=head1 NAME
-ethereal - Interactively browse network traffic
+ethereal - Interactively dump and analyze network traffic
=head1 SYNOPSYS
B<ethereal>
-S<[ B<-a> capture autostop condition ] ...>
-S<[ B<-b> number of ring buffer files [:duration] ]>
-S<[ B<-B> byte view height ]>
-S<[ B<-c> count ]>
-S<[ B<-f> capture filter expression ]>
+S<[ B<-a> E<lt>capture autostop conditionE<gt> ] ...>
+S<[ B<-b> E<lt>capture ring buffer optionE<gt> ] ...>
+S<[ B<-B> E<lt>capture buffer size (Win32 only)E<gt> ] >
+S<[ B<-c> E<lt>capture packet countE<gt> ]>
+S<[ B<-D> ]>
+S<[ B<-f> E<lt>capture filterE<gt> ]>
+S<[ B<-g> E<lt>packet numberE<gt> ]>
S<[ B<-h> ]>
-S<[ B<-i> interface ]>
+S<[ B<-i> E<lt>capture interfaceE<gt>|- ]>
S<[ B<-k> ]>
S<[ B<-l> ]>
S<[ B<-L> ]>
-S<[ B<-m> font ]>
+S<[ B<-m> E<lt>fontE<gt> ]>
S<[ B<-n> ]>
-S<[ B<-N> resolving flags ] >
-S<[ B<-o> preference setting ] ...>
+S<[ B<-N> E<lt>name resolving flagsE<gt> ] >
+S<[ B<-o> E<lt>preference/recent settingE<gt> ] ...>
S<[ B<-p> ]>
-S<[ B<-P> packet list height ]>
S<[ B<-Q> ]>
-S<[ B<-r> infile ]>
-S<[ B<-R> display filter expression ]>
+S<[ B<-r> E<lt>infileE<gt> ]>
+S<[ B<-R> E<lt>read (display) filterE<gt> ]>
S<[ B<-S> ]>
-S<[ B<-s> snaplen ]>
-S<[ B<-T> details view height ]>
-S<[ B<-t> time stamp format ]>
+S<[ B<-s> E<lt>capture snaplenE<gt> ]>
+S<[ B<-t> ad|a|r|d ]>
S<[ B<-v> ]>
-S<[ B<-w> savefile]>
-S<[ B<-y> link type ]>
-S<[ B<-z> statistics-string ]>
-S<[ infile ]>
+S<[ B<-w> E<lt>outfileE<gt> ]>
+S<[ B<-y> E<lt>capture link typeE<gt> ]>
+S<[ B<-X> E<lt>eXtension optionE<gt> ]>
+S<[ B<-z> E<lt>statisticsE<gt> ]>
+S<[ E<lt>infileE<gt> ]>
=head1 DESCRIPTION
Most users will want to start B<Ethereal> without options and configure
it from the menus instead. Those users may just skip this section.
-=item -a
+=item -a E<lt>capture autostop conditionE<gt>
Specify a criterion that specifies when B<Ethereal> is to stop writing
to a capture file. The criterion is of the form I<test>B<:>I<value>,
where I<test> is one of:
-=for man .RS
+B<duration>:I<value> Stop writing to a capture file after I<value> seconds have elapsed.
-=for html <P><DL>
+B<filesize>:I<value> Stop writing to a capture file after it reaches a size of I<value>
+kilobytes (where a kilobyte is 1024 bytes). If this option
+is used together with the -b option, Ethereal will stop writing to the
+current capture file and switch to the next one if filesize is reached.
-=item duration
+B<files>:I<value> Stop writing to capture files after I<value> number of files were written.
-Stop writing to a capture file after I<value> seconds have elapsed.
+=item -b E<lt>capture ring buffer optionE<gt>
-=item filesize
+Cause B<Ethereal> to run in "multiple files" mode. In "multiple files" mode,
+B<Ethereal> will write to several capture files. When the first capture file
+fills up, B<Ethereal> will switch writing to the next file and so on.
-Stop writing to a capture file after it reaches a size of I<value>
-kilobytes (where a kilobyte is 1000 bytes, not 1024 bytes).
+The created filenames are based on the filename given with the B<-w> flag, the number of
+the file and on the creation date and time,
+e.g. outfile_00001_20050604120117.pcap, outfile_00001_20050604120523.pcap, ...
-=for man .RE
+With the I<files> option it's also possible to form a "ring buffer".
+This will fill up new files until the number of files specified,
+at which point B<Ethereal> will discard the data in the first file and start
+writing to that file and so on. If the I<files> option is not set,
+new files filled up until one of the capture stop conditions match (or
+until the disk if full).
-=for html </DL>
+The criterion is of the form I<key>B<:>I<value>,
+where I<key> is one of:
-=item -b
+B<duration>:I<value> switch to the next file after I<value> seconds have
+elapsed, even if the current file is not completely filled up.
-If a maximum capture file size was specified, cause B<Ethereal> to run
-in "ring buffer" mode, with the specified number of files. In "ring
-buffer" mode, B<Ethereal> will write to several capture files.
-Their name is based on the number of the file and on the creation date
-and time.
+B<filesize>:I<value> switch to the next file after it reaches a size of
+I<value> kilobytes (where a kilobyte is 1024 bytes).
-When the first capture file fills up, B<Ethereal> will switch to writing
-to the next file, until it fills up the last file, at which point it'll
-discard the data in the first file (unless 0 is specified, in which case,
-the number of files is unlimited) and start writing to that file and so on.
+B<files>:I<value> begin again with the first file after I<value> number of
+files were written (form a ring buffer).
-If the optional duration is specified, B<Ethereal> will switch also
-to the next file when the specified number of seconds has elapsed even
-if the current file is not completely fills up.
+=item -B E<lt>capture buffer size (Win32 only)E<gt>
-=item -B
+Win32 only: set capture buffer size (in MB, default is 1MB). This is used by the
+the capture driver to buffer packet data until that data can be written to
+disk. If you encounter packet drops while capturing, try to increase this size.
-Set the initial height of the byte view (bottom) pane.
+=item -c E<lt>capture packet countE<gt>
-=item -c
-
-Set the default number of packets to read when capturing live
+Set the maximum number of packets to read when capturing live
data.
-=item -f
+=item -D
+
+Print a list of the interfaces on which B<Ethereal> can capture, and
+exit. For each network interface, a number and an
+interface name, possibly followed by a text description of the
+interface, is printed. The interface name or the number can be supplied
+to the B<-i> flag to specify an interface on which to capture.
+
+This can be useful on systems that don't have a command to list them
+(e.g., Windows systems, or UNIX systems lacking B<ifconfig -a>);
+the number can be useful on Windows 2000 and later systems, where the
+interface name is a somewhat complex string.
+
+Note that "can capture" means that B<Ethereal> was able to open
+that device to do a live capture; if, on your system, a program doing a
+network capture must be run from an account with special privileges (for
+example, as root), then, if B<Ethereal> is run with the B<-D> flag and
+is not run from such an account, it will not list any interfaces.
+
+=item -f E<lt>capture filterE<gt>
Set the capture filter expression.
+=item -g E<lt>packet numberE<gt>
+
+After reading in a capture file using the B<-r> flag, go to the given I<packet number>.
+
=item -h
Print the version and options and exit.
-=item -i
+=item -i E<lt>capture interfaceE<gt>|-
Set the name of the network interface or pipe to use for live packet
-capture.
+capture.
Network interface names should match one of the names listed in
-"B<tethereal -D>". If you're using Unix, "B<netstat -i>" or "B<ifconfig
--a>" might also work to list interface names, although not all versions
-of Unix support the B<-a> flag to B<ifconfig>.
+"B<ethereal -D>" (described above); a number, as reported by
+"B<ethereal -D>", can also be used. If you're using UNIX, "B<netstat
+-i>" or "B<ifconfig -a>" might also work to list interface names,
+although not all versions of UNIX support the B<-a> flag to B<ifconfig>.
+
+If no interface is specified, B<Ethereal> searches the list of
+interfaces, choosing the first non-loopback interface if there are any
+non-loopback interfaces, and choosing the first loopback interface if
+there are no non-loopback interfaces. If there are no interfaces at all,
+B<Ethereal> reports an error and doesn't start the capture.
Pipe names should be either the name of a FIFO (named pipe) or ``-'' to
read data from the standard input. Data read from pipes must be in
standard libpcap format.
+Note: the Win32 version of B<Ethereal> doesn't support capturing from
+pipes or stdin!
+
=item -k
Start the capture session immediately. If the B<-i> flag was
List the data link types supported by the interface and exit.
-=item -m
+=item -m E<lt>fontE<gt>
Set the name of the font used by B<Ethereal> for most text. B<Ethereal>
will construct the name of the bold font used for the data in the byte
=item -n
Disable network object name resolution (such as hostname, TCP and UDP port
-names).
+names), the B<-N> flag might override this one.
-=item -N
+=item -N E<lt>name resolving flagsE<gt>
-Turn on name resolving for particular types of addresses and port
+Turn on name resolving only for particular types of addresses and port
numbers, with name resolving for other types of addresses and port
-numbers turned off; the argument is a string that may contain the
-letters B<m> to enable MAC address resolution, B<n> to enable network
-address resolution, and B<t> to enable transport-layer port number
-resolution. This overrides B<-n> if both B<-N> and B<-n> are present.
-The letter B<C> enables concurrent (asynchronous) DNS lookups.
+numbers turned off. This flag overrides B<-n> if both B<-N> and B<-n> are
+present. If both B<-N> and B<-n> flags are not present, all name resolutions are
+turned on.
+
+The argument is a string that may contain the letters:
+
+B<m> to enable MAC address resolution
+
+B<n> to enable network address resolution
+
+B<t> to enable transport-layer port number resolution
+
+B<C> to enable concurrent (asynchronous) DNS lookups
-=item -o
+=item -o E<lt>preference/recent settingE<gt>
-Set a preference value, overriding the default value and any value read
-from a preference file. The argument to the flag is a string of the
-form I<prefname>B<:>I<value>, where I<prefname> is the name of the
-preference (which is the same name that would appear in the preference
-file), and I<value> is the value to which it should be set.
