4 wireshark - Interactively dump and analyze network traffic
9 S<[ B<-a> E<lt>capture autostop conditionE<gt> ] ...>
10 S<[ B<-b> E<lt>capture ring buffer optionE<gt> ] ...>
11 S<[ B<-B> E<lt>capture buffer size (Win32 only)E<gt> ] >
12 S<[ B<-c> E<lt>capture packet countE<gt> ]>
13 S<[ B<-C> E<lt>configuration profileE<gt> ]>
15 S<[ B<--display=>E<lt>X display to useE<gt> ] >
16 S<[ B<-f> E<lt>capture filterE<gt> ]>
17 S<[ B<-g> E<lt>packet numberE<gt> ]>
20 S<[ B<-i> E<lt>capture interfaceE<gt>|- ]>
21 S<[ B<-J> E<lt>jump filterE<gt> ]>
24 S<[ B<-K> E<lt>keytabE<gt> ]>
27 S<[ B<-m> E<lt>fontE<gt> ]>
29 S<[ B<-N> E<lt>name resolving flagsE<gt> ] >
30 S<[ B<-o> E<lt>preference/recent settingE<gt> ] ...>
32 S<[ B<-P> E<lt>path settingE<gt>]>
34 S<[ B<-r> E<lt>infileE<gt> ]>
35 S<[ B<-R> E<lt>read (display) filterE<gt> ]>
37 S<[ B<-s> E<lt>capture snaplenE<gt> ]>
38 S<[ B<-t> ad|a|r|d|dd|e ]>
40 S<[ B<-w> E<lt>outfileE<gt> ]>
41 S<[ B<-y> E<lt>capture link typeE<gt> ]>
42 S<[ B<-X> E<lt>eXtension optionE<gt> ]>
43 S<[ B<-z> E<lt>statisticsE<gt> ]>
44 S<[ E<lt>infileE<gt> ]>
48 B<Wireshark> is a GUI network protocol analyzer. It lets you
49 interactively browse packet data from a live network or from a
50 previously saved capture file. B<Wireshark>'s native capture file format
51 is B<libpcap> format, which is also the format used by B<tcpdump> and
54 B<Wireshark> can read / import the following file formats:
59 libpcap, tcpdump and various other tools using tcpdump's capture format
62 B<snoop> and B<atmsnoop>
65 Shomiti/Finisar B<Surveyor> captures
68 Novell B<LANalyzer> captures
71 Microsoft B<Network Monitor> captures
74 AIX's B<iptrace> captures
77 Cinco Networks B<NetXRay> captures
80 Network Associates Windows-based B<Sniffer> captures
83 Network General/Network Associates DOS-based B<Sniffer> (compressed or uncompressed) captures
86 AG Group/WildPackets B<EtherPeek>/B<TokenPeek>/B<AiroPeek>/B<EtherHelp>/B<PacketGrabber> captures
89 B<RADCOM>'s WAN/LAN analyzer captures
92 Network Instruments B<Observer> version 9 captures
95 B<Lucent/Ascend> router debug output
98 files from HP-UX's B<nettl>
101 B<Toshiba's> ISDN routers dump output
104 the output from B<i4btrace> from the ISDN4BSD project
107 traces from the B<EyeSDN> USB S0.
110 the output in B<IPLog> format from the Cisco Secure Intrusion Detection System
113 B<pppd logs> (pppdump format)
116 the output from VMS's B<TCPIPtrace>/B<TCPtrace>/B<UCX$TRACE> utilities
119 the text output from the B<DBS Etherwatch> VMS utility
122 Visual Networks' B<Visual UpTime> traffic capture
125 the output from B<CoSine> L2 debug
128 the output from Accellent's B<5Views> LAN agents
131 Endace Measurement Systems' ERF format captures
134 Linux Bluez Bluetooth stack B<hcidump -w> traces
137 Catapult DCT2000 .out files
140 TamoSoft CommView files
143 Apple PacketLogger files
147 There is no need to tell B<Wireshark> what type of
148 file you are reading; it will determine the file type by itself.
149 B<Wireshark> is also capable of reading any of these file formats if they
150 are compressed using gzip. B<Wireshark> recognizes this directly from
151 the file; the '.gz' extension is not required for this purpose.
153 Like other protocol analyzers, B<Wireshark>'s main window shows 3 views
154 of a packet. It shows a summary line, briefly describing what the
155 packet is. A packet details display is shown, allowing you to drill
156 down to exact protocol or field that you interested in. Finally, a hex
157 dump shows you exactly what the packet looks like when it goes over the
160 In addition, B<Wireshark> has some features that make it unique. It can
161 assemble all the packets in a TCP conversation and show you the ASCII
162 (or EBCDIC, or hex) data in that conversation. Display filters in
163 B<Wireshark> are very powerful; more fields are filterable in B<Wireshark>
164 than in other protocol analyzers, and the syntax you can use to create
165 your filters is richer. As B<Wireshark> progresses, expect more and more
166 protocol fields to be allowed in display filters.
168 Packet capturing is performed with the pcap library. The capture filter
169 syntax follows the rules of the pcap library. This syntax is different
170 from the display filter syntax.
172 Compressed file support uses (and therefore requires) the zlib library.
173 If the zlib library is not present, B<Wireshark> will compile, but will
174 be unable to read compressed files.
176 The pathname of a capture file to be read can be specified with the
177 B<-r> option or can be specified as a command-line argument.
181 Most users will want to start B<Wireshark> without options and configure
182 it from the menus instead. Those users may just skip this section.
186 =item -a E<lt>capture autostop conditionE<gt>
188 Specify a criterion that specifies when B<Wireshark> is to stop writing
189 to a capture file. The criterion is of the form I<test>B<:>I<value>,
190 where I<test> is one of:
192 B<duration>:I<value> Stop writing to a capture file after I<value> seconds have elapsed.
194 B<filesize>:I<value> Stop writing to a capture file after it reaches a size of I<value>
195 kilobytes (where a kilobyte is 1024 bytes). If this option
196 is used together with the -b option, Wireshark will stop writing to the
197 current capture file and switch to the next one if filesize is reached.
199 B<files>:I<value> Stop writing to capture files after I<value> number of files were written.
201 =item -b E<lt>capture ring buffer optionE<gt>
203 Cause B<Wireshark> to run in "multiple files" mode. In "multiple files" mode,
204 B<Wireshark> will write to several capture files. When the first capture file
205 fills up, B<Wireshark> will switch writing to the next file and so on.
207 The created filenames are based on the filename given with the B<-w> flag, the number of
208 the file and on the creation date and time,
209 e.g. outfile_00001_20050604120117.pcap, outfile_00001_20050604120523.pcap, ...
211 With the I<files> option it's also possible to form a "ring buffer".
212 This will fill up new files until the number of files specified,
213 at which point B<Wireshark> will discard the data in the first file and start
214 writing to that file and so on. If the I<files> option is not set,
215 new files filled up until one of the capture stop conditions match (or
216 until the disk if full).
218 The criterion is of the form I<key>B<:>I<value>,
219 where I<key> is one of:
221 B<duration>:I<value> switch to the next file after I<value> seconds have
222 elapsed, even if the current file is not completely filled up.
224 B<filesize>:I<value> switch to the next file after it reaches a size of
225 I<value> kilobytes (where a kilobyte is 1024 bytes).
227 B<files>:I<value> begin again with the first file after I<value> number of
228 files were written (form a ring buffer).
230 =item -B E<lt>capture buffer size (Win32 only)E<gt>
232 Win32 only: set capture buffer size (in MB, default is 1MB). This is used by the
233 the capture driver to buffer packet data until that data can be written to
234 disk. If you encounter packet drops while capturing, try to increase this size.
236 =item -c E<lt>capture packet countE<gt>
238 Set the maximum number of packets to read when capturing live
241 =item -C E<lt>configuration profileE<gt>
243 Start with the given configuration profile.
247 Print a list of the interfaces on which B<Wireshark> can capture, and
248 exit. For each network interface, a number and an
249 interface name, possibly followed by a text description of the
250 interface, is printed. The interface name or the number can be supplied
251 to the B<-i> flag to specify an interface on which to capture.
253 This can be useful on systems that don't have a command to list them
254 (e.g., Windows systems, or UNIX systems lacking B<ifconfig -a>);
255 the number can be useful on Windows 2000 and later systems, where the
256 interface name is a somewhat complex string.
258 Note that "can capture" means that B<Wireshark> was able to open
259 that device to do a live capture; if, on your system, a program doing a
260 network capture must be run from an account with special privileges (for
261 example, as root), then, if B<Wireshark> is run with the B<-D> flag and
262 is not run from such an account, it will not list any interfaces.
264 =item --display=E<lt>X display to useE<gt>
266 Specifies the X display to use. A hostname and screen (otherhost:0.0)
267 or just a screen (:0.0) can be specified. This option is not available
270 =item -f E<lt>capture filterE<gt>
272 Set the capture filter expression.
274 =item -g E<lt>packet numberE<gt>
276 After reading in a capture file using the B<-r> flag, go to the given I<packet number>.
280 Print the version and options and exit.
284 Hide the capture info dialog during live packet capture.
286 =item -i E<lt>capture interfaceE<gt>|-
288 Set the name of the network interface or pipe to use for live packet
291 Network interface names should match one of the names listed in
292 "B<wireshark -D>" (described above); a number, as reported by
293 "B<wireshark -D>", can also be used. If you're using UNIX, "B<netstat
294 -i>" or "B<ifconfig -a>" might also work to list interface names,
295 although not all versions of UNIX support the B<-a> flag to B<ifconfig>.
297 If no interface is specified, B<Wireshark> searches the list of
298 interfaces, choosing the first non-loopback interface if there are any
299 non-loopback interfaces, and choosing the first loopback interface if
300 there are no non-loopback interfaces. If there are no interfaces at all,
301 B<Wireshark> reports an error and doesn't start the capture.
303 Pipe names should be either the name of a FIFO (named pipe) or ``-'' to
304 read data from the standard input. On Windows systems, pipe names must be
305 of the form ``\\pipe\.\B<pipename>''. Data read from pipes must be in
306 standard libpcap format.
308 =item -J E<lt>jump filterE<gt>
310 After reading in a capture file using the B<-r> flag, jump to the packet
311 matching the filter (display filter syntax). If no exact match is found
312 the first packet after that is selected.
