4 wireshark - Interactively dump and analyze network traffic
9 S<[ B<-a> E<lt>capture autostop conditionE<gt> ] ...>
10 S<[ B<-b> E<lt>capture ring buffer optionE<gt> ] ...>
11 S<[ B<-B> E<lt>capture buffer size (Win32 only)E<gt> ] >
12 S<[ B<-c> E<lt>capture packet countE<gt> ]>
14 S<[ B<-f> E<lt>capture filterE<gt> ]>
15 S<[ B<-g> E<lt>packet numberE<gt> ]>
18 S<[ B<-i> E<lt>capture interfaceE<gt>|- ]>
22 S<[ B<-m> E<lt>fontE<gt> ]>
24 S<[ B<-N> E<lt>name resolving flagsE<gt> ] >
25 S<[ B<-o> E<lt>preference/recent settingE<gt> ] ...>
28 S<[ B<-r> E<lt>infileE<gt> ]>
29 S<[ B<-R> E<lt>read (display) filterE<gt> ]>
31 S<[ B<-s> E<lt>capture snaplenE<gt> ]>
34 S<[ B<-w> E<lt>outfileE<gt> ]>
35 S<[ B<-y> E<lt>capture link typeE<gt> ]>
36 S<[ B<-X> E<lt>eXtension optionE<gt> ]>
37 S<[ B<-z> E<lt>statisticsE<gt> ]>
38 S<[ E<lt>infileE<gt> ]>
42 B<Wireshark> is a GUI network protocol analyzer. It lets you
43 interactively browse packet data from a live network or from a
44 previously saved capture file. B<Wireshark>'s native capture file format
45 is B<libpcap> format, which is also the format used by B<tcpdump> and
48 B<Wireshark> can read / import the following file formats:
53 libpcap, tcpdump and various other tools using tcpdump's capture format
56 B<snoop> and B<atmsnoop>
59 Shomiti/Finisar B<Surveyor> captures
62 Novell B<LANalyzer> captures
65 Microsoft B<Network Monitor> captures
68 AIX's B<iptrace> captures
71 Cinco Networks B<NetXRay> captures
74 Network Associates Windows-based B<Sniffer> captures
77 Network General/Network Associates DOS-based B<Sniffer> (compressed or uncompressed) captures
80 AG Group/WildPackets B<EtherPeek>/B<TokenPeek>/B<AiroPeek>/B<EtherHelp>/B<PacketGrabber> captures
83 B<RADCOM>'s WAN/LAN analyzer captures
86 Network Instruments B<Observer> version 9 captures
89 B<Lucent/Ascend> router debug output
92 files from HP-UX's B<nettl>
95 B<Toshiba's> ISDN routers dump output
98 the output from B<i4btrace> from the ISDN4BSD project
101 traces from the B<EyeSDN> USB S0.
104 the output in B<IPLog> format from the Cisco Secure Intrusion Detection System
107 B<pppd logs> (pppdump format)
110 the output from VMS's B<TCPIPtrace>/B<TCPtrace>/B<UCX$TRACE> utilities
113 the text output from the B<DBS Etherwatch> VMS utility
116 Visual Networks' B<Visual UpTime> traffic capture
119 the output from B<CoSine> L2 debug
122 the output from Accellent's B<5Views> LAN agents
125 Endace Measurement Systems' ERF format captures
128 Linux Bluez Bluetooth stack B<hcidump -w> traces
131 Catapult DCT2000 .out files
135 There is no need to tell B<Wireshark> what type of
136 file you are reading; it will determine the file type by itself.
137 B<Wireshark> is also capable of reading any of these file formats if they
138 are compressed using gzip. B<Wireshark> recognizes this directly from
139 the file; the '.gz' extension is not required for this purpose.
141 Like other protocol analyzers, B<Wireshark>'s main window shows 3 views
142 of a packet. It shows a summary line, briefly describing what the
143 packet is. A packet details display is shown, allowing you to drill
144 down to exact protocol or field that you interested in. Finally, a hex
145 dump shows you exactly what the packet looks like when it goes over the
148 In addition, B<Wireshark> has some features that make it unique. It can
149 assemble all the packets in a TCP conversation and show you the ASCII
150 (or EBCDIC, or hex) data in that conversation. Display filters in
151 B<Wireshark> are very powerful; more fields are filterable in B<Wireshark>
152 than in other protocol analyzers, and the syntax you can use to create
153 your filters is richer. As B<Wireshark> progresses, expect more and more
154 protocol fields to be allowed in display filters.
156 Packet capturing is performed with the pcap library. The capture filter
157 syntax follows the rules of the pcap library. This syntax is different
158 from the display filter syntax.
160 Compressed file support uses (and therefore requires) the zlib library.
161 If the zlib library is not present, B<Wireshark> will compile, but will
162 be unable to read compressed files.
164 The pathname of a capture file to be read can be specified with the
165 B<-r> option or can be specified as a command-line argument.
171 Most users will want to start B<Wireshark> without options and configure
172 it from the menus instead. Those users may just skip this section.
174 =item -a E<lt>capture autostop conditionE<gt>
176 Specify a criterion that specifies when B<Wireshark> is to stop writing
177 to a capture file. The criterion is of the form I<test>B<:>I<value>,
178 where I<test> is one of:
180 B<duration>:I<value> Stop writing to a capture file after I<value> seconds have elapsed.
182 B<filesize>:I<value> Stop writing to a capture file after it reaches a size of I<value>
183 kilobytes (where a kilobyte is 1024 bytes). If this option
184 is used together with the -b option, Wireshark will stop writing to the
185 current capture file and switch to the next one if filesize is reached.
187 B<files>:I<value> Stop writing to capture files after I<value> number of files were written.
189 =item -b E<lt>capture ring buffer optionE<gt>
191 Cause B<Wireshark> to run in "multiple files" mode. In "multiple files" mode,
192 B<Wireshark> will write to several capture files. When the first capture file
193 fills up, B<Wireshark> will switch writing to the next file and so on.
195 The created filenames are based on the filename given with the B<-w> flag, the number of
196 the file and on the creation date and time,
197 e.g. outfile_00001_20050604120117.pcap, outfile_00001_20050604120523.pcap, ...
199 With the I<files> option it's also possible to form a "ring buffer".
200 This will fill up new files until the number of files specified,
201 at which point B<Wireshark> will discard the data in the first file and start
202 writing to that file and so on. If the I<files> option is not set,
203 new files filled up until one of the capture stop conditions match (or
204 until the disk if full).
206 The criterion is of the form I<key>B<:>I<value>,
207 where I<key> is one of:
209 B<duration>:I<value> switch to the next file after I<value> seconds have
210 elapsed, even if the current file is not completely filled up.
212 B<filesize>:I<value> switch to the next file after it reaches a size of
213 I<value> kilobytes (where a kilobyte is 1024 bytes).
215 B<files>:I<value> begin again with the first file after I<value> number of
216 files were written (form a ring buffer).
218 =item -B E<lt>capture buffer size (Win32 only)E<gt>
220 Win32 only: set capture buffer size (in MB, default is 1MB). This is used by the
221 the capture driver to buffer packet data until that data can be written to
222 disk. If you encounter packet drops while capturing, try to increase this size.
224 =item -c E<lt>capture packet countE<gt>
226 Set the maximum number of packets to read when capturing live
231 Print a list of the interfaces on which B<Wireshark> can capture, and
232 exit. For each network interface, a number and an
233 interface name, possibly followed by a text description of the
234 interface, is printed. The interface name or the number can be supplied
235 to the B<-i> flag to specify an interface on which to capture.
237 This can be useful on systems that don't have a command to list them
238 (e.g., Windows systems, or UNIX systems lacking B<ifconfig -a>);
239 the number can be useful on Windows 2000 and later systems, where the
240 interface name is a somewhat complex string.
242 Note that "can capture" means that B<Wireshark> was able to open
243 that device to do a live capture; if, on your system, a program doing a
244 network capture must be run from an account with special privileges (for
245 example, as root), then, if B<Wireshark> is run with the B<-D> flag and
246 is not run from such an account, it will not list any interfaces.
248 =item -f E<lt>capture filterE<gt>
250 Set the capture filter expression.
252 =item -g E<lt>packet numberE<gt>
254 After reading in a capture file using the B<-r> flag, go to the given I<packet number>.
258 Print the version and options and exit.
262 Hide the capture info dialog during live packet capture.
264 =item -i E<lt>capture interfaceE<gt>|-
266 Set the name of the network interface or pipe to use for live packet
269 Network interface names should match one of the names listed in
270 "B<wireshark -D>" (described above); a number, as reported by
271 "B<wireshark -D>", can also be used. If you're using UNIX, "B<netstat
272 -i>" or "B<ifconfig -a>" might also work to list interface names,
273 although not all versions of UNIX support the B<-a> flag to B<ifconfig>.
275 If no interface is specified, B<Wireshark> searches the list of
276 interfaces, choosing the first non-loopback interface if there are any
277 non-loopback interfaces, and choosing the first loopback interface if
278 there are no non-loopback interfaces. If there are no interfaces at all,
279 B<Wireshark> reports an error and doesn't start the capture.
281 Pipe names should be either the name of a FIFO (named pipe) or ``-'' to
282 read data from the standard input. Data read from pipes must be in
283 standard libpcap format.