+Set a preference or recent value, overriding the default value and any value
+read from a preference/recent file. The argument to the flag is a string of
+the form I<prefname>B<:>I<value>, where I<prefname> is the name of the
+preference/recent value (which is the same name that would appear in the
+preference/recent file), and I<value> is the value to which it should be set.
+Since B<Ethereal> 0.10.12, the recent settings replaces the formerly used
+-B, -P and -T flags to manipulate the GUI dimensions.
=item -p
broadcast traffic, and multicast traffic to addresses received by that
machine.
-=item -P
-
-Set the initial height of the packet list (top) pane.
-
=item -Q
Cause B<Ethereal> to exit after the end of capture session (useful in
batch mode with B<-c> option for instance); this option requires the
B<-i> and B<-w> parameters.
-=item -r
+=item -r E<lt>infileE<gt>
-Read packet data from I<infile>.
+Read packet data from I<infile>, can be any supported capture file format
+(including gzipped files). It's not possible to use named pipes or stdin
+here!
-=item -R
+=item -R E<lt>read (display) filterE<gt>
When reading a capture file specified with the B<-r> flag, causes the
specified filter (which uses the syntax of display filters, rather than
=item -S
-Perform the live packet capture in a separate process, and automatically
-update the packet display as packets are seen.
+Automatically update the packet display as packets are coming in.
-=item -s
+=item -s E<lt>capture snaplenE<gt>
Set the default snapshot length to use when capturing live data.
No more than I<snaplen> bytes of each network packet will be read into
memory, or saved to disk.
-=item -T
+=item -t ad|a|r|d
-Set the initial height of the packet details (middle) pane.
+Set the format of the packet timestamp displayed in the packet list
+window, the default is relative. The format can be one of:
-=item -t
+B<ad> absolute with date: The absolute date and time is the actual time and
+date the packet was captured
-Set the format of the packet timestamp displayed in the packet list
-window. The format can be one of 'r' (relative), 'a' (absolute), 'ad'
-(absolute with date), or 'd' (delta). The relative time is the time
-elapsed between the first packet and the current packet. The absolute
-time is the actual time the packet was captured, with no date displayed;
-the absolute date and time is the actual time and date the packet was
-captured. The delta time is the time since the previous packet was
-captured. The default is relative.
+B<a> absolute: The absolute time is the actual time the packet was captured,
+with no date displayed
+
+B<r> relative: The relative time is the time elapsed between the first packet
+and the current packet
+
+B<d> delta: The delta time is the time since the previous packet was
+captured
=item -v
Print the version and exit.
-=item -w
+=item -w E<lt>outfileE<gt>
Set the default capture file name.
-=item -y
+=item -y E<lt>capture link typeE<gt>
If a capture is started from the command line with B<-k>, set the data
link type to use while capturing packets. The values reported by B<-L>
are the values that can be used.
-=item -z
+=item -X E<lt>eXtension optionsE<gt>
+
+Specify an option to be passed to an B<Ethereal> module. The eXtension option
+is in the form I<extension_key>B<:>I<value>, where I<extension_key> can be:
+
+B<lua_script>:I<lua_script_filename> tells B<Ethereal> to load the given script in addition to the
+default Lua scripts.
+
+
+=item -z E<lt>statisticsE<gt>
Get B<Ethereal> to collect various types of statistics and display the result
in a window that updates in semi-real time.
=over 4
-=item File:Open, File:Open Recent, File:Close
+=item File:Open
+
+=item File:Open Recent
+
+=item File:Close
Open or close a capture file. The I<File:Open> dialog box
allows a filter to be specified; when the capture file is read, the
matching the filter are discarded. The I<File:Open Recent> is a submenu
and will show a list of previously opened files.
-=item File:Save, File:Save As
+=item File:Merge
+
+Merge another capture file to the currently loaded one. The I<File:Merge>
+dialog box allows the merge "Prepended", "Chronologically" or "Appended",
+relative to the already loaded one.
+
+=item File:Save
+
+=item File:Save As
Save the current capture, or the packets currently displayed from that
capture, to a file. Check boxes let you select whether to save all
currently displayed from that capture, can be saved), a file format in
which to save it.
+=item File:File Set:List Files
+
+Show a dialog box that list all files of the file set matching the currently
+loaded file. A file set is a compound of files resulting from a capture using
+the "multiple files" / "ringbuffer" mode, recognizable by the filename pattern,
+e.g.: Filename_00001_20050604101530.pcap.
+
+=item File:File Set:Next File
+
+=item File:File Set:Previous File
+
+If the currently loaded file is part of a file set (see above), open the
+next / previous file in that set.
+
=item File:Export
-Export captured data, currently very limited.
+Export captured data into an external format. Note: the data cannot be
+imported back into Ethereal, so be sure to keep the capture file.
=item File:Print
-Print, for a selectable range of packets in the current capture, either
-the summary line for the packet or the packet details view of the
-packet; when printing the packet details view, the hex dump of the
-packet can be printed as well. Printing options can be set with the
-I<Edit:Preferences> menu item, or in the dialog box popped up by this
-item.
+Print packet data from the current capture. You can select the range of
+packets to be printed (which packets are printed), and the output format of
+each packet (how each packet is printed). The output format will be similar
+to the displayed values, so a summary line, the packet details view, and/or
+the hex dump of the packet can be printed.
+
+Printing options can be set with the I<Edit:Preferences> menu item, or in the
+dialog box popped up by this menu item.
=item File:Quit
=item Edit:Find Next
-Search forward, starting with the currently selected packet
-(or the most recently selected packet, if no packet is selected), for a
-packet matching the filter from the previous search.
-
=item Edit:Find Previous
-Search backward, starting with the currently selected packet (or the
-most recently selected packet, if no packet is selected), for a packet
-matching the filter from the previous search.
+Search forward / backward for a packet matching the filter from the previous
+search, starting with the currently selected packet (or the most recently
+selected packet, if no packet is selected).
-=item Edit:Time Reference:Set Time Reference
+=item Edit:Time Reference:Set Time Reference (toggle)
Set (or unset if currently set) the selected packet as a Time Reference packet.
When a packet is set as a Time Reference packet, the timestamps in the packet
=item Edit:Time Reference:Find Next
-Find the next time referenced packet.
-
=item Edit:Time Reference:Find Previous
-Find the previously time referenced packet.
+Search forward / backward for a time referenced packet.
-=item Edit:Mark Packet
+=item Edit:Mark Packet (toggle)
Mark (or unmark if currently marked) the selected packet. The field
"frame.marked" is set for packets that are marked, so that, for example,
a display filters can be used to display only marked packets, and so that
-the L<Find Packet> menu item can be used to find the next or previous
+the L<Edit:Find Packet|/item_edit_3afind_packet> dialog can be used to find the next or previous
marked packet.
=item Edit:Mark All Packets
-Mark all packets that are currently displayed.
-
=item Edit:Unmark All Packets
-Unmark all packets that are currently displayed.
+Mark / Unmark all packets that are currently displayed.
=item Edit:Preferences
-Set the packet printing, column display, TCP stream coloring, and GUI
-options (see L<"Preferences"> below).
-
-=item Edit:Coloring Rules
-
-Change the foreground and background colors of the packet information in
-the list of packets, based upon display filters. The list of display
-filters is applied to each packet sequentially. After the first display
-filter matches a packet, any additional display filters in the list are
-ignored. Therefore, if you are filtering on the existence of protocols,
-you should list the higher-level protocols first, and the lower-level
-protocols last.
+Set the GUI, capture, printing and protocol options
+(see L<Preferences|/item_preferences> dialog below).
=item View:Main Toolbar
+
=item View:Filter Toolbar
-=item View:Status Bar
+
+=item View:Statusbar
Show or hide the main window controls.
=item View:Packet List
+
=item View:Packet Details
+
=item View:Packet Bytes
Show or hide the main window panes.
=item View:Time Display Format
-Set the format of the packet timestamp displayed in the packet list window
-to relative, absolute, absolute date and time, or delta.
+Set the format of the packet timestamp displayed in the packet list window.
+
+=item View:Name Resolution:Resolve Name
-=item View:Name Resolution
+Try to resolve a name for the currently seleted item.
+
+=item View:Name Resolution:Enable for ... Layer
Enable or disable translation of addresses to names in the display.
+=item View:Colorize Packet List
+
+Enable or disable the coloring rules. Disabling will improve performance.
+
=item View:Auto Scroll in Live Capture
Enable or disable the automatic scrolling of the
=item View:Zoom In
-Zoom into the main window data.
-
=item View:Zoom Out
-Zoom out of the main window data.
+Zoom into / out of the main window data (by changing the font size).
=item View:Normal Size
Reset the zoom factor of zoom in / zoom out back to normal font size.
-=item View:Collapse All
+=item View:Resize All Columns
+
+Resize all columns to best fit the current packet display.
+
+=item View:Expand Subtrees
-Collapse all branches of the packet details.
+Expands the currently selected item and it's subtrees in the packet details.
=item View:Expand All
-Expands all branches of the packet details.
+=item View:Collapse All
+
+Expand / Collapse all branches of the packet details.
+
+=item View:Coloring Rules
+
+Change the foreground and background colors of the packet information in
+the list of packets, based upon display filters. The list of display
+filters is applied to each packet sequentially. After the first display
+filter matches a packet, any additional display filters in the list are
+ignored. Therefore, if you are filtering on the existence of protocols,
+you should list the higher-level protocols first, and the lower-level
+protocols last.
=over
Packets are colored according to a list of color filters. Each filter
consists of a name, a filter expression and a coloration. A packet is
-colored according to the first filter that it matches, Color filter
+colored according to the first filter that it matches. Color filter
expressions use exactly the same syntax as display filter expressions.
-
-When Ethereal starts the color filters are loaded from:
-1. The user's personal color filters file or, if that does not exist,
-2. The global color filters file.
-If neither of these exist then the packets will not be colored.
-=item The Color Filters Dialog
-
-This dialog displays a list of color filters and allows it to be
-modified.
+When Ethereal starts, the color filters are loaded from:
=over
-=item THE FILTER LIST
-
-Single rows may be selected by clicking. Multiple rows may be selected
-by using the ctrl and shift keys in combination with the mouse button.
-
-=item NEW
-
-Adds a new filter at the bottom of the list and opens the Edit Color
-Filter dialog box. You will have to alter the filter expression at
-least before the filter will be accepted. The format of color filter
-expressions is identical to that of display filters. The new filter is
-selected, so it may immediately be moved up and down, deleted or edited.
