lets you specify
2036 whether to put the interface in promiscuous mode when capturing.
2038 The I<Update list of packets in real time> check box lets you specify
2039 that the display should be updated as packets are seen.
2041 The I<Automatic scrolling in live capture> check box lets you specify
2042 whether, in an "Update list of packets in real time" capture, the packet
2043 list pane should automatically scroll to show the most recently captured
2046 =item Printing Preferences
2048 The radio buttons at the top of the I<Printing> page allow you choose
2049 between printing packets with the I<File:Print Packet> menu item as text
2050 or PostScript, and sending the output directly to a command or saving it
2051 to a file. The I<Command:> text entry box, on UNIX-compatible systems,
2052 is the command to send files to (usually B<lpr>), and the I<File:> entry
2053 box lets you enter the name of the file you wish to save to.
2054 Additionally, you can select the I<File:> button to browse the file
2055 system for a particular save file.
2057 =item Name Resolution Preferences
2059 The I<Enable MAC name resolution>, I<Enable network name resolution> and
2060 I<Enable transport name resolution> check boxes let you specify whether
2061 MAC addresses, network addresses, and transport-layer port numbers
2062 should be translated to names.
2064 The I<Enable concurrent DNS name resolution> allows Wireshark to send out
2065 multiple name resolution requests and not wait for the result before
2066 continuing dissection. This speeds up dissection with network name
2067 resolution but initially may miss resolutions. The number of concurrent
2068 requests can be set here as well.
2074 =item RTP Player Preferences
2076 This page allows you to select the number of channels visible in the
2077 RTP player window. It determines the height of the window, more channels
2078 are possible and visible by means of a scroll bar.
2080 =item Protocol Preferences
2082 There are also pages for various protocols that Wireshark dissects,
2083 controlling the way Wireshark handles those protocols.
2087 =item Edit Capture Filter List
2089 =item Edit Display Filter List
2091 =item Capture Filter
2093 =item Display Filter
2099 The I<Edit Capture Filter List> dialog lets you create, modify, and
2100 delete capture filters, and the I<Edit Display Filter List> dialog lets
2101 you create, modify, and delete display filters.
2103 The I<Capture Filter> dialog lets you do all of the editing operations
2104 listed, and also lets you choose or construct a filter to be used when
2107 The I<Display Filter> dialog lets you do all of the editing operations
2108 listed, and also lets you choose or construct a filter to be used to
2109 filter the current capture being viewed.
2111 The I<Read Filter> dialog lets you do all of the editing operations
2112 listed, and also lets you choose or construct a filter to be used to
2113 as a read filter for a capture file you open.
2115 The I<Search Filter> dialog lets you do all of the editing operations
2116 listed, and also lets you choose or construct a filter expression to be
2117 used in a find operation.
2119 In all of those dialogs, the I<Filter name> entry specifies a
2120 descriptive name for a filter, e.g. B<Web and DNS traffic>. The
2121 I<Filter string> entry is the text that actually describes the filtering
2122 action to take, as described above.The dialog buttons perform the
2129 If there is text in the two entry boxes, creates a new associated list
2134 Modifies the currently selected list item to match what's in the entry
2139 Deletes the currently selected list item.
2141 =item Add Expression...
2143 For display filter expressions, pops up a dialog box to allow you to
2144 construct a filter expression to test a particular field; it offers
2145 lists of field names, and, when appropriate, lists from which to select
2146 tests to perform on the field and values with which to compare it. In
2147 that dialog box, the OK button will cause the filter expression you
2148 constructed to be entered into the I<Filter string> entry at the current
2153 In the I<Capture Filter> dialog, closes the dialog box and makes the
2154 filter in the I<Filter string> entry the filter in the I<Capture
2155 Preferences> dialog. In the I<Display Filter> dialog, closes the dialog
2156 box and makes the filter in the I<Filter string> entry the current
2157 display filter, and applies it to the current capture. In the I<Read
2158 Filter> dialog, closes the dialog box and makes the filter in the
2159 I<Filter string> entry the filter in the I<Open Capture File> dialog.
2160 In the I<Search Filter> dialog, closes the dialog box and makes the
2161 filter in the I<Filter string> entry the filter in the I<Find Packet>
2166 Makes the filter in the I<Filter string> entry the current display
2167 filter, and applies it to the current capture.