285 Note: the Win32 version of B<Wireshark> doesn't support capturing from
290 Start the capture session immediately. If the B<-i> flag was
291 specified, the capture uses the specified interface. Otherwise,
292 B<Wireshark> searches the list of interfaces, choosing the first
293 non-loopback interface if there are any non-loopback interfaces, and
294 choosing the first loopback interface if there are no non-loopback
295 interfaces; if there are no interfaces, B<Wireshark> reports an error and
296 doesn't start the capture.
300 Turn on automatic scrolling if the packet display is being updated
301 automatically as packets arrive during a capture (as specified by the
306 List the data link types supported by the interface and exit.
308 =item -m E<lt>fontE<gt>
310 Set the name of the font used by B<Wireshark> for most text. B<Wireshark>
311 will construct the name of the bold font used for the data in the byte
312 view pane that corresponds to the field selected in the packet details
313 pane from the name of the main text font.
317 Disable network object name resolution (such as hostname, TCP and UDP port
318 names), the B<-N> flag might override this one.
320 =item -N E<lt>name resolving flagsE<gt>
322 Turn on name resolving only for particular types of addresses and port
323 numbers, with name resolving for other types of addresses and port
324 numbers turned off. This flag overrides B<-n> if both B<-N> and B<-n> are
325 present. If both B<-N> and B<-n> flags are not present, all name resolutions are
328 The argument is a string that may contain the letters:
330 B<m> to enable MAC address resolution
332 B<n> to enable network address resolution
334 B<t> to enable transport-layer port number resolution
336 B<C> to enable concurrent (asynchronous) DNS lookups
338 =item -o E<lt>preference/recent settingE<gt>
340 Set a preference or recent value, overriding the default value and any value
341 read from a preference/recent file. The argument to the flag is a string of
342 the form I<prefname>B<:>I<value>, where I<prefname> is the name of the
343 preference/recent value (which is the same name that would appear in the
344 preference/recent file), and I<value> is the value to which it should be set.
345 Since B<Wireshark> 0.10.12, the recent settings replaces the formerly used
346 -B, -P and -T flags to manipulate the GUI dimensions.
350 I<Don't> put the interface into promiscuous mode. Note that the
351 interface might be in promiscuous mode for some other reason; hence,
352 B<-p> cannot be used to ensure that the only traffic that is captured is
353 traffic sent to or from the machine on which B<Wireshark> is running,
354 broadcast traffic, and multicast traffic to addresses received by that
359 Cause B<Wireshark> to exit after the end of capture session (useful in
360 batch mode with B<-c> option for instance); this option requires the
361 B<-i> and B<-w> parameters.
363 =item -r E<lt>infileE<gt>
365 Read packet data from I<infile>, can be any supported capture file format
366 (including gzipped files). It's not possible to use named pipes or stdin
369 =item -R E<lt>read (display) filterE<gt>
371 When reading a capture file specified with the B<-r> flag, causes the
372 specified filter (which uses the syntax of display filters, rather than
373 that of capture filters) to be applied to all packets read from the
374 capture file; packets not matching the filter are discarded.
378 Automatically update the packet display as packets are coming in.
380 =item -s E<lt>capture snaplenE<gt>
382 Set the default snapshot length to use when capturing live data.
383 No more than I<snaplen> bytes of each network packet will be read into
384 memory, or saved to disk.
388 Set the format of the packet timestamp displayed in the packet list
389 window, the default is relative. The format can be one of:
391 B<ad> absolute with date: The absolute date and time is the actual time and
392 date the packet was captured
394 B<a> absolute: The absolute time is the actual time the packet was captured,
395 with no date displayed
397 B<r> relative: The relative time is the time elapsed between the first packet
398 and the current packet
400 B<d> delta: The delta time is the time since the previous packet was
405 Print the version and exit.
407 =item -w E<lt>outfileE<gt>
409 Set the default capture file name.
411 =item -y E<lt>capture link typeE<gt>
413 If a capture is started from the command line with B<-k>, set the data
414 link type to use while capturing packets. The values reported by B<-L>
415 are the values that can be used.
417 =item -X E<lt>eXtension optionsE<gt>
419 Specify an option to be passed to an B<Wireshark> module. The eXtension option
420 is in the form I<extension_key>B<:>I<value>, where I<extension_key> can be:
422 B<lua_script>:I<lua_script_filename> tells B<Wireshark> to load the given script in addition to the
426 =item -z E<lt>statisticsE<gt>
428 Get B<Wireshark> to collect various types of statistics and display the result
429 in a window that updates in semi-real time.
430 Currently implemented statistics are:
432 B<-z> dcerpc,srt,I<uuid>,I<major>.I<minor>[,I<filter>]
434 Collect call/reply SRT (Service Response Time) data for DCERPC interface I<uuid>,
435 version I<major>.I<minor>.
436 Data collected is number of calls for each procedure, MinSRT, MaxSRT
438 Example: use B<-z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0> to collect data for CIFS SAMR Interface.
439 This option can be used multiple times on the command line.
441 If the optional filterstring is provided, the stats will only be calculated
442 on those calls that match that filter.
443 Example: use B<-z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4> to collect SAMR
444 SRT statistics for a specific host.
448 Collect packet/bytes statistics for the capture in intervals of 1 seconds.
449 This option will open a window with up to 5 color-coded graphs where
450 number-of-packets-per-second or number-of-bytes-per-second statistics
451 can be calculated and displayed.
453 This option can be used multiple times on the command line.
455 This graph window can also be opened from the Analyze:Statistics:Traffic:IO-Stat
459 B<-z> rpc,srt,I<program>,I<version>[,<filter>]
461 Collect call/reply SRT (Service Response Time) data for I<program>/I<version>. Data collected
462 is number of calls for each procedure, MinSRT, MaxSRT and AvgSRT.
463 Example: use B<-z rpc,srt,100003,3> to collect data for NFS v3. This
464 option can be used multiple times on the command line.
466 If the optional filter string is provided, the stats will only be calculated
467 on those calls that match that filter.
468 Example: use B<-z rpc,srt,100003,3,nfs.fh.hash==0x12345678> to collect NFS v3
469 SRT statistics for a specific file.
473 Collect call/reply RTT data for all known ONC-RPC programs/versions.
474 Data collected is number of calls for each protocol/version, MinRTT,
477 B<-z> scsi,srt,I<cmdset>[,<filter>]
479 Collect call/reply SRT (Service Response Time) data for SCSI commandset <cmdset>.
481 Commandsets are 0:SBC 1:SSC 5:MMC
485 is number of calls for each procedure, MinSRT, MaxSRT and AvgSRT.
486 Example: use B<-z scsi,srt,0> to collect data for SCSI BLOCK COMMANDS (SBC). This
487 option can be used multiple times on the command line.
489 If the optional filter string is provided, the stats will only be calculated
490 on those calls that match that filter.
491 Example: use B<-z scsi,srt,0,ip.addr==1.2.3.4> to collect SCSI SBC
492 SRT statistics for a specific iscsi/ifcp/fcip host.
494 B<-z> smb,srt[,I<filter>]
496 Collect call/reply SRT (Service Response Time) data for SMB. Data collected
497 is number of calls for each SMB command, MinSRT, MaxSRT and AvgSRT.
498 Example: use B<-z smb,srt>.
500 The data will be presented as separate tables for all normal SMB commands,
501 all Transaction2 commands and all NT Transaction commands.
502 Only those commands that are seen in the capture will have its stats
504 Only the first command in a xAndX command chain will be used in the
505 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
506 only the SessionSetupAndX call will be used in the statistics.
507 This is a flaw that might be fixed in the future.
509 This option can be used multiple times on the command line.
511 If the optional filterstring is provided, the stats will only be calculated
512 on those calls that match that filter.
513 Example: use B<-z "smb,srt,ip.addr==1.2.3.4"> to only collect stats for
514 SMB packets echanged by the host at IP address 1.2.3.4 .
516 B<-z> fc,srt[,I<filter>]
518 Collect call/reply SRT (Service Response Time) data for FC. Data collected
519 is number of calls for each Fibre Channel command, MinSRT, MaxSRT and AvgSRT.
520 Example: use B<-z fc,srt>.
521 The Service Response Time is calculated as the time delta between the
522 First packet of the exchange and the Last packet of the exchange.
524 The data will be presented as separate tables for all normal FC commands,
525 Only those commands that are seen in the capture will have its stats
528 This option can be used multiple times on the command line.
530 If the optional filterstring is provided, the stats will only be calculated
531 on those calls that match that filter.
532 Example: use B<-z "fc,srt,fc.id==01.02.03"> to only collect stats for
533 FC packets echanged by the host at FC address 01.02.03 .
535 B<-z> ldap,srt[,I<filter>]
537 Collect call/reply SRT (Service Response Time) data for LDAP. Data collected
538 is number of calls for each implemented LDAP command, MinSRT, MaxSRT and AvgSRT.
