4 tshark - Dump and analyze network traffic
9 S<[ B<-a> E<lt>capture autostop conditionE<gt> ] ...>
10 S<[ B<-b> E<lt>capture ring buffer optionE<gt>] ...>
11 S<[ B<-B> E<lt>capture buffer size (Win32 only)E<gt> ] >
12 S<[ B<-c> E<lt>capture packet countE<gt> ]>
13 S<[ B<-d> E<lt>layer typeE<gt>==E<lt>selectorE<gt>,E<lt>decode-as protocolE<gt> ]>
15 S<[ B<-e> E<lt>fieldE<gt> ]>
16 S<[ B<-E> E<lt>field print optionE<gt> ]>
17 S<[ B<-f> E<lt>capture filterE<gt> ]>
18 S<[ B<-F> E<lt>file formatE<gt> ]>
20 S<[ B<-i> E<lt>capture interfaceE<gt>|- ]>
24 S<[ B<-N> E<lt>name resolving flagsE<gt> ]>
25 S<[ B<-o> E<lt>preference settingE<gt> ] ...>
28 S<[ B<-r> E<lt>infileE<gt> ]>
29 S<[ B<-R> E<lt>read (display) filterE<gt> ]>
30 S<[ B<-s> E<lt>capture snaplenE<gt> ]>
32 S<[ B<-t> ad|a|r|d|e ]>
33 S<[ B<-T> pdml|psml|ps|text|fields ]>
36 S<[ B<-w> E<lt>outfileE<gt>|- ]>
38 S<[ B<-X> E<lt>eXtension optionE<gt>]>
39 S<[ B<-y> E<lt>capture link typeE<gt> ]>
40 S<[ B<-z> E<lt>statisticsE<gt> ]>
41 S<[ E<lt>capture filterE<gt> ]>
45 B<TShark> is a network protocol analyzer. It lets you capture packet
46 data from a live network, or read packets from a previously saved
47 capture file, either printing a decoded form of those packets to the
48 standard output or writing the packets to a file. B<TShark>'s native
49 capture file format is B<libpcap> format, which is also the format used
50 by B<tcpdump> and various other tools.
52 Without any options set, B<TShark> will work much like B<tcpdump>. It will
53 use the pcap library to capture traffic from the first available network
54 interface and displays a summary line on stdout for each received packet.
56 B<TShark> is able to detect, read and write the same capture files that
57 are supported by B<Wireshark>.
58 The input file doesn't need a specific filename extension; the file
59 format and an optional gzip compression will be automatically detected.
60 Near the beginning of the DESCRIPTION section of wireshark(1) or
61 L<http://www.wireshark.org/docs/man-pages/wireshark.html>
62 is a detailed description of the way B<Wireshark> handles this, which is
63 the same way B<Tshark> handles this.
65 Compressed file support uses (and therefore requires) the zlib library.
66 If the zlib library is not present, B<TShark> will compile, but will
67 be unable to read compressed files.
69 If the B<-w> option is not specified, B<TShark> writes to the standard
70 output the text of a decoded form of the packets it captures or reads.
71 If the B<-w> option is specified, B<TShark> writes to the file
72 specified by that option the raw data of the packets, along with the
75 When writing a decoded form of packets, B<TShark> writes, by
76 default, a summary line containing the fields specified by the
77 preferences file (which are also the fields displayed in the packet list
78 pane in B<Wireshark>), although if it's writing packets as it captures
79 them, rather than writting packets from a saved capture file, it won't
80 show the "frame number" field. If the B<-V> option is specified, it
81 writes instead a view of the details of the packet, showing all the
82 fields of all protocols in the packet.
84 If you want to write the decoded form of packets to a file, run
85 B<TShark> without the B<-w> option, and redirect its standard output to
86 the file (do I<not> use the B<-w> option).
88 When writing packets to a file, B<TShark>, by default, writes the
89 file in B<libpcap> format, and writes all of the packets it sees to the
90 output file. The B<-F> option can be used to specify the format in which
91 to write the file. This list of available file formats is displayed by
94 Read filters in B<TShark>, which allow you to select which packets
95 are to be decoded or written to a file, are very powerful; more fields
96 are filterable in B<TShark> than in other protocol analyzers, and the
97 syntax you can use to create your filters is richer. As B<TShark>
98 progresses, expect more and more protocol fields to be allowed in read
101 Packet capturing is performed with the pcap library. The capture filter
102 syntax follows the rules of the pcap library. This syntax is different
103 from the read filter syntax. A read filter can also be specified when
104 capturing, and only packets that pass the read filter will be displayed
105 or saved to the output file; note, however, that capture filters are much
106 more efficient than read filters, and it may be more difficult for
107 B<TShark> to keep up with a busy network if a read filter is
108 specified for a live capture.