316 Use after B<-J> to change the behaviour when no exact match is found for
317 the filter. With this option select the first packet before.
321 Start the capture session immediately. If the B<-i> flag was
322 specified, the capture uses the specified interface. Otherwise,
323 B<Wireshark> searches the list of interfaces, choosing the first
324 non-loopback interface if there are any non-loopback interfaces, and
325 choosing the first loopback interface if there are no non-loopback
326 interfaces; if there are no interfaces, B<Wireshark> reports an error and
327 doesn't start the capture.
329 =item -K E<lt>keytabE<gt>
331 Load kerberos crypto keys from the specified keytab file.
332 This option can be used multiple times to load keys from several files.
334 Example: B<-K krb5.keytab>
338 Turn on automatic scrolling if the packet display is being updated
339 automatically as packets arrive during a capture (as specified by the
344 List the data link types supported by the interface and exit.
346 =item -m E<lt>fontE<gt>
348 Set the name of the font used by B<Wireshark> for most text. B<Wireshark>
349 will construct the name of the bold font used for the data in the byte
350 view pane that corresponds to the field selected in the packet details
351 pane from the name of the main text font.
355 Disable network object name resolution (such as hostname, TCP and UDP port
356 names), the B<-N> flag might override this one.
358 =item -N E<lt>name resolving flagsE<gt>
360 Turn on name resolving only for particular types of addresses and port
361 numbers, with name resolving for other types of addresses and port
362 numbers turned off. This flag overrides B<-n> if both B<-N> and B<-n> are
363 present. If both B<-N> and B<-n> flags are not present, all name resolutions are
366 The argument is a string that may contain the letters:
368 B<m> to enable MAC address resolution
370 B<n> to enable network address resolution
372 B<t> to enable transport-layer port number resolution
374 B<C> to enable concurrent (asynchronous) DNS lookups
376 =item -o E<lt>preference/recent settingE<gt>
378 Set a preference or recent value, overriding the default value and any value
379 read from a preference/recent file. The argument to the flag is a string of
380 the form I<prefname>B<:>I<value>, where I<prefname> is the name of the
381 preference/recent value (which is the same name that would appear in the
382 preference/recent file), and I<value> is the value to which it should be set.
383 Since B<Ethereal> 0.10.12, the recent settings replaces the formerly used
384 -B, -P and -T flags to manipulate the GUI dimensions.
386 If I<prefname> is "uat", you can override settings in various user access
387 tables using the form uatB<:>I<uat filename>:I<uat record>. I<uat filename>
388 must be the name of a UAT file, e.g. I<user_dlts>. I<uat_record> must be in
389 the form of a valid record for that file, including quotes. For instance, to
390 specify a user DLT from the command line, you would use
394 -o "uat:user_dlts:\"User 0 (DLT=147)\",\"cops\",\"0\",\"\",\"0\",\"\""
400 I<Don't> put the interface into promiscuous mode. Note that the
401 interface might be in promiscuous mode for some other reason; hence,
402 B<-p> cannot be used to ensure that the only traffic that is captured is
403 traffic sent to or from the machine on which B<Wireshark> is running,
404 broadcast traffic, and multicast traffic to addresses received by that
407 =item -P E<lt>path settingE<gt>
409 Special path settings usually detected automatically. This is used for
410 special cases, e.g. starting Wireshark from a known location on an USB stick.
412 The criterion is of the form I<key>B<:>I<path>, where I<key> is one of:
414 B<persconf>:I<path> path of personal configuration files, like the
417 B<persdata>:I<path> path of personal data files, it's the folder initially
418 opened. After the very first initialization, the recent file will keep the
423 Cause B<Wireshark> to exit after the end of capture session (useful in
424 batch mode with B<-c> option for instance); this option requires the
425 B<-i> and B<-w> parameters.
427 =item -r E<lt>infileE<gt>
429 Read packet data from I<infile>, can be any supported capture file format
430 (including gzipped files). It's not possible to use named pipes or stdin
433 =item -R E<lt>read (display) filterE<gt>
435 When reading a capture file specified with the B<-r> flag, causes the
436 specified filter (which uses the syntax of display filters, rather than
437 that of capture filters) to be applied to all packets read from the
438 capture file; packets not matching the filter are discarded.
442 Automatically update the packet display as packets are coming in.
444 =item -s E<lt>capture snaplenE<gt>
446 Set the default snapshot length to use when capturing live data.
447 No more than I<snaplen> bytes of each network packet will be read into
448 memory, or saved to disk. A value of 0 specifies a snapshot length of
449 65535, so that the full packet is captured; this is the default.
451 =item -t ad|a|r|d|dd|e
453 Set the format of the packet timestamp displayed in the packet list
454 window. The format can be one of:
456 B<ad> absolute with date: The absolute date and time is the actual time and
457 date the packet was captured
459 B<a> absolute: The absolute time is the actual time the packet was captured,
460 with no date displayed
462 B<r> relative: The relative time is the time elapsed between the first packet
463 and the current packet
465 B<d> delta: The delta time is the time since the previous packet was
468 B<dd> delta_displayed: The delta_displayed time is the time since the
469 previous displayed packet was captured
471 B<e> epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00)
473 The default format is relative.
477 Print the version and exit.
479 =item -w E<lt>outfileE<gt>
481 Set the default capture file name.
483 =item -y E<lt>capture link typeE<gt>
485 If a capture is started from the command line with B<-k>, set the data
486 link type to use while capturing packets. The values reported by B<-L>
487 are the values that can be used.
489 =item -X E<lt>eXtension optionsE<gt>
491 Specify an option to be passed to an B<Wireshark> module. The eXtension option
492 is in the form I<extension_key>B<:>I<value>, where I<extension_key> can be:
494 B<lua_script>:I<lua_script_filename> tells B<Wireshark> to load the given script in addition to the
497 =item -z E<lt>statisticsE<gt>
499 Get B<Wireshark> to collect various types of statistics and display the result
500 in a window that updates in semi-real time.
502 Currently implemented statistics are:
506 =item B<-z> dcerpc,srt,I<uuid>,I<major>.I<minor>[,I<filter>]
508 Collect call/reply SRT (Service Response Time) data for DCERPC interface I<uuid>,
509 version I<major>.I<minor>.
510 Data collected is the number of calls for each procedure, MinSRT, MaxSRT
513 Example: S<B<-z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0>> will collect data for the CIFS SAMR Interface.
515 This option can be used multiple times on the command line.
517 If the optional I<filter> is provided, the stats will only be calculated
518 on those calls that match that filter.
520 Example: S<B<-z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4>> will collect SAMR
521 SRT statistics for a specific host.
525 Collect packet/bytes statistics for the capture in intervals of 1 second.
526 This option will open a window with up to 5 color-coded graphs where
527 number-of-packets-per-second or number-of-bytes-per-second statistics
528 can be calculated and displayed.
530 This option can be used multiple times on the command line.
532 This graph window can also be opened from the Analyze:Statistics:Traffic:IO-Stat
535 =item B<-z> rpc,srt,I<program>,I<version>[,<filter>]
537 Collect call/reply SRT (Service Response Time) data for I<program>/I<version>. Data collected
538 is the number of calls for each procedure, MinSRT, MaxSRT and AvgSRT.
540 Example: B<-z rpc,srt,100003,3> will collect data for NFS v3.
542 This option can be used multiple times on the command line.
544 If the optional I<filter> is provided, the stats will only be calculated
545 on those calls that match that filter.
547 Example: S<B<-z rpc,srt,100003,3,nfs.fh.hash==0x12345678>> will collect NFS v3
548 SRT statistics for a specific file.
550 =item B<-z> rpc,programs
552 Collect call/reply RTT data for all known ONC-RPC programs/versions.
553 Data collected is the number of calls for each protocol/version, MinRTT,
556 =item B<-z> scsi,srt,I<cmdset>[,<filter>]
558 Collect call/reply SRT (Service Response Time) data for SCSI commandset <cmdset>.
560 Commandsets are 0:SBC 1:SSC 5:MMC
563 is the number of calls for each procedure, MinSRT, MaxSRT and AvgSRT.
565 Example: B<-z scsi,srt,0> will collect data for SCSI BLOCK COMMANDS (SBC).
567 This option can be used multiple times on the command line.
569 If the optional I<filter> is provided, the stats will only be calculated
570 on those calls that match that filter.
572 Example: B<-z scsi,srt,0,ip.addr==1.2.3.4> will collect SCSI SBC
573 SRT statistics for a specific iscsi/ifcp/fcip host.
575 =item B<-z> smb,srt[,I<filter>]
577 Collect call/reply SRT (Service Response Time) data for SMB. Data collected
578 is the number of calls for each SMB command, MinSRT, MaxSRT and AvgSRT.
580 Example: B<-z smb,srt>
582 The data will be presented as separate tables for all normal SMB commands,
583 all Transaction2 commands and all NT Transaction commands.
584 Only those commands that are seen in the capture will have their stats
586 Only the first command in a xAndX command chain will be used in the
587 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
588 only the SessionSetupAndX call will be used in the statistics.
589 This is a flaw that might be fixed in the future.
591 This option can be used multiple times on the command line.
593 If the optional I<filter> is provided, the stats will only be calculated
594 on those calls that match that filter.
596 Example: B<-z "smb,srt,ip.addr==1.2.3.4"> will collect stats only for
597 SMB packets echanged by the host at IP address 1.2.3.4 .
599 =item B<-z> fc,srt[,I<filter>]
601 Collect call/reply SRT (Service Response Time) data for FC. Data collected
602 is the number of calls for each Fibre Channel command, MinSRT, MaxSRT and AvgSRT.
604 Example: B<-z fc,srt>
605 will calculate the Service Response Time as the time delta between the
606 First packet of the exchange and the Last packet of the exchange.
608 The data will be presented as separate tables for all normal FC commands,
609 Only those commands that are seen in the capture will have its stats
612 This option can be used multiple times on the command line.
614 If the optional I<filter> is provided, the stats will only be calculated
615 on those calls that match that filter.
617 Example: B<-z "fc,srt,fc.id==01.02.03"> will collect stats only for
618 FC packets exchanged by the host at FC address 01.02.03 .
620 =item B<-z> ldap,srt[,I<filter>]
622 Collect call/reply SRT (Service Response Time) data for LDAP. Data collected
623 is the number of calls for each implemented LDAP command, MinSRT, MaxSRT and AvgSRT.