539 Example: use B<-z ldap,srt>.
540 The Service Response Time is calculated as the time delta between the
541 Request and the Response.
543 The data will be presented as separate tables for all implemented LDAP commands,
544 Only those commands that are seen in the capture will have its stats
547 This option can be used multiple times on the command line.
549 If the optional filterstring is provided, the stats will only be calculated
550 on those calls that match that filter.
551 Example: use B<-z "ldap,srt,ip.addr==10.1.1.1"> to only collect stats for
552 LDAP packets echanged by the host at IP address 10.1.1.1 .
554 The only LDAP command that are currently implemented and the stats will be available for are:
565 B<-z> mgcp,srt[I<,filter>]
567 Collect requests/response SRT (Service Response Time) data for MGCP.
568 This is similar to B<-z smb,srt>). Data collected is number of calls
569 for each known MGCP Type, Minimum SRT, Maximum SRT and Average SRT.
570 Example: use B<-z mgcp,srt>.
572 This option can be used multiple times on the command line.
574 If the optional filterstring is provided, the stats will only be calculated
575 on those calls that match that filter.
576 Example: use B<-z "mgcp,srt,ip.addr==1.2.3.4"> to only collect stats for
577 MGCP packets exchanged by the host at IP address 1.2.3.4 .
579 B<-z> conv,I<type>[,I<filter>]
581 Create a table that lists all conversations that could be seen in the
582 capture. I<type> specifies for which type of conversation we want to
583 generate the statistics; currently the supported ones are
586 "fc" Fibre Channel addresses
587 "fddi" FDDI addresses
590 "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported
592 "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported
594 If the optional filter string is specified, only those packets that match the
595 filter will be used in the calculations.
597 The table is presented with one line for each conversation and displays
598 number of packets/bytes in each direction as well as total number of
599 packets/bytes. By default, the table is sorted according to total number
602 These tables can also be generated at runtime by selecting the appropriate
603 conversation type from the menu "Tools/Statistics/Conversation List/".
605 B<-z> h225,counter[I<,filter>]
607 Count ITU-T H.225 messages and their reasons. In the first column you get a
608 list of H.225 messages and H.225 message reasons, which occur in the current
609 capture file. The number of occurences of each message or reason is displayed
610 in the second column.
612 Example: use B<-z h225,counter>.
614 This option can be used multiple times on the command line.
616 If the optional filterstring is provided, the stats will only be calculated
617 on those calls that match that filter.
618 Example: use B<-z "h225,counter,ip.addr==1.2.3.4"> to only collect stats for
619 H.225 packets exchanged by the host at IP address 1.2.3.4 .
622 B<-z> h225,srt[I<,filter>]
624 Collect requests/response SRT (Service Response Time) data for ITU-T H.225 RAS.
625 Data collected is number of calls of each ITU-T H.225 RAS Message Type,
626 Minimum SRT, Maximum SRT, Average SRT, Minimum in Packet, and Maximum in Packet.
627 You will also get the number of Open Requests (Unresponded Requests),
628 Discarded Responses (Responses without matching request) and Duplicate Messages.
629 Example: use B<-z h225,srt>.
631 This option can be used multiple times on the command line.
633 If the optional filterstring is provided, the stats will only be calculated
634 on those calls that match that filter.
635 Example: use B<-z "h225,srt,ip.addr==1.2.3.4"> to only collect stats for
636 ITU-T H.225 RAS packets exchanged by the host at IP address 1.2.3.4 .
638 B<-z> sip,stat[I<,filter>]
640 This option will activate a counter for SIP messages. You will get the number
641 of occurences of each SIP Method and of each SIP Status-Code. Additionally you
642 also get the number of resent SIP Messages (only for SIP over UDP).
644 Example: use B<-z sip,stat>.
646 This option can be used multiple times on the command line.
648 If the optional filter string is provided, the stats will only be calculated
649 on those calls that match that filter.
650 Example: use B<-z "sip,stat,ip.addr==1.2.3.4"> to only collect stats for
651 SIP packets exchanged by the host at IP address 1.2.3.4 .
663 =item File:Open Recent
667 Open or close a capture file. The I<File:Open> dialog box
668 allows a filter to be specified; when the capture file is read, the
669 filter is applied to all packets read from the file, and packets not
670 matching the filter are discarded. The I<File:Open Recent> is a submenu
671 and will show a list of previously opened files.
675 Merge another capture file to the currently loaded one. The I<File:Merge>
676 dialog box allows the merge "Prepended", "Chronologically" or "Appended",
677 relative to the already loaded one.
683 Save the current capture, or the packets currently displayed from that
684 capture, to a file. Check boxes let you select whether to save all
685 packets, or just those that have passed the current display filter and/or
686 those that are currently marked, and an option menu lets you select (from
687 a list of file formats in which at particular capture, or the packets
688 currently displayed from that capture, can be saved), a file format in
691 =item File:File Set:List Files
693 Show a dialog box that list all files of the file set matching the currently
694 loaded file. A file set is a compound of files resulting from a capture using
695 the "multiple files" / "ringbuffer" mode, recognizable by the filename pattern,
696 e.g.: Filename_00001_20050604101530.pcap.
698 =item File:File Set:Next File
700 =item File:File Set:Previous File
702 If the currently loaded file is part of a file set (see above), open the
703 next / previous file in that set.
707 Export captured data into an external format. Note: the data cannot be
708 imported back into Wireshark, so be sure to keep the capture file.
712 Print packet data from the current capture. You can select the range of
713 packets to be printed (which packets are printed), and the output format of
714 each packet (how each packet is printed). The output format will be similar
715 to the displayed values, so a summary line, the packet details view, and/or
716 the hex dump of the packet can be printed.
718 Printing options can be set with the I<Edit:Preferences> menu item, or in the
719 dialog box popped up by this menu item.
723 Exit the application.
725 =item Edit:Find Packet
727 Search forward or backward, starting with the currently selected packet
728 (or the most recently selected packet, if no packet is selected). Search
729 criteria can be a display filter expression, a string of hexadecimal
730 digits, or a text string.
732 When searching for a text string, you can search the packet data, or you
733 can search the text in the Info column in the packet list pane or in the
736 Hexadecimal digits can be separated by colons, periods, or dashes.
737 Text string searches can be ASCII or Unicode (or both), and may be
742 =item Edit:Find Previous
744 Search forward / backward for a packet matching the filter from the previous
745 search, starting with the currently selected packet (or the most recently
746 selected packet, if no packet is selected).
748 =item Edit:Time Reference:Set Time Reference (toggle)
750 Set (or unset if currently set) the selected packet as a Time Reference packet.
751 When a packet is set as a Time Reference packet, the timestamps in the packet
752 list pane will be replaced with the string "*REF*".
753 The relative time timestamp in later packets will then be calculated relative
754 to the timestamp of this Time Reference packet and not the first packet in
757 Packets that have been selected as Time Reference packets will always be
758 displayed in the packet list pane. Display filters will not affect or
761 If there is a column displayed for "Culmulative Bytes" this counter will
762 be reset at every Time Reference packet.
764 =item Edit:Time Reference:Find Next
766 =item Edit:Time Reference:Find Previous
768 Search forward / backward for a time referenced packet.
770 =item Edit:Mark Packet (toggle)
772 Mark (or unmark if currently marked) the selected packet. The field
773 "frame.marked" is set for packets that are marked, so that, for example,
774 a display filters can be used to display only marked packets, and so that
775 the L<Edit:Find Packet|/item_edit_3afind_packet> dialog can be used to find the next or previous
778 =item Edit:Mark All Packets
780 =item Edit:Unmark All Packets
782 Mark / Unmark all packets that are currently displayed.
784 =item Edit:Preferences
786 Set the GUI, capture, printing and protocol options
787 (see L<Preferences|/item_preferences> dialog below).
789 =item View:Main Toolbar
791 =item View:Filter Toolbar
795 Show or hide the main window controls.
797 =item View:Packet List
799 =item View:Packet Details
801 =item View:Packet Bytes
803 Show or hide the main window panes.
805 =item View:Time Display Format
807 Set the format of the packet timestamp displayed in the packet list window.
809 =item View:Name Resolution:Resolve Name
811 Try to resolve a name for the currently seleted item.
813 =item View:Name Resolution:Enable for ... Layer
815 Enable or disable translation of addresses to names in the display.
817 =item View:Colorize Packet List
819 Enable or disable the coloring rules. Disabling will improve performance.
821 =item View:Auto Scroll in Live Capture
823 Enable or disable the automatic scrolling of the
824 packet list while a live capture is in progress.
830 Zoom into / out of the main window data (by changing the font size).
832 =item View:Normal Size
834 Reset the zoom factor of zoom in / zoom out back to normal font size.
836 =item View:Resize All Columns
838 Resize all columns to best fit the current packet display.
840 =item View:Expand Subtrees
842 Expands the currently selected item and it's subtrees in the packet details.
844 =item View:Expand All
846 =item View:Collapse All
848 Expand / Collapse all branches of the packet details.
850 =item View:Coloring Rules
852 Change the foreground and background colors of the packet information in
853 the list of packets, based upon display filters. The list of display
854 filters is applied to each packet sequentially. After the first display
855 filter matches a packet, any additional display filters in the list are
856 ignored. Therefore, if you are filtering on the existence of protocols,
857 you should list the higher-level protocols first, and the lower-level
862 =item How Colorization Works
864 Packets are colored according to a list of color filters. Each filter
865 consists of a name, a filter expression and a coloration. A packet is
866 colored according to the first filter that it matches. Color filter
867 expressions use exactly the same syntax as display filter expressions.