110 A capture or read filter can either be specified with the B<-f> or B<-R>
111 option, respectively, in which case the entire filter expression must be
112 specified as a single argument (which means that if it contains spaces,
113 it must be quoted), or can be specified with command-line arguments
114 after the option arguments, in which case all the arguments after the
115 filter arguments are treated as a filter expression. Capture filters
116 are supported only when doing a live capture; read filters are supported
117 when doing a live capture and when reading a capture file, but require
118 TShark to do more work when filtering, so you might be more likely to
119 lose packets under heavy load if you're using a read filter. If the
120 filter is specified with command-line arguments after the option
121 arguments, it's a capture filter if a capture is being done (i.e., if no
122 B<-r> option was specified) and a read filter if a capture file is being
123 read (i.e., if a B<-r> option was specified).
129 =item -a E<lt>capture autostop conditionE<gt>
131 Specify a criterion that specifies when B<TShark> is to stop writing
132 to a capture file. The criterion is of the form I<test>B<:>I<value>,
133 where I<test> is one of:
135 B<duration>:I<value> Stop writing to a capture file after I<value> seconds have elapsed.
137 B<filesize>:I<value> Stop writing to a capture file after it reaches a size of I<value>
138 kilobytes (where a kilobyte is 1024 bytes). If this option
139 is used together with the -b option, B<TShark> will stop writing to the
140 current capture file and switch to the next one if filesize is reached. When reading a capture file,
141 B<TShark> will stop reading the file after the number of bytes read exceeds this number
142 (the complete packet will be read, so more bytes than this number may be read).
144 B<files>:I<value> Stop writing to capture files after I<value> number of files were written.
146 =item -b E<lt>capture ring buffer optionE<gt>
148 Cause B<TShark> to run in "multiple files" mode. In "multiple files" mode,
149 B<TShark> will write to several capture files. When the first capture file
150 fills up, B<TShark> will switch writing to the next file and so on.
152 The created filenames are based on the filename given with the B<-w> option, the number of
153 the file and on the creation date and time,
154 e.g. outfile_00001_20050604120117.pcap, outfile_00001_20050604120523.pcap, ...
156 With the I<files> option it's also possible to form a "ring buffer".
157 This will fill up new files until the number of files specified,
158 at which point B<TShark> will discard the data in the first file and start
159 writing to that file and so on. If the I<files> option is not set,
160 new files filled up until one of the capture stop conditions match (or
161 until the disk if full).
163 The criterion is of the form I<key>B<:>I<value>,
164 where I<key> is one of:
166 B<duration>:I<value> switch to the next file after I<value> seconds have
167 elapsed, even if the current file is not completely filled up.
169 B<filesize>:I<value> switch to the next file after it reaches a size of
170 I<value> kilobytes (where a kilobyte is 1024 bytes).
172 B<files>:I<value> begin again with the first file after I<value> number of
173 files were written (form a ring buffer).
175 =item -B E<lt>capture buffer size (Win32 only)E<gt>
177 Win32 only: set capture buffer size (in MB, default is 1MB). This is used by the
178 the capture driver to buffer packet data until that data can be written to
179 disk. If you encounter packet drops while capturing, try to increase this size.
181 =item -c E<lt>capture packet countE<gt>
183 Set the maximum number of packets to read when capturing live
184 data. If reading a capture file, set the maximum number of packets to read.
186 =item -d E<lt>layer typeE<gt>==E<lt>selectorE<gt>,E<lt>decode-as protocolE<gt>
188 Specify that if the layer type in question (for example, B<tcp.port> or
189 B<udp.port> for a TCP or UDP port number) has the specified selector
190 value, packets should be dissected as the specified protocol.
192 Example: B<-d tcp.port==8888,http> will decode any traffic running over
193 TCP port 8888 as HTTP.
197 Print a list of the interfaces on which B<TShark> can capture, and
198 exit. For each network interface, a number and an
199 interface name, possibly followed by a text description of the
200 interface, is printed. The interface name or the number can be supplied
201 to the B<-i> option to specify an interface on which to capture.
