1WIRESHARK(1) The Wireshark Network Analyzer WIRESHARK(1)
2
6 wireshark - Interactively dump and analyze network traffic
7
9 wireshark [ -a <capture autostop condition> ] ...
10 [ -b <capture ring buffer option> ] ... [ -B <capture buffer size> ]
11 [ -c <capture packet count> ] [ -C <configuration profile> ] [ -D ]
12 [ --display=<X display to use> ] [ -f <capture filter> ]
13 [ -g <packet number> ] [ -h ] [ -H ] [ -i <capture interface>|- ]
14 [ -I ] [ -j ] [ -J <jump filter> ] [ -k ] [ -K <keytab> ] [ -l ] [ -L ]
15 [ -m <font> ] [ -n ] [ -N <name resolving flags> ]
16 [ -o <preference/recent setting> ] ... [ -p ] [ -P <path setting>]
17 [ -r <infile> ] [ -R <read (display) filter> ] [ -s <capture snaplen> ]
18 [ -S ] [ -t a|ad|d|dd|e|r|u|ud ] [ -v ] [ -w <outfile> ]
19 [ -X <eXtension option> ] [ -y <capture link type> ]
20 [ -Y <displaY filter> ] [ -z <statistics> ] [ <infile> ]
21
23 Wireshark is a GUI network protocol analyzer. It lets you
24 interactively browse packet data from a live network or from a
25 previously saved capture file. Wireshark's native capture file format
26 is pcap format, which is also the format used by tcpdump and various
27 other tools.
28 Wireshark can read / import the following file formats:
30 · pcap - captures from Wireshark/TShark/dumpcap, tcpdump, and various
32 other tools using libpcap's/WinPcap's/tcpdump's/WinDump's capture
33 format
34 · pcap-ng - "next-generation" successor to pcap format
36 · snoop and atmsnoop captures
38 · Shomiti/Finisar Surveyor captures
40 · Novell LANalyzer captures
42 · Microsoft Network Monitor captures
44 · AIX's iptrace captures
46 · Cinco Networks NetXRay captures
48 · Network Associates Windows-based Sniffer captures
50 · Network General/Network Associates DOS-based Sniffer (compressed or
52 uncompressed) captures
53 · AG Group/WildPackets
55 EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures
56 · RADCOM's WAN/LAN analyzer captures
58 · Network Instruments Observer version 9 captures
60 · Lucent/Ascend router debug output
62 · files from HP-UX's nettl
64 · Toshiba's ISDN routers dump output
66 · the output from i4btrace from the ISDN4BSD project
68 · traces from the EyeSDN USB S0.
70 · the output in IPLog format from the Cisco Secure Intrusion
72 Detection System
73 · pppd logs (pppdump format)
75 · the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities
77 · the text output from the DBS Etherwatch VMS utility
79 · Visual Networks' Visual UpTime traffic capture
81 · the output from CoSine L2 debug
83 · the output from InfoVista's 5View LAN agents
85 · Endace Measurement Systems' ERF format captures
87 · Linux Bluez Bluetooth stack hcidump -w traces
89 · Catapult DCT2000 .out files
91 · Gammu generated text output from Nokia DCT3 phones in Netmonitor
93 mode
94 · IBM Series (OS/400) Comm traces (ASCII & UNICODE)
96 · Juniper Netscreen snoop files
98 · Symbian OS btsnoop files
100 · TamoSoft CommView files
102 · Textronix K12xx 32bit .rf5 format files
104 · Textronix K12 text file format captures
106 · Apple PacketLogger files
108 · Files from Aethra Telecommunications' PC108 software for their test
110 instruments
111 · MPEG-2 Transport Streams as defined in ISO/IEC 13818-1
113 · Rabbit Labs CAM Inspector files
115 There is no need to tell Wireshark what type of file you are reading;
117 it will determine the file type by itself. Wireshark is also capable
118 of reading any of these file formats if they are compressed using gzip.
119 Wireshark recognizes this directly from the file; the '.gz' extension
120 is not required for this purpose.
121 Like other protocol analyzers, Wireshark's main window shows 3 views of
123 a packet. It shows a summary line, briefly describing what the packet
124 is. A packet details display is shown, allowing you to drill down to
125 exact protocol or field that you interested in. Finally, a hex dump
126 shows you exactly what the packet looks like when it goes over the
127 wire.
128 In addition, Wireshark has some features that make it unique. It can
130 assemble all the packets in a TCP conversation and show you the ASCII
131 (or EBCDIC, or hex) data in that conversation. Display filters in
132 Wireshark are very powerful; more fields are filterable in Wireshark
133 than in other protocol analyzers, and the syntax you can use to create
134 your filters is richer. As Wireshark progresses, expect more and more
135 protocol fields to be allowed in display filters.
136 Packet capturing is performed with the pcap library. The capture
138 filter syntax follows the rules of the pcap library. This syntax is
139 different from the display filter syntax.
140 Compressed file support uses (and therefore requires) the zlib library.
142 If the zlib library is not present, Wireshark will compile, but will be
143 unable to read compressed files.
144 The pathname of a capture file to be read can be specified with the -r
146 option or can be specified as a command-line argument.
147
149 Most users will want to start Wireshark without options and configure
150 it from the menus instead. Those users may just skip this section.
151 -a <capture autostop condition>
153 Specify a criterion that specifies when Wireshark is to stop
154 writing to a capture file. The criterion is of the form
155 test:value, where test is one of:
156 duration:value Stop writing to a capture file after value seconds
158 have elapsed.
159 filesize:value Stop writing to a capture file after it reaches a
161 size of value kB. If this option is used together with the -b
162 option, Wireshark will stop writing to the current capture file and
163 switch to the next one if filesize is reached. Note that the
164 filesize is limited to a maximum value of 2 GiB.
165 files:value Stop writing to capture files after value number of
167 files were written.
168 -b <capture ring buffer option>
170 Cause Wireshark to run in "multiple files" mode. In "multiple
171 files" mode, Wireshark will write to several capture files. When
172 the first capture file fills up, Wireshark will switch writing to
173 the next file and so on.
174 The created filenames are based on the filename given with the -w
176 flag, the number of the file and on the creation date and time,
177 e.g. outfile_00001_20050604120117.pcap,
178 outfile_00002_20050604120523.pcap, ...
179 With the files option it's also possible to form a "ring buffer".
181 This will fill up new files until the number of files specified, at
182 which point Wireshark will discard the data in the first file and
183 start writing to that file and so on. If the files option is not
184 set, new files filled up until one of the capture stop conditions
185 match (or until the disk is full).
186 The criterion is of the form key:value, where key is one of:
188 duration:value switch to the next file after value seconds have
190 elapsed, even if the current file is not completely filled up.
191 filesize:value switch to the next file after it reaches a size of
193 value kB. Note that the filesize is limited to a maximum value of
194 2 GiB.
195 files:value begin again with the first file after value number of
197 files were written (form a ring buffer). This value must be less
198 than 100000. Caution should be used when using large numbers of
199 files: some filesystems do not handle many files in a single
200 directory well. The files criterion requires either duration or
201 filesize to be specified to control when to go to the next file.
202 It should be noted that each -b parameter takes exactly one
203 criterion; to specify two criterion, each must be preceded by the
204 -b option.
205 Example: -b filesize:1000 -b files:5 results in a ring buffer of
207 five files of size one megabyte each.
208 -B <capture buffer size>
210 Set capture buffer size (in MiB, default is 4 MiB). This is used
211 by the capture driver to buffer packet data until that data can be
212 written to disk. If you encounter packet drops while capturing,
213 try to increase this size. Note that, while Wireshark attempts to
214 set the buffer size to 4 MiB by default, and can be told to set it
215 to a larger value, the system or interface on which you're
216 capturing might silently limit the capture buffer size to a lower
217 value or raise it to a higher value.
218 This is available on UNIX systems with libpcap 1.0.0 or later and
220 on Windows. It is not available on UNIX systems with earlier
221 versions of libpcap.
222 This option can occur multiple times. If used before the first
224 occurrence of the -i option, it sets the default capture buffer
225 size. If used after an -i option, it sets the capture buffer size
226 for the interface specified by the last -i option occurring before
227 this option. If the capture buffer size is not set specifically,
228 the default capture buffer size is used instead.
229 -c <capture packet count>
231 Set the maximum number of packets to read when capturing live data.
232 -C <configuration profile>
234 Start with the given configuration profile.
235 -D Print a list of the interfaces on which Wireshark can capture, and
237 exit. For each network interface, a number and an interface name,
238 possibly followed by a text description of the interface, is
239 printed. The interface name or the number can be supplied to the
240 -i flag to specify an interface on which to capture.
241 This can be useful on systems that don't have a command to list
243 them (e.g., Windows systems, or UNIX systems lacking ifconfig -a);
244 the number can be useful on Windows 2000 and later systems, where
245 the interface name is a somewhat complex string.
246 Note that "can capture" means that Wireshark was able to open that
248 device to do a live capture; if, on your system, a program doing a
249 network capture must be run from an account with special privileges
250 (for example, as root), then, if Wireshark is run with the -D flag
251 and is not run from such an account, it will not list any
252 interfaces.
253 --display=<X display to use>
255 Specifies the X display to use. A hostname and screen
256 (otherhost:0.0) or just a screen (:0.0) can be specified. This
257 option is not available under Windows.