869 When Wireshark starts, the color filters are loaded from:
873 1. The user's personal color filters file or, if that does not exist,
875 2. The global color filters file.
879 If neither of these exist then the packets will not be colored.
883 =item View:Show Packet In New Window
885 Create a new window containing a packet details view and a hex dump
886 window of the currently selected packet; this window will continue to
887 display that packet's details and data even if another packet is
892 Reload a capture file. Same as I<File:Close> and I<File:Open> the same
897 Go back in previously visited packets history.
901 Go forward in previously visited packets history.
903 =item Go:Go To Packet
905 Go to a particular numbered packet.
907 =item Go:Go To Corresponding Packet
909 If a field in the packet details pane containing a packet number is
910 selected, go to the packet number specified by that field. (This works
911 only if the dissector that put that entry into the packet details put it
912 into the details as a filterable field rather than just as text.) This
913 can be used, for example, to go to the packet for the request
914 corresponding to a reply, or the reply corresponding to a request, if
915 that packet number has been put into the packet details.
917 =item Go:First Packet
921 Go to the first / last packet in the capture.
923 =item Capture:Interfaces
925 Shows a dialog box with all currently known interfaces and displaying the
926 current network traffic amount. Capture sessions can be started from here.
927 Beware: keeping this box open results in high system load!
929 =item Capture:Options
931 Initiate a live packet capture (see L<Capture Options|/item_capture_options>
932 dialog below). If no filename is specified, a temporary file will be created
933 to hold the capture. The location of the file can be chosen by setting your
934 TMPDIR environment variable before starting B<Wireshark>. Otherwise, the
935 default TMPDIR location is system-dependent, but is likely either F</var/tmp>
940 Start a live packet capture with the previously seleted options. This won't
941 open the options dialog box, and can be convenient for repeatingly capturing
942 with the same options.
946 Stop a running live capture.
948 =item Capture:Restart
950 While a live capture is running, stop it and restart with the same options
951 again. This can be convenient to remove unrelevant packets, if no valuable
952 packets were captured so far.
954 =item Capture:Capture Filters
956 Edit the saved list of capture filters, allowing filters to be added,
959 =item Analyze:Display Filters
961 Edit the saved list of display filters, allowing filters to be added,
964 =item Analyze:Apply as Filter
966 Create a display filter, or add to the display filter strip at the
967 bottom, a display filter based on the data currently highlighted in the
968 packe details, and apply the filter.
970 If that data is a field that can be tested in a display filter
971 expression, the display filter will test that field; otherwise, the
972 display filter will be based on absolute offset within the packet, and
973 so could be unreliable if the packet contains protocols with
974 variable-length headers, such as a source-routed token-ring packet.
976 The B<Selected> option creates a display filter that tests for a match
977 of the data; the B<Not Selected> option creates a display filter that
978 tests for a non-match of the data. The B<And Selected>, B<Or Selected>,
979 B<And Not Selected>, and B<Or Not Selected> options add to the end of
980 the display filter in the strip at the bottom an AND or OR operator
981 followed by the new display filter expression.
983 =item Analyze:Prepare a Filter
985 Create a display filter, or add to the display filter strip at the
986 bottom, a display filter based on the data currently highlighted in the
987 packet details, but don't apply the filter.
989 =item Analyze:Enabled Protocols
991 Allow protocol dissection to be enabled or disabled for a specific
992 protocol. Individual protocols can be enabled or disabled by clicking
993 on them in the list or by highlighting them and pressing the space bar.
994 The entire list can be enabled, disabled, or inverted using the buttons
997 When a protocol is disabled, dissection in a particular packet stops
998 when that protocol is reached, and Wireshark moves on to the next packet.
999 Any higher-layer protocols that would otherwise have been processed will
1000 not be displayed. For example, disabling TCP will prevent the dissection
1001 and display of TCP, HTTP, SMTP, Telnet, and any other protocol exclusively
1004 The list of protocols can be saved, so that Wireshark will start up with
1005 the protocols in that list disabled.
1007 =item Analyze:Decode As
1009 If you have a packet selected, present a dialog allowing you to change
1010 which dissectors are used to decode this packet. The dialog has one
1011 panel each for the link layer, network layer and transport layer
1012 protocol/port numbers, and will allow each of these to be changed
1013 independently. For example, if the selected packet is a TCP packet to
1014 port 12345, using this dialog you can instruct Wireshark to decode all
1015 packets to or from that TCP port as HTTP packets.
1017 =item Analyze:User Specified Decodes
1019 Create a new window showing whether any protocol ID to dissector
1020 mappings have been changed by the user. This window also allows the
1021 user to reset all decodes to their default values.
1023 =item Analyze:Follow TCP Stream
1025 If you have a TCP packet selected, display the contents of the data
1026 stream for the TCP connection to which that packet belongs, as text, in
1027 a separate window, and leave the list of packets in a filtered state,
1028 with only those packets that are part of that TCP connection being
1029 displayed. You can revert to your old view by pressing ENTER in the
1030 display filter text box, thereby invoking your old display filter (or
1031 resetting it back to no display filter).
1033 The window in which the data stream is displayed lets you select:
1039 whether to display the entire conversation, or one or the other side of
1044 whether the data being displayed is to be treated as ASCII or EBCDIC
1045 text or as raw hex data;
1049 and lets you print what's currently being displayed, using the same
1050 print options that are used for the I<File:Print Packet> menu item, or
1051 save it as text to a file.
1053 =item Statistics:Summary
1055 Show summary information about the capture, including elapsed time,
1056 packet counts, byte counts, and the like. If a display filter is in
1057 effect, summary information will be shown about the capture and about
1058 the packets currently being displayed.
1060 =item Statistics:Protocol Hierarchy
1062 Show the number of packets, and the number of bytes in those packets,
1063 for each protocol in the trace. It organizes the protocols in the same
1064 hierarchy in which they were found in the trace. Besides counting the
1065 packets in which the protocol exists, a count is also made for packets
1066 in which the protocol is the last protocol in the stack. These
1067 last-protocol counts show you how many packets (and the byte count
1068 associated with those packets) B<ended> in a particular protocol. In
1069 the table, they are listed under "End Packets" and "End Bytes".
1071 =item Statistics:IO Graphs
1073 Open a window where up to 5 graphs in different colors can be displayed
1074 to indicate number of packets or number of bytes per second for all packets
1075 matching the specified filter.
1076 By default only one graph will be displayed showing number of packets per second.
1078 The top part of the window contains the graphs and scales for the X and
1079 Y axis. If the graph is too long to fit inside the window there is a
1080 horizontal scrollbar below the drawing area that can scroll the graphs
1081 to the left or the right. The horizontal axis displays the time into
1082 the capture and the vertical axis will display the measured quantity at
1085 Below the drawing area and the scrollbar are the controls. On the
1086 bottom left there will be five similar sets of controls to control each
1087 induvidual graph such as "Display:<button>" which button will toggle
1088 that individual graph on/off. If <button> is ticked, the graph will be
1089 displayed. "Color:<color>" which is just a button to show which color
1090 will be used to draw that graph (color is only available in Gtk2
1091 version) and finally "Filter:<filter-text>" which can be used to specify
1092 a display filter for that particular graph.
1094 If filter-text is empty then all packets will be used to calculate the
1095 quantity for that graph. If filter-text is specified only those packets
1096 that match that display filter will be considered in the calculation of
1099 To the right of the 5 graph controls there are four menus to control
1100 global aspects of the draw area and graphs. The "Unit:" menu is used to
1101 control what to measure; "packets/tick", "bytes/tick" or "advanced..."
1103 packets/tick will measure the number of packets matching the (if
1104 specified) display filter for the graph in each measurement interval.
1106 bytes/tick will measure the total number of bytes in all packets matching
1107 the (if specified) display filter for the graph in each measurement
1110 advanced... see below
1112 "Tick interval:" specifies what measurement intervals to use. The
1113 default is 1 second and means that the data will be counted over 1
1116 "Pixels per tick:" specifies how many pixels wide each measurement
1117 interval will be in the drawing area. The default is 5 pixels per tick.
1119 "Y-scale:" controls the max value for the y-axis. Default value is
1120 "auto" which means that B<Wireshark> will try to adjust the maxvalue
1123 "advanced..." If Unit:advanced... is selected the window will display
1124 two more controls for each of the five graphs. One control will be a
1125 menu where the type of calculation can be selected from
1126 SUM,COUNT,MAX,MIN,AVG and LOAD, and one control, textbox, where the name of a
1127 single display filter field can be specified.