625 Example: B<-z ldap,srt>
626 will calculate the Service Response Time as the time delta between the
627 Request and the Response.
629 The data will be presented as separate tables for all implemented LDAP commands,
630 Only those commands that are seen in the capture will have its stats
633 This option can be used multiple times on the command line.
635 If the optional I<filter> is provided, the stats will only be calculated
636 on those calls that match that filter.
638 Example: use B<-z "ldap,srt,ip.addr==10.1.1.1"> will collect stats only for
639 LDAP packets echanged by the host at IP address 10.1.1.1 .
641 The only LDAP commands that are currently implemented and for which the stats will be available are:
651 =item B<-z> mgcp,srt[I<,filter>]
653 Collect request/response SRT (Service Response Time) data for MGCP.
654 (This is similar to B<-z smb,srt>). Data collected is the number of calls
655 for each known MGCP Type, Minimum SRT, Maximum SRT and Average SRT.
657 Example: B<-z mgcp,srt>
659 This option can be used multiple times on the command line.
661 If the optional I<filter> is provided, the stats will only be calculated
662 on those calls that match that filter.
664 Example: B<-z "mgcp,srt,ip.addr==1.2.3.4"> will collect stats only for
665 MGCP packets exchanged by the host at IP address 1.2.3.4 .
667 =item B<-z> megaco,srt[I<,filter>]
669 Collect request/response SRT (Service Response Time) data for MEGACO.
670 (This is similar to B<-z smb,srt>). Data collected is the number of calls
671 for each known MEGACO Command, Minimum SRT, Maximum SRT and Average SRT.
673 Example: B<-z megaco,srt>
675 This option can be used multiple times on the command line.
677 If the optional I<filter> is provided, the stats will only be calculated
678 on those calls that match that filter.
680 Example: B<-z "megaco,srt,ip.addr==1.2.3.4"> will collect stats only for
681 MEGACO packets exchanged by the host at IP address 1.2.3.4 .
683 =item B<-z> conv,I<type>[,I<filter>]
685 Create a table that lists all conversations that could be seen in the
686 capture. I<type> specifies for which type of conversation we want to
687 generate the statistics; currently the supported ones are:
690 "fc" Fibre Channel addresses
691 "fddi" FDDI addresses
694 "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported
696 "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported
698 If the optional I<filter> is specified, only those packets that match the
699 filter will be used in the calculations.
701 The table is presented with one line for each conversation and displays
702 the number of packets/bytes in each direction as well as total number of
703 packets/bytes. By default, the table is sorted according to total number
706 These tables can also be generated at runtime by selecting the appropriate
707 conversation type from the menu "Tools/Statistics/Conversation List/".
709 =item B<-z> h225,counter[I<,filter>]
711 Count ITU-T H.225 messages and their reasons. In the first column you get a
712 list of H.225 messages and H.225 message reasons which occur in the current
713 capture file. The number of occurences of each message or reason is displayed
714 in the second column.
716 Example: B<-z h225,counter>
718 This option can be used multiple times on the command line.
720 If the optional I<filter> is provided, the stats will only be calculated
721 on those calls that match that filter.
723 Example: B<-z "h225,counter,ip.addr==1.2.3.4"> will collect stats only for
724 H.225 packets exchanged by the host at IP address 1.2.3.4 .
726 =item B<-z> h225,srt[I<,filter>]
728 Collect request/response SRT (Service Response Time) data for ITU-T H.225 RAS.
729 Data collected is the number of calls of each ITU-T H.225 RAS Message Type,
730 Minimum SRT, Maximum SRT, Average SRT, Minimum in Packet, and Maximum in Packet.
731 You will also get the number of Open Requests (Unresponded Requests),
732 Discarded Responses (Responses without matching request) and Duplicate Messages.
734 Example: B<-z h225,srt>
736 This option can be used multiple times on the command line.
738 If the optional I<filter> is provided, the stats will only be calculated
739 on those calls that match that filter.
741 Example: B<-z "h225,srt,ip.addr==1.2.3.4"> willcollect stats only for
742 ITU-T H.225 RAS packets exchanged by the host at IP address 1.2.3.4 .
744 =item B<-z> sip,stat[I<,filter>]
746 This option will activate a counter for SIP messages. You will get the number
747 of occurences of each SIP Method and of each SIP Status-Code. Additionally you
748 also get the number of resent SIP Messages (only for SIP over UDP).
750 Example: B<-z sip,stat>
752 This option can be used multiple times on the command line.
754 If the optional I<filter> is provided, the stats will only be calculated
755 on those calls that match that filter.
757 Example: B<-z "sip,stat,ip.addr==1.2.3.4"> will collect stats only for
758 SIP packets exchanged by the host at IP address 1.2.3.4 .
760 =item B<-z> voip,calls
762 This option will show a window that shows VoIP calls found in the capture file.
763 This is the same window shown as when you go to the Statistics Menu and choose
766 Example: B<-z voip,calls>
780 =item File:Open Recent
784 Merge another capture file to the currently loaded one. The I<File:Merge>
785 dialog box allows the merge "Prepended", "Chronologically" or "Appended",
786 relative to the already loaded one.
790 Open or close a capture file. The I<File:Open> dialog box
791 allows a filter to be specified; when the capture file is read, the
792 filter is applied to all packets read from the file, and packets not
793 matching the filter are discarded. The I<File:Open Recent> is a submenu
794 and will show a list of previously opened files.
800 Save the current capture, or the packets currently displayed from that
801 capture, to a file. Check boxes let you select whether to save all
802 packets, or just those that have passed the current display filter and/or
803 those that are currently marked, and an option menu lets you select (from
804 a list of file formats in which at particular capture, or the packets
805 currently displayed from that capture, can be saved), a file format in
808 =item File:File Set:List Files
810 Show a dialog box that lists all files of the file set matching the currently
811 loaded file. A file set is a compound of files resulting from a capture using
812 the "multiple files" / "ringbuffer" mode, recognizable by the filename pattern,
813 e.g.: Filename_00001_20050604101530.pcap.
815 =item File:File Set:Next File
817 =item File:File Set:Previous File
819 If the currently loaded file is part of a file set (see above), open the
820 next / previous file in that set.
824 Export captured data into an external format. Note: the data cannot be
825 imported back into Wireshark, so be sure to keep the capture file.
829 Print packet data from the current capture. You can select the range of
830 packets to be printed (which packets are printed), and the output format of
831 each packet (how each packet is printed). The output format will be similar
832 to the displayed values, so a summary line, the packet details view, and/or
833 the hex dump of the packet can be printed.
835 Printing options can be set with the I<Edit:Preferences> menu item, or in the
836 dialog box popped up by this menu item.
840 Exit the application.
842 =item Edit:Copy:Description
844 Copies the description of the selected field in the protocol tree to
847 =item Edit:Copy:Fieldname
849 Copies the fieldname of the selected field in the protocol tree to
852 =item Edit:Copy:Value
854 Copies the value of the selected field in the protocol tree to
857 =item Edit:Copy:As Filter
859 Create a display filter based on the data currently highlighted in the
860 packet details and copy that filter to the clipboard.
862 If that data is a field that can be tested in a display filter
863 expression, the display filter will test that field; otherwise, the
864 display filter will be based on the absolute offset within the packet.
865 Therefore it could be unreliable if the packet contains protocols with
866 variable-length headers, such as a source-routed token-ring packet.
868 =item Edit:Find Packet
870 Search forward or backward, starting with the currently selected packet
871 (or the most recently selected packet, if no packet is selected). Search
872 criteria can be a display filter expression, a string of hexadecimal
873 digits, or a text string.
875 When searching for a text string, you can search the packet data, or you
876 can search the text in the Info column in the packet list pane or in the
879 Hexadecimal digits can be separated by colons, periods, or dashes.
880 Text string searches can be ASCII or Unicode (or both), and may be
885 =item Edit:Find Previous
887 Search forward / backward for a packet matching the filter from the previous
888 search, starting with the currently selected packet (or the most recently
889 selected packet, if no packet is selected).
891 =item Edit:Mark Packet (toggle)
893 Mark (or unmark if currently marked) the selected packet. The field
894 "frame.marked" is set for packets that are marked, so that, for example,
895 a display filters can be used to display only marked packets, and so that
896 the L<Edit:Find Packet|/item_edit_3afind_packet> dialog can be used to find the next or previous
899 =item Edit:Find Next Mark
901 =item Edit:Find Previous Mark
903 Find next/previous marked packet.
905 =item Edit:Mark All Packets
907 =item Edit:Unmark All Packets
909 Mark / Unmark all packets that are currently displayed.
911 =item Edit:Time Reference:Set Time Reference (toggle)
913 Set (or unset if currently set) the selected packet as a Time Reference packet.
914 When a packet is set as a Time Reference packet, the timestamps in the packet
915 list pane will be replaced with the string "*REF*".
916 The relative time timestamp in later packets will then be calculated relative
917 to the timestamp of this Time Reference packet and not the first packet in
920 Packets that have been selected as Time Reference packets will always be
921 displayed in the packet list pane. Display filters will not affect or
924 If there is a column displayed for "Cumulative Bytes" this counter will
925 be reset at every Time Reference packet.
927 =item Edit:Time Reference:Find Next
929 =item Edit:Time Reference:Find Previous
931 Search forward / backward for a time referenced packet.
933 =item Edit:Configuration Profiles
935 Manage configuration profiles to be able to use more than one set of
936 preferences and configurations.
938 =item Edit:Preferences
940 Set the GUI, capture, printing and protocol options
941 (see L<Preferences|/item_preferences> dialog below).
943 =item View:Main Toolbar
945 =item View:Filter Toolbar
949 Show or hide the main window controls.
951 =item View:Packet List
953 =item View:Packet Details
955 =item View:Packet Bytes
957 Show or hide the main window panes.
959 =item View:Time Display Format
961 Set the format of the packet timestamp displayed in the packet list window.
963 =item View:Name Resolution:Resolve Name
965 Try to resolve a name for the currently selected item.
967 =item View:Name Resolution:Enable for ... Layer
969 Enable or disable translation of addresses to names in the display.
971 =item View:Colorize Packet List
973 Enable or disable the coloring rules. Disabling will improve performance.
975 =item View:Auto Scroll in Live Capture
977 Enable or disable the automatic scrolling of the
978 packet list while a live capture is in progress.