258 -f <capture filter>
260 Set the capture filter expression.
261 This option can occur multiple times. If used before the first
263 occurrence of the -i option, it sets the default capture filter
264 expression. If used after an -i option, it sets the capture filter
265 expression for the interface specified by the last -i option
266 occurring before this option. If the capture filter expression is
267 not set specifically, the default capture filter expression is used
268 if provided.
269 -g <packet number>
271 After reading in a capture file using the -r flag, go to the given
272 packet number.
273 -h Print the version and options and exit.
275 -H Hide the capture info dialog during live packet capture.
277 -i <capture interface>|-
279 Set the name of the network interface or pipe to use for live
280 packet capture.
281 Network interface names should match one of the names listed in
283 "wireshark -D" (described above); a number, as reported by
284 "wireshark -D", can also be used. If you're using UNIX, "netstat
285 -i" or "ifconfig -a" might also work to list interface names,
286 although not all versions of UNIX support the -a flag to ifconfig.
287 If no interface is specified, Wireshark searches the list of
289 interfaces, choosing the first non-loopback interface if there are
290 any non-loopback interfaces, and choosing the first loopback
291 interface if there are no non-loopback interfaces. If there are no
292 interfaces at all, Wireshark reports an error and doesn't start the
293 capture.
294 Pipe names should be either the name of a FIFO (named pipe) or
296 ``-'' to read data from the standard input. On Windows systems,
297 pipe names must be of the form ``\\pipe\.\pipename''. Data read
298 from pipes must be in standard pcap format.
299 This option can occur multiple times. When capturing from multiple
301 interfaces, the capture file will be saved in pcap-ng format.
302 -I Put the interface in "monitor mode"; this is supported only on IEEE
304 802.11 Wi-Fi interfaces, and supported only on some operating
305 systems.
306 Note that in monitor mode the adapter might disassociate from the
308 network with which it's associated, so that you will not be able to
309 use any wireless networks with that adapter. This could prevent
310 accessing files on a network server, or resolving host names or
311 network addresses, if you are capturing in monitor mode and are not
312 connected to another network with another adapter.
313 This option can occur multiple times. If used before the first
315 occurrence of the -i option, it enables the monitor mode for all
316 interfaces. If used after an -i option, it enables the monitor
317 mode for the interface specified by the last -i option occurring
318 before this option.
319 -j Use after -J to change the behavior when no exact match is found
321 for the filter. With this option select the first packet before.
322 -J <jump filter>
324 After reading in a capture file using the -r flag, jump to the
325 packet matching the filter (display filter syntax). If no exact
326 match is found the first packet after that is selected.
327 -k Start the capture session immediately. If the -i flag was
329 specified, the capture uses the specified interface. Otherwise,
330 Wireshark searches the list of interfaces, choosing the first non-
331 loopback interface if there are any non-loopback interfaces, and
332 choosing the first loopback interface if there are no non-loopback
333 interfaces; if there are no interfaces, Wireshark reports an error
334 and doesn't start the capture.
335 -K <keytab>
337 Load kerberos crypto keys from the specified keytab file. This
338 option can be used multiple times to load keys from several files.
339 Example: -K krb5.keytab
341 -l Turn on automatic scrolling if the packet display is being updated
343 automatically as packets arrive during a capture (as specified by
344 the -S flag).
345 -L List the data link types supported by the interface and exit.
347 -m <font>
349 Set the name of the font used by Wireshark for most text.
350 Wireshark will construct the name of the bold font used for the
351 data in the byte view pane that corresponds to the field selected
352 in the packet details pane from the name of the main text font.
353 -n Disable network object name resolution (such as hostname, TCP and
355 UDP port names), the -N flag might override this one.
356 -N <name resolving flags>
358 Turn on name resolving only for particular types of addresses and
359 port numbers, with name resolving for other types of addresses and
360 port numbers turned off. This flag overrides -n if both -N and -n
361 are present. If both -N and -n flags are not present, all name
362 resolutions are turned on.
363 The argument is a string that may contain the letters:
365 m to enable MAC address resolution
367 n to enable network address resolution
369 N to enable using external resolvers (e.g., DNS) for network
371 address resolution
372 t to enable transport-layer port number resolution
374 C to enable concurrent (asynchronous) DNS lookups
376 -o <preference/recent setting>
378 Set a preference or recent value, overriding the default value and
379 any value read from a preference/recent file. The argument to the
380 flag is a string of the form prefname:value, where prefname is the
381 name of the preference/recent value (which is the same name that
382 would appear in the preference/recent file), and value is the value
383 to which it should be set. Since Ethereal 0.10.12, the recent
384 settings replaces the formerly used -B, -P and -T flags to
385 manipulate the GUI dimensions.
386 If prefname is "uat", you can override settings in various user
388 access tables using the form uat:uat filename:uat record. uat
389 filename must be the name of a UAT file, e.g. user_dlts.
390 uat_record must be in the form of a valid record for that file,
391 including quotes. For instance, to specify a user DLT from the
392 command line, you would use
393 -o "uat:user_dlts:\"User 0 (DLT=147)\",\"cops\",\"0\",\"\",\"0\",\"\""
395 -p Don't put the interface into promiscuous mode. Note that the
397 interface might be in promiscuous mode for some other reason;
398 hence, -p cannot be used to ensure that the only traffic that is
399 captured is traffic sent to or from the machine on which Wireshark
400 is running, broadcast traffic, and multicast traffic to addresses
401 received by that machine.
402 This option can occur multiple times. If used before the first
404 occurrence of the -i option, no interface will be put into the
405 promiscuous mode. If used after an -i option, the interface
406 specified by the last -i option occurring before this option will
407 not be put into the promiscuous mode.
408 -P <path setting>
410 Special path settings usually detected automatically. This is used
411 for special cases, e.g. starting Wireshark from a known location on
412 an USB stick.
413 The criterion is of the form key:path, where key is one of:
415 persconf:path path of personal configuration files, like the
417 preferences files.
418 persdata:path path of personal data files, it's the folder
420 initially opened. After the very first initialization, the recent
421 file will keep the folder last used.
422 -r <infile>
424 Read packet data from infile, can be any supported capture file
425 format (including gzipped files). It's not possible to use named
426 pipes or stdin here! To capture from a pipe or from stdin use -i -
427 -R <read (display) filter>
429 When reading a capture file specified with the -r flag, causes the
430 specified filter (which uses the syntax of display filters, rather
431 than that of capture filters) to be applied to all packets read
432 from the capture file; packets not matching the filter are
433 discarded.
434 -s <capture snaplen>
436 Set the default snapshot length to use when capturing live data.
437 No more than snaplen bytes of each network packet will be read into
438 memory, or saved to disk. A value of 0 specifies a snapshot length
439 of 262144, so that the full packet is captured; this is the
440 default.
441 This option can occur multiple times. If used before the first
443 occurrence of the -i option, it sets the default snapshot length.
444 If used after an -i option, it sets the snapshot length for the
445 interface specified by the last -i option occurring before this
446 option. If the snapshot length is not set specifically, the
447 default snapshot length is used if provided.
448 -S Automatically update the packet display as packets are coming in.
450 -t a|ad|d|dd|e|r|u|ud
452 Set the format of the packet timestamp displayed in the packet list
453 window. The format can be one of:
454 a absolute: The absolute time is the actual time the packet was
456 captured, with no date displayed
457 ad absolute with date: The absolute date and time is the actual
459 time and date the packet was captured
460 d delta: The delta time is the time since the previous packet was
462 captured
463 dd delta_displayed: The delta_displayed time is the time since the
465 previous displayed packet was captured
466 e epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00)
468 r relative: The relative time is the time elapsed between the first
470 packet and the current packet
471 u UTC: The UTC time is the actual time the packet was captured,
473 with no date displayed
474 ud UTC with date: The UTC date and time is the actual time and date
476 the packet was captured
477 The default format is relative.
479 -v Print the version and exit.
481 -w <outfile>
483 Set the default capture file name.
484 -X <eXtension options>
486 Specify an option to be passed to an Wireshark module. The
487 eXtension option is in the form extension_key:value, where
488 extension_key can be:
489 lua_script:lua_script_filename tells Wireshark to load the given
491 script in addition to the default Lua scripts.
492 stdin_descr:description tells Wireshark to use the given
494 description when capturing from standard input (-i -).
495 -y <capture link type>
497 If a capture is started from the command line with -k, set the data
498 link type to use while capturing packets. The values reported by
499 -L are the values that can be used.
500 This option can occur multiple times. If used before the first
502 occurrence of the -i option, it sets the default capture link type.
503 If used after an -i option, it sets the capture link type for the
504 interface specified by the last -i option occurring before this
505 option. If the capture link type is not set specifically, the
506 default capture link type is used if provided.
507 -Y <displaY filter>
509 Start with the given display filter.
510 -z <statistics>
512 Get Wireshark to collect various types of statistics and display
513 the result in a window that updates in semi-real time.
514 Currently implemented statistics are:
516 -z conv,type[,filter]
518 Create a table that lists all conversations that could be seen
519 in the capture. type specifies the conversation endpoint types
520 for which we want to generate the statistics; currently the
521 supported ones are:
522 "eth" Ethernet addresses
524 "fc" Fibre Channel addresses
525 "fddi" FDDI addresses
526 "ip" IPv4 addresses
527 "ipv6" IPv6 addresses
528 "ipx" IPX addresses
529 "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported
530 "tr" Token Ring addresses
531 "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported
532 If the optional filter is specified, only those packets that
534 match the filter will be used in the calculations.