1129 The following restrictions apply to type and field combinations:
1131 SUM: available for all types of integers and will calculate the SUM of
1132 all occurences of this field in the measurement interval. Note that
1133 some field can occur multiple times in the same packet and then all
1134 instances will be summed up. Example: 'tcp.len' which will count the
1135 amount of payload data transferred across TCP in each interval.
1137 COUNT: available for all field types. This will COUNT the number of times
1138 certain field occurs in each interval. Note that some fields
1139 may occur multiple times in each packet and if that is the case
1140 then each instance will be counted independently and COUNT
1141 will be greater than the number of packets.
1143 MAX: available for all integer and relative time fields. This will calculate
1144 the max seen integer/time value seen for the field during the interval.
1145 Example: 'smb.time' which will plot the maximum SMB response time.
1147 MIN: available for all integer and relative time fields. This will calculate
1148 the min seen integer/time value seen for the field during the interval.
1149 Example: 'smb.time' which will plot the minimum SMB response time.
1151 AVG: available for all integer and relative time fields.This will
1152 calculate the average seen integer/time value seen for the field during
1153 the interval. Example: 'smb.time' which will plot the average SMB
1156 LOAD: available only for relative time fields (response times).
1158 Example of advanced:
1159 Display how NFS response time MAX/MIN/AVG changes over time:
1163 filter:nfs&&rpc.time
1168 filter:nfs&&rpc.time
1173 filter:nfs&&rpc.time
1176 Example of advanced:
1177 Display how the average packet size from host a.b.c.d changes over time.
1181 filter:ip.addr==a.b.c.d&&frame.pkt_len
1182 Calc:AVG frame.pkt_len
1185 The LOAD io-stat type is very different from anything you have ever seen
1186 before! While the response times themself as plotted by MIN,MAX,AVG are
1187 indications on the Server load (which affects the Server response time),
1188 the LOAD measurement measures the Client LOAD.
1189 What this measures is how much workload the client generates,
1190 i.e. how fast will the client issue new commands when the previous ones
1192 i.e. the level of concurrency the client can maintain.
1193 The higher the number, the more and faster is the client issuing new
1194 commands. When the LOAD goes down, it may be due to client load making
1195 the client slower in issuing new commands (there may be other reasons as
1196 well, maybe the client just doesn't have any commands it wants to issue
1199 Load is measured in concurrency/number of overlapping i/o and the value
1200 1000 means there is a constant load of one i/o.
1202 In each tick interval the amount of overlap is measured.
1203 See the graph below containing three commands:
1204 Below the graph are the LOAD values for each interval that would be calculated.
1208 | | o=====* | | | | | |
1210 | o========* | o============* | | |
1212 --------------------------------------------------> Time
1213 500 1500 500 750 1000 500 0 0
1215 =item Statistics:Conversation List
1217 This option will open a new window that displays a list of all
1218 conversations between two endpoints. The list has one row for each
1219 unique conversation and displays total number of packets/bytes seen as
1220 well as number of packets/bytes in each direction.
1222 By default the list is sorted according to the number of packets but by
1223 clicking on the column header; it is possible to re-sort the list in
1224 ascending or descending order by any column.
1226 By first selecting a conversation by clicking on it and then using the
1227 right mouse button (on those platforms that have a right
1228 mouse button) wireshark will display a popup menu offering several different
1229 filter operations to apply to the capture.
1231 These statistics windows can also be invoked from the Wireshark command
1232 line using the B<-z conv> argument.
1234 =item Statistics:Service Response Time:DCE-RPC
1236 Open a window to display Service Response Time statistics for an
1237 arbitrary DCE-RPC program
1238 interface and display B<Procedure>, B<Number of Calls>, B<Minimum SRT>,
1239 B<Maximum SRT> and B<Average SRT> for all procedures for that
1240 program/version. These windows opened will update in semi-real time to
1241 reflect changes when doing live captures or when reading new capture
1242 files into B<Wireshark>.
1244 This dialog will also allow an optional filter string to be used.
1245 If an optional filter string is used only such DCE-RPC request/response pairs
1246 that match that filter will be used to calculate the statistics. If no filter
1247 string is specified all request/response pairs will be used.
1249 =item Statistics:Service Response Time:Fibre Channel
1251 Open a window to display Service Response Time statistics for Fibre Channel
1252 and display B<FC Type>, B<Number of Calls>, B<Minimum SRT>,
1253 B<Maximum SRT> and B<Average SRT> for all FC types.
1254 These windows opened will update in semi-real time to
1255 reflect changes when doing live captures or when reading new capture
1256 files into B<Wireshark>.
1257 The Service Response Time is calculated as the time delta between the
1258 First packet of the exchange and the Last packet of the exchange.
1260 This dialog will also allow an optional filter string to be used.
1261 If an optional filter string is used only such FC first/last exchange pairs
1262 that match that filter will be used to calculate the statistics. If no filter
1263 string is specified all request/response pairs will be used.
1265 =item Statistics:Service Response Time:ONC-RPC
1267 Open a window to display statistics for an arbitrary ONC-RPC program interface
1268 and display B<Procedure>, B<Number of Calls>, B<Minimum SRT>, B<Maximum SRT> and B<Average SRT> for all procedures for that program/version.
1269 These windows opened will update in semi-real time to reflect changes when
1270 doing live captures or when reading new capture files into B<Wireshark>.
1272 This dialog will also allow an optional filter string to be used.
1273 If an optional filter string is used only such ONC-RPC request/response pairs
1274 that match that filter will be used to calculate the statistics. If no filter
1275 string is specified all request/response pairs will be used.
1277 By first selecting a conversation by clicking on it and then using the
1278 right mouse button (on those platforms that have a right
1279 mouse button) wireshark will display a popup menu offering several different
1280 filter operations to apply to the capture.
1282 =item Statistics:Service Response Time:SMB
1284 Collect call/reply SRT (Service Response Time) data for SMB. Data collected
1285 is number of calls for each SMB command, MinSRT, MaxSRT and AvgSRT.
1287 The data will be presented as separate tables for all normal SMB commands,
1288 all Transaction2 commands and all NT Transaction commands.
1289 Only those commands that are seen in the capture will have its stats
1291 Only the first command in a xAndX command chain will be used in the
1292 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
1293 only the SessionSetupAndX call will be used in the statistics.
1294 This is a flaw that might be fixed in the future.
1296 You can apply an optional filter string in a dialog box, before starting
1297 the calculation. The stats will only be calculated
1298 on those calls matching that filter.
1300 By first selecting a conversation by clicking on it and then using the
1301 right mouse button (on those platforms that have a right
1302 mouse button) wireshark will display a popup menu offering several different
1303 filter operations to apply to the capture.
1305 =item Statistics:Service Response Time:MGCP
1307 Collect requests/response SRT (Service Response Time) data for MGCP.
1308 Data collected is B<number of calls> for each known MGCP Type,
1309 B<Minimum SRT>, B<Maximum SRT>, B<Average SRT>, B<Minimum in Packet>, and B<Maximum in Packet>.
1310 These windows opened will update in semi-real time to reflect changes when
1311 doing live captures or when reading new capture files into B<Wireshark>.
1313 You can apply an optional filter string in a dialog box, before starting
1314 the calculation. The statistics will only be calculated
1315 on those calls matching that filter.
1317 =item Statistics:Service Response Time:ITU-T H.225 RAS
1319 Collect requests/response SRT (Service Response Time) data for ITU-T H.225 RAS.
1320 Data collected is B<number of calls> for each known ITU-T H.225 RAS Message Type,
1321 B<Minimum SRT>, B<Maximum SRT>, B<Average SRT>, B<Minimum in Packet>, and B<Maximum in Packet>.
1322 You will also get the number of B<Open Requests> (Unresponded Requests),
1323 B<Discarded Responses> (Responses without matching request) and Duplicate Messages.
1324 These windows opened will update in semi-real time to reflect changes when
1325 doing live captures or when reading new capture files into B<Wireshark>.
1327 You can apply an optional filter string in a dialog box, before starting
1328 the calculation. The statistics will only be calculated
1329 on those calls matching that filter.
1331 =item Statistics:ITU-T H.225
1333 Count ITU-T H.225 messages and their reasons. In the first column you get a
1334 list of H.225 messages and H.225 message reasons, which occur in the current
1335 capture file. The number of occurences of each message or reason will be displayed
1336 in the second column.
1337 This window opened will update in semi-real time to reflect changes when
1338 doing live captures or when reading new capture files into B<Wireshark>.
1340 You can apply an optional filter string in a dialog box, before starting
1341 the counter. The statistics will only be calculated
1342 on those calls matching that filter.
1344 =item Statistics:SIP
1346 Activate a counter for SIP messages. You will get the number of occurences of each
1347 SIP Method and of each SIP Status-Code. Additionally you also get the number of
1348 resent SIP Messages (only for SIP over UDP).
1350 This window opened will update in semi-real time to reflect changes when
1351 doing live captures or when reading new capture files into B<Wireshark>.
1353 You can apply an optional filter string in a dialog box, before starting
1354 the counter. The statistics will only be calculated
1355 on those calls matching that filter.