2171 If the list of filters being edited is the list of
2172 capture filters, saves the current filter list to the personal capture
2173 filters file, and if the list of filters being edited is the list of
2174 display filters, saves the current filter list to the personal display
2179 Closes the dialog without doing anything with the filter in the I<Filter
2184 =item The Color Filters Dialog
2186 This dialog displays a list of color filters and allows it to be
2191 =item THE FILTER LIST
2193 Single rows may be selected by clicking. Multiple rows may be selected
2194 by using the ctrl and shift keys in combination with the mouse button.
2198 Adds a new filter at the bottom of the list and opens the Edit Color
2199 Filter dialog box. You will have to alter the filter expression at
2200 least before the filter will be accepted. The format of color filter
2201 expressions is identical to that of display filters. The new filter is
2202 selected, so it may immediately be moved up and down, deleted or edited.
2203 To avoid confusion all filters are unselected before the new filter is
2208 Opens the Edit Color Filter dialog box for the selected filter. (If this
2209 button is disabled you may have more than one filter selected, making it
2210 ambiguous which is to be edited.)
2214 Enables the selected color filter(s).
2218 Disables the selected color filter(s).
2222 Deletes the selected color filter(s).
2226 Allows you to choose a file in which to save the current list of color
2227 filters. You may also choose to save only the selected filters. A
2228 button is provided to save the filters in the global color filters file
2229 (you must have sufficient permissions to write this file, of course).
2233 Allows you to choose a file containing color filters which are then
2234 added to the bottom of the current list. All the added filters are
2235 selected, so they may be moved to the correct position in the list as a
2236 group. To avoid confusion, all filters are unselected before the new
2237 filters are imported. A button is provided to load the filters from the
2238 global color filters file.
2242 Deletes your personal color filters file, reloads the global
2243 color filters file, if any, and closes the dialog.
2247 Moves the selected filter(s) up the list, making it more likely that
2248 they will be used to color packets.
2252 Moves the selected filter(s) down the list, making it less likely that
2253 they will be used to color packets.
2257 Closes the dialog and uses the color filters as they stand.
2261 Colors the packets according to the current list of color filters, but
2262 does not close the dialog.
2266 Saves the current list of color filters in your personal color filters
2267 file. Unless you do this they will not be used the next time you start
2272 Closes the dialog without changing the coloration of the packets. Note
2273 that changes you have made to the current list of color filters are not
2278 =item Capture Options
2280 The I<Capture Options> dialog lets you specify various parameters for
2281 capturing live packet data.
2283 The I<Interface:> field lets you specify the interface from which to
2284 capture packet data or a command from which to get the packet data via a
2287 The I<Link layer header type:> field lets you specify the interfaces link
2288 layer header type. This field is usually disabled, as most interface have
2289 only one header type.
2291 The I<Capture packets in promiscuous mode> check box lets you specify
2292 whether the interface should be put into promiscuous mode when
2295 The I<Limit each packet to ... bytes> check box and field lets you
2296 specify a maximum number of bytes per packet to capture and save; if the
2297 check box is not checked, the limit will be 65535 bytes.
2299 The I<Capture Filter:> entry lets you specify the capture filter using a
2300 tcpdump-style filter string as described above.
2302 The I<File:> entry lets you specify the file into which captured packets
2303 should be saved, as in the I<Printer Options> dialog above. If not
2304 specified, the captured packets will be saved in a temporary file; you
2305 can save those packets to a file with the I<File:Save As> menu item.
2307 The I<Use multiple files> check box lets you specify that the capture
2308 should be done in "multiple files" mode. This option is disabled, if the
2309 I<Update list of packets in real time> option is checked.
2311 The I<Next file every ... megabyte(s)> check box and fields lets
2312 you specify that a switch to a next file should be done
2313 if the specified filesize is reached. You can also select the appropriate
2314 unit, but beware that the filesize has a maximum of 2 GB.
2315 The check box is forced to be checked, as "multiple files" mode requires a
2316 file size to be specified.
2318 The I<Next file every ... minute(s)> check box and fields lets
2319 you specify that the switch to a next file should be done after the specified
2320 time has elapsed, even if the specified capture size is not reached.