535 The table is presented with one line for each conversation and
537 displays the number of packets/bytes in each direction as well
538 as the total number of packets/bytes. By default, the table is
539 sorted according to the total number of packets.
540 These tables can also be generated at runtime by selecting the
542 appropriate conversation type from the menu
543 "Tools/Statistics/Conversation List/".
544 -z dcerpc,srt,uuid,major.minor[,filter]
546 Collect call/reply SRT (Service Response Time) data for DCERPC
547 interface uuid, version major.minor. Data collected is the
548 number of calls for each procedure, MinSRT, MaxSRT and AvgSRT.
549 Example: -z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0
551 will collect data for the CIFS SAMR Interface.
552 This option can be used multiple times on the command line.
554 If the optional filter is provided, the stats will only be
556 calculated on those calls that match that filter.
557 Example:
559 -z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4
560 will collect SAMR SRT statistics for a specific host.
561 -z fc,srt[,filter]
563 Collect call/reply SRT (Service Response Time) data for FC.
564 Data collected is the number of calls for each Fibre Channel
565 command, MinSRT, MaxSRT and AvgSRT.
566 Example: -z fc,srt will calculate the Service Response Time as
568 the time delta between the First packet of the exchange and the
569 Last packet of the exchange.
570 The data will be presented as separate tables for all normal FC
572 commands, Only those commands that are seen in the capture will
573 have its stats displayed.
574 This option can be used multiple times on the command line.
576 If the optional filter is provided, the stats will only be
578 calculated on those calls that match that filter.
579 Example: -z "fc,srt,fc.id==01.02.03" will collect stats only
581 for FC packets exchanged by the host at FC address 01.02.03 .
582 -z h225,counter[,filter]
584 Count ITU-T H.225 messages and their reasons. In the first
585 column you get a list of H.225 messages and H.225 message
586 reasons which occur in the current capture file. The number of
587 occurrences of each message or reason is displayed in the
588 second column.
589 Example: -z h225,counter
591 This option can be used multiple times on the command line.
593 If the optional filter is provided, the stats will only be
595 calculated on those calls that match that filter.
596 Example: -z "h225,counter,ip.addr==1.2.3.4" will collect stats
598 only for H.225 packets exchanged by the host at IP address
599 1.2.3.4 .
600 -z h225,srt[,filter]
602 Collect request/response SRT (Service Response Time) data for
603 ITU-T H.225 RAS. Data collected is the number of calls of each
604 ITU-T H.225 RAS Message Type, Minimum SRT, Maximum SRT, Average
605 SRT, Minimum in Packet, and Maximum in Packet. You will also
606 get the number of Open Requests (Unresponded Requests),
607 Discarded Responses (Responses without matching request) and
608 Duplicate Messages.
609 Example: -z h225,srt
611 This option can be used multiple times on the command line.
613 If the optional filter is provided, the stats will only be
615 calculated on those calls that match that filter.
616 Example: -z "h225,srt,ip.addr==1.2.3.4" will collect stats only
618 for ITU-T H.225 RAS packets exchanged by the host at IP address
619 1.2.3.4 .
620 -z io,stat
622 Collect packet/bytes statistics for the capture in intervals of
623 1 second. This option will open a window with up to 5 color-
624 coded graphs where number-of-packets-per-second or number-of-
625 bytes-per-second statistics can be calculated and displayed.
626 This option can be used multiple times on the command line.
628 This graph window can also be opened from the
630 Analyze:Statistics:Traffic:IO-Stat menu item.
631 -z ldap,srt[,filter]
633 Collect call/reply SRT (Service Response Time) data for LDAP.
634 Data collected is the number of calls for each implemented LDAP
635 command, MinSRT, MaxSRT and AvgSRT.
636 Example: -z ldap,srt will calculate the Service Response Time
638 as the time delta between the Request and the Response.
639 The data will be presented as separate tables for all
641 implemented LDAP commands, Only those commands that are seen in
642 the capture will have its stats displayed.
643 This option can be used multiple times on the command line.
645 If the optional filter is provided, the stats will only be
647 calculated on those calls that match that filter.
648 Example: use -z "ldap,srt,ip.addr==10.1.1.1" will collect stats
650 only for LDAP packets exchanged by the host at IP address
651 10.1.1.1 .
652 The only LDAP commands that are currently implemented and for
654 which the stats will be available are: BIND SEARCH MODIFY ADD
655 DELETE MODRDN COMPARE EXTENDED
656 -z megaco,srt[,filter]
658 Collect request/response SRT (Service Response Time) data for
659 MEGACO. (This is similar to -z smb,srt). Data collected is
660 the number of calls for each known MEGACO Command, Minimum SRT,
661 Maximum SRT and Average SRT.
662 Example: -z megaco,srt
664 This option can be used multiple times on the command line.
666 If the optional filter is provided, the stats will only be
668 calculated on those calls that match that filter.
669 Example: -z "megaco,srt,ip.addr==1.2.3.4" will collect stats
671 only for MEGACO packets exchanged by the host at IP address
672 1.2.3.4 .
673 -z mgcp,srt[,filter]
675 Collect request/response SRT (Service Response Time) data for
676 MGCP. (This is similar to -z smb,srt). Data collected is the
677 number of calls for each known MGCP Type, Minimum SRT, Maximum
678 SRT and Average SRT.
679 Example: -z mgcp,srt
681 This option can be used multiple times on the command line.
683 If the optional filter is provided, the stats will only be
685 calculated on those calls that match that filter.
686 Example: -z "mgcp,srt,ip.addr==1.2.3.4" will collect stats only
688 for MGCP packets exchanged by the host at IP address 1.2.3.4 .
689 -z rpc,programs
691 Collect call/reply SRT data for all known ONC-RPC
692 programs/versions. Data collected is the number of calls for
693 each protocol/version, MinSRT, MaxSRT and AvgSRT.
694 -z rpc,srt,program,version[,<filter>]
696 Collect call/reply SRT (Service Response Time) data for
697 program/version. Data collected is the number of calls for
698 each procedure, MinSRT, MaxSRT and AvgSRT.
699 Example: -z rpc,srt,100003,3 will collect data for NFS v3.
701 This option can be used multiple times on the command line.
703 If the optional filter is provided, the stats will only be
705 calculated on those calls that match that filter.
706 Example: -z rpc,srt,100003,3,nfs.fh.hash==0x12345678 will
708 collect NFS v3 SRT statistics for a specific file.
709 -z scsi,srt,cmdset[,<filter>]
711 Collect call/reply SRT (Service Response Time) data for SCSI
712 commandset <cmdset>.
713 Commandsets are 0:SBC 1:SSC 5:MMC
715 Data collected is the number of calls for each procedure,
717 MinSRT, MaxSRT and AvgSRT.
718 Example: -z scsi,srt,0 will collect data for SCSI BLOCK
720 COMMANDS (SBC).
721 This option can be used multiple times on the command line.
723 If the optional filter is provided, the stats will only be
725 calculated on those calls that match that filter.
726 Example: -z scsi,srt,0,ip.addr==1.2.3.4 will collect SCSI SBC
728 SRT statistics for a specific iscsi/ifcp/fcip host.
729 -z sip,stat[,filter]
731 This option will activate a counter for SIP messages. You will
732 get the number of occurrences of each SIP Method and of each
733 SIP Status-Code. Additionally you also get the number of
734 resent SIP Messages (only for SIP over UDP).
735 Example: -z sip,stat
737 This option can be used multiple times on the command line.
739 If the optional filter is provided, the stats will only be
741 calculated on those calls that match that filter.
742 Example: -z "sip,stat,ip.addr==1.2.3.4" will collect stats only
744 for SIP packets exchanged by the host at IP address 1.2.3.4 .
745 -z smb,srt[,filter]
747 Collect call/reply SRT (Service Response Time) data for SMB.
748 Data collected is the number of calls for each SMB command,
749 MinSRT, MaxSRT and AvgSRT.
750 Example: -z smb,srt
752 The data will be presented as separate tables for all normal
754 SMB commands, all Transaction2 commands and all NT Transaction
755 commands. Only those commands that are seen in the capture
756 will have their stats displayed. Only the first command in a
757 xAndX command chain will be used in the calculation. So for
758 common SessionSetupAndX + TreeConnectAndX chains, only the
759 SessionSetupAndX call will be used in the statistics. This is
760 a flaw that might be fixed in the future.
761 This option can be used multiple times on the command line.
763 If the optional filter is provided, the stats will only be
765 calculated on those calls that match that filter.
766 Example: -z "smb,srt,ip.addr==1.2.3.4" will collect stats only
768 for SMB packets exchanged by the host at IP address 1.2.3.4 .
769 -z voip,calls
771 This option will show a window that shows VoIP calls found in
772 the capture file. This is the same window shown as when you go
773 to the Statistics Menu and choose VoIP Calls.
774 Example: -z voip,calls
776
778 MENU ITEMS
779 File:Open
780 File:Open Recent
781 File:Merge
782 Merge another capture file to the currently loaded one. The
783 File:Merge dialog box allows the merge "Prepended",
784 "Chronologically" or "Appended", relative to the already loaded
785 one.
786 File:Close
788 Open or close a capture file. The File:Open dialog box allows a
789 filter to be specified; when the capture file is read, the filter
790 is applied to all packets read from the file, and packets not
791 matching the filter are discarded. The File:Open Recent is a
792 submenu and will show a list of previously opened files.