984 Zoom into / out of the main window data (by changing the font size).
986 =item View:Normal Size
988 Reset the zoom factor of zoom in / zoom out back to normal font size.
990 =item View:Resize All Columns
992 Resize all columns to best fit the current packet display.
994 =item View:Expand Subtrees
996 Expands the currently selected item and it's subtrees in the packet details.
998 =item View:Expand All
1000 =item View:Collapse All
1002 Expand / Collapse all branches of the packet details.
1004 =item View:Colorize Conversation
1006 Select color for a conversation.
1008 =item View:Reset Coloring 1-10
1010 Reset Color for a conversation.
1012 =item View:Coloring Rules
1014 Change the foreground and background colors of the packet information in
1015 the list of packets, based upon display filters. The list of display
1016 filters is applied to each packet sequentially. After the first display
1017 filter matches a packet, any additional display filters in the list are
1018 ignored. Therefore, if you are filtering on the existence of protocols,
1019 you should list the higher-level protocols first, and the lower-level
1024 =item How Colorization Works
1026 Packets are colored according to a list of color filters. Each filter
1027 consists of a name, a filter expression and a coloration. A packet is
1028 colored according to the first filter that it matches. Color filter
1029 expressions use exactly the same syntax as display filter expressions.
1031 When Wireshark starts, the color filters are loaded from:
1035 1. The user's personal color filters file or, if that does not exist,
1037 2. The global color filters file.
1041 If neither of these exist then the packets will not be colored.
1045 =item View:Show Packet In New Window
1047 Create a new window containing a packet details view and a hex dump
1048 window of the currently selected packet; this window will continue to
1049 display that packet's details and data even if another packet is
1054 Reload a capture file. Same as I<File:Close> and I<File:Open> the same
1059 Go back in previously visited packets history.
1063 Go forward in previously visited packets history.
1065 =item Go:Go To Packet
1067 Go to a particular numbered packet.
1069 =item Go:Go To Corresponding Packet
1071 If a field in the packet details pane containing a packet number is
1072 selected, go to the packet number specified by that field. (This works
1073 only if the dissector that put that entry into the packet details put it
1074 into the details as a filterable field rather than just as text.) This
1075 can be used, for example, to go to the packet for the request
1076 corresponding to a reply, or the reply corresponding to a request, if
1077 that packet number has been put into the packet details.
1079 =item Go:Previous Packet
1081 =item Go:Next Packet
1083 =item Go:First Packet
1085 =item Go:Last Packet
1087 Go to the previous / next / first / last packet in the capture.
1089 =item Capture:Interfaces
1091 Shows a dialog box with all currently known interfaces and displaying the
1092 current network traffic amount. Capture sessions can be started from here.
1093 Beware: keeping this box open results in high system load!
1095 =item Capture:Options
1097 Initiate a live packet capture (see L<Capture Options|/item_capture_options>
1098 dialog below). If no filename is specified, a temporary file will be created
1099 to hold the capture. The location of the file can be chosen by setting your
1100 TMPDIR environment variable before starting B<Wireshark>. Otherwise, the
1101 default TMPDIR location is system-dependent, but is likely either F</var/tmp>
1106 Start a live packet capture with the previously selected options. This won't
1107 open the options dialog box, and can be convenient for repeatingly capturing
1108 with the same options.
1112 Stop a running live capture.
1114 =item Capture:Restart
1116 While a live capture is running, stop it and restart with the same options
1117 again. This can be convenient to remove unrelevant packets, if no valuable
1118 packets were captured so far.
1120 =item Capture:Capture Filters
1122 Edit the saved list of capture filters, allowing filters to be added,
1123 changed, or deleted.
1125 =item Analyze:Display Filters
1127 Edit the saved list of display filters, allowing filters to be added,
1128 changed, or deleted.
1130 =item Analyze:Display Filter Macros
1132 Create shortcuts for complex macros
1134 =item Analyze:Apply as Filter
1136 Create a display filter based on the data currently highlighted in the
1137 packet details and apply the filter.
1139 If that data is a field that can be tested in a display filter
1140 expression, the display filter will test that field; otherwise, the
1141 display filter will be based on the absolute offset within the packet.
1142 Therefore it could be unreliable if the packet contains protocols with
1143 variable-length headers, such as a source-routed token-ring packet.
1145 The B<Selected> option creates a display filter that tests for a match
1146 of the data; the B<Not Selected> option creates a display filter that
1147 tests for a non-match of the data. The B<And Selected>, B<Or Selected>,
1148 B<And Not Selected>, and B<Or Not Selected> options add to the end of
1149 the display filter in the strip at the top (or bottom) an AND or OR
1150 operator followed by the new display filter expression.
1152 =item Analyze:Prepare a Filter
1154 Create a display filter based on the data currently highlighted in the
1155 packet details. The filter strip at the top (or bottom) is updated but
1156 it is not yet applied.
1158 =item Analyze:Enabled Protocols
1160 Allow protocol dissection to be enabled or disabled for a specific
1161 protocol. Individual protocols can be enabled or disabled by clicking
1162 on them in the list or by highlighting them and pressing the space bar.
1163 The entire list can be enabled, disabled, or inverted using the buttons
1166 When a protocol is disabled, dissection in a particular packet stops
1167 when that protocol is reached, and Wireshark moves on to the next packet.
1168 Any higher-layer protocols that would otherwise have been processed will
1169 not be displayed. For example, disabling TCP will prevent the dissection
1170 and display of TCP, HTTP, SMTP, Telnet, and any other protocol exclusively
1173 The list of protocols can be saved, so that Wireshark will start up with
1174 the protocols in that list disabled.
1176 =item Analyze:Decode As
1178 If you have a packet selected, present a dialog allowing you to change
1179 which dissectors are used to decode this packet. The dialog has one
1180 panel each for the link layer, network layer and transport layer
1181 protocol/port numbers, and will allow each of these to be changed
1182 independently. For example, if the selected packet is a TCP packet to
1183 port 12345, using this dialog you can instruct Wireshark to decode all
1184 packets to or from that TCP port as HTTP packets.
1186 =item Analyze:User Specified Decodes
1188 Create a new window showing whether any protocol ID to dissector
1189 mappings have been changed by the user. This window also allows the
1190 user to reset all decodes to their default values.
1192 =item Analyze:Follow TCP Stream
1194 If you have a TCP packet selected, display the contents of the data
1195 stream for the TCP connection to which that packet belongs, as text, in
1196 a separate window, and leave the list of packets in a filtered state,
1197 with only those packets that are part of that TCP connection being
1198 displayed. You can revert to your old view by pressing ENTER in the
1199 display filter text box, thereby invoking your old display filter (or
1200 resetting it back to no display filter).
1202 The window in which the data stream is displayed lets you select:
1208 whether to display the entire conversation, or one or the other side of
1213 whether the data being displayed is to be treated as ASCII or EBCDIC
1214 text or as raw hex data;
1218 and lets you print what's currently being displayed, using the same
1219 print options that are used for the I<File:Print Packet> menu item, or
1220 save it as text to a file.
1222 =item Analyze:Follow UDP Stream
1224 =item Analyze:Follow SSL Stream
1226 (Similar to Analyze:Follow TCP Stream)
1228 =item Analyze:Expert Info
1230 =item Analyze:Expert Info Composite
1232 (Kind of) a log of anomalies found by Wireshark in a capture file.
1234 =item Analyze:Conversation Filter
1236 =item Statistics:Summary
1238 Show summary information about the capture, including elapsed time,
1239 packet counts, byte counts, and the like. If a display filter is in
1240 effect, summary information will be shown about the capture and about
1241 the packets currently being displayed.
1243 =item Statistics:Protocol Hierarchy
1245 Show the number of packets, and the number of bytes in those packets,
1246 for each protocol in the trace. It organizes the protocols in the same
1247 hierarchy in which they were found in the trace. Besides counting the
1248 packets in which the protocol exists, a count is also made for packets
1249 in which the protocol is the last protocol in the stack. These
1250 last-protocol counts show you how many packets (and the byte count
1251 associated with those packets) B<ended> in a particular protocol. In
1252 the table, they are listed under "End Packets" and "End Bytes".
1254 =item Statistics:Conversations
1256 Lists of conversations; selectable by protocol. See Statistics:Conversation List below.
1258 =item Statistics:End Points
1260 List of End Point Addresses by protocol with packets/bytes/.... counts.
1262 =item Statistics:Packet Lengths
1264 Grouped counts of packet lengths (0-19 bytes, 20-39 bytes, ...)
1266 =item Statistics:IO Graphs
1268 Open a window where up to 5 graphs in different colors can be displayed
1269 to indicate number of packets or number of bytes per second for all packets
1270 matching the specified filter.
1271 By default only one graph will be displayed showing number of packets per second.
1273 The top part of the window contains the graphs and scales for the X and
1274 Y axis. If the graph is too long to fit inside the window there is a
1275 horizontal scrollbar below the drawing area that can scroll the graphs
1276 to the left or the right. The horizontal axis displays the time into
1277 the capture and the vertical axis will display the measured quantity at
1280 Below the drawing area and the scrollbar are the controls. On the
1281 bottom left there will be five similar sets of controls to control each
1282 individual graph such as "Display:<button>" which button will toggle
1283 that individual graph on/off. If <button> is ticked, the graph will be
1284 displayed. "Color:<color>" which is just a button to show which color
1285 will be used to draw that graph (color is only available in Gtk2
1286 version) and finally "Filter:<filter-text>" which can be used to specify
1287 a display filter for that particular graph.
1289 If filter-text is empty then all packets will be used to calculate the
1290 quantity for that graph. If filter-text is specified only those packets
1291 that match that display filter will be considered in the calculation of
1294 To the right of the 5 graph controls there are four menus to control
1295 global aspects of the draw area and graphs. The "Unit:" menu is used to
1296 control what to measure; "packets/tick", "bytes/tick" or "advanced..."
1298 packets/tick will measure the number of packets matching the (if
1299 specified) display filter for the graph in each measurement interval.