2322 The I<Ring buffer with ... files> field lets you specify the number
2323 of files of a ring buffer. This feature will capture into to the first file
2324 again, after the specified amount of files were used.
2326 The I<Stop capture after ... files> field lets you specify the number
2327 of capture files used, until the capture is stopped.
2329 The I<Stop capture after ... packet(s)> check box and field let
2330 you specify that Wireshark should stop capturing after having captured
2331 some number of packets; if the check box is not checked, Wireshark will
2332 not stop capturing at some fixed number of captured packets.
2334 The I<Stop capture after ... megabyte(s)> check box and field lets
2335 you specify that Wireshark should stop capturing after the file to which
2336 captured packets are being saved grows as large as or larger than some
2337 specified number of megabytes. If the check box is not checked, Wireshark
2338 will not stop capturing at some capture file size (although the operating
2339 system on which Wireshark is running, or the available disk space, may still
2340 limit the maximum size of a capture file). This option is disabled, if
2341 "multiple files" mode is used,
2343 The I<Stop capture after ... second(s)> check box and field let you
2344 specify that Wireshark should stop capturing after it has been capturing
2345 for some number of seconds; if the check box is not checked, Wireshark
2346 will not stop capturing after some fixed time has elapsed.
2348 The I<Update list of packets in real time> check box lets you specify
2349 whether the display should be updated as packets are captured and, if
2350 you specify that, the I<Automatic scrolling in live capture> check box
2351 lets you specify the packet list pane should automatically scroll to
2352 show the most recently captured packets as new packets arrive.
2354 The I<Enable MAC name resolution>, I<Enable network name resolution> and
2355 I<Enable transport name resolution> check boxes let you specify whether
2356 MAC addresses, network addresses, and transport-layer port numbers
2357 should be translated to names.
2361 The I<About> dialog lets you view various information about Wireshark.
2363 =item About:Wireshark
2365 The I<Wireshark> page lets you view general information about Wireshark,
2366 like the installed version, licensing information and such.
2370 The I<Authors> page shows the author and all contributors.
2374 The I<Folders> page lets you view the directory names where Wireshark is
2375 searching it's various configuration and other files.
2379 The I<Plugins> page lets you view the dissector plugin modules
2380 available on your system.
2382 The I<Plugins List> shows the name and version of each dissector plugin
2383 module found on your system.
2385 On Unix-compatible systems, the plugins are looked for in the following
2386 directories: the F<lib/wireshark/plugins/$VERSION> directory under the
2387 main installation directory (for example,
2388 F</usr/local/lib/wireshark/plugins/$VERSION>), and then
2389 F<$HOME/.wireshark/plugins>.
2391 On Windows systems, the plugins are looked for in the following
2392 directories: F<plugins\$VERSION> directory under the main installation
2393 directory (for example, F<C:\Program Files\Wireshark\plugins\$VERSION>),
2394 and then F<%APPDATA%\Wireshark\plugins\$VERSION> (or, if %APPDATA% isn't
2395 defined, F<%USERPROFILE%\Application Data\Wireshark\plugins\$VERSION>).
2397 $VERSION is the version number of the plugin interface, which
2398 is typically the version number of Wireshark. Note that a dissector
2399 plugin module may support more than one protocol; there is not
2400 necessarily a one-to-one correspondence between dissector plugin modules
2401 and protocols. Protocols supported by a dissector plugin module are
2402 enabled and disabled using the I<Edit:Protocols> dialog box, just as
2403 protocols built into Wireshark are.
2407 =head1 CAPTURE FILTER SYNTAX
2409 See the manual page of pcap-filter(4) or, if that doesn't exist, tcpdump(8),
2410 or, if that doesn't exist, L<http://wiki.wireshark.org/CaptureFilters>.
2412 =head1 DISPLAY FILTER SYNTAX
2414 For a complete table of protocol and protocol fields that are filterable
2415 in B<Wireshark> see the wireshark-filter(4) manual page.
2419 These files contains various B<Wireshark> configuration settings.
2425 The F<preferences> files contain global (system-wide) and personal
2426 preference settings. If the system-wide preference file exists, it is
2427 read first, overriding the default settings. If the personal preferences
2428 file exists, it is read next, overriding any previous values. Note: If
2429 the command line flag B<-o> is used (possibly more than once), it will
2430 in turn override values from the preferences files.