203 This can be useful on systems that don't have a command to list them
204 (e.g., Windows systems, or UNIX systems lacking B<ifconfig -a>);
205 the number can be useful on Windows 2000 and later systems, where the
206 interface name is a somewhat complex string.
208 Note that "can capture" means that B<TShark> was able to open that
209 device to do a live capture. Depending on your system you may need to
210 run tshark from an account with special privileges (for example, as
211 root) to be able to capture network traffic. If B<TShark -D> is not run
212 from such an account, it will not list any interfaces.
214 =item -e E<lt>fieldE<gt>
216 Add a field to the list of fields to display if B<-T fields> is
217 selected. This option can be used multiple times on the command line.
218 At least one field must be provided if the B<-T fields> option is
221 Example: B<-e frame.number -e ip.addr -e udp>
223 Giving a protocol rather than a single field will print multiple items
224 of data about the protocol as a single field. Fields are separated by
225 tab characters by default. B<-E> controls the format of the printed
228 =item -E E<lt>field print optionE<gt>
230 Set an option controlling the printing of fields when B<-T fields> is
235 B<header=y|n> If B<y>, print a list of the field names given using B<-e>
236 as the first line of the output; the field name will be separated using
237 the same character as the field values. Defaults to B<n>.
239 B<separator=/t|/s|>E<lt>characterE<gt> Set the separator character to
240 use for fields. If B</t> tab will be used (this is the default), if
241 B</s>, s single space will be used. Otherwise any character that can be
242 accepted by the command line as part of the option may be used.
244 B<quote=d|s|n> Set the quote character to use to surround fields. B<d>
245 uses double-quotes, B<s> single-quotes, B<n> no quotes (the default).
247 =item -f E<lt>capture filterE<gt>
249 Set the capture filter expression.
251 =item -F E<lt>file formatE<gt>
253 Set the file format of the output capture file written using the B<-w>
254 option. The output written with the B<-w> option is raw packet data, not
255 text, so there is no B<-F> option to request text output.
259 Print the version and options and exits.
261 =item -i E<lt>capture interfaceE<gt>|-
263 Set the name of the network interface or pipe to use for live packet
266 Network interface names should match one of the names listed in
267 "B<tshark -D>" (described above); a number, as reported by
268 "B<tshark -D>", can also be used. If you're using UNIX, "B<netstat
269 -i>" or "B<ifconfig -a>" might also work to list interface names,
270 although not all versions of UNIX support the B<-a> option to B<ifconfig>.
272 If no interface is specified, B<TShark> searches the list of
273 interfaces, choosing the first non-loopback interface if there are any
274 non-loopback interfaces, and choosing the first loopback interface if
275 there are no non-loopback interfaces. If there are no interfaces at all,
276 B<TShark> reports an error and doesn't start the capture.
278 Pipe names should be either the name of a FIFO (named pipe) or ``-'' to
279 read data from the standard input. Data read from pipes must be in
280 standard libpcap format.
282 Note: the Win32 version of B<TShark> doesn't support capturing from
287 Flush the standard output after the information for each packet is
288 printed. (This is not, strictly speaking, line-buffered if B<-V>
289 was specified; however, it is the same as line-buffered if B<-V> wasn't
290 specified, as only one line is printed for each packet, and, as B<-l> is
291 normally used when piping a live capture to a program or script, so that
292 output for a packet shows up as soon as the packet is seen and
293 dissected, it should work just as well as true line-buffering. We do
294 this as a workaround for a deficiency in the Microsoft Visual C++ C
297 This may be useful when piping the output of B<TShark> to another
298 program, as it means that the program to which the output is piped will
299 see the dissected data for a packet as soon as B<TShark> sees the
300 packet and generates that output, rather than seeing it only when the
301 standard output buffer containing that data fills up.
305 List the data link types supported by the interface and exit. The reported
306 link types can be used for the B<-y> option.
310 Disable network object name resolution (such as hostname, TCP and UDP port
311 names), the B<-N> flag might override this one.