793 File:Save
795 File:Save As
796 Save the current capture, or the packets currently displayed from
797 that capture, to a file. Check boxes let you select whether to
798 save all packets, or just those that have passed the current
799 display filter and/or those that are currently marked, and an
800 option menu lets you select (from a list of file formats in which
801 at particular capture, or the packets currently displayed from that
802 capture, can be saved), a file format in which to save it.
803 File:File Set:List Files
805 Show a dialog box that lists all files of the file set matching the
806 currently loaded file. A file set is a compound of files resulting
807 from a capture using the "multiple files" / "ringbuffer" mode,
808 recognizable by the filename pattern, e.g.:
809 Filename_00001_20050604101530.pcap.
810 File:File Set:Next File
812 File:File Set:Previous File
813 If the currently loaded file is part of a file set (see above),
814 open the next / previous file in that set.
815 File:Export
817 Export captured data into an external format. Note: the data
818 cannot be imported back into Wireshark, so be sure to keep the
819 capture file.
820 File:Print
822 Print packet data from the current capture. You can select the
823 range of packets to be printed (which packets are printed), and the
824 output format of each packet (how each packet is printed). The
825 output format will be similar to the displayed values, so a summary
826 line, the packet details view, and/or the hex dump of the packet
827 can be printed.
828 Printing options can be set with the Edit:Preferences menu item, or
830 in the dialog box popped up by this menu item.
831 File:Quit
833 Exit the application.
834 Edit:Copy:Description
836 Copies the description of the selected field in the protocol tree
837 to the clipboard.
838 Edit:Copy:Fieldname
840 Copies the fieldname of the selected field in the protocol tree to
841 the clipboard.
842 Edit:Copy:Value
844 Copies the value of the selected field in the protocol tree to the
845 clipboard.
846 Edit:Copy:As Filter
848 Create a display filter based on the data currently highlighted in
849 the packet details and copy that filter to the clipboard.
850 If that data is a field that can be tested in a display filter
852 expression, the display filter will test that field; otherwise, the
853 display filter will be based on the absolute offset within the
854 packet. Therefore it could be unreliable if the packet contains
855 protocols with variable-length headers, such as a source-routed
856 token-ring packet.
857 Edit:Find Packet
859 Search forward or backward, starting with the currently selected
860 packet (or the most recently selected packet, if no packet is
861 selected). Search criteria can be a display filter expression, a
862 string of hexadecimal digits, or a text string.
863 When searching for a text string, you can search the packet data,
865 or you can search the text in the Info column in the packet list
866 pane or in the packet details pane.
867 Hexadecimal digits can be separated by colons, periods, or dashes.
869 Text string searches can be ASCII or Unicode (or both), and may be
870 case insensitive.
871 Edit:Find Next
873 Edit:Find Previous
874 Search forward / backward for a packet matching the filter from the
875 previous search, starting with the currently selected packet (or
876 the most recently selected packet, if no packet is selected).
877 Edit:Mark Packet (toggle)
879 Mark (or unmark if currently marked) the selected packet. The
880 field "frame.marked" is set for packets that are marked, so that,
881 for example, a display filters can be used to display only marked
882 packets, and so that the "Edit:Find Packet" dialog can be used to
883 find the next or previous marked packet.
884 Edit:Find Next Mark
886 Edit:Find Previous Mark
887 Find next/previous marked packet.
888 Edit:Mark All Packets
890 Edit:Unmark All Packets
891 Mark / Unmark all packets that are currently displayed.
892 Edit:Time Reference:Set Time Reference (toggle)
894 Set (or unset if currently set) the selected packet as a Time
895 Reference packet. When a packet is set as a Time Reference packet,
896 the timestamps in the packet list pane will be replaced with the
897 string "*REF*". The relative time timestamp in later packets will
898 then be calculated relative to the timestamp of this Time Reference
899 packet and not the first packet in the capture.
900 Packets that have been selected as Time Reference packets will
902 always be displayed in the packet list pane. Display filters will
903 not affect or hide these packets.
904 If there is a column displayed for "Cumulative Bytes" this counter
906 will be reset at every Time Reference packet.
907 Edit:Time Reference:Find Next
909 Edit:Time Reference:Find Previous
910 Search forward / backward for a time referenced packet.
911 Edit:Configuration Profiles
913 Manage configuration profiles to be able to use more than one set
914 of preferences and configurations.
915 Edit:Preferences
917 Set the GUI, capture, printing and protocol options (see
918 "Preferences" dialog below).
919 View:Main Toolbar
921 View:Filter Toolbar
922 View:Statusbar
923 Show or hide the main window controls.
924 View:Packet List
926 View:Packet Details
927 View:Packet Bytes
928 Show or hide the main window panes.
929 View:Time Display Format
931 Set the format of the packet timestamp displayed in the packet list
932 window.
933 View:Name Resolution:Resolve Name
935 Try to resolve a name for the currently selected item.
936 View:Name Resolution:Enable for ... Layer
938 Enable or disable translation of addresses to names in the display.
939 View:Colorize Packet List
941 Enable or disable the coloring rules. Disabling will improve
942 performance.
943 View:Auto Scroll in Live Capture
945 Enable or disable the automatic scrolling of the packet list while
946 a live capture is in progress.
947 View:Zoom In
949 View:Zoom Out
950 Zoom into / out of the main window data (by changing the font
951 size).
952 View:Normal Size
954 Reset the zoom factor of zoom in / zoom out back to normal font
955 size.
956 View:Resize All Columns
958 Resize all columns to best fit the current packet display.
959 View:Expand Subtrees
961 Expands the currently selected item and it's subtrees in the packet
962 details.
963 View:Expand All
965 View:Collapse All
966 Expand / Collapse all branches of the packet details.
967 View:Colorize Conversation
969 Select color for a conversation.
970 View:Reset Coloring 1-10
972 Reset Color for a conversation.
973 View:Coloring Rules
975 Change the foreground and background colors of the packet
976 information in the list of packets, based upon display filters.
977 The list of display filters is applied to each packet sequentially.
978 After the first display filter matches a packet, any additional
979 display filters in the list are ignored. Therefore, if you are
980 filtering on the existence of protocols, you should list the
981 higher-level protocols first, and the lower-level protocols last.
982 How Colorization Works
984 Packets are colored according to a list of color filters. Each
985 filter consists of a name, a filter expression and a
986 coloration. A packet is colored according to the first filter
987 that it matches. Color filter expressions use exactly the same
988 syntax as display filter expressions.
989 When Wireshark starts, the color filters are loaded from:
991 1. The user's personal color filters file or, if that does not
993 exist,
994 2. The global color filters file.
996 If neither of these exist then the packets will not be colored.
998 View:Show Packet In New Window
1000 Create a new window containing a packet details view and a hex dump
1001 window of the currently selected packet; this window will continue
1002 to display that packet's details and data even if another packet is
1003 selected.
1004 View:Reload
1006 Reload a capture file. Same as File:Close and File:Open the same
1007 file again.
1008 Go:Back
1010 Go back in previously visited packets history.
1011 Go:Forward
1013 Go forward in previously visited packets history.
1014 Go:Go To Packet
1016 Go to a particular numbered packet.
1017 Go:Go To Corresponding Packet
1019 If a field in the packet details pane containing a packet number is
1020 selected, go to the packet number specified by that field. (This
1021 works only if the dissector that put that entry into the packet
1022 details put it into the details as a filterable field rather than
1023 just as text.) This can be used, for example, to go to the packet
1024 for the request corresponding to a reply, or the reply
1025 corresponding to a request, if that packet number has been put into
1026 the packet details.
1027 Go:Previous Packet
1029 Go:Next Packet
1030 Go:First Packet
1031 Go:Last Packet
1032 Go to the previous / next / first / last packet in the capture.
1033 Go:Previous Packet In Conversation
1035 Go:Next Packet In Conversation
1036 Go to the previous / next packet of the conversation (TCP, UDP or
1037 IP)
1038 Capture:Interfaces
1040 Shows a dialog box with all currently known interfaces and
1041 displaying the current network traffic amount. Capture sessions
1042 can be started from here. Beware: keeping this box open results in
1043 high system load!
1044 Capture:Options
1046 Initiate a live packet capture (see "Capture Options Dialog"
1047 below). If no filename is specified, a temporary file will be
1048 created to hold the capture. The location of the file can be
1049 chosen by setting your TMPDIR environment variable before starting
1050 Wireshark. Otherwise, the default TMPDIR location is system-
1051 dependent, but is likely either /var/tmp or /tmp.
1052 Capture:Start
1054 Start a live packet capture with the previously selected options.
1055 This won't open the options dialog box, and can be convenient for
1056 repeatedly capturing with the same options.
1057 Capture:Stop
1059 Stop a running live capture.
1060 Capture:Restart
1062 While a live capture is running, stop it and restart with the same
1063 options again. This can be convenient to remove irrelevant
1064 packets, if no valuable packets were captured so far.
1065 Capture:Capture Filters
1067 Edit the saved list of capture filters, allowing filters to be
1068 added, changed, or deleted.
1069 Analyze:Display Filters
1071 Edit the saved list of display filters, allowing filters to be
1072 added, changed, or deleted.
1073 Analyze:Display Filter Macros
1075 Create shortcuts for complex macros
1076 Analyze:Apply as Filter
1078 Create a display filter based on the data currently highlighted in
1079 the packet details and apply the filter.
1080 If that data is a field that can be tested in a display filter
1082 expression, the display filter will test that field; otherwise, the
1083 display filter will be based on the absolute offset within the
1084 packet. Therefore it could be unreliable if the packet contains
1085 protocols with variable-length headers, such as a source-routed
1086 token-ring packet.