1357 =item Statistics:ONC-RPC Programs
1359 This dialog will open a window showing aggregated RTT statistics for all
1360 ONC-RPC Programs/versions that exist in the capture file.
1366 =item Help:Supported Protocols
1368 List of supported protocols and display filter protocol fields.
1370 =item Help:Manual Pages
1372 Display locally installed HTML versions of these manual pages in a web browser.
1374 =item Help:Wireshark Online
1376 Various links to online resources to be open in a web browser, like
1377 L<http://www.wireshark.org>.
1379 =item Help:About Wireshark
1381 See various information about Wireshark (see L<About|/item_about> dialog below), like the
1382 version, the folders used, the available plugins, ...
1392 The main window contains the usual things like the menu, some toolbars, the
1393 main area and a statusbar. The main area is split into three panes, you can
1394 resize each pane using a "thumb" at the right end of each divider line.
1396 The main window is much more flexible than before. The layout of the main
1397 window can be customized by the I<Layout> page in the dialog box popped
1398 up by I<Edit:Preferences>, the following will describe the layout with the
1405 Some menu items are available for quick access here. There is no way to
1406 customize the items in the toolbar, however the toolbar can be hidden by
1407 I<View:Main Toolbar>.
1409 =item Filter Toolbar
1411 A display filter can be entered into the filter toolbar.
1412 A filter for HTTP, HTTPS, and DNS traffic might look like this:
1414 tcp.port == 80 || tcp.port == 443 || tcp.port == 53
1416 Selecting the I<Filter:> button lets you choose from a list of named
1417 filters that you can optionally save. Pressing the Return or Enter
1418 keys, or selecting the I<Apply> button, will cause the filter to be
1419 applied to the current list of packets. Selecting the I<Reset> button
1420 clears the display filter so that all packets are displayed (again).
1422 There is no way to customize the items in the toolbar, however the toolbar
1423 can be hidden by I<View:Filter Toolbar>.
1425 =item Packet List Pane
1427 The top pane contains the list of network packets that you can scroll
1428 through and select. By default, the packet number, packet timestamp,
1429 source and destination addresses, protocol, and description are
1430 displayed for each packet; the I<Columns> page in the dialog box popped
1431 up by I<Edit:Preferences> lets you change this (although, unfortunately,
1432 you currently have to save the preferences, and exit and restart
1433 Wireshark, for those changes to take effect).
1435 If you click on the heading for a column, the display will be sorted by
1436 that column; clicking on the heading again will reverse the sort order
1439 An effort is made to display information as high up the protocol stack
1440 as possible, e.g. IP addresses are displayed for IP packets, but the
1441 MAC layer address is displayed for unknown packet types.
1443 The right mouse button can be used to pop up a menu of operations.
1445 The middle mouse button can be used to mark a packet.
1447 =item Packet Details Pane
1449 The middle pane contains a display of the details of the
1450 currently-selected packet. The display shows each field and its value
1451 in each protocol header in the stack. The right mouse button can be
1452 used to pop up a menu of operations.
1454 =item Packet Bytes Pane
1456 The lowest pane contains a hex and ASCII dump of the actual packet data.
1457 Selecting a field in the packet details highlights the corresponding
1458 bytes in this section.
1460 The right mouse button can be used to pop up a menu of operations.
1464 The statusbar is divided into two parts, on the left some context dependant
1465 things are shown, like information about the loaded file, on the right the
1466 number of packets are displayed: P = Packets captured/loaded, D = Displayed
1467 in packet list (after filtering), M = Marked by user.
1469 The statusbar can be hidden by I<View:Statusbar>.
1475 The I<Preferences> dialog lets you control various personal preferences
1476 for the behavior of B<Wireshark>.
1480 =item User Interface Preferences
1482 The I<User Interface> page is used to modify small aspects of the GUI to
1483 your own personal taste:
1489 The vertical scrollbars in the three panes can be set to be either on
1490 the left or the right.
1492 =item Selection Bars
1494 The selection bar in the packet list and packet details can have either
1495 a "browse" or "select" behavior. If the selection bar has a "browse"
1496 behavior, the arrow keys will move an outline of the selection bar,
1497 allowing you to browse the rest of the list or details without changing
1498 the selection until you press the space bar. If the selection bar has a
1499 "select" behavior, the arrow keys will move the selection bar and change
1500 the selection to the new item in the packet list or packet details.
1502 =item Tree Line Style
1504 Trees can be drawn with no lines, solid lines, or dotted lines between
1505 items, or can be drawn with "tab" headings.
1507 =item Tree Expander Style
1509 The expander item that can be clicked to show or hide items under a tree
1510 item can be omitted (note that this will prevent you from changing
1511 whether those items are shown or hidden!), or can be drawn as squares,
1512 triangles, or circles.
1516 The highlight method in the hex dump display for the selected protocol
1517 item can be set to use either inverse video, or bold characters.
1519 =item Save Window Position
1521 If this item is selected, the position of the main Wireshark window will
1522 be saved when Wireshark exits, and used when Wireshark is started again.
1524 =item Save Window Size
1526 If this item is selected, the size of the main Wireshark window will
1527 be saved when Wireshark exits, and used when Wireshark is started again.
1529 =item File Open Dialog Behavior
1531 This item allows the user to select how Wireshark handles the listing
1532 of the "File Open" Dialog when opening trace files. "Remember Last
1533 Directory" causes Wireshark to automatically position the dialog in the
1534 directory of the most recently opened file, even between launches of Wireshark.
1535 "Always Open in Directory" allows the user to define a persistent directory
1536 that the dialog will always default to.
1540 Allows the user to specify a persistent File Open directory. Trailing
1541 slashes or backslashes will automatically be added.
1545 =item Layout Preferences
1547 The I<Layout> page lets you specify the general layout of the main window.
1548 You can choose from six different layouts and fill the three panes with the
1551 =item Column Preferences
1553 The I<Columns> page lets you specify the number, title, and format
1554 of each column in the packet list.
1556 The I<Column title> entry is used to specify the title of the column
1557 displayed at the top of the packet list. The type of data that the column
1558 displays can be specified using the I<Column format> option menu.
1559 The row of buttons on the left perform the following actions:
1565 Adds a new column to the list.
1569 Deletes the currently selected list item.
1573 Moves the selected list item up or down one position.
1577 =item Font Preferences
1579 The I<Font> page lets you select the font to be used for most text.
1581 =item Color Preferences
1583 The I<Colors> page can be used to change the color of the text
1584 displayed in the TCP stream window and for marked packets. To change a color,
1585 simply select an attribute from the "Set:" menu and use the color selector to
1586 get the desired color. The new text colors are displayed as a sample text.
1588 =item Capture Preferences
1590 The I<Capture> page lets you specify various parameters for capturing
1591 live packet data; these are used the first time a capture is started.
1593 The I<Interface:> combo box lets you specify the interface from which to
1594 capture packet data, or the name of a FIFO from which to get the packet
1597 The I<Data link type:> option menu lets you, for some interfaces, select
1598 the data link header you want to see on the packets you capture. For
1599 example, in some OSes and with some versions of libpcap, you can choose,
1600 on an 802.11 interface, whether the packets should appear as Ethernet
1601 packets (with a fake Ethernet header) or as 802.11 packets.
1603 The I<Limit each packet to ... bytes> check box lets you set the
1604 snapshot length to use when capturing live data; turn on the check box,
1605 and then set the number of bytes to use as the snapshot length.
1607 The I<Filter:> text entry lets you set a capture filter expression to be
1608 used when capturing.
1610 If any of the environment variables SSH_CONNECTION, SSH_CLIENT,
1611 REMOTEHOST, DISPLAY, or CLIENTNAME are set, Wireshark will create a
1612 default capture filter that excludes traffic from the hosts and ports
1613 defined in those variables.
1615 The I<Capture packets in promiscuous mode> check box lets you specify
1616 whether to put the interface in promiscuous mode when capturing.
1618 The I<Update list of packets in real time> check box lets you specify
1619 that the display should be updated as packets are seen.
1621 The I<Automatic scrolling in live capture> check box lets you specify
1622 whether, in an "Update list of packets in real time" capture, the packet
1623 list pane should automatically scroll to show the most recently captured
1626 =item Printing Preferences
1628 The radio buttons at the top of the I<Printing> page allow you choose
1629 between printing packets with the I<File:Print Packet> menu item as text
1630 or PostScript, and sending the output directly to a command or saving it
1631 to a file. The I<Command:> text entry box, on UNIX-compatible systems,
1632 is the command to send files to (usually B<lpr>), and the I<File:> entry
1633 box lets you enter the name of the file you wish to save to.
1634 Additionally, you can select the I<File:> button to browse the file
1635 system for a particular save file.
1637 =item Protocol Preferences
1639 There are also pages for various protocols that Wireshark dissects,
1640 controlling the way Wireshark handles those protocols.
1644 =item Edit Capture Filter List
1646 =item Edit Display Filter List
1648 =item Capture Filter
1650 =item Display Filter
1656 The I<Edit Capture Filter List> dialog lets you create, modify, and
1657 delete capture filters, and the I<Edit Display Filter List> dialog lets
1658 you create, modify, and delete display filters.