313 =item -N E<lt>name resolving flagsE<gt>
315 Turn on name resolving only for particular types of addresses and port
316 numbers, with name resolving for other types of addresses and port
317 numbers turned off. This flag overrides B<-n> if both B<-N> and B<-n> are
318 present. If both B<-N> and B<-n> flags are not present, all name resolutions are
321 The argument is a string that may contain the letters:
323 B<m> to enable MAC address resolution
325 B<n> to enable network address resolution
327 B<t> to enable transport-layer port number resolution
329 B<C> to enable concurrent (asynchronous) DNS lookups
331 =item -o E<lt>preferenceE<gt>:E<lt>valueE<gt>
333 Set a preference value, overriding the default value and any value read
334 from a preference file. The argument to the option is a string of the
335 form I<prefname>B<:>I<value>, where I<prefname> is the name of the
336 preference (which is the same name that would appear in the preference
337 file), and I<value> is the value to which it should be set.
341 I<Don't> put the interface into promiscuous mode. Note that the
342 interface might be in promiscuous mode for some other reason; hence,
343 B<-p> cannot be used to ensure that the only traffic that is captured is
344 traffic sent to or from the machine on which B<TShark> is running,
345 broadcast traffic, and multicast traffic to addresses received by that
350 When capturing packets, don't display the continuous count of packets
351 captured that is normally shown when saving a capture to a file;
352 instead, just display, at the end of the capture, a count of packets
353 captured. On systems that support the SIGINFO signal, such as various
354 BSDs, you can cause the current count to be displayed by typing your
355 "status" character (typically control-T, although it
356 might be set to "disabled" by default on at least some BSDs, so you'd
357 have to explicitly set it to use it).
359 When reading a capture file, or when capturing and not saving to a file,
360 don't print packet information; this is useful if you're using a B<-z>
361 option to calculate statistics and don't want the packet information
362 printed, just the statistics.
364 =item -r E<lt>infileE<gt>
366 Read packet data from I<infile>, can be any supported capture file format
367 (including gzipped files). It's B<not> possible to use named pipes
370 =item -R E<lt>read (display) filterE<gt>
372 Cause the specified filter (which uses the syntax of read/display filters,
373 rather than that of capture filters) to be applied before printing a
374 decoded form of packets or writing packets to a file; packets not
375 matching the filter are discarded rather than being printed or written.
377 =item -s E<lt>capture snaplenE<gt>
379 Set the default snapshot length to use when capturing live data.
380 No more than I<snaplen> bytes of each network packet will be read into
381 memory, or saved to disk.
385 Decode and display packets even while writing raw packet data using the
390 Set the format of the packet timestamp printed in summary lines, the default
391 is relative. The format can be one of:
393 B<ad> absolute with date: The absolute date and time is the actual time and
394 date the packet was captured
396 B<a> absolute: The absolute time is the actual time the packet was captured,
397 with no date displayed
399 B<r> relative: The relative time is the time elapsed between the first packet
400 and the current packet
402 B<d> delta: The delta time is the time since the previous packet was
405 B<e> epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00)
407 =item -T pdml|psml|ps|text|fields
409 Set the format of the output when viewing decoded packet data. The
412 B<pdml> Packet Details Markup Language, an XML-based format for the details of
413 a decoded packet. This information is equivalent to the packet details
414 printed with the B<-V> flag.
416 B<psml> Packet Summary Markup Language, an XML-based format for the summary
417 information of a decoded packet. This information is equivalent to the
418 information shown in the one-line summary printed by default.
420 B<ps> PostScript for a human-readable one-line summary of each of the packets,
421 or a multi-line view of the details of each of the packets, depending on
422 whether the B<-V> flag was specified.
424 B<text> Text of a human-readable one-line summary of each of the packets, or a
425 multi-line view of the details of each of the packets, depending on
426 whether the B<-V> flag was specified. This is the default.
428 B<fields> The values of fields specified with the B<-e> option, in a
429 form specified by the B<-E> option.
433 Print the version and exit.
437 Cause B<TShark> to print a view of the packet details rather
438 than a one-line summary of the packet.
440 =item -w E<lt>outfileE<gt>|-
442 Write raw packet data to I<outfile> or to the standard output if
445 NOTE: -w provides raw packet data, not text. If you want text output
446 you need to redirect stdout (e.g. using '>'), don't use the B<-w>
451 Cause B<TShark> to print a hex and ASCII dump of the packet data
452 after printing the summary or details.