1087 The Selected option creates a display filter that tests for a match
1089 of the data; the Not Selected option creates a display filter that
1090 tests for a non-match of the data. The And Selected, Or Selected,
1091 And Not Selected, and Or Not Selected options add to the end of the
1092 display filter in the strip at the top (or bottom) an AND or OR
1093 operator followed by the new display filter expression.
1094 Analyze:Prepare a Filter
1096 Create a display filter based on the data currently highlighted in
1097 the packet details. The filter strip at the top (or bottom) is
1098 updated but it is not yet applied.
1099 Analyze:Enabled Protocols
1101 Allow protocol dissection to be enabled or disabled for a specific
1102 protocol. Individual protocols can be enabled or disabled by
1103 clicking on them in the list or by highlighting them and pressing
1104 the space bar. The entire list can be enabled, disabled, or
1105 inverted using the buttons below the list.
1106 When a protocol is disabled, dissection in a particular packet
1108 stops when that protocol is reached, and Wireshark moves on to the
1109 next packet. Any higher-layer protocols that would otherwise have
1110 been processed will not be displayed. For example, disabling TCP
1111 will prevent the dissection and display of TCP, HTTP, SMTP, Telnet,
1112 and any other protocol exclusively dependent on TCP.
1113 The list of protocols can be saved, so that Wireshark will start up
1115 with the protocols in that list disabled.
1116 Analyze:Decode As
1118 If you have a packet selected, present a dialog allowing you to
1119 change which dissectors are used to decode this packet. The dialog
1120 has one panel each for the link layer, network layer and transport
1121 layer protocol/port numbers, and will allow each of these to be
1122 changed independently. For example, if the selected packet is a
1123 TCP packet to port 12345, using this dialog you can instruct
1124 Wireshark to decode all packets to or from that TCP port as HTTP
1125 packets.
1126 Analyze:User Specified Decodes
1128 Create a new window showing whether any protocol ID to dissector
1129 mappings have been changed by the user. This window also allows
1130 the user to reset all decodes to their default values.
1131 Analyze:Follow TCP Stream
1133 If you have a TCP packet selected, display the contents of the data
1134 stream for the TCP connection to which that packet belongs, as
1135 text, in a separate window, and leave the list of packets in a
1136 filtered state, with only those packets that are part of that TCP
1137 connection being displayed. You can revert to your old view by
1138 pressing ENTER in the display filter text box, thereby invoking
1139 your old display filter (or resetting it back to no display
1140 filter).
1141 The window in which the data stream is displayed lets you select:
1143 · whether to display the entire conversation, or one or the
1145 other side of it;
1146 · whether the data being displayed is to be treated as ASCII
1148 or EBCDIC text or as raw hex data;
1149 and lets you print what's currently being displayed, using the same
1151 print options that are used for the File:Print Packet menu item, or
1152 save it as text to a file.
1153 Analyze:Follow UDP Stream
1155 Analyze:Follow SSL Stream
1156 (Similar to Analyze:Follow TCP Stream)
1157 Analyze:Expert Info
1159 Analyze:Expert Info Composite
1160 (Kind of) a log of anomalies found by Wireshark in a capture file.
1161 Analyze:Conversation Filter
1163 Statistics:Summary
1164 Show summary information about the capture, including elapsed time,
1165 packet counts, byte counts, and the like. If a display filter is
1166 in effect, summary information will be shown about the capture and
1167 about the packets currently being displayed.
1168 Statistics:Protocol Hierarchy
1170 Show the number of packets, and the number of bytes in those
1171 packets, for each protocol in the trace. It organizes the
1172 protocols in the same hierarchy in which they were found in the
1173 trace. Besides counting the packets in which the protocol exists,
1174 a count is also made for packets in which the protocol is the last
1175 protocol in the stack. These last-protocol counts show you how
1176 many packets (and the byte count associated with those packets)
1177 ended in a particular protocol. In the table, they are listed
1178 under "End Packets" and "End Bytes".
1179 Statistics:Conversations
1181 Lists of conversations; selectable by protocol. See
1182 Statistics:Conversation List below.
1183 Statistics:End Points
1185 List of End Point Addresses by protocol with packets/bytes/....
1186 counts.
1187 Statistics:Packet Lengths
1189 Grouped counts of packet lengths (0-19 bytes, 20-39 bytes, ...)
1190 Statistics:IO Graphs
1192 Open a window where up to 5 graphs in different colors can be
1193 displayed to indicate number of packets or number of bytes per
1194 second for all packets matching the specified filter. By default
1195 only one graph will be displayed showing number of packets per
1196 second.
1197 The top part of the window contains the graphs and scales for the X
1199 and Y axis. If the graph is too long to fit inside the window
1200 there is a horizontal scrollbar below the drawing area that can
1201 scroll the graphs to the left or the right. The horizontal axis
1202 displays the time into the capture and the vertical axis will
1203 display the measured quantity at that time.
1204 Below the drawing area and the scrollbar are the controls. On the
1206 bottom left there will be five similar sets of controls to control
1207 each individual graph such as "Display:<button>" which button will
1208 toggle that individual graph on/off. If <button> is ticked, the
1209 graph will be displayed. "Color:<color>" which is just a button to
1210 show which color will be used to draw that graph (color is only
1211 available in Gtk2 version) and finally "Filter:<filter-text>" which
1212 can be used to specify a display filter for that particular graph.
1213 If filter-text is empty then all packets will be used to calculate
1215 the quantity for that graph. If filter-text is specified only
1216 those packets that match that display filter will be considered in
1217 the calculation of quantity.
1218 To the right of the 5 graph controls there are four menus to
1220 control global aspects of the draw area and graphs. The "Unit:"
1221 menu is used to control what to measure; "packets/tick",
1222 "bytes/tick" or "advanced..."
1223 packets/tick will measure the number of packets matching the (if
1225 specified) display filter for the graph in each measurement
1226 interval.
1227 bytes/tick will measure the total number of bytes in all packets
1229 matching the (if specified) display filter for the graph in each
1230 measurement interval.
1231 advanced... see below
1233 "Tick interval:" specifies what measurement intervals to use. The
1235 default is 1 second and means that the data will be counted over 1
1236 second intervals.
1237 "Pixels per tick:" specifies how many pixels wide each measurement
1239 interval will be in the drawing area. The default is 5 pixels per
1240 tick.
1241 "Y-scale:" controls the max value for the y-axis. Default value is
1243 "auto" which means that Wireshark will try to adjust the maxvalue
1244 automatically.
1245 "advanced..." If Unit:advanced... is selected the window will
1247 display two more controls for each of the five graphs. One control
1248 will be a menu where the type of calculation can be selected from
1249 SUM,COUNT,MAX,MIN,AVG and LOAD, and one control, textbox, where the
1250 name of a single display filter field can be specified.
1251 The following restrictions apply to type and field combinations:
1253 SUM: available for all types of integers and will calculate the SUM
1255 of all occurrences of this field in the measurement interval. Note
1256 that some field can occur multiple times in the same packet and
1257 then all instances will be summed up. Example: 'tcp.len' which
1258 will count the amount of payload data transferred across TCP in
1259 each interval.
1260 COUNT: available for all field types. This will COUNT the number
1262 of times certain field occurs in each interval. Note that some
1263 fields may occur multiple times in each packet and if that is the
1264 case then each instance will be counted independently and COUNT
1265 will be greater than the number of packets.
1266 MAX: available for all integer and relative time fields. This will
1268 calculate the max seen integer/time value seen for the field during
1269 the interval. Example: 'smb.time' which will plot the maximum SMB
1270 response time.
1271 MIN: available for all integer and relative time fields. This will
1273 calculate the min seen integer/time value seen for the field during
1274 the interval. Example: 'smb.time' which will plot the minimum SMB
1275 response time.
1276 AVG: available for all integer and relative time fields.This will
1278 calculate the average seen integer/time value seen for the field
1279 during the interval. Example: 'smb.time' which will plot the
1280 average SMB response time.
1281 LOAD: available only for relative time fields (response times).
1283 Example of advanced: Display how NFS response time MAX/MIN/AVG
1285 changes over time:
1286 Set first graph to:
1288 filter:nfs&&rpc.time
1290 Calc:MAX rpc.time
1291 Set second graph to
1293 filter:nfs&&rpc.time
1295 Calc:AVG rpc.time
1296 Set third graph to
1298 filter:nfs&&rpc.time
1300 Calc:MIN rpc.time
1301 Example of advanced: Display how the average packet size from host
1303 a.b.c.d changes over time.
1304 Set first graph to
1306 filter:ip.addr==a.b.c.d&&frame.pkt_len
1308 Calc:AVG frame.pkt_len
1309 LOAD: The LOAD io-stat type is very different from anything you
1311 have ever seen before! While the response times themselves as
1312 plotted by MIN,MAX,AVG are indications on the Server load (which
1313 affects the Server response time), the LOAD measurement measures
1314 the Client LOAD. What this measures is how much workload the
1315 client generates, i.e. how fast will the client issue new commands
1316 when the previous ones completed. i.e. the level of concurrency
1317 the client can maintain. The higher the number, the more and
1318 faster is the client issuing new commands. When the LOAD goes
1319 down, it may be due to client load making the client slower in
1320 issuing new commands (there may be other reasons as well, maybe the
1321 client just doesn't have any commands it wants to issue right
1322 then).
1323 Load is measured in concurrency/number of overlapping i/o and the
1325 value 1000 means there is a constant load of one i/o.