2432 The preferences settings are in the form I<prefname>B<:>I<value>,
2434 where I<prefname> is the name of the preference
2435 and I<value> is the value to
2436 which it should be set; white space is allowed between B<:> and
2437 I<value>. A preference setting can be continued on subsequent lines by
2438 indenting the continuation lines with white space. A B<#> character
2439 starts a comment that runs to the end of the line:
2441 # Vertical scrollbars should be on right side?
2442 # TRUE or FALSE (case-insensitive).
2443 gui.scrollbar_on_right: TRUE
2445 The global preferences file is looked for in the F<wireshark> directory
2446 under the F<share> subdirectory of the main installation directory (for
2447 example, F</usr/local/share/wireshark/preferences>) on UNIX-compatible
2448 systems, and in the main installation directory (for example,
2449 F<C:\Program Files\Wireshark\preferences>) on Windows systems.
2451 The personal preferences file is looked for in F<$HOME/.wireshark/preferences> on
2452 UNIX-compatible systems and F<%APPDATA%\Wireshark\preferences> (or, if
2453 %APPDATA% isn't defined, F<%USERPROFILE%\Application
2454 Data\Wireshark\preferences>) on Windows systems.
2456 Note: Whenever the preferences are saved by using the I<Save> button
2457 in the I<Edit:Preferences> dialog box, your personal preferences file
2458 will be overwritten with the new settings, destroying any comments and
2459 unknown/obsolete settings that were in the file.
2463 The F<recent> file contains personal settings (mostly GUI related) such
2464 as the current B<Wireshark> window size. The file is saved at program exit and
2465 read in at program start automatically. Note: The command line flag B<-o>
2466 may be used to override settings from this file.
2468 The settings in this file have the same format as in the F<preferences>
2469 files, and the same directory as for the personal preferences file is
2472 Note: Whenever Wireshark is closed, your recent file
2473 will be overwritten with the new settings, destroying any comments and
2474 unknown/obsolete settings that were in the file.
2476 =item Disabled (Enabled) Protocols
2478 The F<disabled_protos> files contain system-wide and personal lists of
2479 protocols that have been disabled, so that their dissectors are never
2480 called. The files contain protocol names, one per line, where the
2481 protocol name is the same name that would be used in a display filter
2487 If a protocol is listed in the global F<disabled_protos> file, it is not
2488 displayed in the I<Analyze:Enabled Protocols> dialog box, and so cannot
2489 be enabled by the user.
2491 The global F<disabled_protos> file uses the same directory as the global
2494 The personal F<disabled_protos> file uses the same directory as the
2495 personal preferences file.
2497 Note: Whenever the disabled protocols list is saved by using the I<Save>
2498 button in the I<Analyze:Enabled Protocols> dialog box, your personal
2499 disabled protocols file will be overwritten with the new settings,
2500 destroying any comments that were in the file.
2502 =item Name Resolution (hosts)
2504 If the personal F<hosts> file exists, it is
2505 used to resolve IPv4 and IPv6 addresses before any other
2506 attempts are made to resolve them. The file has the standard F<hosts>
2507 file syntax; each line contains one IP address and name, separated by
2508 whitespace. The same directory as for the personal preferences file is used.
2510 Capture filter name resolution is handled by libpcap on UNIX-compatible
2511 systems and WinPCAP on Windows. As such the Wireshark personal F<hosts> file
2512 will not be consulted for capture filter name resolution.
2514 =item Name Resolution (ethers)
2516 The F<ethers> files are consulted to correlate 6-byte hardware addresses to
2517 names. First the personal F<ethers> file is tried and if an address is not
2518 found there the global F<ethers> file is tried next.
2520 Each line contains one hardware address and name, separated by
2521 whitespace. The digits of the hardware address are separated by colons
2522 (:), dashes (-) or periods (.). The same separator character must be
2523 used consistently in an address. The following three lines are valid
2524 lines of an F<ethers> file:
2526 ff:ff:ff:ff:ff:ff Broadcast
2527 c0-00-ff-ff-ff-ff TR_broadcast
2528 00.00.00.00.00.00 Zero_broadcast
2530 The global F<ethers> file is looked for in the F</etc> directory on
2531 UNIX-compatible systems, and in the main installation directory (for
2532 example, F<C:\Program Files\Wireshark>) on Windows systems.