-To avoid confusion all filters are unselected before the new filter is
-created.
-
-=item EDIT
-
-Opens the Edit Color Filter dialog box for the selected filter. (If this
-button is disabled you may have more than one filter selected, making it
-ambiguous which is to be edited.)
-
-=item DELETE
-
-Deletes the selected color filter(s).
-
-=item EXPORT
-
-Allows you to choose a file in which to save the current list of color
-filters. You may also choose to save only the selected filters. A
-button is provided to save the filters in the global color filters file
-(you must have sufficient permissions to write this file, of course).
-
-=item IMPORT
-
-Allows you to choose a file containing color filters which are then
-added to the bottom of the current list. All the added filters are
-selected, so they may be moved to the correct position in the list as a
-group. To avoid confusion, all filters are unselected before the new
-filters are imported. A button is provided to load the filters from the
-global color filters file.
-
-=item CLEAR
-
-Deletes your personal color filters file, reloads the global
-color filters file, if any, and closes the dialog.
-
-=item UP
-
-Moves the selected filter(s) up the list, making it more likely that
-they will be used to color packets.
-
-=item DOWN
-
-Moves the selected filter(s) down the list, making it less likely that
-they will be used to color packets.
-
-=item OK
-
-Closes the dialog and uses the color filters as they stand.
-
-=item APPLY
-
-Colors the packets according to the current list of color filters, but
-does not close the dialog.
-
-=item SAVE
-
-Saves the current list of color filters in your personal color filters
-file. Unless you do this they will not be used the next time you start
-Ethereal.
-
-=item CLOSE
+1. The user's personal color filters file or, if that does not exist,
-Closes the dialog without changing the coloration of the packets. Note
-that changes you have made to the current list of color filters are not
-undone.
+2. The global color filters file.
=back
+If neither of these exist then the packets will not be colored.
+
=back
=item View:Show Packet In New Window
Reload a capture file. Same as I<File:Close> and I<File:Open> the same
file again.
+=item Go:Back
+
+Go back in previously visited packets history.
+
+=item Go:Forward
+
+Go forward in previously visited packets history.
+
=item Go:Go To Packet
Go to a particular numbered packet.
=item Go:First Packet
-Go to the first packet in the capture.
-
=item Go:Last Packet
-Go to the last packet in the capture.
+Go to the first / last packet in the capture.
+
+=item Capture:Interfaces
+
+Shows a dialog box with all currently known interfaces and displaying the
+current network traffic amount. Capture sessions can be started from here.
+Beware: keeping this box open results in high system load!
+
+=item Capture:Options
+
+Initiate a live packet capture (see L<Capture Options|/item_capture_options>
+dialog below). If no filename is specified, a temporary file will be created
+to hold the capture. The location of the file can be chosen by setting your
+TMPDIR environment variable before starting B<Ethereal>. Otherwise, the
+default TMPDIR location is system-dependent, but is likely either F</var/tmp>
+or F</tmp>.
=item Capture:Start
-Initiate a live packet capture (see L<"Capture Options"> below). A
-temporary file will be created to hold the capture. The location of the
-file can be chosen by setting your TMPDIR environment variable before
-starting B<Ethereal>. Otherwise, the default TMPDIR location is
-system-dependent, but is likely either F</var/tmp> or F</tmp>.
+Start a live packet capture with the previously seleted options. This won't
+open the options dialog box, and can be convenient for repeatingly capturing
+with the same options.
=item Capture:Stop
-In a capture that updates the packet display as packets arrive (so that
-Ethereal responds to user input other than pressing the "Stop" button in
-the capture packet statistics dialog box), stop the capture.
+Stop a running live capture.
+
+=item Capture:Restart
+
+While a live capture is running, stop it and restart with the same options
+again. This can be convenient to remove unrelevant packets, if no valuable
+packets were captured so far.
=item Capture:Capture Filters
Edit the saved list of display filters, allowing filters to be added,
changed, or deleted.
-=item Analyze:Match
+=item Analyze:Apply as Filter
Create a display filter, or add to the display filter strip at the
bottom, a display filter based on the data currently highlighted in the
the display filter in the strip at the bottom an AND or OR operator
followed by the new display filter expression.
-=item Analyze:Prepare
+=item Analyze:Prepare a Filter
Create a display filter, or add to the display filter strip at the
bottom, a display filter based on the data currently highlighted in the
single display filter field can be specified.
The following restrictions apply to type and field combinations:
-SUM: available for all types of integers and will calculate the SUM of all
- occurences of this field in teh capture. Note that some field can
- occur multiple times in the same packet and then all instances will
- be summed up.
- Example: 'tcp.len' which will count the amount of payload data
- transferred across tcp in each interval.
+
+SUM: available for all types of integers and will calculate the SUM of
+all occurences of this field in the measurement interval. Note that
+some field can occur multiple times in the same packet and then all
+instances will be summed up. Example: 'tcp.len' which will count the
+amount of payload data transferred across TCP in each interval.
+
COUNT: available for all field types. This will COUNT the number of times
- a certain field occurs in each interval. Note that some fields
- may occur multiple times in each packet and if that is the case
- then each instance willb e counted independently and COUNT
- will be greater than the number of packets.
+certain field occurs in each interval. Note that some fields
+may occur multiple times in each packet and if that is the case
+then each instance will be counted independently and COUNT
+will be greater than the number of packets.
+
MAX: available for all integer and relative time fields. This will calculate
- the max seen integer/time value seen for the field during the interval.
- Example: 'smb.time' which will plot the maximum SMB response time.
+the max seen integer/time value seen for the field during the interval.
+Example: 'smb.time' which will plot the maximum SMB response time.
+
MIN: available for all integer and relative time fields. This will calculate
- the min seen integer/time value seen for the field during the interval.
- Example: 'smb.time' which will plot the minimum SMB response time.
-AVG: available for all integer and relative time fields.This will calculate
- the average seen integer/time value seen for the field during the
- interval.
- Example: 'smb.time' which will plot the average SMB response time.
-LOAD: available only for relative time fields (response times).
+the min seen integer/time value seen for the field during the interval.
+Example: 'smb.time' which will plot the minimum SMB response time.
+
+AVG: available for all integer and relative time fields.This will
+calculate the average seen integer/time value seen for the field during
+the interval. Example: 'smb.time' which will plot the average SMB
+response time.
+LOAD: available only for relative time fields (response times).
Example of advanced:
Display how NFS response time MAX/MIN/AVG changes over time:
-Set first graph to filter:nfs&&rpc.time Calc:MAX rpc.time
-Set second graph to filter:nfs&&rpc.time Calc:AVG rpc.time
-Set third graph to filter:nfs&&rpc.time Calc:MIN rpc.time
+Set first graph to:
+
+ filter:nfs&&rpc.time
+ Calc:MAX rpc.time
+
+Set second graph to
+
+ filter:nfs&&rpc.time
+ Calc:AVG rpc.time
+Set third graph to
+
+ filter:nfs&&rpc.time
+ Calc:MIN rpc.time
Example of advanced:
-Display how the average packetsize from host a.b.c.d changes over time.
+Display how the average packet size from host a.b.c.d changes over time.
-Set first graph to filter:ip.addr==a.b.c.d&&frame.pkt_len Calc:AVG frame.pkt_len
+Set first graph to
+ filter:ip.addr==a.b.c.d&&frame.pkt_len
+ Calc:AVG frame.pkt_len
LOAD:
The LOAD io-stat type is very different from anything you have ever seen
The higher the number, the more and faster is the client issuing new
commands. When the LOAD goes down, it may be due to client load making
the client slower in issuing new commands (there may be other reasons as
-well, maybe the client just dont have any commands it wants to issue
+well, maybe the client just doesn't have any commands it wants to issue
right then).
Load is measured in concurrency/number of overlapping i/o and the value
In each tick interval the amount of overlap is measured.
See the graph below containing three commands:
Below the graph are the LOAD values for each interval that would be calculated.
-| | | | | | | | |
-| | | | | | | | |
-| | o=====* | | | | | |
-| | | | | | | | |
-| o========* | o============* | | |
-| | | | | | | | |
---------------------------------------------------> Time
- 500 1500 500 750 1000 500 0 0
+ | | | | | | | | |
+ | | | | | | | | |
+ | | o=====* | | | | | |
+ | | | | | | | | |
+ | o========* | o============* | | |
+ | | | | | | | | |
+ --------------------------------------------------> Time
+ 500 1500 500 750 1000 500 0 0
=item Statistics:Conversation List
mouse button) ethereal will display a popup menu offering several different
filter operations to apply to the capture.
-
These statistics windows can also be invoked from the Ethereal command
line using the B<-z conv> argument.
List of supported protocols and display filter protocol fields.
-=item Help:About Plugins
+=item Help:Manual Pages
+
+Display locally installed HTML versions of these manual pages in a web browser.
-See what dynamically loadable dissector plugin modules have been loaded
-(see I<"Plugins"> below).
+=item Help:Ethereal Online
+
+Various links to online resources to be open in a web browser, like http://www.ethereal.com.
=item Help:About Ethereal
-What this is all about...
+See various information about Ethereal (see L<About|/item_about> dialog below), like the
+version, the folders used, the available plugins, ...
=back
=item Main Window
-The main window is split into three panes. You can resize each pane using
-a "thumb" at the right end of each divider line. Below the panes is a
-strip that shows the current filter and informational text.
+The main window contains the usual things like the menu, some toolbars, the
+main area and a statusbar. The main area is split into three panes, you can
+resize each pane using a "thumb" at the right end of each divider line.
+
+The main window is much more flexible than before. The layout of the main
+window can be customized by the I<Layout> page in the dialog box popped
+up by I<Edit:Preferences>, the following will describe the layout with the
+default settings.
=over 6
-=item Top Pane
+=item Main Toolbar
+
+Some menu items are available for quick access here. There is no way to
+customize the items in the toolbar, however the toolbar can be hidden by
+I<View:Main Toolbar>.
+
+=item Filter Toolbar
+
+A display filter can be entered into the filter toolbar.
