4 ethereal - Interactively browse network traffic
9 S<[ B<-a> capture autostop condition ] ...>
10 S<[ B<-b> number of ring buffer files ]>
11 S<[ B<-B> byte view height ]>
13 S<[ B<-f> capture filter expression ]>
15 S<[ B<-i> interface ]>
20 S<[ B<-N> resolving flags ] >
21 S<[ B<-o> preference setting ] ...>
23 S<[ B<-P> packet list height ]>
26 S<[ B<-R> display filter expression ]>
29 S<[ B<-T> tree view height ]>
30 S<[ B<-t> time stamp format ]>
33 S<[ B<-z> statistics-string ]>
38 B<Ethereal> is a GUI network protocol analyzer. It lets you
39 interactively browse packet data from a live network or from a
40 previously saved capture file. B<Ethereal>'s native capture file format
41 is B<libpcap> format, which is also the format used by B<tcpdump> and
42 various other tools. In addition, B<Ethereal> can read capture files
43 from B<snoop> and B<atmsnoop>, Shomiti/Finisar B<Surveyor>, Novell
44 B<LANalyzer>, Network General/Network Associates DOS-based B<Sniffer>
45 (compressed or uncompressed), Microsoft B<Network Monitor>, AIX's
46 B<iptrace>, Cinco Networks B<NetXRay>, Network Associates Windows-based
47 B<Sniffer>, AG Group/WildPackets B<EtherPeek>/B<TokenPeek>/B<AiroPeek>,
48 B<RADCOM>'s WAN/LAN analyzer, B<Lucent/Ascend> router debug output,
49 HP-UX's B<nettl>, the dump output from B<Toshiba's> ISDN routers, the
50 output from B<i4btrace> from the ISDN4BSD project, the output in
51 B<IPLog> format from the Cisco Secure Intrusion Detection System, B<pppd
52 logs> (pppdump format), the output from VMS's B<TCPIPtrace> utility, the
53 text output from the B<DBS Etherwatch> VMS utility, traffic capture
54 files from Visual Networks' Visual UpTime, and the output from B<CoSine>
55 L2 debug. There is no need to tell B<Ethereal> what type of file you
56 are reading; it will determine the file type by itself. B<Ethereal>
57 is also capable of reading any of these file formats if they are
58 compressed using gzip. B<Ethereal> recognizes this directly from the
59 file; the '.gz' extension is not required for this purpose.
61 Like other protocol analyzers, B<Ethereal>'s main window shows 3 views
62 of a packet. It shows a summary line, briefly describing what the
63 packet is. A protocol tree is shown, allowing you to drill down to
64 exact protocol or field that you interested in. Finally, a hex dump
65 shows you exactly what the packet looks like when it goes over the wire.
67 In addition, B<Ethereal> has some features that make it unique. It can
68 assemble all the packets in a TCP conversation and show you the ASCII
69 (or EBCDIC, or hex) data in that conversation. Display filters in
70 B<Ethereal> are very powerful; more fields are filterable in B<Ethereal>
71 than in other protocol analyzers, and the syntax you can use to create
72 your filters is richer. As B<Ethereal> progresses, expect more and more
73 protocol fields to be allowed in display filters.
75 Packet capturing is performed with the pcap library. The capture filter
76 syntax follows the rules of the pcap library. This syntax is different
77 from the display filter syntax.
79 Compressed file support uses (and therefore requires) the zlib library.
80 If the zlib library is not present, B<Ethereal> will compile, but will
81 be unable to read compressed files.
83 The pathname of a capture file to be read can be specified with the
84 B<-r> option or can be specified as a command-line argument.
90 Most users will want to start B<Ethereal> without options and configure
91 it from the menus instead. Those users may just skip this section.
95 Specify a criterion that specifies when B<Ethereal> is to stop writing
96 to a capture file. The criterion is of the form I<test>B<:>I<value>,
97 where I<test> is one of:
105 Stop writing to a capture file after I<value> seconds have elapsed.
109 Stop writing to a capture file after it reaches a size of I<value>
110 kilobytes (where a kilobyte is 1000 bytes, not 1024 bytes).
118 If a maximum capture file size was specified, cause B<Ethereal> to run
119 in "ring buffer" mode, with the specified number of files. In "ring
120 buffer" mode, B<Ethereal> will write to several capture files; the name
121 of the first file, while the capture is in progress, will be the name
122 specified by the B<-w> flag, and subsequent files with have .I<n>
123 appended, with I<n> counting up.
125 When the first capture file fills up, B<Ethereal> will switch to writing
126 to the next file, until it fills up the last file, at which point it'll
127 discard the data in the first file and start writing to that file. When
128 that file fills up, B<Ethereal> will discard the data in the next file
129 and start writing to it, and so on.
131 When the capture completes, the files will be renamed to have names
132 based on the number of the file and on the date and time at which
133 packets most recently started being written to the file.
137 Set the initial height of the byte view (bottom) pane.
141 Set the default number of packets to read when capturing live
146 Set the capture filter expression.
150 Print the version and options and exit.
154 Set the name of the network interface or pipe to use for live packet capture.
155 Network interface names should match one of the names listed in
156 "B<tethereal -D>". If you're using Unix, "B<netstat -i>" or "B<ifconfig -a>"
158 Pipe names should be either the name of a FIFO (named pipe) or ``-'' to read
159 data from the standard input. Data read from pipes must be in libpcap format.
163 Start the capture session immediately. If the B<-i> flag was
164 specified, the capture uses the specified interface. Otherwise,
165 B<Ethereal> searches the list of interfaces, choosing the first
166 non-loopback interface if there are any non-loopback interfaces, and
167 choosing the first loopback interface if there are no non-loopback
168 interfaces; if there are no interfaces, B<Ethereal> reports an error and
169 doesn't start the capture.
173 Turn on automatic scrolling if the packet display is being updated
174 automatically as packets arrive during a capture (as specified by the
179 Set the name of the font used by B<Ethereal> for most text.
180 B<Ethereal> will construct the name of the bold font used for the data
181 in the byte view pane that corresponds to the field selected in the
182 protocol tree pane from the name of the main text font.
186 Disable network object name resolution (such as hostname, TCP and UDP port
191 Turn on name resolving for particular types of addresses and port
192 numbers, with name resolving for other types of addresses and port
193 numbers turned off; the argument is a string that may contain the
194 letters B<m> to enable MAC address resolution, B<n> to enable network
195 address resolution, and B<t> to enable transport-layer port number
196 resolution. This overrides B<-n> if both B<-N> and B<-n> are present.
200 Set a preference value, overriding the default value and any value read
201 from a preference file. The argument to the flag is a string of the
202 form I<prefname>B<:>I<value>, where I<prefname> is the name of the
203 preference (which is the same name that would appear in the preference
204 file), and I<value> is the value to which it should be set.
208 I<Don't> put the interface into promiscuous mode. Note that the
209 interface might be in promiscuous mode for some other reason; hence,
210 B<-p> cannot be used to ensure that the only traffic that is captured is
211 traffic sent to or from the machine on which B<Ethereal> is running,
212 broadcast traffic, and multicast traffic to addresses received by that
217 Set the initial height of the packet list (top) pane.
221 Cause B<Ethereal> to exit after the end of capture session (useful in
222 batch mode with B<-c> option for instance); this option requires the
223 B<-i> and B<-w> parameters.
227 Read packet data from I<infile>.
231 When reading a capture file specified with the B<-r> flag, causes the
232 specified filter (which uses the syntax of display filters, rather than
233 that of capture filters) to be applied to all packets read from the
234 capture file; packets not matching the filter are discarded.
238 Perform the live packet capture in a separate process, and automatically
239 update the packet display as packets are seen.
243 Set the default snapshot length to use when capturing live data.
244 No more than I<snaplen> bytes of each network packet will be read into
245 memory, or saved to disk.