2534 The personal F<ethers> file is looked for in the same directory as the personal
2537 Capture filter name resolution is handled by libpcap on UNIX-compatible
2538 systems and WinPCAP on Windows. As such the Wireshark personal F<ethers> file
2539 will not be consulted for capture filter name resolution.
2541 =item Name Resolution (manuf)
2543 The F<manuf> file is used to match the 3-byte vendor portion of a 6-byte
2544 hardware address with the manufacturer's name; it can also contain well-known
2545 MAC addresses and address ranges specified with a netmask. The format of the
2546 file is the same as the F<ethers> files, except that entries such as:
2550 can be provided, with the 3-byte OUI and the name for a vendor, and
2553 00-00-0C-07-AC/40 All-HSRP-routers
2555 can be specified, with a MAC address and a mask indicating how many bits
2556 of the address must match. The above entry, for example, has 40
2557 significant bits, or 5 bytes, and would match addresses from
2558 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
2561 The F<manuf> file is looked for in the same directory as the global
2564 =item Name Resolution (ipxnets)
2566 The F<ipxnets> files are used to correlate 4-byte IPX network numbers to
2567 names. First the global F<ipxnets> file is tried and if that address is not
2568 found there the personal one is tried next.
2570 The format is the same as the F<ethers>
2571 file, except that each address is four bytes instead of six.
2572 Additionally, the address can be represented as a single hexadecimal
2573 number, as is more common in the IPX world, rather than four hex octets.
2574 For example, these four lines are valid lines of an F<ipxnets> file:
2578 00:00:BE:EF IT_Server1
2581 The global F<ipxnets> file is looked for in the F</etc> directory on
2582 UNIX-compatible systems, and in the main installation directory (for
2583 example, F<C:\Program Files\Wireshark>) on Windows systems.
2585 The personal F<ipxnets> file is looked for in the same directory as the
2586 personal preferences file.
2588 =item Capture Filters
2590 The F<cfilters> files contain system-wide and personal capture filters.
2591 Each line contains one filter, starting with the string displayed in the
2592 dialog box in quotation marks, followed by the filter string itself:
2597 The global F<cfilters> file uses the same directory as the
2598 global preferences file.
2600 The personal F<cfilters> file uses the same directory as the personal
2601 preferences file. It is written through the Capture:Capture Filters
2604 If the global F<cfilters> file exists, it is used only if the personal
2605 F<cfilters> file does not exist; global and personal capture filters are
2608 =item Display Filters
2610 The F<dfilters> files contain system-wide and personal display filters.
2611 Each line contains one filter, starting with the string displayed in the
2612 dialog box in quotation marks, followed by the filter string itself:
2617 The global F<dfilters> file uses the same directory as the
2618 global preferences file.
2620 The personal F<dfilters> file uses the same directory as the
2621 personal preferences file. It is written through the Analyze:Display
2624 If the global F<dfilters> file exists, it is used only if the personal
2625 F<dfilters> file does not exist; global and personal display filters are
2628 =item Color Filters (Coloring Rules)
2630 The F<colorfilters> files contain system-wide and personal color filters.
2631 Each line contains one filter, starting with the string displayed in the
2632 dialog box, followed by the corresponding display filter. Then the
2633 background and foreground colors are appended:
2636 @tcp@tcp@[59345,58980,65534][0,0,0]
2637 @udp@udp@[28834,57427,65533][0,0,0]
2639 The global F<colorfilters> file uses the same directory as the
2640 global preferences file.
2642 The personal F<colorfilters> file uses the same directory as the
2643 personal preferences file. It is written through the View:Coloring Rules
2646 If the global F<colorfilters> file exists, it is used only if the personal
2647 F<colorfilters> file does not exist; global and personal color filters are
2652 The F<gtkrc> files contain system-wide and personal GTK theme settings.
2654 The global F<gtkrc> file uses the same directory as the
2655 global preferences file.