+A filter for HTTP, HTTPS, and DNS traffic might look like this:
+
+ tcp.port == 80 || tcp.port == 443 || tcp.port == 53
+
+Selecting the I<Filter:> button lets you choose from a list of named
+filters that you can optionally save. Pressing the Return or Enter
+keys, or selecting the I<Apply> button, will cause the filter to be
+applied to the current list of packets. Selecting the I<Reset> button
+clears the display filter so that all packets are displayed (again).
+
+There is no way to customize the items in the toolbar, however the toolbar
+can be hidden by I<View:Filter Toolbar>.
+
+=item Packet List Pane
The top pane contains the list of network packets that you can scroll
through and select. By default, the packet number, packet timestamp,
The middle mouse button can be used to mark a packet.
-=item Middle Pane
+=item Packet Details Pane
The middle pane contains a display of the details of the
currently-selected packet. The display shows each field and its value
in each protocol header in the stack. The right mouse button can be
used to pop up a menu of operations.
-=item Bottom Pane
+=item Packet Bytes Pane
The lowest pane contains a hex and ASCII dump of the actual packet data.
Selecting a field in the packet details highlights the corresponding
The right mouse button can be used to pop up a menu of operations.
-=item Current Filter
-
-A display filter can be entered into the strip at the bottom.
-A filter for HTTP, HTTPS, and DNS traffic might look like this:
+=item Statusbar
- tcp.port == 80 || tcp.port == 443 || tcp.port == 53
+The statusbar is divided into two parts, on the left some context dependant
+things are shown, like information about the loaded file, on the right the
+number of packets are displayed: P = Packets captured/loaded, D = Displayed
+in packet list (after filtering), M = Marked by user.
-Selecting the I<Filter:> button lets you choose from a list of named
-filters that you can optionally save. Pressing the Return or Enter
-keys, or selecting the I<Apply> button, will cause the filter to be
-applied to the current list of packets. Selecting the I<Reset> button
-clears the display filter so that all packets are displayed.
+The statusbar can be hidden by I<View:Statusbar>.
=back
=over 6
-=item Printing Preferences
-
-The radio buttons at the top of the I<Printing> page allow you choose
-between printing packets with the I<File:Print Packet> menu item as text
-or PostScript, and sending the output directly to a command or saving it
-to a file. The I<Command:> text entry box, on UNIX-compatible systems,
-is the command to send files to (usually B<lpr>), and the I<File:> entry
-box lets you enter the name of the file you wish to save to.
-Additionally, you can select the I<File:> button to browse the file
-system for a particular save file.
-
-=item Column Preferences
-
-The I<Columns> page lets you specify the number, title, and format
-of each column in the packet list.
-
-The I<Column title> entry is used to specify the title of the column
-displayed at the top of the packet list. The type of data that the column
-displays can be specified using the I<Column format> option menu.
-The row of buttons on the left perform the following actions:
-
-=over 6
-
-=item Add New
-
-Adds a new column to the list.
-
-=item Delete
-
-Deletes the currently selected list item.
-
-=item Up / Down
-
-Moves the selected list item up or down one position.
-
-=item OK
-
-Currently has no effect.
-
-=item Save
-
-Saves the current column format as the default.
-
-=item Cancel
-
-Closes the dialog without making any changes.
-
-=back
-
-=item TCP Streams Preferences
-
-The I<TCP Streams> page can be used to change the color of the text
-displayed in the TCP stream window. To change a color, simply select
-an attribute from the "Set:" menu and use the color selector to get the
-desired color. The new text colors are displayed in a sample window.
-
=item User Interface Preferences
The I<User Interface> page is used to modify small aspects of the GUI to
"Always Open in Directory" allows the user to define a persistent directory
that the dialog will always default to.
-=item Directory:
+=item Directory
Allows the user to specify a persistent File Open directory. Trailing
slashes or backslashes will automatically be added.
-=item Fonts
+=back
+
+=item Layout Preferences
+
+The I<Layout> page lets you specify the general layout of the main window.
+You can choose from six different layouts and fill the three panes with the
+contents you like.
+
+=item Column Preferences
+
+The I<Columns> page lets you specify the number, title, and format
+of each column in the packet list.
+
+The I<Column title> entry is used to specify the title of the column
+displayed at the top of the packet list. The type of data that the column
+displays can be specified using the I<Column format> option menu.
+The row of buttons on the left perform the following actions:
+
+=over 6
+
+=item New
+
+Adds a new column to the list.
-The "Font..." button lets you select the font to be used for most text.
+=item Delete
+
+Deletes the currently selected list item.
-=item Colors
+=item Up / Down
-The "Colors..." button lets you select the colors to be used for instance
-for the marked packets.
+Moves the selected list item up or down one position.
=back
+=item Font Preferences
+
+The I<Font> page lets you select the font to be used for most text.
+
+=item Color Preferences
+
+The I<Colors> page can be used to change the color of the text
+displayed in the TCP stream window and for marked packets. To change a color,
+simply select an attribute from the "Set:" menu and use the color selector to
+get the desired color. The new text colors are displayed as a sample text.
+
=item Capture Preferences
The I<Capture> page lets you specify various parameters for capturing
list pane should automatically scroll to show the most recently captured
packets.
+=item Printing Preferences
+
+The radio buttons at the top of the I<Printing> page allow you choose
+between printing packets with the I<File:Print Packet> menu item as text
+or PostScript, and sending the output directly to a command or saving it
+to a file. The I<Command:> text entry box, on UNIX-compatible systems,
+is the command to send files to (usually B<lpr>), and the I<File:> entry
+box lets you enter the name of the file you wish to save to.
+Additionally, you can select the I<File:> button to browse the file
+system for a particular save file.
+
=item Protocol Preferences
There are also pages for various protocols that Ethereal dissects,
=item Save
-Saves the current filter list in F<$HOME/.ethereal/cfilters> on
-UNIX-compatible systems, and F<%APPDATA%\Ethereal\cfilters> (or, if
-%APPDATA% isn't defined,
-F<%USERPROFILE%\Application Data\Ethereal\cfilters>)
-on Windows systems, if the list of filters being edited is the list of
-capture filters, or in F<$HOME/.ethereal/dfilters> on UNIX-compatible
-systems, and F<%APPDATA%\Ethereal\dfilters> (or, if %APPDATA% isn't
-defined, F<%USERPROFILE%\Application Data\Ethereal\dfilters>) on Windows
-systems, if the list of filters being edited is the list of display
-filters.
+If the list of filters being edited is the list of
+capture filters, saves the current filter list to the personal capture
+filters file, and if the list of filters being edited is the list of
+display filters, saves the current filter list to the personal display
+filters file.
=item Close
=back
+=item The Color Filters Dialog
+
+This dialog displays a list of color filters and allows it to be
+modified.
+
+=over
+
+=item THE FILTER LIST
+
+Single rows may be selected by clicking. Multiple rows may be selected
+by using the ctrl and shift keys in combination with the mouse button.
+
+=item NEW
+
+Adds a new filter at the bottom of the list and opens the Edit Color
+Filter dialog box. You will have to alter the filter expression at
+least before the filter will be accepted. The format of color filter
+expressions is identical to that of display filters. The new filter is
+selected, so it may immediately be moved up and down, deleted or edited.
+To avoid confusion all filters are unselected before the new filter is
+created.
+
+=item EDIT
+
+Opens the Edit Color Filter dialog box for the selected filter. (If this
+button is disabled you may have more than one filter selected, making it
+ambiguous which is to be edited.)
+
+=item DELETE
+
+Deletes the selected color filter(s).
+
+=item EXPORT
+
+Allows you to choose a file in which to save the current list of color
+filters. You may also choose to save only the selected filters. A
+button is provided to save the filters in the global color filters file
+(you must have sufficient permissions to write this file, of course).
+
+=item IMPORT
+
+Allows you to choose a file containing color filters which are then
+added to the bottom of the current list. All the added filters are
+selected, so they may be moved to the correct position in the list as a
+group. To avoid confusion, all filters are unselected before the new
+filters are imported. A button is provided to load the filters from the
+global color filters file.
+
+=item CLEAR
+
+Deletes your personal color filters file, reloads the global
+color filters file, if any, and closes the dialog.
+
+=item UP
+
+Moves the selected filter(s) up the list, making it more likely that
+they will be used to color packets.
+
+=item DOWN
+
+Moves the selected filter(s) down the list, making it less likely that
+they will be used to color packets.
+
+=item OK
+
+Closes the dialog and uses the color filters as they stand.
+
+=item APPLY
+
+Colors the packets according to the current list of color filters, but
+does not close the dialog.
+
+=item SAVE
+
+Saves the current list of color filters in your personal color filters
+file. Unless you do this they will not be used the next time you start
+Ethereal.
+
+=item CLOSE
+
+Closes the dialog without changing the coloration of the packets. Note
+that changes you have made to the current list of color filters are not
+undone.
+
+=back
+
=item Capture Options
The I<Capture Options> dialog lets you specify various parameters for
MAC addresses, network addresses, and transport-layer port numbers
should be translated to names.
-=item Plugins
+=item About
-The I<Plugins> dialog lets you view the dissector plugin modules
+The I<About> dialog lets you view various information about Ethereal.
+
+=item About:Ethereal
+
+The I<Ethereal> page lets you view general information about Ethereal,
+like the installed version, licensing information and such.
+
+=item About:Authors
+
+The I<Authors> page shows the author and all contributors.
+
+=item About:Folders
+
+The I<Folders> page lets you view the directory names where Ethereal is
+searching it's various configuration and other files.
+
+=item About:Plugins
+
+The I<Plugins> page lets you view the dissector plugin modules
available on your system.
The I<Plugins List> shows the name and version of each dissector plugin
-module found on your system. The plugins are searched in the following
+module found on your system.
+
+On Unix-compatible systems, the plugins are looked for in the following
directories: the F<lib/ethereal/plugins/$VERSION> directory under the
main installation directory (for example,
-F</usr/local/lib/ethereal/plugins/$VERSION>),
-F</usr/lib/ethereal/plugins/$VERSION>,
-F</usr/local/lib/ethereal/plugins/$VERSION>, and
-F<$HOME/.ethereal/plugins> on UNIX-compatible systems, and in the
-F<plugins\$VERSION> directory under the main installation directory (for
-example, F<C:\Program Files\Ethereal\plugins\$VERSION>) and
-F<%APPDATA%\Ethereal\plugins\$VERSION> (or, if %APPDATA% isn't defined,
-F<%USERPROFILE%\Application Data\Ethereal\plugins\$VERSION>) on Windows
-systems; $VERSION is the version number of the plugin interface, which
+F</usr/local/lib/ethereal/plugins/$VERSION>), and then
+F<$HOME/.ethereal/plugins>.