249 Set the initial height of the tree view (middle) pane.
253 Set the format of the packet timestamp displayed in the packet list
254 window. The format can be one of 'r' (relative), 'a' (absolute), 'ad'
255 (absolute with date), or 'd' (delta). The relative time is the time
256 elapsed between the first packet and the current packet. The absolute
257 time is the actual time the packet was captured, with no date displayed;
258 the absolute date and time is the actual time and date the packet was
259 captured. The delta time is the time since the previous packet was
260 captured. The default is relative.
264 Print the version and exit.
268 Set the default capture file name.
272 Get B<Ethereal> to collect various types of statistics and display the result
273 in a window that updates in semi-real time.
274 Currently implemented statistics are:
276 B<-z> dcerpc,rtt,I<uuid>,I<major>.I<minor>[,I<filter>]
278 Collect call/reply RTT data for DCERPC interface I<uuid>,
279 version I<major>.I<minor>.
280 Data collected is number of calls for each procedure, MinRTT, MaxRTT
282 Example: use B<-z dcerpc,rtt,12345778-1234-abcd-ef00-0123456789ac,1.0> to collect data for CIFS SAMR Interface.
283 This option can be used multiple times on the command line.
285 If the optional filterstring is provided, the stats will only be calculated
286 on those calls that match that filter.
287 Example: use B<-z dcerpc,rtt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4> to collect SAMR
288 RTT statistics for a specific host.
292 Collect frame/bytes statistics for the capture in intervals of 1 seconds.
293 This option will open a window with up to 5 color-coded graphs where
294 number-of-frames-per-second or number-of-bytes-per-second statistics
295 can be calculated and displayed.
297 This option can be used multiple times on the command line.
299 This graph window can also be opened from the Tools:Statistics:Traffic:IO-Stat
303 B<-z> rpc,rtt,I<program>,I<version>[,<filter>]
305 Collect call/reply RTT data for I<program>/I<version>. Data collected
306 is number of calls for each procedure, MinRTT, MaxRTT and AvgRTT.
307 Example: use B<-z rpc,rtt,100003,3> to collect data for NFS v3. This
308 option can be used multiple times on the command line.
310 If the optional filter string is provided, the stats will only be calculated
311 on those calls that match that filter.
312 Example: use B<-z rpc,rtt,100003,3,nfs.fh.hash==0x12345678> to collect NFS v3
313 RTT statistics for a specific file.
317 Collect call/reply RTT data for all known ONC-RPC programs/versions.
318 Data collected is number of calls for each protocol/version, MinRTT,
329 =item File:Open, File:Close, File:Reload
331 Open, close, or reload a capture file. The I<File:Open> dialog box
332 allows a filter to be specified; when the capture file is read, the
333 filter is applied to all packets read from the file, and packets not
334 matching the filter are discarded.
336 =item File:Save, File:Save As
338 Save the current capture, or the packets currently displayed from that
339 capture, to a file. Check boxes let you select whether to save all
340 packets, or just those that have passed the current display filter and/or
341 those that are currently marked, and an option menu lets you select (from
342 a list of file formats in which at particular capture, or the packets
343 currently displayed from that capture, can be saved), a file format in
348 Print, for all the packets in the current capture, either the summary
349 line for the packet or the protocol tree view of the packet; when
350 printing the protocol tree view, the hex dump of the packet can be
351 printed as well. Printing options can be set with the
352 I<Edit:Preferences> menu item, or in the dialog box popped up by this
355 =item File:Print Packet
357 Print a fully-expanded protocol tree view of the currently-selected
358 packet. Printing options can be set with the I<Edit:Preferences> menu
363 Exit the application.
365 =item Edit:Find Frame
367 Search forward or backward, starting with the currently selected packet
368 (or the most recently selected packet, if no packet is selected), for a
369 packet matching a given display filter expression.
373 Search forward, starting with the currently selected packet
374 (or the most recently selected packet, if no packet is selected), for a
375 packet matching the filter from the previous search.
377 =item Edit:Find Previous
379 Search backward, starting with the currently selected packet (or the
380 most recently selected packet, if no packet is selected), for a packet
381 matching the filter from the previous search.
383 =item Edit:Go To Frame
385 Go to a particular numbered packet.
387 =item Edit:Mark Frame
389 Mark (or unmark if currently marked) the selected packet. The field
390 "frame.marked" is set for frames that are marked, so that, for example,
391 a display filters can be used to display only marked frames, and so that
392 the L<Find Frame> menu item can be used to find the next or previous
395 =item Edit:Mark All Frames
397 Mark all packets that are currently displayed.
399 =item Edit:Unmark All Frames
401 Unmark all packets that are currently displayed.
403 =item Edit:Preferences
405 Set the packet printing, column display, TCP stream coloring, and GUI
406 options (see L<"Preferences"> below).
408 =item Edit:Capture Filters
410 Edit the saved list of capture filters, allowing filters to be added,
413 =item Edit:Display Filters
415 Edit the saved list of display filters, allowing filters to be added,
420 Edit the list of protocols, allowing protocol dissection to be
425 Initiate a live packet capture (see L<"Capture Options"> below). A
426 temporary file will be created to hold the capture. The location of the
427 file can be chosen by setting your TMPDIR environment variable before
428 starting B<Ethereal>. Otherwise, the default TMPDIR location is
429 system-dependent, but is likely either F</var/tmp> or F</tmp>.
433 In a capture that updates the packet display as packets arrive (so that
434 Ethereal responds to user input other than pressing the "Stop" button in
435 the capture packet statistics dialog box), stop the capture.
437 =item Display:Options
439 Pop up a dialog allowing you to set the format of the packet timestamp
440 displayed in the packet list window to relative, absolute, absolute date
441 and time, or delta, to enable or disable the automatic scrolling of the
442 packet list while a live capture is in progress or to enable or disable
443 translation of addresses to names in the display.
447 Create a display filter, or add to the display filter strip at the
448 bottom, a display filter based on the data currently highlighted in the
449 protocol tree, and apply the filter.
451 If that data is a field that can be tested in a display filter
452 expression, the display filter will test that field; otherwise, the
453 display filter will be based on absolute offset within the packet, and
454 so could be unreliable if the packet contains protocols with
455 variable-length headers, such as a source-routed token-ring packet.
457 The B<Selected> option creates a display filter that tests for a match
458 of the data; the B<Not Selected> option creates a display filter that
459 tests for a non-match of the data. The B<And Selected>, B<Or Selected>,
460 B<And Not Selected>, and B<Or Not Selected> options add to the end of
461 the display filter in the strip at the bottom an AND or OR operator
462 followed by the new display filter expression.
464 =item Display:Prepare
466 Create a display filter, or add to the display filter strip at the
467 bottom, a display filter based on the data currently highlighted in the
468 protocol tree, but don't apply the filter.
470 =item Display:Colorize Display
472 Change the foreground and background colors of the packet information in
473 the list of packets, based upon display filters. The list of display
474 filters is applied to each packet sequentially. After the first display
475 filter matches a packet, any additional display filters in the list are
476 ignored. Therefore, if you are filtering on the existence of protocols,
477 you should list the higher-level protocols first, and the lower-level
480 =item Display:Collapse All
482 Collapse the protocol tree branches.
484 =item Display:Expand All
486 Expand all branches of the protocol tree.
488 =item Display:Expand All
490 Expands all branches of the protocol tree.
492 =item Display:Show Packet In New Window
494 Create a new window containing a protocol tree view and a hex dump
495 window of the currently selected packet; this window will continue to
496 display that packet's protocol tree and data even if another packet is
499 =item Display:User Specified Decodes
501 Create a new window showing whether any protocol ID to dissector
502 mappings have been changed by the user. This window also allows the
503 user to reset all decodes to their default values.
507 See what dynamically loadable dissector plugin modules have been loaded
508 (see I<"Plugins"> below).
510 =item Tools:Follow TCP Stream
512 If you have a TCP packet selected, display the contents of the data
513 stream for the TCP connection to which that packet belongs, as text, in
514 a separate window, and leave the list of packets in a filtered state,
515 with only those packets that are part of that TCP connection being
516 displayed. You can revert to your old view by pressing ENTER in the
517 display filter text box, thereby invoking your old display filter (or
518 resetting it back to no display filter).