1660 The I<Capture Filter> dialog lets you do all of the editing operations
1661 listed, and also lets you choose or construct a filter to be used when
1664 The I<Display Filter> dialog lets you do all of the editing operations
1665 listed, and also lets you choose or construct a filter to be used to
1666 filter the current capture being viewed.
1668 The I<Read Filter> dialog lets you do all of the editing operations
1669 listed, and also lets you choose or construct a filter to be used to
1670 as a read filter for a capture file you open.
1672 The I<Search Filter> dialog lets you do all of the editing operations
1673 listed, and also lets you choose or construct a filter expression to be
1674 used in a find operation.
1676 In all of those dialogs, the I<Filter name> entry specifies a
1677 descriptive name for a filter, e.g. B<Web and DNS traffic>. The
1678 I<Filter string> entry is the text that actually describes the filtering
1679 action to take, as described above.The dialog buttons perform the
1686 If there is text in the two entry boxes, creates a new associated list
1691 Modifies the currently selected list item to match what's in the entry
1696 Deletes the currently selected list item.
1698 =item Add Expression...
1700 For display filter expressions, pops up a dialog box to allow you to
1701 construct a filter expression to test a particular field; it offers
1702 lists of field names, and, when appropriate, lists from which to select
1703 tests to perform on the field and values with which to compare it. In
1704 that dialog box, the OK button will cause the filter expression you
1705 constructed to be entered into the I<Filter string> entry at the current
1710 In the I<Capture Filter> dialog, closes the dialog box and makes the
1711 filter in the I<Filter string> entry the filter in the I<Capture
1712 Preferences> dialog. In the I<Display Filter> dialog, closes the dialog
1713 box and makes the filter in the I<Filter string> entry the current
1714 display filter, and applies it to the current capture. In the I<Read
1715 Filter> dialog, closes the dialog box and makes the filter in the
1716 I<Filter string> entry the filter in the I<Open Capture File> dialog.
1717 In the I<Search Filter> dialog, closes the dialog box and makes the
1718 filter in the I<Filter string> entry the filter in the I<Find Packet>
1723 Makes the filter in the I<Filter string> entry the current display
1724 filter, and applies it to the current capture.
1728 If the list of filters being edited is the list of
1729 capture filters, saves the current filter list to the personal capture
1730 filters file, and if the list of filters being edited is the list of
1731 display filters, saves the current filter list to the personal display
1736 Closes the dialog without doing anything with the filter in the I<Filter
1741 =item The Color Filters Dialog
1743 This dialog displays a list of color filters and allows it to be
1748 =item THE FILTER LIST
1750 Single rows may be selected by clicking. Multiple rows may be selected
1751 by using the ctrl and shift keys in combination with the mouse button.
1755 Adds a new filter at the bottom of the list and opens the Edit Color
1756 Filter dialog box. You will have to alter the filter expression at
1757 least before the filter will be accepted. The format of color filter
1758 expressions is identical to that of display filters. The new filter is
1759 selected, so it may immediately be moved up and down, deleted or edited.
1760 To avoid confusion all filters are unselected before the new filter is
1765 Opens the Edit Color Filter dialog box for the selected filter. (If this
1766 button is disabled you may have more than one filter selected, making it
1767 ambiguous which is to be edited.)
1771 Deletes the selected color filter(s).
1775 Allows you to choose a file in which to save the current list of color
1776 filters. You may also choose to save only the selected filters. A
1777 button is provided to save the filters in the global color filters file
1778 (you must have sufficient permissions to write this file, of course).
1782 Allows you to choose a file containing color filters which are then
1783 added to the bottom of the current list. All the added filters are
1784 selected, so they may be moved to the correct position in the list as a
1785 group. To avoid confusion, all filters are unselected before the new
1786 filters are imported. A button is provided to load the filters from the
1787 global color filters file.
1791 Deletes your personal color filters file, reloads the global
1792 color filters file, if any, and closes the dialog.
1796 Moves the selected filter(s) up the list, making it more likely that
1797 they will be used to color packets.
1801 Moves the selected filter(s) down the list, making it less likely that
1802 they will be used to color packets.
1806 Closes the dialog and uses the color filters as they stand.
1810 Colors the packets according to the current list of color filters, but
1811 does not close the dialog.
1815 Saves the current list of color filters in your personal color filters
1816 file. Unless you do this they will not be used the next time you start
1821 Closes the dialog without changing the coloration of the packets. Note
1822 that changes you have made to the current list of color filters are not
1827 =item Capture Options
1829 The I<Capture Options> dialog lets you specify various parameters for
1830 capturing live packet data.
1832 The I<Interface:> field lets you specify the interface from which to
1833 capture packet data or a command from which to get the packet data via a
1836 The I<Link layer header type:> field lets you specify the interfaces link
1837 layer header type. This field is usually disabled, as most interface have
1838 only one header type.
1840 The I<Capture packets in promiscuous mode> check box lets you specify
1841 whether the interface should be put into promiscuous mode when
1844 The I<Limit each packet to ... bytes> check box and field lets you
1845 specify a maximum number of bytes per packet to capture and save; if the
1846 check box is not checked, the limit will be 65535 bytes.
1848 The I<Capture Filter:> entry lets you specify the capture filter using a
1849 tcpdump-style filter string as described above.
1851 The I<File:> entry lets you specify the file into which captured packets
1852 should be saved, as in the I<Printer Options> dialog above. If not
1853 specified, the captured packets will be saved in a temporary file; you
1854 can save those packets to a file with the I<File:Save As> menu item.
1856 The I<Use multiple files> check box lets you specify that the capture
1857 should be done in "multiple files" mode. This option is disabled, if the
1858 I<Update list of packets in real time> option is checked.
1860 The I<Next file every ... megabyte(s)> check box and fields lets
1861 you specify that a switch to a next file should be done
1862 if the specified filesize is reached. You can also select the appriate
1863 unit, but beware that the filesize has a maximum of 2 GB.
1864 The check box is forced to be checked, as "multiple files" mode requires a
1865 file size to be specified.
1867 The I<Next file every ... minute(s)> check box and fields lets
1868 you specify that the switch to a next file should be done after the specified
1869 time has elapsed, even if the specified capture size is not reached.
1871 The I<Ring buffer with ... files> field lets you specify the number
1872 of files of a ring buffer. This feature will capture into to the first file
1873 again, after the specified amount of files were used.
1875 The I<Stop capture after ... files> field lets you specify the number
1876 of capture files used, until the capture is stopped.
1878 The I<Stop capture after ... packet(s)> check box and field let
1879 you specify that Wireshark should stop capturing after having captured
1880 some number of packets; if the check box is not checked, Wireshark will
1881 not stop capturing at some fixed number of captured packets.
1883 The I<Stop capture after ... megabyte(s)> check box and field lets
1884 you specify that Wireshark should stop capturing after the file to which
1885 captured packets are being saved grows as large as or larger than some
1886 specified number of megabytes. If the check box is not checked, Wireshark
1887 will not stop capturing at some capture file size (although the operating
1888 system on which Wireshark is running, or the available disk space, may still
1889 limit the maximum size of a capture file). This option is disabled, if
1890 "multiple files" mode is used,
1892 The I<Stop capture after ... second(s)> check box and field let you
1893 specify that Wireshark should stop capturing after it has been capturing
1894 for some number of seconds; if the check box is not checked, Wireshark
1895 will not stop capturing after some fixed time has elapsed.
1897 The I<Update list of packets in real time> check box lets you specify
1898 whether the display should be updated as packets are captured and, if
1899 you specify that, the I<Automatic scrolling in live capture> check box
1900 lets you specify the packet list pane should automatically scroll to
1901 show the most recently captured packets as new packets arrive.
1903 The I<Enable MAC name resolution>, I<Enable network name resolution> and
1904 I<Enable transport name resolution> check boxes let you specify whether
1905 MAC addresses, network addresses, and transport-layer port numbers
1906 should be translated to names.
1910 The I<About> dialog lets you view various information about Wireshark.
1912 =item About:Wireshark
1914 The I<Wireshark> page lets you view general information about Wireshark,
1915 like the installed version, licensing information and such.
1919 The I<Authors> page shows the author and all contributors.
1923 The I<Folders> page lets you view the directory names where Wireshark is
1924 searching it's various configuration and other files.
1928 The I<Plugins> page lets you view the dissector plugin modules
1929 available on your system.
1931 The I<Plugins List> shows the name and version of each dissector plugin
1932 module found on your system.
1934 On Unix-compatible systems, the plugins are looked for in the following
1935 directories: the F<lib/wireshark/plugins/$VERSION> directory under the
1936 main installation directory (for example,
1937 F</usr/local/lib/wireshark/plugins/$VERSION>), and then
1938 F<$HOME/.wireshark/plugins>.
1940 On Windows systems, the plugins are looked for in the following
1941 directories: F<plugins\$VERSION> directory under the main installation
1942 directory (for example, F<C:\Program Files\Wireshark\plugins\$VERSION>),
1943 and then F<%APPDATA%\Wireshark\plugins\$VERSION> (or, if %APPDATA% isn't
1944 defined, F<%USERPROFILE%\Application Data\Wireshark\plugins\$VERSION>).