+
+On Windows systems, the plugins are looked for in the following
+directories: F<plugins\$VERSION> directory under the main installation
+directory (for example, F<C:\Program Files\Ethereal\plugins\$VERSION>),
+and then F<%APPDATA%\Ethereal\plugins\$VERSION> (or, if %APPDATA% isn't
+defined, F<%USERPROFILE%\Application Data\Ethereal\plugins\$VERSION>).
+
+$VERSION is the version number of the plugin interface, which
is typically the version number of Ethereal. Note that a dissector
plugin module may support more than one protocol; there is not
necessarily a one-to-one correspondence between dissector plugin modules
=head1 CAPTURE FILTER SYNTAX
-See the tcpdump(8) manual page.
+See the manual page of I<tcpdump(8)>.
=head1 DISPLAY FILTER SYNTAX
For a complete table of protocol and protocol fields that are filterable
-in B<Ethereal> see ethereal-filter(4).
+in B<Ethereal> see the I<ethereal-filter(4)> manual page.
=head1 FILES
-The F<ethereal.conf> file, which is installed in the F<etc> directory
-under the main installation directory (for example, F</usr/local/etc>)
-on UNIX-compatible systems, and in the main installation directory (for
-example, F<C:\Program Files\Ethereal>) on Windows systems, and the
-personal preferences file, which is F<$HOME/.ethereal/preferences> on
+These files contains various B<Ethereal> configuration settings.
+
+=over 4
+
+=item Preferences
+
+The F<preferences> files contain global (system-wide) and personal
+preference settings. If the system-wide preference file exists, it is
+read first, overriding the default settings. If the personal preferences
+file exists, it is read next, overriding any previous values. Note: If
+the command line flag B<-o> is used (possibly more than once), it will
+in turn override values from the preferences files.
+
+The preferences settings are in the form I<prefname>B<:>I<value>,
+one per line,
+where I<prefname> is the name of the preference
+and I<value> is the value to
+which it should be set; white space is allowed between B<:> and
+I<value>. A preference setting can be continued on subsequent lines by
+indenting the continuation lines with white space. A B<#> character
+starts a comment that runs to the end of the line:
+
+ # Vertical scrollbars should be on right side?
+ # TRUE or FALSE (case-insensitive).
+ gui.scrollbar_on_right: TRUE
+
+The global preferences file is looked for in the F<ethereal> directory
+under the F<share> subdirectory of the main installation directory (for
+example, F</usr/local/share/ethereal/preferences>) on UNIX-compatible
+systems, and in the main installation directory (for example,
+F<C:\Program Files\Ethereal\preferences>) on Windows systems.
+
+The personal preferences file is looked for in F<$HOME/.ethereal/preferences> on
UNIX-compatible systems and F<%APPDATA%\Ethereal\preferences> (or, if
-%APPDATA% isn't defined,
-F<%USERPROFILE%\Application Data\Ethereal\preferences>) on
-Windows systems, contain system-wide and personal preference settings,
-respectively. The file contains preference settings of the form
-I<prefname>B<:>I<value>, one per line, where I<prefname> is the name of
-the preference (which is the same name that would appear in the
-preference file), and I<value> is the value to which it should be set;
-white space is allowed between B<:> and I<value>. A preference setting
-can be continued on subsequent lines by indenting the continuation lines
-with white space. A B<#> character starts a comment that runs to the
-end of the line.
-
-The system-wide preference file is read first, if it exists, overriding
-B<Ethereal>'s default values; the personal preferences file is then
-read, if it exists, overriding default values and values read from the
-system-wide preference file.
-
-Note that whenever the preferences are saved by using the I<Save> button
+%APPDATA% isn't defined, F<%USERPROFILE%\Application
+Data\Ethereal\preferences>) on Windows systems.
+
+Note: Whenever the preferences are saved by using the I<Save> button
in the I<Edit:Preferences> dialog box, your personal preferences file
-will be overwritten with the new settings, destroying any comments that
-were in the file.
+will be overwritten with the new settings, destroying any comments and
+unknown/obsolete settings that were in the file.
+
+=item Recent
+
+The F<recent> file contains personal settings (mostly GUI related) such
+as the current B<Ethereal> window size. The file is saved at program exit and
+read in at program start automatically. Note: The command line flag B<-o>
+may be used to override settings from this file.
+
+The settings in this file have the same format as in the F<preferences>
+files, and the same directory as for the personal preferences file is
+used.
+
+Note: Whenever Ethereal is closed, your recent file
+will be overwritten with the new settings, destroying any comments and
+unknown/obsolete settings that were in the file.
-The disabled protocols file, which is F<$HOME/.ethereal/disabled_protos>
-on UNIX-compatible systems and F<%APPDATA%\Ethereal\disabled_protos>
-(or, if %APPDATA% isn't defined, F<%USERPROFILE%\Application
-Data\Ethereal\disabled_protos>) on Windows systems, contain a list of
+=item Disabled (Enabled) Protocols
+
+The F<disabled_protos> files contain system-wide and personal lists of
protocols that have been disabled, so that their dissectors are never
-called. The file contains protocol names, one per line, where the
+called. The files contain protocol names, one per line, where the
protocol name is the same name that would be used in a display filter
-for the protocol. A B<#> character starts a comment that runs to the
-end of the line.
+for the protocol:
-Note that whenever the disabled protocols list is saved by using the
-I<Save> button in the I<Edit:Protocols> dialog box, your disabled
-protocols file will be overwritten with the new settings, destroying any
-comments that were in the file.
+ http
+ tcp # a comment
-The F<ethers> file, which is found in the F</etc> directory on
-UNIX-compatible systems, and in the main installation directory (for
-example, F<C:\Program Files\Ethereal>) on Windows systems, is consulted
-to correlate 6-byte hardware addresses to names. If an address is not
-found in the F<ethers> file, the F<$HOME/.ethereal/ethers> file on
-UNIX-compatible systems, and the F<%APPDATA%\Ethereal\ethers> file (or, if
-%APPDATA% isn't defined, the
-F<%USERPROFILE%\Application Data\Ethereal\ethers> file) on Windows
-systems is consulted next. Each line contains one hardware
-address and name, separated by whitespace. The digits of the hardware
-address are separated by either a colon (:), a dash (-), or a period
-(.). The following three lines are valid lines of an ethers file:
+If a protocol is listed in the global F<disabled_protos> file, it is not
+displayed in the I<Analyze:Enabled Protocols> dialog box, and so cannot
+be enabled by the user.
+
+The global F<disabled_protos> file uses the same directory as the global
+preferences file.
+
+The personal F<disabled_protos> file uses the same directory as the
+personal preferences file.
+
+Note: Whenever the disabled protocols list is saved by using the I<Save>
+button in the I<Analyze:Enabled Protocols> dialog box, your personal
+disabled protocols file will be overwritten with the new settings,
+destroying any comments that were in the file.
+
+=item Name Resolution (hosts)
+
+If the personal F<hosts> file exists, it is
+used to resolve IPv4 and IPv6 addresses before any other
+attempts are made to resolve them. The file has the standard F<hosts>
+file syntax; each line contains one IP address and name, separated by
+whitespace. The same directory as for the personal preferences file is used.
+
+=item Name Resolution (ethers)
+
+The F<ethers> files are consulted to correlate 6-byte hardware addresses to
+names. First the personal F<ethers> file is tried and if an address is not
+found there the global F<ethers> file is tried next.
+
+Each line contains one hardware address and name, separated by
+whitespace. The digits of the hardware address are separated by colons
+(:), dashes (-) or periods (.). The same separator character must be
+used consistently in an address. The following three lines are valid
+lines of an F<ethers> file:
ff:ff:ff:ff:ff:ff Broadcast
c0-00-ff-ff-ff-ff TR_broadcast
00.00.00.00.00.00 Zero_broadcast
-The F<manuf> file, which is installed in the F<etc> directory under the
-main installation directory (for example, F</usr/local/etc>) on
+The global F<ethers> file is looked for in the F</etc> directory on
UNIX-compatible systems, and in the main installation directory (for
-example, F<C:\Program Files\Ethereal>) on Windows systems, matches the
-3-byte vendor portion of a 6-byte hardware address with the
-manufacturer's name; it can also contain well-known MAC addresses and
-address ranges specified with a netmask. The format of the file is the
-same as the F<ethers> file, except that entries of the form
+example, F<C:\Program Files\Ethereal>) on Windows systems.
+
+The personal F<ethers> file is looked for in the same directory as the personal
+preferences file.
+
+=item Name Resolution (manuf)
+
+The F<manuf> file is used to match the 3-byte vendor portion of a 6-byte
+hardware address with the manufacturer's name; it can also contain well-known
+MAC addresses and address ranges specified with a netmask. The format of the
+file is the same as the F<ethers> files, except that entries such as:
00:00:0C Cisco
can be provided, with the 3-byte OUI and the name for a vendor, and
-entries of the form
+entries such as:
00-00-0C-07-AC/40 All-HSRP-routers
can be specified, with a MAC address and a mask indicating how many bits
-of the address must match. Trailing zero bytes can be omitted from
-address ranges. That entry, for example, will match addresses from
-00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
+of the address must match. The above entry, for example, has 40
+significant bits, or 5 bytes, and would match addresses from
+00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
multiple of 8.
-The F<ipxnets> file, which is found in the F</etc> directory on
-UNIX-compatible systems, and in the main installation directory (for
-example, F<C:\Program Files\Ethereal>) on Windows systems, correlates
-4-byte IPX network numbers to names. If a network number is not found
-in the F<ipxnets> file, the F<$HOME/.ethereal/ipxnets> file on
-UNIX-compatible systems, and the F<%APPDATA%\Ethereal\ipxnets> file (or,
-if %APPDATA% isn't defined, the
-F<%USERPROFILE%\Application Data\Ethereal\ipxnets> file)
-on Windows systems, is consulted next. The format is the same as the
-F<ethers> file, except that each address if four bytes instead of six.
-Additionally, the address can be represented a single hexadecimal
+The F<manuf> file is looked for in the same directory as the global
+preferences file.