1301 bytes/tick will measure the total number of bytes in all packets matching
1302 the (if specified) display filter for the graph in each measurement
1305 advanced... see below
1307 "Tick interval:" specifies what measurement intervals to use. The
1308 default is 1 second and means that the data will be counted over 1
1311 "Pixels per tick:" specifies how many pixels wide each measurement
1312 interval will be in the drawing area. The default is 5 pixels per tick.
1314 "Y-scale:" controls the max value for the y-axis. Default value is
1315 "auto" which means that B<Wireshark> will try to adjust the maxvalue
1318 "advanced..." If Unit:advanced... is selected the window will display
1319 two more controls for each of the five graphs. One control will be a
1320 menu where the type of calculation can be selected from
1321 SUM,COUNT,MAX,MIN,AVG and LOAD, and one control, textbox, where the name of a
1322 single display filter field can be specified.
1324 The following restrictions apply to type and field combinations:
1326 SUM: available for all types of integers and will calculate the SUM of
1327 all occurences of this field in the measurement interval. Note that
1328 some field can occur multiple times in the same packet and then all
1329 instances will be summed up. Example: 'tcp.len' which will count the
1330 amount of payload data transferred across TCP in each interval.
1332 COUNT: available for all field types. This will COUNT the number of times
1333 certain field occurs in each interval. Note that some fields
1334 may occur multiple times in each packet and if that is the case
1335 then each instance will be counted independently and COUNT
1336 will be greater than the number of packets.
1338 MAX: available for all integer and relative time fields. This will calculate
1339 the max seen integer/time value seen for the field during the interval.
1340 Example: 'smb.time' which will plot the maximum SMB response time.
1342 MIN: available for all integer and relative time fields. This will calculate
1343 the min seen integer/time value seen for the field during the interval.
1344 Example: 'smb.time' which will plot the minimum SMB response time.
1346 AVG: available for all integer and relative time fields.This will
1347 calculate the average seen integer/time value seen for the field during
1348 the interval. Example: 'smb.time' which will plot the average SMB
1351 LOAD: available only for relative time fields (response times).
1353 Example of advanced:
1354 Display how NFS response time MAX/MIN/AVG changes over time:
1358 filter:nfs&&rpc.time
1363 filter:nfs&&rpc.time
1368 filter:nfs&&rpc.time
1371 Example of advanced:
1372 Display how the average packet size from host a.b.c.d changes over time.
1376 filter:ip.addr==a.b.c.d&&frame.pkt_len
1377 Calc:AVG frame.pkt_len
1380 The LOAD io-stat type is very different from anything you have ever seen
1381 before! While the response times themself as plotted by MIN,MAX,AVG are
1382 indications on the Server load (which affects the Server response time),
1383 the LOAD measurement measures the Client LOAD.
1384 What this measures is how much workload the client generates,
1385 i.e. how fast will the client issue new commands when the previous ones
1387 i.e. the level of concurrency the client can maintain.
1388 The higher the number, the more and faster is the client issuing new
1389 commands. When the LOAD goes down, it may be due to client load making
1390 the client slower in issuing new commands (there may be other reasons as
1391 well, maybe the client just doesn't have any commands it wants to issue
1394 Load is measured in concurrency/number of overlapping i/o and the value
1395 1000 means there is a constant load of one i/o.
1397 In each tick interval the amount of overlap is measured.
1398 See the graph below containing three commands:
1399 Below the graph are the LOAD values for each interval that would be calculated.
1403 | | o=====* | | | | | |
1405 | o========* | o============* | | |
1407 --------------------------------------------------> Time
1408 500 1500 500 750 1000 500 0 0
1410 =item Statistics:Conversation List
1412 This option will open a new window that displays a list of all
1413 conversations between two endpoints. The list has one row for each
1414 unique conversation and displays total number of packets/bytes seen as
1415 well as number of packets/bytes in each direction.
1417 By default the list is sorted according to the number of packets but by
1418 clicking on the column header; it is possible to re-sort the list in
1419 ascending or descending order by any column.
1421 By first selecting a conversation by clicking on it and then using the
1422 right mouse button (on those platforms that have a right
1423 mouse button) wireshark will display a popup menu offering several different
1424 filter operations to apply to the capture.
1426 These statistics windows can also be invoked from the Wireshark command
1427 line using the B<-z conv> argument.
1429 =item Statistics:Service Response Time
1445 Open a window to display Service Response Time statistics for an
1446 arbitrary DCE-RPC program
1447 interface and display B<Procedure>, B<Number of Calls>, B<Minimum SRT>,
1448 B<Maximum SRT> and B<Average SRT> for all procedures for that
1449 program/version. These windows opened will update in semi-real time to
1450 reflect changes when doing live captures or when reading new capture
1451 files into B<Wireshark>.
1453 This dialog will also allow an optional filter string to be used.
1454 If an optional filter string is used only such DCE-RPC request/response pairs
1455 that match that filter will be used to calculate the statistics. If no filter
1456 string is specified all request/response pairs will be used.
1466 Open a window to display Service Response Time statistics for Fibre Channel
1467 and display B<FC Type>, B<Number of Calls>, B<Minimum SRT>,
1468 B<Maximum SRT> and B<Average SRT> for all FC types.
1469 These windows opened will update in semi-real time to
1470 reflect changes when doing live captures or when reading new capture
1471 files into B<Wireshark>.
1472 The Service Response Time is calculated as the time delta between the
1473 First packet of the exchange and the Last packet of the exchange.
1475 This dialog will also allow an optional filter string to be used.
1476 If an optional filter string is used only such FC first/last exchange pairs
1477 that match that filter will be used to calculate the statistics. If no filter
1478 string is specified all request/response pairs will be used.
1488 Collect requests/response SRT (Service Response Time) data for ITU-T H.225 RAS.
1489 Data collected is B<number of calls> for each known ITU-T H.225 RAS Message Type,
1490 B<Minimum SRT>, B<Maximum SRT>, B<Average SRT>, B<Minimum in Packet>, and B<Maximum in Packet>.
1491 You will also get the number of B<Open Requests> (Unresponded Requests),
1492 B<Discarded Responses> (Responses without matching request) and Duplicate Messages.
1493 These windows opened will update in semi-real time to reflect changes when
1494 doing live captures or when reading new capture files into B<Wireshark>.
1496 You can apply an optional filter string in a dialog box, before starting
1497 the calculation. The statistics will only be calculated
1498 on those calls matching that filter.
1512 Collect requests/response SRT (Service Response Time) data for MGCP.
1513 Data collected is B<number of calls> for each known MGCP Type,
1514 B<Minimum SRT>, B<Maximum SRT>, B<Average SRT>, B<Minimum in Packet>, and B<Maximum in Packet>.
1515 These windows opened will update in semi-real time to reflect changes when
1516 doing live captures or when reading new capture files into B<Wireshark>.
1518 You can apply an optional filter string in a dialog box, before starting
1519 the calculation. The statistics will only be calculated
1520 on those calls matching that filter.
1530 Open a window to display statistics for an arbitrary ONC-RPC program interface
1531 and display B<Procedure>, B<Number of Calls>, B<Minimum SRT>, B<Maximum SRT> and B<Average SRT> for all procedures for that program/version.
1532 These windows opened will update in semi-real time to reflect changes when
1533 doing live captures or when reading new capture files into B<Wireshark>.
1535 This dialog will also allow an optional filter string to be used.
1536 If an optional filter string is used only such ONC-RPC request/response pairs
1537 that match that filter will be used to calculate the statistics. If no filter
1538 string is specified all request/response pairs will be used.
1540 By first selecting a conversation by clicking on it and then using the
1541 right mouse button (on those platforms that have a right
1542 mouse button) wireshark will display a popup menu offering several different
1543 filter operations to apply to the capture.
1557 Collect call/reply SRT (Service Response Time) data for SMB. Data collected
1558 is the number of calls for each SMB command, MinSRT, MaxSRT and AvgSRT.
1560 The data will be presented as separate tables for all normal SMB commands,
1561 all Transaction2 commands and all NT Transaction commands.
1562 Only those commands that are seen in the capture will have its stats
1564 Only the first command in a xAndX command chain will be used in the
1565 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
1566 only the SessionSetupAndX call will be used in the statistics.
1567 This is a flaw that might be fixed in the future.
1569 You can apply an optional filter string in a dialog box, before starting
1570 the calculation. The stats will only be calculated
1571 on those calls matching that filter.
1573 By first selecting a conversation by clicking on it and then using the
1574 right mouse button (on those platforms that have a right
1575 mouse button) wireshark will display a popup menu offering several different
1576 filter operations to apply to the capture.
1584 =item Statistics:BOOTP-DHCP
1588 =item Statistics:Compare
1590 Compare two Capture Files
1592 =item Statistics:Flow Graph
1594 Flow Graph: General/TCP
1596 =item Statistics:HTTP
1598 HTTP Load Distribution, Packet Counter & Requests
1600 =item Statistics:IP Addresses
1602 Count/Rate/Percent by IP Address
1604 =item Statistics:IP Destinations
1606 Count/Rate/Percent by IP Address/protocol/port
1608 =item Statistics:IP Protocol Types
1610 Count/Rate/Percent by IP Protocol Types
1612 =item Statistics:ONC-RPC Programs
1614 This dialog will open a window showing aggregated RTT statistics for all
1615 ONC-RPC Programs/versions that exist in the capture file.
1617 =item Statistics:TCP Stream Graph
1619 Graphs: Round Trip; Thoughput; Time-Sequence (Stevens); Time-Sequence (tcptrace)
1621 =item Statistics:UDP Multicast streams
1623 Multicast Streams Counts/Rates/... by Source/Destination Address/Port pairs
1625 =item Statistics:WLAN Traffic
1627 WLAn Traffic Statistics
1629 =item Telephony:ITU-T H.225
1631 Count ITU-T H.225 messages and their reasons. In the first column you get a
1632 list of H.225 messages and H.225 message reasons, which occur in the current
1633 capture file. The number of occurences of each message or reason will be displayed
1634 in the second column.
1635 This window opened will update in semi-real time to reflect changes when
1636 doing live captures or when reading new capture files into B<Wireshark>.
1638 You can apply an optional filter string in a dialog box, before starting
1639 the counter. The statistics will only be calculated
1640 on those calls matching that filter.
1644 Activate a counter for SIP messages. You will get the number of occurences of each
1645 SIP Method and of each SIP Status-Code. Additionally you also get the number of
1646 resent SIP Messages (only for SIP over UDP).