1946 $VERSION is the version number of the plugin interface, which
1947 is typically the version number of Wireshark. Note that a dissector
1948 plugin module may support more than one protocol; there is not
1949 necessarily a one-to-one correspondence between dissector plugin modules
1950 and protocols. Protocols supported by a dissector plugin module are
1951 enabled and disabled using the I<Edit:Protocols> dialog box, just as
1952 protocols built into Wireshark are.
1956 =head1 CAPTURE FILTER SYNTAX
1958 See the manual page of tcpdump(8).
1960 =head1 DISPLAY FILTER SYNTAX
1962 For a complete table of protocol and protocol fields that are filterable
1963 in B<Wireshark> see the wireshark-filter(4) manual page.
1967 These files contains various B<Wireshark> configuration settings.
1973 The F<preferences> files contain global (system-wide) and personal
1974 preference settings. If the system-wide preference file exists, it is
1975 read first, overriding the default settings. If the personal preferences
1976 file exists, it is read next, overriding any previous values. Note: If
1977 the command line flag B<-o> is used (possibly more than once), it will
1978 in turn override values from the preferences files.
1980 The preferences settings are in the form I<prefname>B<:>I<value>,
1982 where I<prefname> is the name of the preference
1983 and I<value> is the value to
1984 which it should be set; white space is allowed between B<:> and
1985 I<value>. A preference setting can be continued on subsequent lines by
1986 indenting the continuation lines with white space. A B<#> character
1987 starts a comment that runs to the end of the line:
1989 # Vertical scrollbars should be on right side?
1990 # TRUE or FALSE (case-insensitive).
1991 gui.scrollbar_on_right: TRUE
1993 The global preferences file is looked for in the F<wireshark> directory
1994 under the F<share> subdirectory of the main installation directory (for
1995 example, F</usr/local/share/wireshark/preferences>) on UNIX-compatible
1996 systems, and in the main installation directory (for example,
1997 F<C:\Program Files\Wireshark\preferences>) on Windows systems.
1999 The personal preferences file is looked for in F<$HOME/.wireshark/preferences> on
2000 UNIX-compatible systems and F<%APPDATA%\Wireshark\preferences> (or, if
2001 %APPDATA% isn't defined, F<%USERPROFILE%\Application
2002 Data\Wireshark\preferences>) on Windows systems.
2004 Note: Whenever the preferences are saved by using the I<Save> button
2005 in the I<Edit:Preferences> dialog box, your personal preferences file
2006 will be overwritten with the new settings, destroying any comments and
2007 unknown/obsolete settings that were in the file.
2011 The F<recent> file contains personal settings (mostly GUI related) such
2012 as the current B<Wireshark> window size. The file is saved at program exit and
2013 read in at program start automatically. Note: The command line flag B<-o>
2014 may be used to override settings from this file.
2016 The settings in this file have the same format as in the F<preferences>
2017 files, and the same directory as for the personal preferences file is
2020 Note: Whenever Wireshark is closed, your recent file
2021 will be overwritten with the new settings, destroying any comments and
2022 unknown/obsolete settings that were in the file.
2024 =item Disabled (Enabled) Protocols
2026 The F<disabled_protos> files contain system-wide and personal lists of
2027 protocols that have been disabled, so that their dissectors are never
2028 called. The files contain protocol names, one per line, where the
2029 protocol name is the same name that would be used in a display filter
2035 If a protocol is listed in the global F<disabled_protos> file, it is not
2036 displayed in the I<Analyze:Enabled Protocols> dialog box, and so cannot
2037 be enabled by the user.
2039 The global F<disabled_protos> file uses the same directory as the global
2042 The personal F<disabled_protos> file uses the same directory as the
2043 personal preferences file.
2045 Note: Whenever the disabled protocols list is saved by using the I<Save>
2046 button in the I<Analyze:Enabled Protocols> dialog box, your personal
2047 disabled protocols file will be overwritten with the new settings,
2048 destroying any comments that were in the file.
2050 =item Name Resolution (hosts)
2052 If the personal F<hosts> file exists, it is
2053 used to resolve IPv4 and IPv6 addresses before any other
2054 attempts are made to resolve them. The file has the standard F<hosts>
2055 file syntax; each line contains one IP address and name, separated by
2056 whitespace. The same directory as for the personal preferences file is used.
2058 =item Name Resolution (ethers)
2060 The F<ethers> files are consulted to correlate 6-byte hardware addresses to
2061 names. First the personal F<ethers> file is tried and if an address is not
2062 found there the global F<ethers> file is tried next.
2064 Each line contains one hardware address and name, separated by
2065 whitespace. The digits of the hardware address are separated by colons
2066 (:), dashes (-) or periods (.). The same separator character must be
2067 used consistently in an address. The following three lines are valid
2068 lines of an F<ethers> file:
2070 ff:ff:ff:ff:ff:ff Broadcast
2071 c0-00-ff-ff-ff-ff TR_broadcast
2072 00.00.00.00.00.00 Zero_broadcast
2074 The global F<ethers> file is looked for in the F</etc> directory on
2075 UNIX-compatible systems, and in the main installation directory (for
2076 example, F<C:\Program Files\Wireshark>) on Windows systems.
2078 The personal F<ethers> file is looked for in the same directory as the personal
2081 =item Name Resolution (manuf)
2083 The F<manuf> file is used to match the 3-byte vendor portion of a 6-byte
2084 hardware address with the manufacturer's name; it can also contain well-known
2085 MAC addresses and address ranges specified with a netmask. The format of the
2086 file is the same as the F<ethers> files, except that entries such as:
2090 can be provided, with the 3-byte OUI and the name for a vendor, and
2093 00-00-0C-07-AC/40 All-HSRP-routers
2095 can be specified, with a MAC address and a mask indicating how many bits
2096 of the address must match. The above entry, for example, has 40
2097 significant bits, or 5 bytes, and would match addresses from
2098 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
2101 The F<manuf> file is looked for in the same directory as the global
2104 =item Name Resolution (ipxnets)
2106 The F<ipxnets> files are used to correlate 4-byte IPX network numbers to
2107 names. First the global F<ipxnets> file is tried and if that address is not
2108 found there the personal one is tried next.
2110 The format is the same as the F<ethers>
2111 file, except that each address is four bytes instead of six.
2112 Additionally, the address can be represented as a single hexadecimal
2113 number, as is more common in the IPX world, rather than four hex octets.
2114 For example, these four lines are valid lines of an F<ipxnets> file:
2118 00:00:BE:EF IT_Server1
2121 The global F<ipxnets> file is looked for in the F</etc> directory on
2122 UNIX-compatible systems, and in the main installation directory (for
2123 example, F<C:\Program Files\Wireshark>) on Windows systems.
2125 The personal F<ipxnets> file is looked for in the same directory as the
2126 personal preferences file.
2128 =item Capture Filters
2130 The F<cfilters> files contain system-wide and personal capture filters.
2131 Each line contains one filter, starting with the string displayed in the
2132 dialog box in quotation marks, followed by the filter string itself:
2137 The global F<cfilters> file uses the same directory as the
2138 global preferences file.
2140 The personal F<cfilters> file uses the same directory as the personal
2141 preferences file. It is written through the Capture:Capture Filters
2144 If the global F<cfilters> file exists, it is used only if the personal
2145 F<cfilters> file does not exist; global and personal capture filters are
2148 =item Display Filters
2150 The F<dfilters> files contain system-wide and personal display filters.
2151 Each line contains one filter, starting with the string displayed in the
2152 dialog box in quotation marks, followed by the filter string itself:
2157 The global F<dfilters> file uses the same directory as the
2158 global preferences file.
2160 The personal F<dfilters> file uses the same directory as the
2161 personal preferences file. It is written through the Analyze:Display
2164 If the global F<dfilters> file exists, it is used only if the personal
2165 F<dfilters> file does not exist; global and personal display filters are
2168 =item Color Filters (Coloring Rules)
2170 The F<colorfilters> files contain system-wide and personal color filters.
2171 Each line contains one filter, starting with the string displayed in the
2172 dialog box, followed by the corresponding display filter. Then the
2173 background and foreground colors are appended:
2176 @tcp@tcp@[59345,58980,65534][0,0,0]
2177 @udp@udp@[28834,57427,65533][0,0,0]
2179 The global F<colorfilters> file uses the same directory as the
2180 global preferences file.
2182 The personal F<colorfilters> file uses the same directory as the
2183 personal preferences file. It is written through the View:Coloring Rules
2186 If the global F<colorfilters> file exists, it is used only if the personal
2187 F<colorfilters> file does not exist; global and personal color filters are
2192 The F<gtkrc> files contain system-wide and personal GTK theme settings.
2194 The global F<gtkrc> file uses the same directory as the
2195 global preferences file.
2197 The personal F<gtkrc> file uses the same directory as the personal
2202 See above in the description of the About:Plugins page.
2208 wireshark-filter(4), tshark(1), editcap(1), tcpdump(8), pcap(3)
2212 The latest version of B<Wireshark> can be found at
2213 L<http://www.wireshark.org>.
2215 HTML versions of the Wireshark project man pages are available at:
2216 L<http://www.wireshark.org/docs/man-pages>.