+
+=item Name Resolution (ipxnets)
+
+The F<ipxnets> files are used to correlate 4-byte IPX network numbers to
+names. First the global F<ipxnets> file is tried and if that address is not
+found there the personal one is tried next.
+
+The format is the same as the F<ethers>
+file, except that each address is four bytes instead of six.
+Additionally, the address can be represented as a single hexadecimal
number, as is more common in the IPX world, rather than four hex octets.
-For example, these four lines are valid lines of an ipxnets file.
+For example, these four lines are valid lines of an F<ipxnets> file:
C0.A8.2C.00 HR
c0-a8-1c-00 CEO
00:00:BE:EF IT_Server1
110f FileServer3
-The global color filters file, F<colorfilters>, which is installed in
-the F<etc> directory under the main installation directory (for example,
-F</usr/local/etc>) on UNIX-compatible systems, and in the main
-installation directory (for example, F<C:\Program Files\Ethereal>) on
-Windows systems, and the personal color filters file, which is
-F<$HOME/.ethereal/colorfilters> on UNIX-compatible systems and
-F<%APPDATA%\Ethereal\colorfilters> (or, if %APPDATA% isn't defined,
-F<%USERPROFILE%\Application Data\Ethereal\color filters>) on Windows
-systems, contain system-wide and personal color filters,
-respectively.
+The global F<ipxnets> file is looked for in the F</etc> directory on
+UNIX-compatible systems, and in the main installation directory (for
+example, F<C:\Program Files\Ethereal>) on Windows systems.
+
+The personal F<ipxnets> file is looked for in the same directory as the
+personal preferences file.
+
+=item Capture Filters
+
+The F<cfilters> files contain system-wide and personal capture filters.
+Each line contains one filter, starting with the string displayed in the
+dialog box in quotation marks, followed by the filter string itself:
+
+ "HTTP" port 80
+ "DCERPC" port 135
+
+The global F<cfilters> file uses the same directory as the
+global preferences file.
+
+The personal F<cfilters> file uses the same directory as the personal
+preferences file. It is written through the Capture:Capture Filters
+dialog.
+
+If the global F<cfilters> file exists, it is used only if the personal
+F<cfilters> file does not exist; global and personal capture filters are
+not merged.
+
+=item Display Filters
+
+The F<dfilters> files contain system-wide and personal display filters.
+Each line contains one filter, starting with the string displayed in the
+dialog box in quotation marks, followed by the filter string itself:
+
+ "HTTP" http
+ "DCERPC" dcerpc
+
+The global F<dfilters> file uses the same directory as the
+global preferences file.
+
+The personal F<dfilters> file uses the same directory as the
+personal preferences file. It is written through the Analyze:Display
+Filters dialog.
+
+If the global F<dfilters> file exists, it is used only if the personal
+F<dfilters> file does not exist; global and personal display filters are
+not merged.
+
+=item Color Filters (Coloring Rules)
+
+The F<colorfilters> files contain system-wide and personal color filters.
+Each line contains one filter, starting with the string displayed in the
+dialog box, followed by the corresponding display filter. Then the
+background and foreground colors are appended:
+
+ # a comment
+ @tcp@tcp@[59345,58980,65534][0,0,0]
+ @udp@udp@[28834,57427,65533][0,0,0]
+
+The global F<colorfilters> file uses the same directory as the
+global preferences file.
+
+The personal F<colorfilters> file uses the same directory as the
+personal preferences file. It is written through the View:Coloring Rules
+dialog.
+
+If the global F<colorfilters> file exists, it is used only if the personal
+F<colorfilters> file does not exist; global and personal color filters are
+not merged.
+
+=item GTK rc files
+
+The F<gtkrc> files contain system-wide and personal GTK theme settings.
+
+The global F<gtkrc> file uses the same directory as the
+global preferences file.
+
+The personal F<gtkrc> file uses the same directory as the personal
+preferences file.
+
+=item Plugins
+
+See above in the description of the About:Plugins page.
+
+=back
=head1 SEE ALSO
=head1 AUTHORS
- Original Author
- -------- ------
- Gerald Combs <gerald[AT]ethereal.com>
-
-
- Contributors
- ------------
- Gilbert Ramirez <gram[AT]alumni.rice.edu>
- Hannes R. Boehm <hannes[AT]boehm.org>
- Mike Hall <mike [AT] hallzone.net>
- Bobo Rajec <bobo[AT]bsp-consulting.sk>
- Laurent Deniel <laurent.deniel[AT]free.fr>
- Don Lafontaine <lafont02[AT]cn.ca>
- Guy Harris <guy[AT]alum.mit.edu>
- Simon Wilkinson <sxw[AT]dcs.ed.ac.uk>
- Joerg Mayer <jmayer[AT]loplof.de>
- Martin Maciaszek <fastjack[AT]i-s-o.net>
- Didier Jorand <Didier.Jorand[AT]alcatel.fr>
- Jun-ichiro itojun Hagino <itojun[AT]itojun.org>
- Richard Sharpe <sharpe[AT]ns.aus.com>
- John McDermott <jjm[AT]jkintl.com>
- Jeff Jahr <jjahr[AT]shastanets.com>
- Brad Robel-Forrest <bradr[AT]watchguard.com>
- Ashok Narayanan <ashokn[AT]cisco.com>
- Aaron Hillegass <aaron[AT]classmax.com>
- Jason Lango <jal[AT]netapp.com>
- Johan Feyaerts <Johan.Feyaerts[AT]siemens.atea.be>
- Olivier Abad <oabad[AT]noos.fr>
- Thierry Andry <Thierry.Andry[AT]advalvas.be>
- Jeff Foster <jfoste[AT]woodward.com>
- Peter Torvals <petertv[AT]xoommail.com>
- Christophe Tronche <ch.tronche[AT]computer.org>
- Nathan Neulinger <nneul[AT]umr.edu>
- Tomislav Vujec <tvujec[AT]carnet.hr>
- Kojak <kojak[AT]bigwig.net>
- Uwe Girlich <Uwe.Girlich[AT]philosys.de>
- Warren Young <tangent[AT]mail.com>
- Heikki Vatiainen <hessu[AT]cs.tut.fi>
- Greg Hankins <gregh[AT]twoguys.org>
- Jerry Talkington <jtalkington[AT]users.sourceforge.net>
- Dave Chapeskie <dchapes[AT]ddm.on.ca>
- James Coe <jammer[AT]cin.net>
- Bert Driehuis <driehuis[AT]playbeing.org>
- Stuart Stanley <stuarts[AT]mxmail.net>
- John Thomes <john[AT]ensemblecom.com>
- Laurent Cazalet <laurent.cazalet[AT]mailclub.net>
- Thomas Parvais <thomas.parvais[AT]advalvas.be>
- Gerrit Gehnen <G.Gehnen[AT]atrie.de>
- Craig Newell <craign[AT]cheque.uq.edu.au>
- Ed Meaney <emeaney[AT]cisco.com>
- Dietmar Petras <DPetras[AT]ELSA.de>
- Fred Reimer <fwr[AT]ga.prestige.net>
- Florian Lohoff <flo[AT]rfc822.org>
- Jochen Friedrich <jochen+ethereal[AT]scram.de>
- Paul Welchinski <paul.welchinski[AT]telusplanet.net>
- Doug Nazar <nazard[AT]dragoninc.on.ca>
- Andreas Sikkema <h323 [AT] ramdyne.nl>
- Mark Muhlestein <mmm[AT]netapp.com>
- Graham Bloice <graham.bloice[AT]trihedral.com>
- Ralf Schneider <ralf.schneider[AT]alcatel.se>
- Yaniv Kaul <ykaul[AT]netvision.net.il>
- Paul Ionescu <paul[AT]acorp.ro>
- Mark Burton <markb[AT]ordern.com>
- Stefan Raab <sraab[AT]cisco.com>
- Mark Clayton <clayton[AT]shore.net>
- Michael Rozhavsky <mike[AT]tochna.technion.ac.il>
- Dug Song <dugsong[AT]monkey.org>
- Michael Tuexen <Michael.Tuexen [AT] siemens.com>
- Bruce Korb <bkorb[AT]sco.com>
- Jose Pedro Oliveira <jpo[AT]di.uminho.pt>
- David Frascone <dave[AT]frascone.com>
- Peter Kjellerstedt <pkj[AT]axis.com>
- Phil Techau <phil_t[AT]altavista.net>
- Wes Hardaker <wjhardaker[AT]ucdavis.edu>
- Robert Tsai <rtsai[AT]netapp.com>
- Craig Metz <cmetz[AT]inner.net>
- Per Flock <per.flock[AT]axis.com>
- Jack Keane <jkeane[AT]OpenReach.com>
- Brian Wellington <bwelling[AT]xbill.org>
- Santeri Paavolainen <santtu[AT]ssh.com>