455 =item -X E<lt>eXtension optionsE<gt>
457 Specify an option to be passed to a B<TShark> module. The eXtension option
458 is in the form I<extension_key>B<:>I<value>, where I<extension_key> can be:
460 B<lua_script>:I<lua_script_filename> tells B<Wireshark> to load the given script in addition to the
464 =item -y E<lt>capture link typeE<gt>
466 Set the data link type to use while capturing packets. The values
467 reported by B<-L> are the values that can be used.
469 =item -z E<lt>statisticsE<gt>
471 Get B<TShark> to collect various types of statistics and display the result
472 after finishing reading the capture file. Use the B<-q> flag if you're
473 reading a capture file and only want the statistics printed, not any
474 per-packet information.
476 Note that the B<-z proto> option is different - it doesn't cause
477 statistics to be gathered and printed when the capture is complete, it
478 modifies the regular packet summary output to include the values of
479 fields specified with the option. Therefore you must not use the B<-q>
480 option, as that option would suppress the printing of the regular packet
481 summary output, and must also not use the B<-V> option, as that would
482 cause packet detail information rather than packet summary information
485 Currently implemented statistics are:
487 B<-z> dcerpc,rtt,I<uuid>,I<major>.I<minor>[,I<filter>]
489 Collect call/reply RTT data for DCERPC interface I<uuid>,
490 version I<major>.I<minor>.
491 Data collected is number of calls for each procedure, MinRTT, MaxRTT
493 Example: use B<-z dcerpc,rtt,12345778-1234-abcd-ef00-0123456789ac,1.0> to collect data for CIFS SAMR Interface.
494 This option can be used multiple times on the command line.
496 If the optional filterstring is provided, the stats will only be calculated
497 on those calls that match that filter.
498 Example: use B<-z dcerpc,rtt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4> to collect SAMR
499 RTT statistics for a specific host.
502 B<-z> io,phs[,I<filter>]
504 Create Protocol Hierarchy Statistics listing both number of packets and bytes.
505 If no I<filter> is specified the statistics will be calculated for all packets.
506 If a I<filters> is specified statistics will be only calculated for those
507 packets that match the filter.
509 This option can be used multiple times on the command line.
512 B<-z> io,stat,I<interval>[,I<filter>][,I<filter>][,I<filter>]...
514 Collect packet/bytes statistics for the capture in intervals of
515 I<interval> seconds. I<Intervals> can be specified either as whole or
516 fractional seconds. Interval can be specified in ms resolution.
518 If no I<filter> is specified the statistics will be calculated for all packets.
519 If one or more I<filters> are specified statistics will be calculated for
520 all filters and presented with one column of statistics for each filter.
522 This option can be used multiple times on the command line.
525 Example: B<-z io,stat,1,ip.addr==1.2.3.4> to generate 1 second
526 statistics for all traffic to/from host 1.2.3.4.
528 Example: B<-z "io,stat,0.001,smb&&ip.addr==1.2.3.4"> to generate 1ms
529 statistics for all SMB packets to/from host 1.2.3.4.
531 The examples above all use the standard syntax for generating statistics
532 which only calculates the number of packets and bytes in each interval.
534 B<io,stat> can also do much more statistics and calculate COUNT(), SUM(),
535 MIN(), MAX(), and AVG() using a slightly different filter syntax:
537 [COUNT|SUM|MIN|MAX|AVG](<field>)<filter>
539 One important thing to note here is that the field that the calculation is
540 based on MUST also be part of the filter string or else the calculation will
543 So: B<-z io,stat,0.010,AVG(smb.time)> does not work. Use B<-z
544 io,stat,0.010,AVG(smb.time)smb.time> instead. Also be aware that a field
545 can exist multiple times inside the same packet and will then be counted
546 multiple times in those packets.
549 COUNT(<field>) can be used on any type which has a display filter name.
550 It will count how many times this particular field is encountered in the
551 filtered packet list.
553 Example: B<-z io,stat,0.010,COUNT(smb.sid)smb.sid>
554 This will count the total number of SIDs seen in each 10ms interval.
556 SUM(<field>) can only be used on named fields of integer type.
557 This will sum together every occurence of this fields value for each interval.
559 Example: B<-z io,stat,0.010,SUM(frame.pkt_len)frame.pkt_len>
560 This will report the total number of bytes seen in all the packets within
563 MIN/MAX/AVG(<field>) can only be used on named fields that are either
564 integers or relative time fields. This will calculate maximum/minimum
565 or average seen in each interval. If the field is a relative time field
566 the output will be presented in seconds and three digits after the
567 decimal point. The resolution for time calculations is 1ms and anything
568 smaller will be truncated.