520 The window in which the data stream is displayed lets you select whether
527 whether to display the entire conversation, or one or the other side of
532 whether the data being displayed is to be treated as ASCII or EBCDIC
533 text or as raw hex data;
543 and lets you print what's currently being displayed, using the same
544 print options that are used for the I<File:Print Packet> menu item, or
545 save it as text to a file.
549 =item Tools:Decode As
551 If you have a packet selected, present a dialog allowing you to change
552 which dissectors are used to decode this packet. The dialog has one
553 panel each for the link layer, network layer and transport layer
554 protocol/port numbers, and will allow each of these to be changed
555 independently. For example, if the selected packet is a TCP packet to
556 port 12345, using this dialog you can instruct Ethereal to decode all
557 packets to or from that TCP port as HTTP packets.
559 =item Tools:Protocol Hierarchy Statistics
561 Show the number of packets, and the number of bytes in those packets,
562 for each protocol in the trace. It organizes the protocols in the same
563 hierarchy in which they were found in the trace. Besides counting the
564 packets in which the protocol exists, a count is also made for packets
565 in which the protocol is the last protocol in the stack. These
566 last-protocol counts show you how many packets (and the byte count
567 associated with those packets) B<ended> in a particular protocol. In
568 the table, they are listed under "End Packets" and "End Bytes".
570 =item Tools:Statistics:ONC-RPC:RTT
572 Open a window to display statistics for an arbitrary ONC-RPC program interface
573 and display B<Procedure>, B<Number of Calls>, B<Minimum RTT>, B<Maximum RTT> and B<Average RTT> for all procedures for that program/version.
574 These windows opened will update in semi-real time to reflect changes when
575 doing live captures or when reading new capture files into B<Ethereal>.
577 This dialog will also allow an optional filter string to be used.
578 If an optional filter string is used only such ONC-RPC request/response pairs
579 that match that filter will be used to calculate the statistics. If no filter
580 string is specified all request/response pairs will be used.
582 =item Tools:Statistics:ONC-RPC:Programs
584 This dialog will open a window showing aggregated RTT statistics for all
585 ONC-RPC Programs/versions that exist in the capture file.
587 =item Tools:Statistics:DCE-RPC:RTT
589 Open a window to display statistics for an arbitrary DCE-RPC program interface
590 and display B<Procedure>, B<Number of Calls>, B<Minimum RTT>, B<Maximum RTT> and B<Average RTT> for all procedures for that program/version.
591 These windows opened will update in semi-real time to reflect changes when
592 doing live captures or when reading new capture files into B<Ethereal>.
594 This dialog will also allow an optional filter string to be used.
595 If an optional filter string is used only such DCE-RPC request/response pairs
596 that match that filter will be used to calculate the statistics. If no filter
597 string is specified all request/response pairs will be used.
599 =item Tools:Statistics:Traffic:IO-Stat
601 Open a window where up to 5 graphs in different colors can be displayed
602 to indicate number of frames or number of bytes per second for all packets
603 matching the specified filter.
604 By default only one graph will be displayed showing number of frames per second.
606 The Y-scale shows how many frames/bytes per second was measured.
607 The X-scale shows how many seconds into the capture the measurement was taken.
616 The main window is split into three panes. You can resize each pane using
617 a "thumb" at the right end of each divider line. Below the panes is a
618 strip that shows the current filter and informational text.
624 The top pane contains the list of network packets that you can scroll
625 through and select. By default, the packet number, packet timestamp,
626 source and destination addresses, protocol, and description are
627 displayed for each packet; the I<Columns> page in the dialog box popped
628 up by I<Edit:Preferences> lets you change this (although, unfortunately,
629 you currently have to save the preferences, and exit and restart
630 Ethereal, for those changes to take effect).
632 If you click on the heading for a column, the display will be sorted by
633 that column; clicking on the heading again will reverse the sort order
636 An effort is made to display information as high up the protocol stack
637 as possible, e.g. IP addresses are displayed for IP packets, but the
638 MAC layer address is displayed for unknown packet types.
640 The right mouse button can be used to pop up a menu of operations.
642 The middle mouse button can be used to mark a packet.
646 The middle pane contains a I<protocol tree> for the currently-selected
647 packet. The tree displays each field and its value in each protocol
648 header in the stack. The right mouse button can be used to pop up a
653 The lowest pane contains a hex dump of the actual packet data.
654 Selecting a field in the I<protocol tree> highlights the corresponding
655 bytes in this section.
657 The right mouse button can be used to pop up a menu of operations.
661 A display filter can be entered into the strip at the bottom.
662 A filter for HTTP, HTTPS, and DNS traffic might look like this:
664 tcp.port == 80 || tcp.port == 443 || tcp.port == 53
666 Selecting the I<Filter:> button lets you choose from a list of named
667 filters that you can optionally save. Pressing the Return or Enter
668 keys, or selecting the I<Apply> button, will cause the filter to be
669 applied to the current list of packets. Selecting the I<Reset> button
670 clears the display filter so that all packets are displayed.
676 The I<Preferences> dialog lets you control various personal preferences
677 for the behavior of B<Ethereal>.
681 =item Printing Preferences
683 The radio buttons at the top of the I<Printing> page allow you choose
684 between printing packets with the I<File:Print Packet> menu item as text
685 or PostScript, and sending the output directly to a command or saving it
686 to a file. The I<Command:> text entry box, on UNIX-compatible systems,
687 is the command to send files to (usually B<lpr>), and the I<File:> entry
688 box lets you enter the name of the file you wish to save to.
689 Additionally, you can select the I<File:> button to browse the file
690 system for a particular save file.
692 =item Column Preferences
694 The I<Columns> page lets you specify the number, title, and format
695 of each column in the packet list.
697 The I<Column title> entry is used to specify the title of the column
698 displayed at the top of the packet list. The type of data that the column
699 displays can be specified using the I<Column format> option menu.
700 The row of buttons on the left perform the following actions:
706 Adds a new column to the list.
710 Deletes the currently selected list item.
714 Moves the selected list item up or down one position.
718 Currently has no effect.
722 Saves the current column format as the default.
726 Closes the dialog without making any changes.
730 =item TCP Streams Preferences
732 The I<TCP Streams> page can be used to change the color of the text
733 displayed in the TCP stream window. To change a color, simply select
734 an attribute from the "Set:" menu and use the color selector to get the
735 desired color. The new text colors are displayed in a sample window.
737 =item User Interface Preferences
739 The I<User Interface> page is used to modify small aspects of the GUI to
740 your own personal taste:
746 The vertical scrollbars in the three panes can be set to be either on
747 the left or the right.
751 The selection bar in the packet list and protocol tree can have either a
752 "browse" or "select" behavior. If the selection bar has a "browse"
753 behavior, the arrow keys will move an outline of the selection bar,
754 allowing you to browse the rest of the list or tree without changing the
755 selection until you press the space bar. If the selection bar has a
756 "select" behavior, the arrow keys will move the selection bar and change
757 the selection to the new item in the packet list or protocol tree.
759 =item Tree Line Style
761 Trees can be drawn with no lines, solid lines, or dotted lines between
762 items, or can be drawn with "tab" headings.
764 =item Tree Expander Style
766 The expander item that can be clicked to show or hide items under a tree
767 item can be omitted (note that this will prevent you from changing
768 whether those items are shown or hidden!), or can be drawn as squares,
769 triangles, or circles.
773 The highlight method in the hex dump display for the selected protocol
774 item can be set to use either inverse video, or bold characters.
776 =item Save Window Position
778 If this item is selected, the position of the main Ethereal window will
779 be saved when Ethereal exits, and used when Ethereal is started again.
781 =item Save Window Size
783 If this item is selected, the size of the main Ethereal window will
784 be saved when Ethereal exits, and used when Ethereal is started again.