- Ulrich Kiermayr <uk[AT]ap.univie.ac.at>
- Neil Hunter <neil.hunter[AT]energis-squared.com>
- Ralf Holzer <ralf[AT]well.com>
- Craig Rodrigues <rodrigc [AT] attbi.com>
- Ed Warnicke <hagbard[AT]physics.rutgers.edu>
- Johan Jorgensen <johan.jorgensen[AT]axis.com>
- Frank Singleton <frank.singleton[AT]ericsson.com>
- Kevin Shi <techishi[AT]ms22.hinet.net>
- Mike Frisch <mfrisch[AT]isurfer.ca>
- Burke Lau <burke_lau[AT]agilent.com>
- Martti Kuparinen <martti.kuparinen[AT]iki.fi>
- David Hampton <dhampton[AT]mac.com>
- Kent Engström <kent[AT]unit.liu.se>
- Ronnie Sahlberg <sahlberg[AT]optushome.com.au>
- Borosa Tomislav <tomislav.borosa[AT]SIEMENS.HR>
- Alexandre P. Ferreira <alexandref[AT]tcoip.com.br>
- Simharajan Srishylam <Simharajan.Srishylam[AT]netapp.com>
- Greg Kilfoyle <gregk[AT]redback.com>
- James E. Flemer <jflemer[AT]acm.jhu.edu>
- Peter Lei <peterlei[AT]cisco.com>
- Thomas Gimpel <thomas.gimpel[AT]ferrari.de>
- Albert Chin <china[AT]thewrittenword.com>
- Charles Levert <charles[AT]comm.polymtl.ca>
- Todd Sabin <tas[AT]webspan.net>
- Eduardo Pérez Ureta <eperez[AT]dei.inf.uc3m.es>
- Martin Thomas <martin_a_thomas[AT]yahoo.com>
- Hartmut Mueller <hartmut[AT]wendolene.ping.de>
- Michal Melerowicz <Michal.Melerowicz[AT]nokia.com>
- Hannes Gredler <hannes[AT]juniper.net>
- Inoue <inoue[AT]ainet.or.jp>
- Olivier Biot <Olivier.Biot[AT]siemens.com>
- Patrick Wolfe <pjw[AT]zocalo.cellular.ameritech.com>
- Martin Held <Martin.Held[AT]icn.siemens.de>
- Riaan Swart <rswart[AT]cs.sun.ac.za>
- Christian Lacunza <celacunza[AT]gmx.net>
- Scott Renfro <scott[AT]renfro.org>
- Juan Toledo <toledo[AT]users.sourceforge.net>
- Jean-Christian Pennetier <jeanchristian.pennetier[AT]rd.francetelecom.fr>
- Jian Yu <bgp4news[AT]yahoo.com>
- Eran Mann <emann[AT]opticalaccess.com>
- Andy Hood <ajhood [AT] fl.net.au>
- Randy McEoin <rmceoin[AT]pe.net>
- Edgar Iglesias <edgar.iglesias[AT]axis.com>
- Martina Obermeier <Martina.Obermeier[AT]icn.siemens.de>
- Javier Achirica <achirica[AT]ttd.net>
- B. Johannessen <bob[AT]havoq.com>
- Thierry Pelle <thierry.pelle[AT]laposte.net>
- Francisco Javier Cabello <fjcabello[AT]vtools.es>
- Laurent Rabret <laurent.rabret[AT]rd.francetelecom.fr>
- nuf si <gnippiks[AT]yahoo.com>
- Jeff Morriss <jeff.morriss[AT]ulticom.com>
- Aamer Akhter <aakhter[AT]cisco.com>
- Pekka Savola <pekkas[AT]netcore.fi>
- David Eisner <cradle[AT]Glue.umd.edu>
- Steve Dickson <steved[AT]talarian.com>
- Markus Seehofer <mseehofe[AT]nt.hirschmann.de>
- Lee Berger <lberger[AT]roy.org>
- Motonori Shindo <mshindo[AT]mshindo.net>
- Terje Krogdahl <tekr[AT]nextra.com>
- Jean-Francois Mule <jfm[AT]cablelabs.com>
- Thomas Wittwer <thomas.wittwer[AT]iclip.ch>
- Matthias Nyffenegger <matthias.nyffenegger[AT]iclip.ch>
- Palle Lyckegaard <Palle[AT]lyckegaard.dk>
- Nicolas Balkota <balkota[AT]mac.com>
- Tom Uijldert <Tom.Uijldert[AT]cmg.nl>
- Akira Endoh <endoh[AT]netmarks.co.jp>
- Graeme Hewson <graeme.hewson[AT]oracle.com>
- Pasi Eronen <pe[at]iki.fi>
- Georg von Zezschwitz <gvz[AT]2scale.net>
- Steffen Weinreich <steve[AT]weinreich.org>
- Marc Milgram <ethereal[AT]mmilgram.NOSPAMmail.net>
- Gordon McKinney <gordon[AT]night-ray.com>
- Tim Farley <tfarley[AT]iss.net>
- Daniel Thompson <daniel.thompson[AT]st.com>
- Chris Jepeway <thai-dragon[AT]eleven29.com>
- Pavel Novotny <Pavel.Novotny[AT]icn.siemens.de>
- Shinsuke Suzuki <suz[AT]kame.net>
- Andrew C. Feren <aferen[AT]cetacean.com>
- Tomas Kukosa <tomas.kukosa [AT] siemens.com>
- Andreas Stockmeier <a.stockmeier[AT]avm.de>
- Pekka Nikander <pekka.nikander[AT]nomadiclab.com>
- Hamish Moffatt <hamish[AT]cloud.net.au>
- Kazushi Sugyo <k-sugyou[AT]nwsl.mesh.ad.jp>
- Tim Potter <tpot[AT]samba.org>
- Raghu Angadi <rangadi[AT]inktomi.com>
- Taisuke Sasaki <sasaki[AT]soft.net.fujitsu.co.jp>
- Tim Newsham <newsham[AT]lava.net>
- Tom Nisbet <Tnisbet[AT]VisualNetworks.com>
- Darren New <dnew[AT]san.rr.com>
- Pavel Mores <pvl[AT]uh.cz>
- Bernd Becker <bb[AT]bernd-becker.de>
- Heinz Prantner <Heinz.Prantner[AT]radisys.com>
- Irfan Khan <ikhan[AT]qualcomm.com>
- Jayaram V.R <vjayar[AT]cisco.com>
- Dinesh Dutt <ddutt[AT]cisco.com>
- Nagarjuna Venna <nvenna[AT]Brixnet.com>
- Jirka Novak <j.novak[AT]netsystem.cz>
- Ricardo Barroetaveña <rbarroetavena[AT]veufort.com>
- Alan Harrison <alanharrison[AT]mail.com>
- Mike Frantzen <frantzen[AT]w4g.org>
- Charlie Duke <cduke[AT]fvc.com>
- Alfred Arnold <Alfred.Arnold[AT]elsa.de>
- Dermot Bradley <dermot.bradley[AT]openwave.com>
- Adam Sulmicki <adam[AT]cfar.umd.edu>
- Kari Tiirikainen <kari.tiirikainen[AT]nokia.com>
- John Mackenzie <John.A.Mackenzie[AT]t-online.de>
- Peter Valchev <pvalchev[AT]openbsd.org>
- Alex Rozin <Arozin[AT]mrv.com>
- Jouni Malinen <jkmaline[AT]cc.hut.fi>
- Paul E. Erkkila <pee[AT]erkkila.org>
- Jakob Schlyter <jakob[AT]openbsd.org>
- Jim Sienicki <sienicki[AT]issanni.com>
- Steven French <sfrench[AT]us.ibm.com>
- Diana Eichert <deicher[AT]sandia.gov>
- Blair Cooper <blair[AT]teamon.com>
- Kikuchi Ayamura <ayamura[AT]ayamura.org>
- Didier Gautheron <dgautheron[AT]magic.fr>
- Phil Williams <csypbw[AT]comp.leeds.ac.uk>
- Kevin Humphries <khumphries[AT]networld.com>
- Erik Nordström <erik.nordstrom[AT]it.uu.se>
- Devin Heitmueller <dheitmueller[AT]netilla.com>
- Chenjiang Hu <chu[AT]chiaro.com>
- Kan Sasaki <sasaki[AT]fcc.ad.jp>
- Stefan Wenk <stefan.wenk[AT]gmx.at>
- Ruud Linders <ruud[AT]lucent.com>
- Andrew Esh <Andrew.Esh[AT]tricord.com>
- Greg Morris <GMORRIS[AT]novell.com>
- Dirk Steinberg <dws[AT]dirksteinberg.de>
- Kari Heikkila <kari.o.heikkila[AT]nokia.com>
- Olivier Dreux <Olivier.Dreux[AT]alcatel.fr>
- Michael Stiller <ms[AT]2scale.net>
- Antti Tuominen <ajtuomin[AT]tml.hut.fi>
- Martin Gignac <lmcgign[AT]mobilitylab.net>
- John Wells <wells[AT]ieee.org>
- Loic Tortay <tortay[AT]cc.in2p3.fr>
- Steve Housley <Steve_Housley[AT]eur.3com.com>
- Peter Hawkins <peter[AT]hawkins.emu.id.au>
- Bill Fumerola <billf[AT]FreeBSD.org>
- Chris Waters <chris[AT]waters.co.nz>
- Solomon Peachy <pizza[AT]shaftnet.org>
- Jaime Fournier <Jaime.Fournier [AT] hush.com>
- Markus Steinmann <ms[AT]seh.de>
- Tsutomu Mieno <iitom[AT]utouto.com>
- Yasuhiro Shirasaki <yasuhiro[AT]gnome.gr.jp>
- Anand V. Narwani <anand[AT]narwani.org>
- Christopher K. St. John <cks[AT]distributopia.com>
- Nix <nix[AT]esperi.demon.co.uk>
- Liviu Daia <Liviu.Daia[AT]imar.ro>
- Richard Urwin <rurwin[AT]schenck.co.uk>
- Prabhakar Krishnan <Prabhakar.Krishnan[AT]netapp.com>
- Jim McDonough <jmcd[AT]us.ibm.com>
- Sergei Shokhor <sshokhor[AT]uroam.com>
- Hidetaka Ogawa <ogawa[AT]bs2.qnes.nec.co.jp>
- Jan Kratochvil <short[AT]ucw.cz>
- Alfred Koebler <ak[AT]icon-sult.de>
- Vassilii Khachaturov <Vassilii.Khachaturov[AT]comverse.com>
- Bill Studenmund <wrstuden[AT]wasabisystems.com>
- Brian Bruns <camber[AT]ais.org>
- Flavio Poletti <flavio[AT]polettix.it>
- Marcus Haebler <haeblerm[AT]yahoo.com>
- Ulf Lamping <ulf.lamping[AT]web.de>
- Matthew Smart <smart[AT]monkey.org>
- Luke Howard <lukeh[AT]au.padl.com>
- PC Drew <drewpc[AT]ibsncentral.com>
- Renzo Tomas <renzo.toma [AT] xs4all.nl>
- Clive A. Stubbings <eth[AT]vjet.demon.co.uk>
- Steve Langasek <vorlon [AT] netexpress.net>
- Brad Hards <bhards[AT]bigpond.net.au>
- cjs 2895 <cjs2895[AT]hotmail.com>
- Lutz Jaenicke <Lutz.Jaenicke [AT] aet.TU-Cottbus.DE>
- Senthil Kumar Nagappan <sknagappan [AT] yahoo.com>