1326 In each tick interval the amount of overlap is measured. See the
1328 graph below containing three commands: Below the graph are the LOAD
1329 values for each interval that would be calculated.
1330 | | | | | | | | |
1332 | | | | | | | | |
1333 | | o=====* | | | | | |
1334 | | | | | | | | |
1335 | o========* | o============* | | |
1336 | | | | | | | | |
1337 --------------------------------------------------> Time
1338 500 1500 500 750 1000 500 0 0
1339 Statistics:Conversation List
1341 This option will open a new window that displays a list of all
1342 conversations between two endpoints. The list has one row for each
1343 unique conversation and displays total number of packets/bytes seen
1344 as well as number of packets/bytes in each direction.
1345 By default the list is sorted according to the number of packets
1347 but by clicking on the column header; it is possible to re-sort the
1348 list in ascending or descending order by any column.
1349 By first selecting a conversation by clicking on it and then using
1351 the right mouse button (on those platforms that have a right mouse
1352 button) wireshark will display a popup menu offering several
1353 different filter operations to apply to the capture.
1354 These statistics windows can also be invoked from the Wireshark
1356 command line using the -z conv argument.
1357 Statistics:Service Response Time
1359 · AFP
1360 · CAMEL
1362 · DCE-RPC
1364 Open a window to display Service Response Time statistics for
1366 an arbitrary DCE-RPC program interface and display Procedure,
1367 Number of Calls, Minimum SRT, Maximum SRT and Average SRT for
1368 all procedures for that program/version. These windows opened
1369 will update in semi-real time to reflect changes when doing
1370 live captures or when reading new capture files into Wireshark.
1371 This dialog will also allow an optional filter string to be
1373 used. If an optional filter string is used only such DCE-RPC
1374 request/response pairs that match that filter will be used to
1375 calculate the statistics. If no filter string is specified all
1376 request/response pairs will be used.
1377 · Diameter
1379 · Fibre Channel
1381 Open a window to display Service Response Time statistics for
1383 Fibre Channel and display FC Type, Number of Calls, Minimum
1384 SRT, Maximum SRT and Average SRT for all FC types. These
1385 windows opened will update in semi-real time to reflect changes
1386 when doing live captures or when reading new capture files into
1387 Wireshark. The Service Response Time is calculated as the time
1388 delta between the First packet of the exchange and the Last
1389 packet of the exchange.
1390 This dialog will also allow an optional filter string to be
1392 used. If an optional filter string is used only such FC
1393 first/last exchange pairs that match that filter will be used
1394 to calculate the statistics. If no filter string is specified
1395 all request/response pairs will be used.
1396 · GTP
1398 · H.225 RAS
1400 Collect requests/response SRT (Service Response Time) data for
1402 ITU-T H.225 RAS. Data collected is number of calls for each
1403 known ITU-T H.225 RAS Message Type, Minimum SRT, Maximum SRT,
1404 Average SRT, Minimum in Packet, and Maximum in Packet. You
1405 will also get the number of Open Requests (Unresponded
1406 Requests), Discarded Responses (Responses without matching
1407 request) and Duplicate Messages. These windows opened will
1408 update in semi-real time to reflect changes when doing live
1409 captures or when reading new capture files into Wireshark.
1410 You can apply an optional filter string in a dialog box, before
1412 starting the calculation. The statistics will only be
1413 calculated on those calls matching that filter.
1414 · LDAP
1416 · MEGACO
1418 · MGCP
1420 Collect requests/response SRT (Service Response Time) data for
1422 MGCP. Data collected is number of calls for each known MGCP
1423 Type, Minimum SRT, Maximum SRT, Average SRT, Minimum in Packet,
1424 and Maximum in Packet. These windows opened will update in
1425 semi-real time to reflect changes when doing live captures or
1426 when reading new capture files into Wireshark.
1427 You can apply an optional filter string in a dialog box, before
1429 starting the calculation. The statistics will only be
1430 calculated on those calls matching that filter.
1431 · NCP
1433 · ONC-RPC
1435 Open a window to display statistics for an arbitrary ONC-RPC
1437 program interface and display Procedure, Number of Calls,
1438 Minimum SRT, Maximum SRT and Average SRT for all procedures for
1439 that program/version. These windows opened will update in
1440 semi-real time to reflect changes when doing live captures or
1441 when reading new capture files into Wireshark.
1442 This dialog will also allow an optional filter string to be
1444 used. If an optional filter string is used only such ONC-RPC
1445 request/response pairs that match that filter will be used to
1446 calculate the statistics. If no filter string is specified all
1447 request/response pairs will be used.
1448 By first selecting a conversation by clicking on it and then
1450 using the right mouse button (on those platforms that have a
1451 right mouse button) wireshark will display a popup menu
1452 offering several different filter operations to apply to the
1453 capture.
1454 · RADIUS
1456 · SCSI
1458 · SMB
1460 Collect call/reply SRT (Service Response Time) data for SMB.
1462 Data collected is the number of calls for each SMB command,
1463 MinSRT, MaxSRT and AvgSRT.
1464 The data will be presented as separate tables for all normal
1466 SMB commands, all Transaction2 commands and all NT Transaction
1467 commands. Only those commands that are seen in the capture
1468 will have its stats displayed. Only the first command in a
1469 xAndX command chain will be used in the calculation. So for
1470 common SessionSetupAndX + TreeConnectAndX chains, only the
1471 SessionSetupAndX call will be used in the statistics. This is
1472 a flaw that might be fixed in the future.
1473 You can apply an optional filter string in a dialog box, before
1475 starting the calculation. The stats will only be calculated on
1476 those calls matching that filter.
1477 By first selecting a conversation by clicking on it and then
1479 using the right mouse button (on those platforms that have a
1480 right mouse button) wireshark will display a popup menu
1481 offering several different filter operations to apply to the
1482 capture.
1483 · SMB2
1485 Statistics:BOOTP-DHCP
1487 Statistics:Compare
1488 Compare two Capture Files
1489 Statistics:Flow Graph
1491 Flow Graph: General/TCP
1492 Statistics:HTTP
1494 HTTP Load Distribution, Packet Counter & Requests
1495 Statistics:IP Addresses
1497 Count/Rate/Percent by IP Address
1498 Statistics:IP Destinations
1500 Count/Rate/Percent by IP Address/protocol/port
1501 Statistics:IP Protocol Types
1503 Count/Rate/Percent by IP Protocol Types
1504 Statistics:ONC-RPC Programs
1506 This dialog will open a window showing aggregated SRT statistics
1507 for all ONC-RPC Programs/versions that exist in the capture file.
1508 Statistics:TCP Stream Graph
1510 Graphs: Round Trip; Throughput; Time-Sequence (Stevens); Time-
1511 Sequence (tcptrace)
1512 Statistics:UDP Multicast streams
1514 Multicast Streams Counts/Rates/... by Source/Destination
1515 Address/Port pairs
1516 Statistics:WLAN Traffic
1518 WLAN Traffic Statistics
1519 Telephony:ITU-T H.225
1521 Count ITU-T H.225 messages and their reasons. In the first column
1522 you get a list of H.225 messages and H.225 message reasons, which
1523 occur in the current capture file. The number of occurrences of
1524 each message or reason will be displayed in the second column.
1525 This window opened will update in semi-real time to reflect changes
1526 when doing live captures or when reading new capture files into
1527 Wireshark.
1528 You can apply an optional filter string in a dialog box, before
1530 starting the counter. The statistics will only be calculated on
1531 those calls matching that filter.
1532 Telephony:SIP
1534 Activate a counter for SIP messages. You will get the number of
1535 occurrences of each SIP Method and of each SIP Status-Code.
1536 Additionally you also get the number of resent SIP Messages (only
1537 for SIP over UDP).
1538 This window opened will update in semi-real time to reflect changes
1540 when doing live captures or when reading new capture files into
1541 Wireshark.
1542 You can apply an optional filter string in a dialog box, before
1544 starting the counter. The statistics will only be calculated on
1545 those calls matching that filter.
1546 Tools:Firewall ACL Rules
1548 Help:Contents
1549 Some help texts.
1550 Help:Supported Protocols
1552 List of supported protocols and display filter protocol fields.
1553 Help:Manual Pages
1555 Display locally installed HTML versions of these manual pages in a
1556 web browser.
1557 Help:Wireshark Online
1559 Various links to online resources to be open in a web browser, like
1560 <http://www.wireshark.org>.
1561 Help:About Wireshark
1563 See various information about Wireshark (see "About" dialog below),
1564 like the version, the folders used, the available plugins, ...
1565 WINDOWS
1567 Main Window
1568 The main window contains the usual things like the menu, some
1569 toolbars, the main area and a statusbar. The main area is split
1570 into three panes, you can resize each pane using a "thumb" at the
1571 right end of each divider line.
1572 The main window is much more flexible than before. The layout of
1574 the main window can be customized by the Layout page in the dialog
1575 box popped up by Edit:Preferences, the following will describe the
1576 layout with the default settings.
1577 Main Toolbar
1579 Some menu items are available for quick access here. There
1580 is no way to customize the items in the toolbar, however the
1581 toolbar can be hidden by View:Main Toolbar.
1582 Filter Toolbar
1584 A display filter can be entered into the filter toolbar. A
1585 filter for HTTP, HTTPS, and DNS traffic might look like this:
1586 tcp.port == 80 || tcp.port == 443 || tcp.port == 53
1588 Selecting the Filter: button lets you choose from a list of
1590 named filters that you can optionally save. Pressing the
1591 Return or Enter keys, or selecting the Apply button, will
1592 cause the filter to be applied to the current list of
1593 packets. Selecting the Reset button clears the display
1594 filter so that all packets are displayed (again).