788 The "Font..." button lets you select the font to be used for most text.
792 The "Colors..." button lets you select the colors to be used for instance
793 for the marked frames.
797 =item Capture Preferences
799 The I<Capture> page lets you specify various parameters for capturing
800 live packet data; these are used the first time a capture is started.
802 The I<Interface:> combo box lets you specify the interface from which to
803 capture packet data, or the name of a FIFO from which to get the packet
804 data. You can specify whether the interface is to be put in promiscuous
805 mode or not with the I<Capture packets in promiscuous mode> check box,
806 can specify that the display should be updated as packets are captured
807 with the I<Update list of packets in real time> check box, and can
808 specify whether in such a capture the packet list pane should scroll to
809 show the most recently captured packets with the I<Automatic scrolling
810 in live capture> check box.
812 =item Protocol Preferences
814 There are also pages for various protocols that Ethereal dissects,
815 controlling the way Ethereal handles those protocols.
819 =item Edit Capture Filter List
821 =item Edit Display Filter List
831 The I<Edit Capture Filter List> dialog lets you create, modify, and
832 delete capture filters, and the I<Edit Display Filter List> dialog lets
833 you create, modify, and delete display filters.
835 The I<Capture Filter> dialog lets you do all of the editing operations
836 listed, and also lets you choose or construct a filter to be used when
839 The I<Display Filter> dialog lets you do all of the editing operations
840 listed, and also lets you choose or construct a filter to be used to
841 filter the current capture being viewed.
843 The I<Read Filter> dialog lets you do all of the editing operations
844 listed, and also lets you choose or construct a filter to be used to
845 as a read filter for a capture file you open.
847 The I<Search Filter> dialog lets you do all of the editing operations
848 listed, and also lets you choose or construct a filter expression to be
849 used in a find operation.
851 In all of those dialogs, the I<Filter name> entry specifies a
852 descriptive name for a filter, e.g. B<Web and DNS traffic>. The
853 I<Filter string> entry is the text that actually describes the filtering
854 action to take, as described above.The dialog buttons perform the
861 If there is text in the two entry boxes, creates a new associated list
866 Modifies the currently selected list item to match what's in the entry
871 Makes a copy of the currently selected list item.
875 Deletes the currently selected list item.
877 =item Add Expression...
879 For display filter expressions, pops up a dialog box to allow you to
880 construct a filter expression to test a particular field; it offers
881 lists of field names, and, when appropriate, lists from which to select
882 tests to perform on the field and values with which to compare it. In
883 that dialog box, the OK button will cause the filter expression you
884 constructed to be entered into the I<Filter string> entry at the current
889 In the I<Capture Filter> dialog, closes the dialog box and makes the
890 filter in the I<Filter string> entry the filter in the I<Capture
891 Preferences> dialog. In the I<Display Filter> dialog, closes the dialog
892 box and makes the filter in the I<Filter string> entry the current
893 display filter, and applies it to the current capture. In the I<Read
894 Filter> dialog, closes the dialog box and makes the filter in the
895 I<Filter string> entry the filter in the I<Open Capture File> dialog.
896 In the I<Search Filter> dialog, closes the dialog box and makes the
897 filter in the I<Filter string> entry the filter in the I<Find Frame>
902 Makes the filter in the I<Filter string> entry the current display
903 filter, and applies it to the current capture.
907 Saves the current filter list in F<$HOME/.ethereal/cfilters> on
908 UNIX-compatible systems, and F<%APPDATA%\Ethereal\cfilters> (or, if
909 %APPDATA% isn't defined,
910 F<%USERPROFILE%\Application Data\Ethereal\cfilters>)
911 on Windows systems, if the list of filters being edited is the list of
912 capture filters, or in F<$HOME/.ethereal/dfilters> on UNIX-compatible
913 systems, and F<%APPDATA%\Ethereal\dfilters> (or, if %APPDATA% isn't
914 defined, F<%USERPROFILE%\Application Data\Ethereal\dfilters>) on Windows
915 systems, if the list of filters being edited is the list of display
920 Closes the dialog without doing anything with the filter in the I<Filter
925 =item Capture Options
927 The I<Capture Options> dialog lets you specify various parameters for
928 capturing live packet data.
930 The I<Interface:> field lets you specify the interface from which to
931 capture packet data or a command from which to get the packet data via a
934 The I<Limit each packet to ... bytes> check box and field lets you
935 specify a maximum number of bytes per packet to capture and save; if the
936 check box is not checked, the limit will be 65535 bytes.
938 The I<Capture packets in promiscuous mode> check box lets you specify
939 whether the interface should be put into promiscuous mode when
942 The I<Filter:> entry lets you specify the capture filter using a
943 tcpdump-style filter string as described above.
945 The I<File:> entry lets you specify the file into which captured packets
946 should be saved, as in the I<Printer Options> dialog above. If not
947 specified, the captured packets will be saved in a temporary file; you
948 can save those packets to a file with the I<File:Save As> menu item.
950 The I<Use ring buffer> check box lets you specify that the capture
951 should be done in "ring buffer" mode; the I<Number of files> field
952 lets you specify the number of files in the ring buffer.
954 The I<Update list of packets in real time> check box lets you specify
955 whether the display should be updated as packets are captured and, if
956 you specify that, the I<Automatic scrolling in live capture> check box
957 lets you specify the packet list pane should automatically scroll to
958 show the most recently captured packets as new packets arrive.
960 The I<Stop capture after ... packet(s) captured> check box and field let
961 you specify that Ethereal should stop capturing after having captured
962 some number of packets; if the check box is not checked, Ethereal will
963 not stop capturing at some fixed number of captured packets.
965 If "ring buffer" mode is not specified, the I<Stop capture after ...
966 kilobyte(s) captured> check box and field let you specify that Ethereal
967 should stop capturing after the the file to which captured packets are
968 being saved grows as large as or larger than some specified number of
969 kilobytes (where a kilobyte is 1000 bytes, not 1024 bytes). If the
970 check box is not checked, Ethereal will not stop capturing at some
971 capture file size (although the operating system on which Ethereal is
972 running, or the available disk space, may still limit the maximum size
975 If "ring buffer" mode is specified, that field becomes the I<Rotate
976 capture file very ... kilobyte(s)> field, and specifies the number
977 of kilobytes at which to start writing to a new ring buffer file; the
978 check box is forced to be checked, as "ring buffer" mode requires a file
979 size to be specified.
981 The I<Stop capture after ... second(s)> check box and field let you
982 specify that Ethereal should stop capturing after it has been capturing
983 for some number of seconds; if the check box is not checked, Ethereal
984 will not stop capturing after some fixed time has elapsed.
986 The I<Enable MAC name resolution>, I<Enable network name resolution> and
987 I<Enable transport name resolution> check boxes let you specify whether
988 MAC addresses, network addresses, and transport-layer port numbers
989 should be translated to names.
991 =item Display Options
993 The I<Display Options> dialog lets you specify the format of the time
994 stamp in the packet list. You can select "Time of day" for absolute
995 time stamps, "Date and time of day" for absolute time stamps with the
996 date, "Seconds since beginning of capture" for relative time stamps, or
997 "Seconds since previous frame" for delta time stamps. You can also
998 specify whether, when the display is updated as packets are captured,
999 the list should automatically scroll to show the most recently captured
1000 packets or not and whether addresses or port numbers should be
1001 translated to names in the display on a MAC, network and transport layer
1006 The I<Plugins> dialog lets you view the dissector plugin modules
1007 available on your system.