- Jason House <jhouse [AT] mitre.org>
- Peter Fales <psfales [AT] lucent.com>
- Fritz Budiyanto <fritzb88 [AT] yahoo.com>
- Jean-Baptiste Marchand <Jean-Baptiste.Marchand [AT] hsc.fr>
- Andreas Trauer <andreas.trauer [AT] siemens.com>
- Ronald Henderson <Ronald.Henderson [AT] CognicaseUSA.com>
- Brian Ginsbach <ginsbach [AT] cray.com>
- Dave Richards <d_m_richards [AT] attbi.com>
- Martin Regner <martin.regner [AT] chello.se>
- Jason Greene <jason [AT] inetgurus.net>
- Marco Molteni <mmolteni [AT] cisco.com>
- James Harris <jharris [AT] fourhorsemen.org>
- rmkml <rmkml [AT] wanadoo.fr>
- Anders Broman <anders.broman [AT] ericsson.com>
- Christian Falckenberg <christian.falckenberg [AT] nortelnetworks.com>
- Huagang Xie <xie [AT] lids.org>
- cjs 2895 <cjs2895 [AT] hotmail.com>
- Pasi Kovanen <Pasi.Kovanen [AT] tahoenetworks.fi>
- Teemu Rinta-aho <teemu.rinta-aho [AT] nomadiclab.com>
- Martijn Schipper <martijn.schipper [AT] intersil.com>
- Wayne Parrott <wayne_p [AT] pacific.net.au>
- Laurent Meyer <laurent.meyer6 [AT] wanadoo.fr>
- Lars Roland <Lars.Roland [AT] gmx.net>
- Miha Jemec <m.jemec [AT] iskratel.si>
- Markus Friedl <markus [AT] openbsd.org>
- Todd Montgomery <tmontgom [AT] tibco.com>
- emre <emre [AT] flash.net>
- Stephen Shelley <steve.shelley [AT] attbi.com>
- Erwin Rol <erwin [AT] muffin.org>
- Duncan Laurie <duncan [AT] sun.com>
- Tony Schene <schene [AT] pcisys.net>
- Matthijs Melchior <mmelchior [AT] xs4all.nl>
- Garth Bushell <gbushell [AT] elipsan.com>
- Mark C. Brown <mbrown [AT] nosila.net>
- Can Erkin Acar <canacar [AT] eee.metu.edu.tr>
- Martin Warnes <martin.warnes [AT] ntlworld.com>
- J Bruce Fields <bfields [AT] fieldses.org>
- tz <tz1 [AT] mac.com>
- Jeff Liu <jqliu [AT] broadcom.com>
- Niels Koot <Niels.Koot [AT] logicacmg.com>
- Lionel Ains <lains [AT] gmx.net>
- Joakim Wiberg <jow [AT] hms-networks.com>
- Jeff Rizzo <riz [AT] boogers.sf.ca.us>
- Christoph Wiest <ch.wiest [AT] tesionmail.de>
- Xuan Zhang <xz [AT] aemail4u.com>
- Thierry Martin <thierry.martin [AT] accellent-group.com>
- Oleg Terletsky <oleg.terletsky [AT] comverse.com>
- Michael Lum <mlum [AT] telostech.com>
- Shiang-Ming Huang <smhuang [AT] pcs.csie.nctu.edu.tw>
- Tony Lindstrom <tony.lindstrom [AT] ericsson.com>
- Niklas Ogren <niklas.ogren [AT] 71.se>
- Jesper Peterson <jesper [AT] endace.com>
- Giles Scott <giles.scott1 [AT] btinternet.com>
- Vincent Jardin <vincent.jardin [AT] 6wind.com>
- Jean-Michel Fayard <jean-michel.fayard [AT] moufrei.de>
- Josef Korelus <jkor [AT] quick.cz>
- Brian K. Teravskis <Brian_Teravskis [AT] Cargill.com>
- Nathan Jennings <njen [AT] bellsouth.net>
- Hans Viens <hviens [AT] mediatrix.com>
- Kevin A. Noll <knoll [AT] poss.com>
- Emanuele Caratti <wiz [AT] libero.it>
- Graeme Reid <graeme.reid [AT] norwoodsystems.com>
- Lars Ruoff <lars.ruoff [AT] sxb.bsf.alcatel.fr>
- Samuel Qu <samuel.qu [AT] utstar.com>
- Baktha Muralitharan <muralidb [AT] cisco.com>
- Loïc Minier <lool [AT] dooz.org>
- Marcel Holtmann <marcel [AT] holtmann.org>
- Scott Emberley <scotte [AT] netinst.com>
- Brian Fundakowski Feldman <bfeldman [AT] fla.fujitsu.com>
- Yuriy Sidelnikov <ysidelnikov [AT] hotmail.com>
- Matthias Drochner <M.Drochner [AT] fz-juelich.de>
- Dave Sclarsky <dave_sclarsky [AT] cnt.com>
- Scott Hovis <scott.hovis [AT] ums.msfc.nasa.gov>
- David Fort <david.fort [AT] irisa.fr>
- Martijn Schipper <mschipper [AT] globespanvirata.com>
- Felix Fei <felix.fei [AT] utstar.com>
- Christoph Neusch <christoph.neusch [AT] nortelnetworks.com>
- Jan Kiszka <jan.kiszka [AT] web.de>
- Joshua Craig Douglas <jdouglas [AT] enterasys.com>
- Dick Gooris <gooris [AT] lucent.com>
- Michael Shuldman <michaels [AT] inet.no>
- Tadaaki Nagao <nagao [AT] iij.ad.jp>
- Aaron Woo <woo [AT] itd.nrl.navy.mil>
- Chris Wilson <chris [AT] mxtelecom.com>
- Rolf Fiedler <Rolf.Fiedler [AT] Innoventif.com>
- Alastair Maw <ethereal [AT] almaw.com>
- Sam Leffler <sam [AT] errno.com>
- Martin Mathieson <martin [AT] arca-technologies.com>
- Christian Wagner <Christian.Wagner [AT] stud.uni-karlsruhe.de>
- Edwin Calo <calo [AT] fusemail.com>
- Ian Schorr <ischorr [AT] comcast.net>
- Rowan McFarland <rmcfarla [AT] cisco.com>
- John Engelhart <johne [AT] zang.com>
- Ryuji Somegawa <ryuji-so [AT] is.aist-nara.ac.jp>
- metatech <metatech [AT] flashmail.com>
- Brian Wheeler <Brian.Wheeler [AT] arrisi.com>
- Josh Bailey <joshbailey [AT] lucent.com>
- Jelmer Vernooij <jelmer [AT] samba.org>
- Duncan Sargeant <dunc-ethereal-dev [AT] rcpt.to>
- Love Hörnquist Åstrand <lha [AT] it.su.se>
- Lukas Pokorny <maskis [AT] seznam.cz>
- Pavel Roskin <proski [AT] gnu.org>
- Georgi Guninski <guninski [AT] guninski.com>
- Jason Copenhaver <jcopenha [AT] typedef.org>
- Eric Perie <eric.perie [AT] colubris.com>
- David Yon <yon [AT] tacticalsoftware.com>
- Marcio Franco <franco.marcio [AT] rd.francetelecom.fr>
- Kaloian Stoilov <kalkata [AT] yahoo.com>
- Steven Lass <stevenlass [AT] mail.com>
- Gregory Stark <gsstark [AT] mit.edu>
- Darren Steele <steeley [AT] steeley.co.uk>
- <smhuang [AT] pcs.csie.nctu.edu.tw>
- Michael Kopp <michael.kopp [AT] isarnet.de>
- Bernd Leibing <bernd.leibing [AT] kiz.uni-ulm.de>
- Chris Heath <chris [AT] heathens.co.nz>
- Gisle Vanem <giva [AT] bgnett.no>
- Ritchie <ritchie [AT] tipsybottle.com>
- Aki Immonen <aki.immonen [AT] golftalma.fi>
- David E. Weekly <david [AT] weekly.org>
- Steve Ford <sford [AT] geeky-boy.com>
- Masaki Chikama <masaki-c [AT] is.aist-nara.ac.jp>
- Mohammad Hanif <mhanif [AT] nexthop.com>
- Eric Wedel <ewedel [AT] bluearc.com>
- Reinhard Speyerer <rspmn [AT] arcor.de>
- Patrick Kursawe <phosphan [AT] gentoo.org>
- Arsen Chaloyan <achaloyan [AT] yahoo.com>
- <melerski [AT] poczta.onet.pl>
- Arnaud Jacques <webmaster [AT] securiteinfo.com>
- D. Manzella <manzella [AT] lucent.com>
- Jari Mustajarvi <jari.mustajarvi [AT] nokia.com>
- Joost Yervante Damad <Joost.Damad [AT] siemens.com>
- Thomas Anders <thomas.anders [AT] blue-cable.de>
- Pierre Juhen <pierre.juhen [AT] wanadoo.fr>
- David Richards <drichards [AT] alum.mit.edu>
- Shusaku Ueda <ueda [AT] sra.co.jp>
- Jonathan Perkins <jonathan.perkins [AT] ipaccess.com>
- Holger Schurig <h.schurig [AT] mn-logistik.de>
- Peter J. Creath <peter-ethereal [AT] creath.net>
- Magnus Hansson <mah [AT] hms.se>
- Pavel Kankovsky <kan [AT] dcit.cz>
- Nick Black <dank [AT] reflexsecurity.com>
- Bill Guyton <guyton [AT] bguyton.com>
- Chernishov Yury <Chernishov [AT] iskrauraltel.ru>
- Thomas Palmer <Thomas.Palmer [AT] Gunter.AF.mil>
- Jon Oberheide <jon [AT] focalhost.com>
- Clinton Work <clinton [AT] scripty.com>
- Joe Marcus Clarke <marcus [AT] marcuscom.com>
- Carlos M. Pignataro <cpignata [AT] cisco.com>
-
-Alain Magloire <alainm[AT]rcsm.ece.mcgill.ca> was kind enough to give his
-permission to use his version of snprintf.c.
-
-Dan Lasley <dlasley[AT]promus.com> gave permission for his dumpit() hex-dump
-routine to be used.
-
-Mattia Cazzola <mattiac[AT]alinet.it> provided a patch to the hex dump
-display routine.
-
-We use the exception module from Kazlib, a C library written by
-Kaz Kylheku <kaz[AT]ashi.footprints.net>. Thanks goes to him for his
-well-written library. The Kazlib home page can be found at
-http://users.footprints.net/~kaz/kazlib.html
git.samba.org / obnox / wireshark / wip.git / blobdiff