1648 This window opened will update in semi-real time to reflect changes when
1649 doing live captures or when reading new capture files into B<Wireshark>.
1651 You can apply an optional filter string in a dialog box, before starting
1652 the counter. The statistics will only be calculated
1653 on those calls matching that filter.
1655 =item Tools:Firewall ACL Rules
1663 =item Help:Supported Protocols
1665 List of supported protocols and display filter protocol fields.
1667 =item Help:Manual Pages
1669 Display locally installed HTML versions of these manual pages in a web browser.
1671 =item Help:Wireshark Online
1673 Various links to online resources to be open in a web browser, like
1674 L<http://www.wireshark.org>.
1676 =item Help:About Wireshark
1678 See various information about Wireshark (see L<About|/item_about> dialog below), like the
1679 version, the folders used, the available plugins, ...
1689 The main window contains the usual things like the menu, some toolbars, the
1690 main area and a statusbar. The main area is split into three panes, you can
1691 resize each pane using a "thumb" at the right end of each divider line.
1693 The main window is much more flexible than before. The layout of the main
1694 window can be customized by the I<Layout> page in the dialog box popped
1695 up by I<Edit:Preferences>, the following will describe the layout with the
1702 Some menu items are available for quick access here. There is no way to
1703 customize the items in the toolbar, however the toolbar can be hidden by
1704 I<View:Main Toolbar>.
1706 =item Filter Toolbar
1708 A display filter can be entered into the filter toolbar.
1709 A filter for HTTP, HTTPS, and DNS traffic might look like this:
1711 tcp.port == 80 || tcp.port == 443 || tcp.port == 53
1713 Selecting the I<Filter:> button lets you choose from a list of named
1714 filters that you can optionally save. Pressing the Return or Enter
1715 keys, or selecting the I<Apply> button, will cause the filter to be
1716 applied to the current list of packets. Selecting the I<Reset> button
1717 clears the display filter so that all packets are displayed (again).
1719 There is no way to customize the items in the toolbar, however the toolbar
1720 can be hidden by I<View:Filter Toolbar>.
1722 =item Packet List Pane
1724 The top pane contains the list of network packets that you can scroll
1725 through and select. By default, the packet number, packet timestamp,
1726 source and destination addresses, protocol, and description are
1727 displayed for each packet; the I<Columns> page in the dialog box popped
1728 up by I<Edit:Preferences> lets you change this (although, unfortunately,
1729 you currently have to save the preferences, and exit and restart
1730 Wireshark, for those changes to take effect).
1732 If you click on the heading for a column, the display will be sorted by
1733 that column; clicking on the heading again will reverse the sort order
1736 An effort is made to display information as high up the protocol stack
1737 as possible, e.g. IP addresses are displayed for IP packets, but the
1738 MAC layer address is displayed for unknown packet types.
1740 The right mouse button can be used to pop up a menu of operations.
1742 The middle mouse button can be used to mark a packet.
1744 =item Packet Details Pane
1746 The middle pane contains a display of the details of the
1747 currently-selected packet. The display shows each field and its value
1748 in each protocol header in the stack. The right mouse button can be
1749 used to pop up a menu of operations.
1751 =item Packet Bytes Pane
1753 The lowest pane contains a hex and ASCII dump of the actual packet data.
1754 Selecting a field in the packet details highlights the corresponding
1755 bytes in this section.
1757 The right mouse button can be used to pop up a menu of operations.
1761 The statusbar is divided into three parts, on the left some context dependent
1762 things are shown, like information about the loaded file, in the center the
1763 number of packets are displayed, and on the right the current configuration
1766 The statusbar can be hidden by I<View:Statusbar>.
1772 The I<Preferences> dialog lets you control various personal preferences
1773 for the behavior of B<Wireshark>.
1777 =item User Interface Preferences
1779 The I<User Interface> page is used to modify small aspects of the GUI to
1780 your own personal taste:
1784 =item Selection Bars
1786 The selection bar in the packet list and packet details can have either
1787 a "browse" or "select" behavior. If the selection bar has a "browse"
1788 behavior, the arrow keys will move an outline of the selection bar,
1789 allowing you to browse the rest of the list or details without changing
1790 the selection until you press the space bar. If the selection bar has a
1791 "select" behavior, the arrow keys will move the selection bar and change
1792 the selection to the new item in the packet list or packet details.
1794 =item Save Window Position
1796 If this item is selected, the position of the main Wireshark window will
1797 be saved when Wireshark exits, and used when Wireshark is started again.
1799 =item Save Window Size
1801 If this item is selected, the size of the main Wireshark window will
1802 be saved when Wireshark exits, and used when Wireshark is started again.
1804 =item Save Window Maximized state
1806 If this item is selected the maximize state of the main Wireshark window
1807 will be saved when Wireshark exists, and used when Wireshark is started again.
1809 =item File Open Dialog Behavior
1811 This item allows the user to select how Wireshark handles the listing
1812 of the "File Open" Dialog when opening trace files. "Remember Last
1813 Directory" causes Wireshark to automatically position the dialog in the
1814 directory of the most recently opened file, even between launches of Wireshark.
1815 "Always Open in Directory" allows the user to define a persistent directory
1816 that the dialog will always default to.
1820 Allows the user to specify a persistent File Open directory. Trailing
1821 slashes or backslashes will automatically be added.
1823 =item File Open Preview timeout
1825 This items allows the user to define how much time is spend reading the
1826 capture file to present preview data in the File Open dialog.
1828 =item Open Recent maximum list entries
1830 The File menu supports a recent file list. This items allows the user to
1831 specify how many files are kept track of in this list.
1833 =item Ask for unsaved capture files
1835 When closing a capture file or Wireshark itself if the file isn't saved yet
1836 the user is presented the option to save the file when this item is set.
1838 =item Wrap during find
1840 This items determines the behaviour when reaching the beginning or the end
1841 of a capture file. When set the search wraps around and continues, otherwise
1844 =item Settings dialogs show a save button
1846 This item determines if the various dialogs sport an explicit Save button
1847 or that save is implicit in Ok / Apply.
1849 =item Web browser command
1851 This entry specifies the command line to launch a web browser. It is used
1852 to access online content, like the Wiki and user guide. Use '%s' to place
1853 the request URL in the command line.
1857 =item Layout Preferences
1859 The I<Layout> page lets you specify the general layout of the main window.
1860 You can choose from six different layouts and fill the three panes with the
1867 The vertical scrollbars in the three panes can be set to be either on
1868 the left or the right.
1870 =item Alternating row colors
1874 The highlight method in the hex dump display for the selected protocol
1875 item can be set to use either inverse video, or bold characters.
1879 =item Filter toolbar placement
1881 =item Custom window title
1885 =item Column Preferences
1887 The I<Columns> page lets you specify the number, title, and format
1888 of each column in the packet list.
1890 The I<Column title> entry is used to specify the title of the column
1891 displayed at the top of the packet list. The type of data that the column
1892 displays can be specified using the I<Column format> option menu.
1893 The row of buttons on the left perform the following actions:
1899 Adds a new column to the list.
1903 Deletes the currently selected list item.
1907 Moves the selected list item up or down one position.
1911 =item Font Preferences
1913 The I<Font> page lets you select the font to be used for most text.
1915 =item Color Preferences
1917 The I<Colors> page can be used to change the color of the text
1918 displayed in the TCP stream window and for marked packets. To change a color,
1919 simply select an attribute from the "Set:" menu and use the color selector to
1920 get the desired color. The new text colors are displayed as a sample text.
1922 =item Capture Preferences
1924 The I<Capture> page lets you specify various parameters for capturing
1925 live packet data; these are used the first time a capture is started.
1927 The I<Interface:> combo box lets you specify the interface from which to
1928 capture packet data, or the name of a FIFO from which to get the packet
1931 The I<Data link type:> option menu lets you, for some interfaces, select
1932 the data link header you want to see on the packets you capture. For
1933 example, in some OSes and with some versions of libpcap, you can choose,
1934 on an 802.11 interface, whether the packets should appear as Ethernet
1935 packets (with a fake Ethernet header) or as 802.11 packets.
1937 The I<Limit each packet to ... bytes> check box lets you set the
1938 snapshot length to use when capturing live data; turn on the check box,
1939 and then set the number of bytes to use as the snapshot length.
1941 The I<Filter:> text entry lets you set a capture filter expression to be
1942 used when capturing.
1944 If any of the environment variables SSH_CONNECTION, SSH_CLIENT,
1945 REMOTEHOST, DISPLAY, or SESSIONNAME are set, Wireshark will create a
1946 default capture filter that excludes traffic from the hosts and ports
1947 defined in those variables.
1949 The I<Capture packets in promiscuous mode> check box lets you specify
1950 whether to put the interface in promiscuous mode when capturing.
1952 The I<Update list of packets in real time> check box lets you specify
1953 that the display should be updated as packets are seen.
1955 The I<Automatic scrolling in live capture> check box lets you specify
1956 whether, in an "Update list of packets in real time" capture, the packet
1957 list pane should automatically scroll to show the most recently captured
1960 =item Printing Preferences
1962 The radio buttons at the top of the I<Printing> page allow you choose
1963 between printing packets with the I<File:Print Packet> menu item as text
1964 or PostScript, and sending the output directly to a command or saving it
1965 to a file. The I<Command:> text entry box, on UNIX-compatible systems,
1966 is the command to send files to (usually B<lpr>), and the I<File:> entry
1967 box lets you enter the name of the file you wish to save to.
1968 Additionally, you can select the I<File:> button to browse the file
1969 system for a particular save file.
1971 =item Name Resolution Preferences
1973 The I<Enable MAC name resolution>, I<Enable network name resolution> and
1974 I<Enable transport name resolution> check boxes let you specify whether
1975 MAC addresses, network addresses, and transport-layer port numbers
1976 should be translated to names.
1978 The I<Enable concurrent DNS name resolution> allows Wireshark to send out
1979 multiple name resolution requests and not wait for the result before
1980 continuing dissection. This speeds up dissection with network name
1981 resolution but initially may miss resolutions. The number of concurrent
1982 requests can be set here as well.
1988 =item RTP Player Preferences
1990 This page allows you to select the number of channels visible in the
1991 RTP player window. It determines the height of the window, more channels
1992 are possible and visible by means of a scroll bar.