1009 The I<Plugins List> shows the name and version of each dissector plugin
1010 module found on your system. The plugins are searched in the following
1011 directories: the F<lib/ethereal/plugins/$VERSION> directory under the
1012 main installation directory (for example,
1013 F</usr/local/lib/ethereal/plugins/$VERSION>),
1014 F</usr/lib/ethereal/plugins/$VERSION>,
1015 F</usr/local/lib/ethereal/plugins/$VERSION>, and
1016 F<$HOME/.ethereal/plugins> on UNIX-compatible systems, and in the
1017 F<plugins\$VERSION> directory under the main installation directory (for
1018 example, F<C:\Program Files\Ethereal\plugins\$VERSION>) and
1019 F<%APPDATA%\Ethereal\plugins\$VERSION> (or, if %APPDATA% isn't defined,
1020 F<%USERPROFILE%\Application Data\Ethereal\plugins\$VERSION>) on Windows
1021 systems; $VERSION is the version number of the plugin interface, which
1022 is typically the version number of Ethereal. Note that a dissector
1023 plugin module may support more than one protocol; there is not
1024 necessarily a one-to-one correspondence between dissector plugin modules
1025 and protocols. Protocols supported by a dissector plugin module are
1026 enabled and disabled using the I<Edit:Protocols> dialog box, just as
1027 protocols built into Ethereal are.
1029 =head1 CAPTURE FILTER SYNTAX
1031 See manual page of tcpdump(8).
1033 =head1 DISPLAY FILTER SYNTAX
1035 Display filters help you remove the noise from a packet trace and let
1036 you see only the packets that interest you. If a packet meets the
1037 requirements expressed in your display filter, then it is displayed in
1038 the list of packets. Display filters let you compare the fields within
1039 a protocol against a specific value, compare fields against fields, and
1040 to check the existence of specified fields or protocols.
1042 The simplest display filter allows you to check for the existence of a
1043 protocol or field. If you want to see all packets which contain the IPX
1044 protocol, the filter would be "ipx". (Without the quotation marks) To
1045 see all packets that contain a Token-Ring RIF field, use "tr.rif".
1047 Fields can also be compared against values. The comparison operators
1048 can be expressed either through C-like symbols, or through English-like
1055 ge, >= Greater than or Equal to
1056 le, <= Less than or Equal to
1058 Furthermore, each protocol field is typed. The types are:
1060 Unsigned integer (either 8-bit, 16-bit, 24-bit, or 32-bit)
1061 Signed integer (either 8-bit, 16-bit, 24-bit, or 32-bit)
1063 Ethernet address (6 bytes)
1064 Byte string (n-number of bytes)
1069 Double-precision floating point number
1071 An integer may be expressed in decimal, octal, or hexadecimal notation.
1072 The following three display filters are equivalent:
1078 Boolean values are either true or false. In a display filter expression
1079 testing the value of a Boolean field, "true" is expressed as 1 or any
1080 other non-zero value, and "false" is expressed as zero. For example, a
1081 token-ring packet's source route field is boolean. To find any
1082 source-routed packets, a display filter would be:
1086 Non source-routed packets can be found with:
1090 Ethernet addresses, as well as a string of bytes, are represented in hex
1091 digits. The hex digits may be separated by colons, periods, or hyphens:
1093 fddi.dst eq ff:ff:ff:ff:ff:ff
1094 ipx.srcnode == 0.0.0.0.0.1
1095 eth.src == aa-aa-aa-aa-aa-aa
1097 If a string of bytes contains only one byte, then it is represented as
1098 an unsigned integer. That is, if you are testing for hex value 'ff' in
1099 a one-byte byte-string, you must compare it agains '0xff' and not 'ff'.
1101 IPv4 addresses can be represented in either dotted decimal notation, or
1102 by using the hostname:
1104 ip.dst eq www.mit.edu
1105 ip.src == 192.168.1.1
1107 IPv4 addresses can be compared with the same logical relations as numbers:
1108 eq, ne, gt, ge, lt, and le. The IPv4 address is stored in host order,
1109 so you do not have to worry about how the endianness of an IPv4 address
1110 when using it in a display filter.
1112 Classless InterDomain Routing (CIDR) notation can be used to test if an
1113 IPv4 address is in a certain subnet. For example, this display filter
1114 will find all packets in the 129.111 Class-B network:
1116 ip.addr == 129.111.0.0/16
1118 Remember, the number after the slash represents the number of bits used
1119 to represent the network. CIDR notation can also be used with
1120 hostnames, in this example of finding IP addresses on the same Class C
1121 network as 'sneezy':
1123 ip.addr eq sneezy/24
1125 The CIDR notation can only be used on IP addresses or hostnames, not in
1126 variable names. So, a display filter like "ip.src/24 == ip.dst/24" is
1129 IPX networks are represented by unsigned 32-bit integers. Most likely
1130 you will be using hexadecimal when testing for IPX network values:
1132 ipx.srcnet == 0xc0a82c00
1134 A slice operator also exists. You can check the substring
1135 (byte-string) of any protocol or field. For example, you can filter on
1136 the vendor portion of an ethernet address (the first three bytes) like
1139 eth.src[0:3] == 00:00:83
1141 If the length of your byte-slice is only one byte, then it is still
1142 represented in hex, but without the preceding "0x":
1146 You can use the slice operator on a protocol name, too. And
1147 remember, the "frame" protocol encompasses the entire packet, allowing
1148 you to look at the nth byte of a packet regardless of its frame type
1149 (Ethernet, token-ring, etc.).
1151 token[0:5] ne 0.0.0.1.1
1155 The following syntax governs slices:
1157 [i:j] i = start_offset, j = length
1158 [i-j] i = start_offet, j = end_offset, inclusive.
1159 [i] i = start_offset, length = 1
1160 [:j] start_offset = 0, length = j
1161 [i:] start_offset = i, end_offset = end_of_field
1163 Offsets and lengths can be negative, in which case they indicate the
1164 offset from the B<end> of the field. Here's how to check the last 4
1167 frame[-4:4] == 0.1.2.3
1171 frame[-4:] == 0.1.2.3
1173 You can create complex concatenations of slices using the comma operator:
1175 field[1,3-5,9:] == 01:03:04:05:09:0a:0b
1177 All the above tests can be combined together with logical expressions.
1178 These too are expressable in C-like syntax or with English-like
1185 Expressions can be grouped by parentheses as well. The following are
1186 all valid display filter expression:
1188 tcp.port == 80 and ip.src == 192.168.2.1
1190 (ipx.srcnet == 0xbad && ipx.srnode == 0.0.0.0.0.1) || ip
1191 tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29
1193 A special caveat must be given regarding fields that occur more than
1194 once per packet. "ip.addr" occurs twice per IP packet, once for the
1195 source address, and once for the destination address. Likewise,
1196 tr.rif.ring fields can occur more than once per packet. The following
1197 two expressions are not equivalent:
1199 ip.addr ne 192.168.4.1
1200 not ip.addr eq 192.168.4.1
1202 The first filter says "show me IP packets where an ip.addr exists that
1203 does not equal 192.168.4.1". That is, as long as one ip.addr in the
1204 packet does not equal 192.168.44.1, the packet passes the display
1205 filter. The second filter "don't show me any packets that have at least
1206 one ip.addr field equal to 192.168.4.1". If one ip.addr is 192.168.4.1,
1207 the packet does not pass. If B<neither> ip.addr fields is 192.168.4.1,
1208 then the packet passes.
1210 It is easy to think of the 'ne' and 'eq' operators as having an implict
1211 "exists" modifier when dealing with multiply-recurring fields. "ip.addr
1212 ne 192.168.4.1" can be thought of as "there exists an ip.addr that does
1213 not equal 192.168.4.1".
1215 Be careful with multiply-recurring fields; they can be confusing.
1217 Care must also be taken when using the display filter to remove noise
1218 from the packet trace. If you want to e.g. filter out all IP multicast
1219 packets to address 224.1.2.3, then using:
1223 may be too restrictive. Filtering with "ip.dst" selects only those
1224 B<IP> packets that satisfy the rule. Any other packets, including all
1225 non-IP packets, will not displayed. For displaying also the non-IP
1226 packets, you can use one of the following two expressions:
1228 not ip or ip.dst ne 224.1.2.3
1229 not ip.addr eq 224.1.2.3
1231 The first filter uses "not ip" to include all non-IP packets and then
1232 lets "ip.dst ne 224.1.2.3" to filter out the unwanted IP packets. The
1233 second filter has already been explained above where filtering with
1234 multiply occuring fields was discussed.