1595 There is no way to customize the items in the toolbar,
1597 however the toolbar can be hidden by View:Filter Toolbar.
1598 Packet List Pane
1600 The top pane contains the list of network packets that you
1601 can scroll through and select. By default, the packet
1602 number, packet timestamp, source and destination addresses,
1603 protocol, and description are displayed for each packet; the
1604 Columns page in the dialog box popped up by Edit:Preferences
1605 lets you change this (although, unfortunately, you currently
1606 have to save the preferences, and exit and restart Wireshark,
1607 for those changes to take effect).
1608 If you click on the heading for a column, the display will be
1610 sorted by that column; clicking on the heading again will
1611 reverse the sort order for that column.
1612 An effort is made to display information as high up the
1614 protocol stack as possible, e.g. IP addresses are displayed
1615 for IP packets, but the MAC layer address is displayed for
1616 unknown packet types.
1617 The right mouse button can be used to pop up a menu of
1619 operations.
1620 The middle mouse button can be used to mark a packet.
1622 Packet Details Pane
1624 The middle pane contains a display of the details of the
1625 currently-selected packet. The display shows each field and
1626 its value in each protocol header in the stack. The right
1627 mouse button can be used to pop up a menu of operations.
1628 Packet Bytes Pane
1630 The lowest pane contains a hex and ASCII dump of the actual
1631 packet data. Selecting a field in the packet details
1632 highlights the corresponding bytes in this section.
1633 The right mouse button can be used to pop up a menu of
1635 operations.
1636 Statusbar
1638 The statusbar is divided into three parts, on the left some
1639 context dependent things are shown, like information about
1640 the loaded file, in the center the number of packets are
1641 displayed, and on the right the current configuration
1642 profile.
1643 The statusbar can be hidden by View:Statusbar.
1645 Preferences
1647 The Preferences dialog lets you control various personal
1648 preferences for the behavior of Wireshark.
1649 User Interface Preferences
1651 The User Interface page is used to modify small aspects of
1652 the GUI to your own personal taste:
1653 Selection Bars
1655 The selection bar in the packet list and packet details
1656 can have either a "browse" or "select" behavior. If
1657 the selection bar has a "browse" behavior, the arrow
1658 keys will move an outline of the selection bar,
1659 allowing you to browse the rest of the list or details
1660 without changing the selection until you press the
1661 space bar. If the selection bar has a "select"
1662 behavior, the arrow keys will move the selection bar
1663 and change the selection to the new item in the packet
1664 list or packet details.
1665 Save Window Position
1667 If this item is selected, the position of the main
1668 Wireshark window will be saved when Wireshark exits,
1669 and used when Wireshark is started again.
1670 Save Window Size
1672 If this item is selected, the size of the main
1673 Wireshark window will be saved when Wireshark exits,
1674 and used when Wireshark is started again.
1675 Save Window Maximized state
1677 If this item is selected the maximize state of the main
1678 Wireshark window will be saved when Wireshark exists,
1679 and used when Wireshark is started again.
1680 File Open Dialog Behavior
1682 This item allows the user to select how Wireshark
1683 handles the listing of the "File Open" Dialog when
1684 opening trace files. "Remember Last Directory" causes
1685 Wireshark to automatically position the dialog in the
1686 directory of the most recently opened file, even
1687 between launches of Wireshark. "Always Open in
1688 Directory" allows the user to define a persistent
1689 directory that the dialog will always default to.
1690 Directory
1692 Allows the user to specify a persistent File Open
1693 directory. Trailing slashes or backslashes will
1694 automatically be added.
1695 File Open Preview timeout
1697 This items allows the user to define how much time is
1698 spend reading the capture file to present preview data
1699 in the File Open dialog.
1700 Open Recent maximum list entries
1702 The File menu supports a recent file list. This items
1703 allows the user to specify how many files are kept
1704 track of in this list.
1705 Ask for unsaved capture files
1707 When closing a capture file or Wireshark itself if the
1708 file isn't saved yet the user is presented the option
1709 to save the file when this item is set.
1710 Wrap during find
1712 This items determines the behavior when reaching the
1713 beginning or the end of a capture file. When set the
1714 search wraps around and continues, otherwise it stops.
1715 Settings dialogs show a save button
1717 This item determines if the various dialogs sport an
1718 explicit Save button or that save is implicit in OK /
1719 Apply.
1720 Web browser command
1722 This entry specifies the command line to launch a web
1723 browser. It is used to access online content, like the
1724 Wiki and user guide. Use '%s' to place the request URL
1725 in the command line.
1726 Display LEDs in the Expert Infos dialog tab labels
1728 This item determines if LED-like colored images are
1729 displayed in the Expert Infos dialog tab labels.
1730 Layout Preferences
1732 The Layout page lets you specify the general layout of the
1733 main window. You can choose from six different layouts and
1734 fill the three panes with the contents you like.
1735 Scrollbars
1737 The vertical scrollbars in the three panes can be set
1738 to be either on the left or the right.
1739 Alternating row colors
1741 Hex Display
1742 The highlight method in the hex dump display for the
1743 selected protocol item can be set to use either inverse
1744 video, or bold characters.
1745 Toolbar style
1747 Filter toolbar placement
1748 Custom window title
1749 Column Preferences
1750 The Columns page lets you specify the number, title, and
1751 format of each column in the packet list.
1752 The Column title entry is used to specify the title of the
1754 column displayed at the top of the packet list. The type of
1755 data that the column displays can be specified using the
1756 Column format option menu. The row of buttons on the left
1757 perform the following actions:
1758 New Adds a new column to the list.
1760 Delete
1762 Deletes the currently selected list item.
1763 Up / Down
1765 Moves the selected list item up or down one position.
1766 Font Preferences
1768 The Font page lets you select the font to be used for most
1769 text.
1770 Color Preferences
1772 The Colors page can be used to change the color of the text
1773 displayed in the TCP stream window and for marked packets.
1774 To change a color, simply select an attribute from the "Set:"
1775 menu and use the color selector to get the desired color.
1776 The new text colors are displayed as a sample text.
1777 Capture Preferences
1779 The Capture page lets you specify various parameters for
1780 capturing live packet data; these are used the first time a
1781 capture is started.
1782 The Interface: combo box lets you specify the interface from
1784 which to capture packet data, or the name of a FIFO from
1785 which to get the packet data.
1786 The Data link type: option menu lets you, for some
1788 interfaces, select the data link header you want to see on
1789 the packets you capture. For example, in some OSes and with
1790 some versions of libpcap, you can choose, on an 802.11
1791 interface, whether the packets should appear as Ethernet
1792 packets (with a fake Ethernet header) or as 802.11 packets.
1793 The Limit each packet to ... bytes check box lets you set the
1795 snapshot length to use when capturing live data; turn on the
1796 check box, and then set the number of bytes to use as the
1797 snapshot length.
1798 The Filter: text entry lets you set a capture filter
1800 expression to be used when capturing.
1801 If any of the environment variables SSH_CONNECTION,
1803 SSH_CLIENT, REMOTEHOST, DISPLAY, or SESSIONNAME are set,
1804 Wireshark will create a default capture filter that excludes
1805 traffic from the hosts and ports defined in those variables.
1806 The Capture packets in promiscuous mode check box lets you
1808 specify whether to put the interface in promiscuous mode when
1809 capturing.
1810 The Update list of packets in real time check box lets you
1812 specify that the display should be updated as packets are
1813 seen.
1814 The Automatic scrolling in live capture check box lets you
1816 specify whether, in an "Update list of packets in real time"
1817 capture, the packet list pane should automatically scroll to
1818 show the most recently captured packets.
1819 Printing Preferences
1821 The radio buttons at the top of the Printing page allow you
1822 choose between printing packets with the File:Print Packet
1823 menu item as text or PostScript, and sending the output
1824 directly to a command or saving it to a file. The Command:
1825 text entry box, on UNIX-compatible systems, is the command to
1826 send files to (usually lpr), and the File: entry box lets you
1827 enter the name of the file you wish to save to.
1828 Additionally, you can select the File: button to browse the
1829 file system for a particular save file.
1830 Name Resolution Preferences
1832 The Enable MAC name resolution, Enable network name
1833 resolution and Enable transport name resolution check boxes
1834 let you specify whether MAC addresses, network addresses, and
1835 transport-layer port numbers should be translated to names.
1836 The Enable concurrent DNS name resolution allows Wireshark to
1838 send out multiple name resolution requests and not wait for
1839 the result before continuing dissection. This speeds up
1840 dissection with network name resolution but initially may
1841 miss resolutions. The number of concurrent requests can be
1842 set here as well.
1843 SMI paths
1845 SMI modules
1847 RTP Player Preferences
1849 This page allows you to select the number of channels visible
1850 in the RTP player window. It determines the height of the
1851 window, more channels are possible and visible by means of a
1852 scroll bar.
1853 Protocol Preferences
1855 There are also pages for various protocols that Wireshark
1856 dissects, controlling the way Wireshark handles those
1857 protocols.
1858 Edit Capture Filter List
1860 Edit Display Filter List
1861 Capture Filter
1862 Display Filter
1863 Read Filter
1864 Search Filter
1865 The Edit Capture Filter List dialog lets you create, modify, and
1866 delete capture filters, and the Edit Display Filter List dialog
1867 lets you create, modify, and delete display filters.