1994 =item Protocol Preferences
1996 There are also pages for various protocols that Wireshark dissects,
1997 controlling the way Wireshark handles those protocols.
2001 =item Edit Capture Filter List
2003 =item Edit Display Filter List
2005 =item Capture Filter
2007 =item Display Filter
2013 The I<Edit Capture Filter List> dialog lets you create, modify, and
2014 delete capture filters, and the I<Edit Display Filter List> dialog lets
2015 you create, modify, and delete display filters.
2017 The I<Capture Filter> dialog lets you do all of the editing operations
2018 listed, and also lets you choose or construct a filter to be used when
2021 The I<Display Filter> dialog lets you do all of the editing operations
2022 listed, and also lets you choose or construct a filter to be used to
2023 filter the current capture being viewed.
2025 The I<Read Filter> dialog lets you do all of the editing operations
2026 listed, and also lets you choose or construct a filter to be used to
2027 as a read filter for a capture file you open.
2029 The I<Search Filter> dialog lets you do all of the editing operations
2030 listed, and also lets you choose or construct a filter expression to be
2031 used in a find operation.
2033 In all of those dialogs, the I<Filter name> entry specifies a
2034 descriptive name for a filter, e.g. B<Web and DNS traffic>. The
2035 I<Filter string> entry is the text that actually describes the filtering
2036 action to take, as described above.The dialog buttons perform the
2043 If there is text in the two entry boxes, creates a new associated list
2048 Modifies the currently selected list item to match what's in the entry
2053 Deletes the currently selected list item.
2055 =item Add Expression...
2057 For display filter expressions, pops up a dialog box to allow you to
2058 construct a filter expression to test a particular field; it offers
2059 lists of field names, and, when appropriate, lists from which to select
2060 tests to perform on the field and values with which to compare it. In
2061 that dialog box, the OK button will cause the filter expression you
2062 constructed to be entered into the I<Filter string> entry at the current
2067 In the I<Capture Filter> dialog, closes the dialog box and makes the
2068 filter in the I<Filter string> entry the filter in the I<Capture
2069 Preferences> dialog. In the I<Display Filter> dialog, closes the dialog
2070 box and makes the filter in the I<Filter string> entry the current
2071 display filter, and applies it to the current capture. In the I<Read
2072 Filter> dialog, closes the dialog box and makes the filter in the
2073 I<Filter string> entry the filter in the I<Open Capture File> dialog.
2074 In the I<Search Filter> dialog, closes the dialog box and makes the
2075 filter in the I<Filter string> entry the filter in the I<Find Packet>
2080 Makes the filter in the I<Filter string> entry the current display
2081 filter, and applies it to the current capture.
2085 If the list of filters being edited is the list of
2086 capture filters, saves the current filter list to the personal capture
2087 filters file, and if the list of filters being edited is the list of
2088 display filters, saves the current filter list to the personal display
2093 Closes the dialog without doing anything with the filter in the I<Filter
2098 =item The Color Filters Dialog
2100 This dialog displays a list of color filters and allows it to be
2105 =item THE FILTER LIST
2107 Single rows may be selected by clicking. Multiple rows may be selected
2108 by using the ctrl and shift keys in combination with the mouse button.
2112 Adds a new filter at the bottom of the list and opens the Edit Color
2113 Filter dialog box. You will have to alter the filter expression at
2114 least before the filter will be accepted. The format of color filter
2115 expressions is identical to that of display filters. The new filter is
2116 selected, so it may immediately be moved up and down, deleted or edited.
2117 To avoid confusion all filters are unselected before the new filter is
2122 Opens the Edit Color Filter dialog box for the selected filter. (If this
2123 button is disabled you may have more than one filter selected, making it
2124 ambiguous which is to be edited.)
2128 Enables the selected color filter(s).
2132 Disables the selected color filter(s).
2136 Deletes the selected color filter(s).
2140 Allows you to choose a file in which to save the current list of color
2141 filters. You may also choose to save only the selected filters. A
2142 button is provided to save the filters in the global color filters file
2143 (you must have sufficient permissions to write this file, of course).
2147 Allows you to choose a file containing color filters which are then
2148 added to the bottom of the current list. All the added filters are
2149 selected, so they may be moved to the correct position in the list as a
2150 group. To avoid confusion, all filters are unselected before the new
2151 filters are imported. A button is provided to load the filters from the
2152 global color filters file.
2156 Deletes your personal color filters file, reloads the global
2157 color filters file, if any, and closes the dialog.
2161 Moves the selected filter(s) up the list, making it more likely that
2162 they will be used to color packets.
2166 Moves the selected filter(s) down the list, making it less likely that
2167 they will be used to color packets.
2171 Closes the dialog and uses the color filters as they stand.
2175 Colors the packets according to the current list of color filters, but
2176 does not close the dialog.
2180 Saves the current list of color filters in your personal color filters
2181 file. Unless you do this they will not be used the next time you start
2186 Closes the dialog without changing the coloration of the packets. Note
2187 that changes you have made to the current list of color filters are not
2192 =item Capture Options
2194 The I<Capture Options> dialog lets you specify various parameters for
2195 capturing live packet data.
2197 The I<Interface:> field lets you specify the interface from which to
2198 capture packet data or a command from which to get the packet data via a
2201 The I<Link layer header type:> field lets you specify the interfaces link
2202 layer header type. This field is usually disabled, as most interface have
2203 only one header type.
2205 The I<Capture packets in promiscuous mode> check box lets you specify
2206 whether the interface should be put into promiscuous mode when
2209 The I<Limit each packet to ... bytes> check box and field lets you
2210 specify a maximum number of bytes per packet to capture and save; if the
2211 check box is not checked, the limit will be 65535 bytes.
2213 The I<Capture Filter:> entry lets you specify the capture filter using a
2214 tcpdump-style filter string as described above.
2216 The I<File:> entry lets you specify the file into which captured packets
2217 should be saved, as in the I<Printer Options> dialog above. If not
2218 specified, the captured packets will be saved in a temporary file; you
2219 can save those packets to a file with the I<File:Save As> menu item.
2221 The I<Use multiple files> check box lets you specify that the capture
2222 should be done in "multiple files" mode. This option is disabled, if the
2223 I<Update list of packets in real time> option is checked.
2225 The I<Next file every ... megabyte(s)> check box and fields lets
2226 you specify that a switch to a next file should be done
2227 if the specified filesize is reached. You can also select the appriate
2228 unit, but beware that the filesize has a maximum of 2 GB.
2229 The check box is forced to be checked, as "multiple files" mode requires a
2230 file size to be specified.
2232 The I<Next file every ... minute(s)> check box and fields lets
2233 you specify that the switch to a next file should be done after the specified
2234 time has elapsed, even if the specified capture size is not reached.
2236 The I<Ring buffer with ... files> field lets you specify the number
2237 of files of a ring buffer. This feature will capture into to the first file
2238 again, after the specified amount of files were used.
2240 The I<Stop capture after ... files> field lets you specify the number
2241 of capture files used, until the capture is stopped.
2243 The I<Stop capture after ... packet(s)> check box and field let
2244 you specify that Wireshark should stop capturing after having captured
2245 some number of packets; if the check box is not checked, Wireshark will
2246 not stop capturing at some fixed number of captured packets.
2248 The I<Stop capture after ... megabyte(s)> check box and field lets
2249 you specify that Wireshark should stop capturing after the file to which
2250 captured packets are being saved grows as large as or larger than some
2251 specified number of megabytes. If the check box is not checked, Wireshark
2252 will not stop capturing at some capture file size (although the operating
2253 system on which Wireshark is running, or the available disk space, may still
2254 limit the maximum size of a capture file). This option is disabled, if
2255 "multiple files" mode is used,
2257 The I<Stop capture after ... second(s)> check box and field let you
2258 specify that Wireshark should stop capturing after it has been capturing
2259 for some number of seconds; if the check box is not checked, Wireshark
2260 will not stop capturing after some fixed time has elapsed.
2262 The I<Update list of packets in real time> check box lets you specify
2263 whether the display should be updated as packets are captured and, if
2264 you specify that, the I<Automatic scrolling in live capture> check box
2265 lets you specify the packet list pane should automatically scroll to
2266 show the most recently captured packets as new packets arrive.
2268 The I<Enable MAC name resolution>, I<Enable network name resolution> and
2269 I<Enable transport name resolution> check boxes let you specify whether
2270 MAC addresses, network addresses, and transport-layer port numbers
2271 should be translated to names.
2275 The I<About> dialog lets you view various information about Wireshark.
2277 =item About:Wireshark
2279 The I<Wireshark> page lets you view general information about Wireshark,
2280 like the installed version, licensing information and such.
2284 The I<Authors> page shows the author and all contributors.
2288 The I<Folders> page lets you view the directory names where Wireshark is
2289 searching it's various configuration and other files.
2293 The I<Plugins> page lets you view the dissector plugin modules
2294 available on your system.
2296 The I<Plugins List> shows the name and version of each dissector plugin
2297 module found on your system.
2299 On Unix-compatible systems, the plugins are looked for in the following
2300 directories: the F<lib/wireshark/plugins/$VERSION> directory under the
2301 main installation directory (for example,
2302 F</usr/local/lib/wireshark/plugins/$VERSION>), and then
2303 F<$HOME/.wireshark/plugins>.
2305 On Windows systems, the plugins are looked for in the following
2306 directories: F<plugins\$VERSION> directory under the main installation
2307 directory (for example, F<C:\Program Files\Wireshark\plugins\$VERSION>),
2308 and then F<%APPDATA%\Wireshark\plugins\$VERSION> (or, if %APPDATA% isn't
2309 defined, F<%USERPROFILE%\Application Data\Wireshark\plugins\$VERSION>).
2311 $VERSION is the version number of the plugin interface, which
2312 is typically the version number of Wireshark. Note that a dissector
2313 plugin module may support more than one protocol; there is not
2314 necessarily a one-to-one correspondence between dissector plugin modules
2315 and protocols. Protocols supported by a dissector plugin module are
2316 enabled and disabled using the I<Edit:Protocols> dialog box, just as
2317 protocols built into Wireshark are.