1236 The following is a table of protocol and protocol fields that are
1237 filterable in B<Ethereal>. The abbreviation of the protocol or field is
1238 given. This abbreviation is what you use in the display filter. The
1239 type of the field is also given.
1241 =insert_dfilter_table
1245 The F<ethereal.conf> file, which is installed in the F<etc> directory
1246 under the main installation directory (for example, F</usr/local/etc>)
1247 on UNIX-compatible systems, and in the main installation directory (for
1248 example, F<C:\Program Files\Ethereal>) on Windows systems, and the
1249 personal preferences file, which is F<$HOME/.ethereal/preferences> on
1250 UNIX-compatible systems and F<%APPDATA%\Ethereal\preferences> (or, if
1251 %APPDATA% isn't defined,
1252 F<%USERPROFILE%\Application Data\Ethereal\preferences>) on
1253 Windows systems, contain system-wide and personal preference settings,
1254 respectively. The file contains preference settings of the form
1255 I<prefname>B<:>I<value>, one per line, where I<prefname> is the name of
1256 the preference (which is the same name that would appear in the
1257 preference file), and I<value> is the value to which it should be set;
1258 white space is allowed between B<:> and I<value>. A preference setting
1259 can be continued on subsequent lines by indenting the continuation lines
1260 with white space. A B<#> character starts a comment that runs to the
1263 The system-wide preference file is read first, if it exists, overriding
1264 B<Ethereal>'s default values; the personal preferences file is then
1265 read, if it exists, overriding default values and values read from the
1266 system-wide preference file.
1268 Note that whenever the preferences are saved by using the I<Save> button
1269 in the I<Edit:Preferences> dialog box, your personal preferences file
1270 will be overwritten with the new settings, destroying any comments that
1273 The F<ethers> file, which is found in the F</etc> directory on
1274 UNIX-compatible systems, and in the main installation directory (for
1275 example, F<C:\Program Files\Ethereal>) on Windows systems, is consulted
1276 to correlate 6-byte hardware addresses to names. If an address is not
1277 found in the F<ethers> file, the F<$HOME/.ethereal/ethers> file on
1278 UNIX-compatible systems, and the F<%APPDATA%\Ethereal\ethers> file (or, if
1279 %APPDATA% isn't defined, the
1280 F<%USERPROFILE%\Application Data\Ethereal\ethers> file) on Windows
1281 systems is consulted next. Each line contains one hardware
1282 address and name, separated by whitespace. The digits of the hardware
1283 address are separated by either a colon (:), a dash (-), or a period
1284 (.). The following three lines are valid lines of an ethers file:
1286 ff:ff:ff:ff:ff:ff Broadcast
1287 c0-00-ff-ff-ff-ff TR_broadcast
1288 00.00.00.00.00.00 Zero_broadcast
1290 The F<manuf> file, which is installed in the F<etc> directory under the
1291 main installation directory (for example, F</usr/local/etc>) on
1292 UNIX-compatible systems, and in the main installation directory (for
1293 example, F<C:\Program Files\Ethereal>) on Windows systems, matches the
1294 3-byte vendor portion of a 6-byte hardware address with the
1295 manufacturer's name; it can also contain well-known MAC addresses and
1296 address ranges specified with a netmask. The format of the file is the
1297 same as the F<ethers> file, except that entries of the form
1301 can be provided, with the 3-byte OUI and the name for a vendor, and
1304 00-00-0C-07-AC/40 All-HSRP-routers
1306 can be specified, with a MAC address and a mask indicating how many bits
1307 of the address must match. Trailing zero bytes can be omitted from
1308 address ranges. That entry, for example, will match addresses from
1309 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
1312 The F<ipxnets> file, which is found in the F</etc> directory on
1313 UNIX-compatible systems, and in the main installation directory (for
1314 example, F<C:\Program Files\Ethereal>) on Windows systems, correlates
1315 4-byte IPX network numbers to names. If a network number is not found
1316 in the F<ipxnets> file, the F<$HOME/.ethereal/ipxnets> file on
1317 UNIX-compatible systems, and the F<%APPDATA%\Ethereal\ipxnets> file (or,
1318 if %APPDATA% isn't defined, the
1319 F<%USERPROFILE%\Application Data\Ethereal\ipxnets> file)
1320 on Windows systems, is consulted next. The format is the same as the
1321 F<ethers> file, except that each address if four bytes instead of six.
1322 Additionally, the address can be represented a single hexadecimal
1323 number, as is more common in the IPX world, rather than four hex octets.
1324 For example, these four lines are valid lines of an ipxnets file.
1328 00:00:BE:EF IT_Server1
1333 I<tethereal(1)>, I<editcap(1)>, I<tcpdump(8)>, I<pcap(3)>
1337 The latest version of B<Ethereal> can be found at
1338 B<http://www.ethereal.com>.
1344 Gerald Combs <gerald[AT]ethereal.com>
1349 Gilbert Ramirez <gram[AT]alumni.rice.edu>
1350 Hannes R. Boehm <hannes[AT]boehm.org>
1351 Mike Hall <mlh[AT]io.com>
1352 Bobo Rajec <bobo[AT]bsp-consulting.sk>
1353 Laurent Deniel <deniel[AT]worldnet.fr>
1354 Don Lafontaine <lafont02[AT]cn.ca>
1355 Guy Harris <guy[AT]alum.mit.edu>
1356 Simon Wilkinson <sxw[AT]dcs.ed.ac.uk>
1357 Joerg Mayer <jmayer[AT]loplof.de>
1358 Martin Maciaszek <fastjack[AT]i-s-o.net>
1359 Didier Jorand <Didier.Jorand[AT]alcatel.fr>
1360 Jun-ichiro itojun Hagino <itojun[AT]itojun.org>
1361 Richard Sharpe <sharpe[AT]ns.aus.com>
1362 John McDermott <jjm[AT]jkintl.com>
1363 Jeff Jahr <jjahr[AT]shastanets.com>
1364 Brad Robel-Forrest <bradr[AT]watchguard.com>