570 Example: B<-z "io,stat,0.010,smb.time&&ip.addr==1.1.1.1,MIN(smb.time)smb.time&&ip.addr==1.1.1.1,MAX(smb.time)smb.time&&ip.addr==1.1.1.1,MAX(smb.time)smb.time&&ip.addr==1.1.1.1">
572 This will calculate statistics for all smb response times we see to/from
573 host 1.1.1.1 in 10ms intervals. The output will be displayed in 4
574 columns; number of packets/bytes, minimum response time, maximum response
575 time and average response time.
579 B<-z> conv,I<type>[,I<filter>]
581 Create a table that lists all conversations that could be seen in the capture.
582 I<type> specifies which type of conversation we want to generate the
583 statistics for; currently the supported ones are
590 "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported
592 "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported
594 If the optional filter string is specified, only those packets that match the
595 filter will be used in the calculations.
597 The table is presented with one line for each conversation and displays
598 number of packets/bytes in each direction as well as total number of
600 The table is sorted according to total number of bytes.
603 B<-z> proto,colinfo,I<filter>,I<field>
605 Append all I<field> values for the packet to the Info column of the
606 one-line summary output.
607 This feature can be used to append arbitrary fields to the Info column
608 in addition to the normal content of that column.
609 I<field> is the display-filter name of a field which value should be placed
611 I<filter> is a filter string that controls for which packets the field value
612 will be presented in the info column. I<field> will only be presented in the
613 Info column for the packets which match I<filter>.
615 NOTE: In order for B<TShark> to be able to extract the I<field> value
616 from the packet, I<field> MUST be part of the I<filter> string. If not,
617 B<TShark> will not be able to extract its value.
619 For a simple example to add the "nfs.fh.hash" field to the Info column
620 for all packets containing the "nfs.fh.hash" field, use
622 B<-z proto,colinfo,nfs.fh.hash,nfs.fh.hash>
625 To put "nfs.fh.hash" in the Info column but only for packets coming from
628 B<-z "proto,colinfo,nfs.fh.hash && ip.src==1.2.3.4,nfs.fh.hash">
630 This option can be used multiple times on the command line.
633 B<-z> rpc,rtt,I<program>,I<version>[,I<filter>]
635 Collect call/reply RTT data for I<program>/I<version>. Data collected
636 is number of calls for each procedure, MinRTT, MaxRTT and AvgRTT.
637 Example: use B<-z rpc,rtt,100003,3> to collect data for NFS v3. This
638 option can be used multiple times on the command line.
640 If the optional filterstring is provided, the stats will only be calculated
641 on those calls that match that filter.
642 Example: use B<-z rpc,rtt,100003,3,nfs.fh.hash==0x12345678> to collect NFS v3
643 RTT statistics for a specific file.
648 Collect call/reply RTT data for all known ONC-RPC programs/versions.
649 Data collected is number of calls for each protocol/version, MinRTT,
651 This option can only be used once on the command line.
653 B<-z> smb,rtt[,I<filter>]
655 Collect call/reply RTT data for SMB. Data collected
656 is number of calls for each SMB command, MinRTT, MaxRTT and AvgRTT.
657 Example: use B<-z smb,rtt>.
658 The data will be presented as separate tables for all normal SMB commands,
659 all Transaction2 commands and all NT Transaction commands.
660 Only those commands that are seen in the capture will have its stats
662 Only the first command in a xAndX command chain will be used in the
663 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
664 only the SessionSetupAndX call will be used in the statistics.
665 This is a flaw that might be fixed in the future.
667 This option can be used multiple times on the command line.
669 If the optional filterstring is provided, the stats will only be calculated
670 on those calls that match that filter.
671 Example: use B<-z "smb,rtt,ip.addr==1.2.3.4"> to only collect stats for
672 SMB packets echanged by the host at IP address 1.2.3.4 .
676 When this feature is used B<TShark> will print a report with all the
677 discovered SID and account name mappings. Only those SIDs where the
678 account name is known will be presented in the table.