2321 =head1 CAPTURE FILTER SYNTAX
2323 See the manual page of pcap-filter(4) or, if that doesn't exist, tcpdump(8).
2325 =head1 DISPLAY FILTER SYNTAX
2327 For a complete table of protocol and protocol fields that are filterable
2328 in B<Wireshark> see the wireshark-filter(4) manual page.
2332 These files contains various B<Wireshark> configuration settings.
2338 The F<preferences> files contain global (system-wide) and personal
2339 preference settings. If the system-wide preference file exists, it is
2340 read first, overriding the default settings. If the personal preferences
2341 file exists, it is read next, overriding any previous values. Note: If
2342 the command line flag B<-o> is used (possibly more than once), it will
2343 in turn override values from the preferences files.
2345 The preferences settings are in the form I<prefname>B<:>I<value>,
2347 where I<prefname> is the name of the preference
2348 and I<value> is the value to
2349 which it should be set; white space is allowed between B<:> and
2350 I<value>. A preference setting can be continued on subsequent lines by
2351 indenting the continuation lines with white space. A B<#> character
2352 starts a comment that runs to the end of the line:
2354 # Vertical scrollbars should be on right side?
2355 # TRUE or FALSE (case-insensitive).
2356 gui.scrollbar_on_right: TRUE
2358 The global preferences file is looked for in the F<wireshark> directory
2359 under the F<share> subdirectory of the main installation directory (for
2360 example, F</usr/local/share/wireshark/preferences>) on UNIX-compatible
2361 systems, and in the main installation directory (for example,
2362 F<C:\Program Files\Wireshark\preferences>) on Windows systems.
2364 The personal preferences file is looked for in F<$HOME/.wireshark/preferences> on
2365 UNIX-compatible systems and F<%APPDATA%\Wireshark\preferences> (or, if
2366 %APPDATA% isn't defined, F<%USERPROFILE%\Application
2367 Data\Wireshark\preferences>) on Windows systems.
2369 Note: Whenever the preferences are saved by using the I<Save> button
2370 in the I<Edit:Preferences> dialog box, your personal preferences file
2371 will be overwritten with the new settings, destroying any comments and
2372 unknown/obsolete settings that were in the file.
2376 The F<recent> file contains personal settings (mostly GUI related) such
2377 as the current B<Wireshark> window size. The file is saved at program exit and
2378 read in at program start automatically. Note: The command line flag B<-o>
2379 may be used to override settings from this file.
2381 The settings in this file have the same format as in the F<preferences>
2382 files, and the same directory as for the personal preferences file is
2385 Note: Whenever Wireshark is closed, your recent file
2386 will be overwritten with the new settings, destroying any comments and
2387 unknown/obsolete settings that were in the file.
2389 =item Disabled (Enabled) Protocols
2391 The F<disabled_protos> files contain system-wide and personal lists of
2392 protocols that have been disabled, so that their dissectors are never
2393 called. The files contain protocol names, one per line, where the
2394 protocol name is the same name that would be used in a display filter
2400 If a protocol is listed in the global F<disabled_protos> file, it is not
2401 displayed in the I<Analyze:Enabled Protocols> dialog box, and so cannot
2402 be enabled by the user.
2404 The global F<disabled_protos> file uses the same directory as the global
2407 The personal F<disabled_protos> file uses the same directory as the
2408 personal preferences file.
2410 Note: Whenever the disabled protocols list is saved by using the I<Save>
2411 button in the I<Analyze:Enabled Protocols> dialog box, your personal
2412 disabled protocols file will be overwritten with the new settings,
2413 destroying any comments that were in the file.
2415 =item Name Resolution (hosts)
2417 If the personal F<hosts> file exists, it is
2418 used to resolve IPv4 and IPv6 addresses before any other
2419 attempts are made to resolve them. The file has the standard F<hosts>
2420 file syntax; each line contains one IP address and name, separated by
2421 whitespace. The same directory as for the personal preferences file is used.
2423 =item Name Resolution (ethers)
2425 The F<ethers> files are consulted to correlate 6-byte hardware addresses to
2426 names. First the personal F<ethers> file is tried and if an address is not
2427 found there the global F<ethers> file is tried next.
2429 Each line contains one hardware address and name, separated by
2430 whitespace. The digits of the hardware address are separated by colons
2431 (:), dashes (-) or periods (.). The same separator character must be
2432 used consistently in an address. The following three lines are valid
2433 lines of an F<ethers> file:
2435 ff:ff:ff:ff:ff:ff Broadcast
2436 c0-00-ff-ff-ff-ff TR_broadcast
2437 00.00.00.00.00.00 Zero_broadcast
2439 The global F<ethers> file is looked for in the F</etc> directory on
2440 UNIX-compatible systems, and in the main installation directory (for
2441 example, F<C:\Program Files\Wireshark>) on Windows systems.
2443 The personal F<ethers> file is looked for in the same directory as the personal
2446 =item Name Resolution (manuf)
2448 The F<manuf> file is used to match the 3-byte vendor portion of a 6-byte
2449 hardware address with the manufacturer's name; it can also contain well-known
2450 MAC addresses and address ranges specified with a netmask. The format of the
2451 file is the same as the F<ethers> files, except that entries such as:
2455 can be provided, with the 3-byte OUI and the name for a vendor, and
2458 00-00-0C-07-AC/40 All-HSRP-routers
2460 can be specified, with a MAC address and a mask indicating how many bits
2461 of the address must match. The above entry, for example, has 40
2462 significant bits, or 5 bytes, and would match addresses from
2463 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
2466 The F<manuf> file is looked for in the same directory as the global
2469 =item Name Resolution (ipxnets)
2471 The F<ipxnets> files are used to correlate 4-byte IPX network numbers to
2472 names. First the global F<ipxnets> file is tried and if that address is not
2473 found there the personal one is tried next.
2475 The format is the same as the F<ethers>
2476 file, except that each address is four bytes instead of six.
2477 Additionally, the address can be represented as a single hexadecimal
2478 number, as is more common in the IPX world, rather than four hex octets.
2479 For example, these four lines are valid lines of an F<ipxnets> file:
2483 00:00:BE:EF IT_Server1
2486 The global F<ipxnets> file is looked for in the F</etc> directory on
2487 UNIX-compatible systems, and in the main installation directory (for
2488 example, F<C:\Program Files\Wireshark>) on Windows systems.
2490 The personal F<ipxnets> file is looked for in the same directory as the
2491 personal preferences file.
2493 =item Capture Filters
2495 The F<cfilters> files contain system-wide and personal capture filters.
2496 Each line contains one filter, starting with the string displayed in the
2497 dialog box in quotation marks, followed by the filter string itself:
2502 The global F<cfilters> file uses the same directory as the
2503 global preferences file.
2505 The personal F<cfilters> file uses the same directory as the personal
2506 preferences file. It is written through the Capture:Capture Filters
2509 If the global F<cfilters> file exists, it is used only if the personal
2510 F<cfilters> file does not exist; global and personal capture filters are
2513 =item Display Filters
2515 The F<dfilters> files contain system-wide and personal display filters.
2516 Each line contains one filter, starting with the string displayed in the
2517 dialog box in quotation marks, followed by the filter string itself:
2522 The global F<dfilters> file uses the same directory as the
2523 global preferences file.
2525 The personal F<dfilters> file uses the same directory as the
2526 personal preferences file. It is written through the Analyze:Display
2529 If the global F<dfilters> file exists, it is used only if the personal
2530 F<dfilters> file does not exist; global and personal display filters are
2533 =item Color Filters (Coloring Rules)
2535 The F<colorfilters> files contain system-wide and personal color filters.
2536 Each line contains one filter, starting with the string displayed in the
2537 dialog box, followed by the corresponding display filter. Then the
2538 background and foreground colors are appended:
2541 @tcp@tcp@[59345,58980,65534][0,0,0]
2542 @udp@udp@[28834,57427,65533][0,0,0]
2544 The global F<colorfilters> file uses the same directory as the
2545 global preferences file.
2547 The personal F<colorfilters> file uses the same directory as the
2548 personal preferences file. It is written through the View:Coloring Rules
2551 If the global F<colorfilters> file exists, it is used only if the personal
2552 F<colorfilters> file does not exist; global and personal color filters are
2557 The F<gtkrc> files contain system-wide and personal GTK theme settings.
2559 The global F<gtkrc> file uses the same directory as the
2560 global preferences file.
2562 The personal F<gtkrc> file uses the same directory as the personal
2567 See above in the description of the About:Plugins page.
2571 =head1 ENVIRONMENT VARIABLES
2575 =item WIRESHARK_DEBUG_EP_NO_CHUNKS
2577 Normally per-packet memory is allocated in large "chunks." This behavior
2578 doesn't work well with debugging tools such as Valgrind or ElectricFence.
2579 Export this environment variable to force individual allocations.
2580 Note: disabling chunks also disables canaries (see below).
2582 =item WIRESHARK_DEBUG_SE_NO_CHUNKS
2584 Normally per-file memory is allocated in large "chunks." This behavior
2585 doesn't work well with debugging tools such as Valgrind or ElectricFence.
2586 Export this environment variable to force individual allocations.
2587 Note: disabling chunks also disables canaries (see below).
2589 =item WIRESHARK_DEBUG_EP_NO_CANARY
2591 Normally per-packet memory allocations are separated by "canaries" which
2592 allow detection of memory overruns. This comes at the expense of some extra
2593 memory usage. Exporting this environment variable disables these canaries.
2595 =item WIRESHARK_DEBUG_SE_USE_CANARY
2597 Exporting this environment variable causes per-file memory allocations to be
2598 protected with "canaries" which allow for detection of memory overruns.
2599 This comes at the expense of significant extra memory usage.
2601 =item WIRESHARK_DEBUG_SCRUB_MEMORY
2603 If this environment variable is exported, the contents of per-packet and
2604 per-file memory is initialized to 0xBADDCAFE when the memory is allocated
2605 and is reset to 0xDEADBEEF when the memory is freed. This functionality is
2606 useful mainly to developers looking for bugs in the way memory is handled.
2612 wireshark-filter(4), tshark(1), editcap(1), pcap-filter(4), tcpdump(8),
2613 pcap(3), dumpcap(1), mergecap(1), text2pcap(1)
2617 The latest version of B<Wireshark> can be found at
2618 L<http://www.wireshark.org>.
2620 HTML versions of the Wireshark project man pages are available at:
2621 L<http://www.wireshark.org/docs/man-pages>.