1365 Ashok Narayanan <ashokn[AT]cisco.com>
1366 Aaron Hillegass <aaron[AT]classmax.com>
1367 Jason Lango <jal[AT]netapp.com>
1368 Johan Feyaerts <Johan.Feyaerts[AT]siemens.atea.be>
1369 Olivier Abad <oabad[AT]noos.fr>
1370 Thierry Andry <Thierry.Andry[AT]advalvas.be>
1371 Jeff Foster <jfoste[AT]woodward.com>
1372 Peter Torvals <petertv[AT]xoommail.com>
1373 Christophe Tronche <ch.tronche[AT]computer.org>
1374 Nathan Neulinger <nneul[AT]umr.edu>
1375 Tomislav Vujec <tvujec[AT]carnet.hr>
1376 Kojak <kojak[AT]bigwig.net>
1377 Uwe Girlich <Uwe.Girlich[AT]philosys.de>
1378 Warren Young <tangent[AT]mail.com>
1379 Heikki Vatiainen <hessu[AT]cs.tut.fi>
1380 Greg Hankins <gregh[AT]twoguys.org>
1381 Jerry Talkington <jerryt[AT]netapp.com>
1382 Dave Chapeskie <dchapes[AT]ddm.on.ca>
1383 James Coe <jammer[AT]cin.net>
1384 Bert Driehuis <driehuis[AT]playbeing.org>
1385 Stuart Stanley <stuarts[AT]mxmail.net>
1386 John Thomes <john[AT]ensemblecom.com>
1387 Laurent Cazalet <laurent.cazalet[AT]mailclub.net>
1388 Thomas Parvais <thomas.parvais[AT]advalvas.be>
1389 Gerrit Gehnen <G.Gehnen[AT]atrie.de>
1390 Craig Newell <craign[AT]cheque.uq.edu.au>
1391 Ed Meaney <emeaney[AT]cisco.com>
1392 Dietmar Petras <DPetras[AT]ELSA.de>
1393 Fred Reimer <fwr[AT]ga.prestige.net>
1394 Florian Lohoff <flo[AT]rfc822.org>
1395 Jochen Friedrich <jochen+ethereal[AT]scram.de>
1396 Paul Welchinski <paul.welchinski[AT]telusplanet.net>
1397 Doug Nazar <nazard[AT]dragoninc.on.ca>
1398 Andreas Sikkema <andreas.sikkema[AT]philips.com>
1399 Mark Muhlestein <mmm[AT]netapp.com>
1400 Graham Bloice <graham.bloice[AT]trihedral.com>
1401 Ralf Schneider <ralf.schneider[AT]alcatel.se>
1402 Yaniv Kaul <ykaul[AT]netvision.net.il>
1403 Paul Ionescu <paul[AT]acorp.ro>
1404 Mark Burton <markb[AT]ordern.com>
1405 Stefan Raab <sraab[AT]cisco.com>
1406 Mark Clayton <clayton[AT]shore.net>
1407 Michael Rozhavsky <mike[AT]tochna.technion.ac.il>
1408 Dug Song <dugsong[AT]monkey.org>
1409 Michael Tuexen <Michael.Tuexen[AT]icn.siemens.de>
1410 Bruce Korb <bkorb[AT]sco.com>
1411 Jose Pedro Oliveira <jpo[AT]di.uminho.pt>
1412 David Frascone <dave[AT]frascone.com>
1413 Peter Kjellerstedt <pkj[AT]axis.com>
1414 Phil Techau <phil_t[AT]altavista.net>
1415 Wes Hardaker <wjhardaker[AT]ucdavis.edu>
1416 Robert Tsai <rtsai[AT]netapp.com>
1417 Craig Metz <cmetz[AT]inner.net>
1418 Per Flock <per.flock[AT]axis.com>
1419 Jack Keane <jkeane[AT]OpenReach.com>
1420 Brian Wellington <bwelling[AT]xbill.org>
1421 Santeri Paavolainen <santtu[AT]ssh.com>
1422 Ulrich Kiermayr <uk[AT]ap.univie.ac.at>
1423 Neil Hunter <neil.hunter[AT]energis-squared.com>
1424 Ralf Holzer <ralf[AT]well.com>
1425 Craig Rodrigues <rodrigc[AT]mediaone.net>
1426 Ed Warnicke <hagbard[AT]physics.rutgers.edu>
1427 Johan Jorgensen <johan.jorgensen[AT]axis.com>
1428 Frank Singleton <frank.singleton[AT]ericsson.com>
1429 Kevin Shi <techishi[AT]ms22.hinet.net>
1430 Mike Frisch <mfrisch[AT]isurfer.ca>
1431 Burke Lau <burke_lau[AT]agilent.com>
1432 Martti Kuparinen <martti.kuparinen[AT]iki.fi>
1433 David Hampton <dhampton[AT]mac.com>
1434 Kent Engström <kent[AT]unit.liu.se>
1435 Ronnie Sahlberg <sahlberg[AT]optushome.com.au>
1436 Borosa Tomislav <tomislav.borosa[AT]SIEMENS.HR>
1437 Alexandre P. Ferreira <alexandref[AT]tcoip.com.br>
1438 Simharajan Srishylam <Simharajan.Srishylam[AT]netapp.com>
1439 Greg Kilfoyle <gregk[AT]redback.com>
1440 James E. Flemer <jflemer[AT]acm.jhu.edu>
1441 Peter Lei <peterlei[AT]cisco.com>
1442 Thomas Gimpel <thomas.gimpel[AT]ferrari.de>
1443 Albert Chin <china[AT]thewrittenword.com>
1444 Charles Levert <charles[AT]comm.polymtl.ca>
1445 Todd Sabin <tas[AT]webspan.net>
1446 Eduardo Pérez Ureta <eperez[AT]dei.inf.uc3m.es>
1447 Martin Thomas <martin_a_thomas[AT]yahoo.com>
1448 Hartmut Mueller <hartmut[AT]wendolene.ping.de>
1449 Michal Melerowicz <Michal.Melerowicz[AT]nokia.com>
1450 Hannes Gredler <hannes[AT]juniper.net>
1451 Inoue <inoue[AT]ainet.or.jp>
1452 Olivier Biot <Olivier.Biot[AT]siemens.atea.be>
1453 Patrick Wolfe <pjw[AT]zocalo.cellular.ameritech.com>
1454 Martin Held <Martin.Held[AT]icn.siemens.de>
1455 Riaan Swart <rswart[AT]cs.sun.ac.za>
1456 Christian Lacunza <celacunza[AT]gmx.net>
1457 Scott Renfro <scott[AT]renfro.org>
1458 Juan Toledo <toledo[AT]users.sourceforge.net>
1459 Jean-Christian Pennetier <jeanchristian.pennetier[AT]rd.francetelecom.fr>
1460 Jian Yu <bgp4news[AT]yahoo.com>
1461 Eran Mann <emann[AT]opticalaccess.com>
1462 Andy Hood <ahood[AT]westpac.com.au>
1463 Randy McEoin <rmceoin[AT]pe.net>
1464 Edgar Iglesias <edgar.iglesias[AT]axis.com>
1465 Martina Obermeier <Martina.Obermeier[AT]icn.siemens.de>
1466 Javier Achirica <achirica[AT]ttd.net>
1467 B. Johannessen <bob[AT]havoq.com>
1468 Thierry Pelle <thierry.pelle[AT]rd.francetelecom.fr>
1469 Francisco Javier Cabello <fjcabello[AT]vtools.es>
1470 Laurent Rabret <laurent.rabret[AT]rd.francetelecom.fr>
1471 nuf si <gnippiks[AT]yahoo.com>
1472 Jeff Morriss <jeff.morriss[AT]ulticom.com>
1473 Aamer Akhter <aakhter[AT]cisco.com>
1474 Pekka Savola <pekkas[AT]netcore.fi>
1475 David Eisner <cradle[AT]Glue.umd.edu>
1476 Steve Dickson <steved[AT]talarian.com>
1477 Markus Seehofer <mseehofe[AT]nt.hirschmann.de>
1478 Lee Berger <lberger[AT]roy.org>
1479 Motonori Shindo <mshindo[AT]mshindo.net>
1480 Terje Krogdahl <tekr[AT]nextra.com>
1481 Jean-Francois Mule <jfm[AT]cablelabs.com>
1482 Thomas Wittwer <thomas.wittwer[AT]iclip.ch>
1483 Matthias Nyffenegger <matthias.nyffenegger[AT]iclip.ch>
1484 Palle Lyckegaard <Palle[AT]lyckegaard.dk>
1485 Nicolas Balkota <balkota[AT]mac.com>
1486 Tom Uijldert <Tom.Uijldert[AT]cmg.nl>
1487 Endoh Akira <endoh[AT]netmarks.co.jp>