2657 The personal F<gtkrc> file uses the same directory as the personal
2662 See above in the description of the About:Plugins page.
2666 =head1 ENVIRONMENT VARIABLES
2670 =item WIRESHARK_DEBUG_EP_NO_CHUNKS
2672 Normally per-packet memory is allocated in large "chunks." This behavior
2673 doesn't work well with debugging tools such as Valgrind or ElectricFence.
2674 Export this environment variable to force individual allocations.
2675 Note: disabling chunks also disables canaries (see below).
2677 =item WIRESHARK_DEBUG_SE_NO_CHUNKS
2679 Normally per-file memory is allocated in large "chunks." This behavior
2680 doesn't work well with debugging tools such as Valgrind or ElectricFence.
2681 Export this environment variable to force individual allocations.
2682 Note: disabling chunks also disables canaries (see below).
2684 =item WIRESHARK_DEBUG_EP_NO_CANARY
2686 Normally per-packet memory allocations are separated by "canaries" which
2687 allow detection of memory overruns. This comes at the expense of some extra
2688 memory usage. Exporting this environment variable disables these canaries.
2690 =item WIRESHARK_DEBUG_SE_USE_CANARY
2692 Exporting this environment variable causes per-file memory allocations to be
2693 protected with "canaries" which allow for detection of memory overruns.
2694 This comes at the expense of significant extra memory usage.
2696 =item WIRESHARK_DEBUG_SCRUB_MEMORY
2698 If this environment variable is exported, the contents of per-packet and
2699 per-file memory is initialized to 0xBADDCAFE when the memory is allocated
2700 and is reset to 0xDEADBEEF when the memory is freed. This functionality is
2701 useful mainly to developers looking for bugs in the way memory is handled.
2703 =item WIRESHARK_RUN_FROM_BUILD_DIRECTORY
2705 This environment variable causes the plugins and other data files to be loaded
2706 from the build directory (where the program was compiled) rather than from the
2707 standard locations. It has no effect when the program in question is running
2708 with root (or setuid) permissions on *NIX.
2710 =item WIRESHARK_DATA_DIR
2712 This environment variable causes the various data files to be loaded from
2713 a directory other than the standard locations. It has no effect when the
2714 program in question is running with root (or setuid) permissions on *NIX.
2716 =item WIRESHARK_PYTHON_DIR
2718 This environment variable points to an alternate location for Python.
2719 It has no effect when the program in question is running with root (or setuid)
2720 permissions on *NIX.
2722 =item ERF_RECORDS_TO_CHECK
2724 This environment variable controls the number of ERF records checked when
2725 deciding if a file really is in the ERF format. Setting this environment
2726 variable a number higher than the default (20) would make false positives
2729 =item IPFIX_RECORDS_TO_CHECK
2731 This environment variable controls the number of IPFIX records checked when
2732 deciding if a file really is in the IPFIX format. Setting this environment
2733 variable a number higher than the default (20) would make false positives
2736 =item WIRESHARK_ABORT_ON_DISSECTOR_BUG
2738 If this environment variable is set, B<Wireshark> will call abort(3)
2739 when a dissector bug is encountered. abort(3) will cause the program to
2740 exit abnormally; if you are running B<Wireshark> in a debugger, it
2741 should halt in the debugger and allow inspection of the process, and, if
2742 you are not running it in a debugger, it will, on some OSes, assuming
2743 your environment is configured correctly, generate a core dump file.
2744 This can be useful to developers attempting to troubleshoot a problem
2745 with a protocol dissector.
2747 =item WIRESHARK_EP_VERIFY_POINTERS
2749 This environment variable, if exported, causes certain uses of pointers to be
2750 audited to ensure they do not point to memory that is deallocated after each
2751 packet has been fully dissected. This can be useful to developers writing or
2754 =item WIRESHARK_SE_VERIFY_POINTERS
2756 This environment variable, if exported, causes certain uses of pointers to be
2757 audited to ensure they do not point to memory that is deallocated after when
2758 a capture file is closed. This can be useful to developers writing or
2765 wireshark-filter(4), tshark(1), editcap(1), pcap-filter(4), tcpdump(8),
2766 pcap(3), dumpcap(1), mergecap(1), text2pcap(1)
2770 The latest version of B<Wireshark> can be found at
2771 L<http://www.wireshark.org>.
2773 HTML versions of the Wireshark project man pages are available at:
2774 L<http://www.wireshark.org/docs/man-pages>.