680 For this feature to work you will need to either to enable
681 "Edit/Preferences/Protocols/SMB/Snoop SID to name mappings" in the
682 preferences or you can override the preferences by specifying
683 B<-o "smb.sid_name_snooping:TRUE"> on the B<TShark> command line.
685 The current methods used by B<TShark> to find the SID->name mapping
686 is relatively restricted but is hoped to be expanded in the future.
688 B<-z> mgcp,rtd[I<,filter>]
690 Collect requests/response RTD (Response Time Delay) data for MGCP.
691 This is similar to B<-z smb,rtt>). Data collected is number of calls
692 for each known MGCP Type, MinRTD, MaxRTD and AvgRTD.
693 Additionally you get the number of duplicate requests/responses,
694 unresponded requests, responses ,which don't match with
696 Example: use B<-z mgcp,rtd>.
698 This option can be used multiple times on the command line.
700 If the optional filterstring is provided, the stats will only be calculated
701 on those calls that match that filter.
702 Example: use B<-z "mgcp,rtd,ip.addr==1.2.3.4"> to only collect stats for
703 MGCP packets exchanged by the host at IP address 1.2.3.4 .
705 B<-z> h225,counter[I<,filter>]
707 Count ITU-T H.225 messages and their reasons. In the first column you get a
708 list of H.225 messages and H.225 message reasons, which occur in the current
709 capture file. The number of occurences of each message or reason is displayed
710 in the second column.
712 Example: use B<-z h225,counter>.
714 This option can be used multiple times on the command line.
716 If the optional filterstring is provided, the stats will only be calculated
717 on those calls that match that filter.
718 Example: use B<-z "h225,counter,ip.addr==1.2.3.4"> to only collect stats for
719 H.225 packets exchanged by the host at IP address 1.2.3.4 .
721 B<-z> h225,srt[I<,filter>]
723 Collect requests/response SRT (Service Response Time) data for ITU-T H.225 RAS.
724 Data collected is number of calls of each ITU-T H.225 RAS Message Type,
725 Minimum SRT, Maximum SRT, Average SRT, Minimum in Frame, and Maximum in Frame.
726 You will also get the number of Open Requests (Unresponded Requests),
727 Discarded Responses (Responses without matching request) and Duplicate Messages.
728 Example: use B<-z h225,srt>.
730 This option can be used multiple times on the command line.
732 If the optional filterstring is provided, the stats will only be calculated
733 on those calls that match that filter.
734 Example: use B<-z "h225,srt,ip.addr==1.2.3.4"> to only collect stats for
735 ITU-T H.225 RAS packets exchanged by the host at IP address 1.2.3.4 .
737 B<-z> sip,stat[I<,filter>]
739 This option will activate a counter for SIP messages. You will get the number
740 of occurences of each SIP Method and of each SIP Status-Code. Additionally you
741 also get the number of resent SIP Messages (only for SIP over UDP).
743 Example: use B<-z sip,stat>.
745 This option can be used multiple times on the command line.
747 If the optional filter string is provided, the stats will only be calculated
748 on those calls that match that filter.
749 Example: use B<-z "sip,stat,ip.addr==1.2.3.4"> to only collect stats for
750 SIP packets exchanged by the host at IP address 1.2.3.4 .
754 =head1 CAPTURE FILTER SYNTAX
756 See the manual page of tcpdump(8).
758 =head1 READ FILTER SYNTAX
760 For a complete table of protocol and protocol fields that are filterable
761 in B<TShark> see the wireshark-filter(4) manual page.
765 These files contains various B<Wireshark> configuration values.
771 The F<preferences> files contain global (system-wide) and personal
772 preference settings. If the system-wide preference file exists, it is
773 read first, overriding the default settings. If the personal preferences
774 file exists, it is read next, overriding any previous values. Note: If
775 the command line option B<-o> is used (possibly more than once), it will
776 in turn override values from the preferences files.
778 The preferences settings are in the form I<prefname>B<:>I<value>,
780 where I<prefname> is the name of the preference
781 and I<value> is the value to
782 which it should be set; white space is allowed between B<:> and
783 I<value>. A preference setting can be continued on subsequent lines by
784 indenting the continuation lines with white space. A B<#> character
785 starts a comment that runs to the end of the line:
787 # Capture in promiscuous mode?
788 # TRUE or FALSE (case-insensitive).