1488 Graeme Hewson <graeme.hewson[AT]oracle.com>
1489 Pasi Eronen <pasi.eronen[at]nixu.com>
1490 Georg von Zezschwitz <gvz[AT]2scale.net>
1491 Steffen Weinreich <steve[AT]weinreich.org>
1492 Marc Milgram <mmilgram[AT]arrayinc.com>
1493 Gordon McKinney <gordon[AT]night-ray.com>
1494 Tim Farley <tfarley[AT]iss.net>
1495 Daniel Thompson <daniel.thompson[AT]st.com>
1496 Chris Jepeway <thai-dragon[AT]eleven29.com>
1497 Pavel Novotny <Pavel.Novotny[AT]icn.siemens.de>
1498 Shinsuke Suzuki <suz[AT]kame.net>
1499 Andrew C. Feren <aferen[AT]cetacean.com>
1500 Tomas Kukosa <tomas.kukosa[AT]anfdata.cz>
1501 Andreas Stockmeier <a.stockmeier[AT]avm.de>
1502 Pekka Nikander <pekka.nikander[AT]nomadiclab.com>
1503 Hamish Moffatt <hamish[AT]cloud.net.au>
1504 Kazushi Sugyo <k-sugyou[AT]nwsl.mesh.ad.jp>
1505 Tim Potter <tpot[AT]samba.org>
1506 Raghu Angadi <rangadi[AT]inktomi.com>
1507 Taisuke Sasaki <sasaki[AT]soft.net.fujitsu.co.jp>
1508 Tim Newsham <newsham[AT]lava.net>
1509 Tom Nisbet <Tnisbet[AT]VisualNetworks.com>
1510 Darren New <dnew[AT]san.rr.com>
1511 Pavel Mores <pvl[AT]uh.cz>
1512 Bernd Becker <bb[AT]bernd-becker.de>
1513 Heinz Prantner <Heinz.Prantner[AT]radisys.com>
1514 Irfan Khan <ikhan[AT]qualcomm.com>
1515 Jayaram V.R <vjayar[AT]cisco.com>
1516 Dinesh Dutt <ddutt[AT]cisco.com>
1517 Nagarjuna Venna <nvenna[AT]Brixnet.com>
1518 Jirka Novak <j.novak[AT]netsystem.cz>
1519 Ricardo Barroetaveña <rbarroetavena[AT]veufort.com>
1520 Alan Harrison <alanharrison[AT]mail.com>
1521 Mike Frantzen <frantzen[AT]w4g.org>
1522 Charlie Duke <cduke[AT]fvc.com>
1523 Alfred Arnold <Alfred.Arnold[AT]elsa.de>
1524 Dermot Bradley <dermot.bradley[AT]openwave.com>
1525 Adam Sulmicki <adam[AT]cfar.umd.edu>
1526 Kari Tiirikainen <kari.tiirikainen[AT]nokia.com>
1527 John Mackenzie <John.A.Mackenzie[AT]t-online.de>
1528 Peter Valchev <pvalchev[AT]openbsd.org>
1529 Alex Ruzin <alexr[AT]nbase.co.il>
1530 Jouni Malinen <jkmaline[AT]cc.hut.fi>
1531 Paul E. Erkkila <pee[AT]erkkila.org>
1532 Jakob Schlyter <jakob[AT]crt.se>
1533 Jim Sienicki <sienicki[AT]issanni.com>
1534 Steven French <sfrench[AT]us.ibm.com>
1535 Diana Eichert <deicher[AT]sandia.gov>
1536 Blair Cooper <blair[AT]teamon.com>
1537 Kikuchi Ayamura <ayamura[AT]ayamura.org>
1538 Didier Gautheron <dgautheron[AT]magic.fr>
1539 Phil Williams <csypbw[AT]comp.leeds.ac.uk>
1540 Kevin Humphries <khumphries[AT]networld.com>
1541 Erik Nordström <erik.nordstrom[AT]it.uu.se>
1542 Devin Heitmueller <dheitmueller[AT]netilla.com>
1543 Chenjiang Hu <chu[AT]chiaro.com>
1544 Kan Sasaki <sasaki[AT]fcc.ad.jp>
1545 Stefan Wenk <stefan.wenk[AT]gmx.at>
1546 Ruud Linders <ruud[AT]lucent.com>
1547 Andrew Esh <Andrew.Esh[AT]tricord.com>
1548 Greg Morris <GMORRIS[AT]novell.com>
1549 Dirk Steinberg <dws[AT]dirksteinberg.de>
1550 Kari Heikkila <kari.o.heikkila[AT]nokia.com>
1551 Olivier Dreux <Olivier.Dreux[AT]alcatel.fr>
1552 Michael Stiller <ms[AT]2scale.net>
1553 Antti Tuominen <ajtuomin[AT]tml.hut.fi>
1554 Martin Gignac <lmcgign[AT]mobilitylab.net>
1555 John Wells <wells[AT]ieee.org>
1556 Loic Tortay <tortay[AT]cc.in2p3.fr>
1557 Steve Housley <Steve_Housley[AT]eur.3com.com>
1558 Peter Hawkins <peter[AT]hawkins.emu.id.au>
1559 Bill Fumerola <billf[AT]FreeBSD.org>
1560 Chris Waters <chris[AT]waters.co.nz>
1561 Solomon Peachy <pizza[AT]shaftnet.org>
1562 Jaime Fournier <jafour1[AT]yahoo.com>
1563 Markus Steinmann <ms[AT]seh.de>
1564 Tsutomu Mieno <iitom[AT]utouto.com>
1565 Yasuhiro Shirasaki <yasuhiro[AT]gnome.gr.jp>
1566 Anand V. Narwani <anarwani[AT]cisco.com>
1567 Christopher K. St. John <cks[AT]distributopia.com>
1568 Nix <nix[AT]esperi.demon.co.uk>
1569 Liviu Daia <Liviu.Daia[AT]imar.ro>
1570 Richard Urwin <rurwin[AT]schenck.co.uk>
1571 Prabhakar Krishnan <Prabhakar.Krishnan[AT]netapp.com>
1572 Jim McDonough <jmcd[AT]us.ibm.com>
1573 Sergei Shokhor <sshokhor[AT]uroam.com>
1574 Hidetaka Ogawa <ogawa[AT]bs2.qnes.nec.co.jp>
1575 Jan Kratochvil <short[AT]ucw.cz>
1576 Alfred Koebler <ak[AT]icon-sult.de>
1577 Vassilii Khachaturov <Vassilii.Khachaturov[AT]comverse.com>
1578 Bill Studenmund <wrstuden[AT]wasabisystems.com>
1579 Brian Bruns <camber[AT]ais.org>
1580 Flavio Poletti <flavio[AT]polettix.it>
1581 Marcus Haebler <haeblerm[AT]yahoo.com>
1582 Ulf Lamping <ulf.lamping[AT]web.de>
1583 Matthew Smart <smart[AT]monkey.org>
1584 Luke Howard <lukeh[AT]au.padl.com>
1585 PC Drew <drewpc[AT]ibsncentral.com>
1586 Renzo Tomas <renzo.toma [AT] xs4all.nl>
1587 Clive A. Stubbings <eth[AT]vjet.demon.co.uk>
1588 Steve Langasek <vorlon [AT] netexpress.net>
1589 Brad Hards <bhards[AT]bigpond.net.au>
1590 cjs 2895 <cjs2895[AT]hotmail.com>
1591 Lutz Jaenicke <Lutz.Jaenicke [AT] aet.TU-Cottbus.DE>
1592 Senthil Kumar Nagappan <sknagappan [AT] yahoo.com>
1593 Jason House <jhouse [AT] mitre.org>
1594 Peter Fales <psfales [AT] lucent.com>
1595 Fritz Budiyanto <fritzb88 [AT] yahoo.com>
1596 Jean-Baptiste Marchand <Jean-Baptiste.Marchand [AT] hsc.fr>
1597 Andreas Trauer <andreas.trauer [AT] siemens.com>
1598 Ronald Henderson <Ronald.Henderson [AT] CognicaseUSA.com>
1599 Brian Ginsbach <ginsbach [AT] cray.com>
1600 Dave Richards <d_m_richards [AT] attbi.com>
1602 Alain Magloire <alainm[AT]rcsm.ece.mcgill.ca> was kind enough to give his
1603 permission to use his version of snprintf.c.
1605 Dan Lasley <dlasley[AT]promus.com> gave permission for his dumpit() hex-dump
1608 Mattia Cazzola <mattiac[AT]alinet.it> provided a patch to the hex dump
1611 We use the exception module from Kazlib, a C library written by
1612 Kaz Kylheku <kaz[AT]ashi.footprints.net>. Thanks goes to him for his
1613 well-written library. The Kazlib home page can be found at
1614 http://users.footprints.net/~kaz/kazlib.html