789 capture.prom_mode: TRUE
791 The global preferences file is looked for in the F<wireshark> directory
792 under the F<share> subdirectory of the main installation directory (for
793 example, F</usr/local/share/wireshark/preferences>) on UNIX-compatible
794 systems, and in the main installation directory (for example,
795 F<C:\Program Files\Wireshark\preferences>) on Windows systems.
797 The personal preferences file is looked for in
798 F<$HOME/.wireshark/preferences> on
799 UNIX-compatible systems and F<%APPDATA%\Wireshark\preferences> (or, if
800 %APPDATA% isn't defined, F<%USERPROFILE%\Application
801 Data\Wireshark\preferences>) on Windows systems.
803 =item Disabled (Enabled) Protocols
805 The F<disabled_protos> files contain system-wide and personal lists of
806 protocols that have been disabled, so that their dissectors are never
807 called. The files contain protocol names, one per line, where the
808 protocol name is the same name that would be used in a display filter
814 The global F<disabled_protos> file uses the same directory as the global
817 The personal F<disabled_protos> file uses the same directory as the
818 personal preferences file.
820 =item Name Resolution (hosts)
822 If the personal F<hosts> file exists, it is
823 used to resolve IPv4 and IPv6 addresses before any other
824 attempts are made to resolve them. The file has the standard F<hosts>
825 file syntax; each line contains one IP address and name, separated by
826 whitespace. The same directory as for the personal preferences file is
829 =item Name Resolution (ethers)
831 The F<ethers> files are consulted to correlate 6-byte hardware addresses to
832 names. First the personal F<ethers> file is tried and if an address is not
833 found there the global F<ethers> file is tried next.
835 Each line contains one hardware address and name, separated by
836 whitespace. The digits of the hardware address are separated by colons
837 (:), dashes (-) or periods (.). The same separator character must be
838 used consistently in an address. The following three lines are valid
839 lines of an F<ethers> file:
841 ff:ff:ff:ff:ff:ff Broadcast
842 c0-00-ff-ff-ff-ff TR_broadcast
843 00.00.00.00.00.00 Zero_broadcast
845 The global F<ethers> file is looked for in the F</etc> directory on
846 UNIX-compatible systems, and in the main installation directory (for
847 example, F<C:\Program Files\Wireshark>) on Windows systems.
849 The personal F<ethers> file is looked for in the same directory as the personal
852 =item Name Resolution (manuf)
854 The F<manuf> file is used to match the 3-byte vendor portion of a 6-byte
855 hardware address with the manufacturer's name; it can also contain well-known
856 MAC addresses and address ranges specified with a netmask. The format of the
857 file is the same as the F<ethers> files, except that entries of the form:
861 can be provided, with the 3-byte OUI and the name for a vendor, and
864 00-00-0C-07-AC/40 All-HSRP-routers
866 can be specified, with a MAC address and a mask indicating how many bits
867 of the address must match. The above entry, for example, has 40
868 significant bits, or 5 bytes, and would match addresses from
869 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
872 The F<manuf> file is looked for in the same directory as the global
875 =item Name Resolution (ipxnets)
877 The F<ipxnets> files are used to correlate 4-byte IPX network numbers to
878 names. First the global F<ipxnets> file is tried and if that address is not
879 found there the personal one is tried next.
881 The format is the same as the F<ethers>
882 file, except that each address is four bytes instead of six.
883 Additionally, the address can be represented as a single hexadecimal
884 number, as is more common in the IPX world, rather than four hex octets.
885 For example, these four lines are valid lines of an F<ipxnets> file:
889 00:00:BE:EF IT_Server1
892 The global F<ipxnets> file is looked for in the F</etc> directory on
893 UNIX-compatible systems, and in the main installation directory (for
894 example, F<C:\Program Files\Wireshark>) on Windows systems.
896 The personal F<ipxnets> file is looked for in the same directory as the
897 personal preferences file.
903 wireshark-filter(4), wireshark(1), editcap(1), tcpdump(8), pcap(3),
904 dumpcap(1), text2pcap(1)
908 B<TShark> is part of the B<Wireshark> distribution. The latest version
909 of B<Wireshark> can be found at L<http://www.wireshark.org>.
911 HTML versions of the Wireshark project man pages are available at:
912 L<http://www.wireshark.org/docs/man-pages>.
916 B<TShark> uses the same packet dissection code that B<Wireshark> does,
917 as well as using many other modules from B<Wireshark>; see the list of
918 authors in the B<Wireshark> man page for a list of authors of that code.