1868 The Capture Filter dialog lets you do all of the editing operations
1870 listed, and also lets you choose or construct a filter to be used
1871 when capturing packets.
1872 The Display Filter dialog lets you do all of the editing operations
1874 listed, and also lets you choose or construct a filter to be used
1875 to filter the current capture being viewed.
1876 The Read Filter dialog lets you do all of the editing operations
1878 listed, and also lets you choose or construct a filter to be used
1879 to as a read filter for a capture file you open.
1880 The Search Filter dialog lets you do all of the editing operations
1882 listed, and also lets you choose or construct a filter expression
1883 to be used in a find operation.
1884 In all of those dialogs, the Filter name entry specifies a
1886 descriptive name for a filter, e.g. Web and DNS traffic. The
1887 Filter string entry is the text that actually describes the
1888 filtering action to take, as described above.The dialog buttons
1889 perform the following actions:
1890 New If there is text in the two entry boxes, creates a new
1892 associated list item.
1893 Edit Modifies the currently selected list item to match what's in
1895 the entry boxes.
1896 Delete
1898 Deletes the currently selected list item.
1899 Add Expression...
1901 For display filter expressions, pops up a dialog box to allow
1902 you to construct a filter expression to test a particular
1903 field; it offers lists of field names, and, when appropriate,
1904 lists from which to select tests to perform on the field and
1905 values with which to compare it. In that dialog box, the OK
1906 button will cause the filter expression you constructed to be
1907 entered into the Filter string entry at the current cursor
1908 position.
1909 OK In the Capture Filter dialog, closes the dialog box and makes
1911 the filter in the Filter string entry the filter in the
1912 Capture Preferences dialog. In the Display Filter dialog,
1913 closes the dialog box and makes the filter in the Filter
1914 string entry the current display filter, and applies it to
1915 the current capture. In the Read Filter dialog, closes the
1916 dialog box and makes the filter in the Filter string entry
1917 the filter in the Open Capture File dialog. In the Search
1918 Filter dialog, closes the dialog box and makes the filter in
1919 the Filter string entry the filter in the Find Packet dialog.
1920 Apply Makes the filter in the Filter string entry the current
1922 display filter, and applies it to the current capture.
1923 Save If the list of filters being edited is the list of capture
1925 filters, saves the current filter list to the personal
1926 capture filters file, and if the list of filters being edited
1927 is the list of display filters, saves the current filter list
1928 to the personal display filters file.
1929 Close Closes the dialog without doing anything with the filter in
1931 the Filter string entry.
1932 The Color Filters Dialog
1934 This dialog displays a list of color filters and allows it to be
1935 modified.
1936 THE FILTER LIST
1938 Single rows may be selected by clicking. Multiple rows may be
1939 selected by using the ctrl and shift keys in combination with
1940 the mouse button.
1941 NEW Adds a new filter at the bottom of the list and opens the Edit
1943 Color Filter dialog box. You will have to alter the filter
1944 expression at least before the filter will be accepted. The
1945 format of color filter expressions is identical to that of
1946 display filters. The new filter is selected, so it may
1947 immediately be moved up and down, deleted or edited. To avoid
1948 confusion all filters are unselected before the new filter is
1949 created.
1950 EDIT
1952 Opens the Edit Color Filter dialog box for the selected filter.
1953 (If this button is disabled you may have more than one filter
1954 selected, making it ambiguous which is to be edited.)
1955 ENABLE
1957 Enables the selected color filter(s).
1958 DISABLE
1960 Disables the selected color filter(s).
1961 DELETE
1963 Deletes the selected color filter(s).
1964 EXPORT
1966 Allows you to choose a file in which to save the current list
1967 of color filters. You may also choose to save only the
1968 selected filters. A button is provided to save the filters in
1969 the global color filters file (you must have sufficient
1970 permissions to write this file, of course).
1971 IMPORT
1973 Allows you to choose a file containing color filters which are
1974 then added to the bottom of the current list. All the added
1975 filters are selected, so they may be moved to the correct
1976 position in the list as a group. To avoid confusion, all
1977 filters are unselected before the new filters are imported. A
1978 button is provided to load the filters from the global color
1979 filters file.
1980 CLEAR
1982 Deletes your personal color filters file, reloads the global
1983 color filters file, if any, and closes the dialog.
1984 UP Moves the selected filter(s) up the list, making it more likely
1986 that they will be used to color packets.
1987 DOWN
1989 Moves the selected filter(s) down the list, making it less
1990 likely that they will be used to color packets.
1991 OK Closes the dialog and uses the color filters as they stand.
1993 APPLY
1995 Colors the packets according to the current list of color
1996 filters, but does not close the dialog.
1997 SAVE
1999 Saves the current list of color filters in your personal color
2000 filters file. Unless you do this they will not be used the
2001 next time you start Wireshark.
2002 CLOSE
2004 Closes the dialog without changing the coloration of the
2005 packets. Note that changes you have made to the current list
2006 of color filters are not undone.
2007 Capture Options Dialog
2009 The Capture Options Dialog lets you specify various parameters for
2010 capturing live packet data.
2011 The Interface: field lets you specify the interface from which to
2013 capture packet data or a command from which to get the packet data
2014 via a pipe.
2015 The Link layer header type: field lets you specify the interfaces
2017 link layer header type. This field is usually disabled, as most
2018 interface have only one header type.
2019 The Capture packets in promiscuous mode check box lets you specify
2021 whether the interface should be put into promiscuous mode when
2022 capturing.
2023 The Limit each packet to ... bytes check box and field lets you
2025 specify a maximum number of bytes per packet to capture and save;
2026 if the check box is not checked, the limit will be 262144 bytes.
2027 The Capture Filter: entry lets you specify the capture filter using
2029 a tcpdump-style filter string as described above.
2030 The File: entry lets you specify the file into which captured
2032 packets should be saved, as in the Printer Options dialog above.
2033 If not specified, the captured packets will be saved in a temporary
2034 file; you can save those packets to a file with the File:Save As
2035 menu item.
2036 The Use multiple files check box lets you specify that the capture
2038 should be done in "multiple files" mode. This option is disabled,
2039 if the Update list of packets in real time option is checked.
2040 The Next file every ... megabyte(s) check box and fields lets you
2042 specify that a switch to a next file should be done if the
2043 specified filesize is reached. You can also select the appropriate
2044 unit, but beware that the filesize has a maximum of 2 GiB. The
2045 check box is forced to be checked, as "multiple files" mode
2046 requires a file size to be specified.
2047 The Next file every ... minute(s) check box and fields lets you
2049 specify that the switch to a next file should be done after the
2050 specified time has elapsed, even if the specified capture size is
2051 not reached.
2052 The Ring buffer with ... files field lets you specify the number of
2054 files of a ring buffer. This feature will capture into the first
2055 file again, after the specified number of files have been used.
2056 The Stop capture after ... files field lets you specify the number
2058 of capture files used, until the capture is stopped.
2059 The Stop capture after ... packet(s) check box and field let you
2061 specify that Wireshark should stop capturing after having captured
2062 some number of packets; if the check box is not checked, Wireshark
2063 will not stop capturing at some fixed number of captured packets.
2064 The Stop capture after ... megabyte(s) check box and field lets you
2066 specify that Wireshark should stop capturing after the file to
2067 which captured packets are being saved grows as large as or larger
2068 than some specified number of megabytes. If the check box is not
2069 checked, Wireshark will not stop capturing at some capture file
2070 size (although the operating system on which Wireshark is running,
2071 or the available disk space, may still limit the maximum size of a
2072 capture file). This option is disabled, if "multiple files" mode
2073 is used,
2074 The Stop capture after ... second(s) check box and field let you
2076 specify that Wireshark should stop capturing after it has been
2077 capturing for some number of seconds; if the check box is not
2078 checked, Wireshark will not stop capturing after some fixed time
2079 has elapsed.
2080 The Update list of packets in real time check box lets you specify
2082 whether the display should be updated as packets are captured and,
2083 if you specify that, the Automatic scrolling in live capture check
2084 box lets you specify the packet list pane should automatically
2085 scroll to show the most recently captured packets as new packets
2086 arrive.
2087 The Enable MAC name resolution, Enable network name resolution and
2089 Enable transport name resolution check boxes let you specify
2090 whether MAC addresses, network addresses, and transport-layer port
2091 numbers should be translated to names.
2092 About
2094 The About dialog lets you view various information about Wireshark.
2095 About:Wireshark
2097 The Wireshark page lets you view general information about
2098 Wireshark, like the installed version, licensing information and
2099 such.
2100 About:Authors
2102 The Authors page shows the author and all contributors.
2103 About:Folders
2105 The Folders page lets you view the directory names where Wireshark
2106 is searching it's various configuration and other files.
2107 About:Plugins
2109 The Plugins page lets you view the dissector plugin modules
2110 available on your system.
2111 The Plugins List shows the name and version of each dissector
2113 plugin module found on your system.
2114 On Unix-compatible systems, the plugins are looked for in the
2116 following directories: the lib/wireshark/plugins/$VERSION directory
2117 under the main installation directory (for example,
2118 /usr/local/lib/wireshark/plugins/$VERSION), and then
2119 $HOME/.wireshark/plugins.
2120 On Windows systems, the plugins are looked for in the following
2122 directories: plugins\$VERSION directory under the main installation
2123 directory (for example, C:\Program
2124 Files\Wireshark\plugins\$VERSION), and then
2125 %APPDATA%\Wireshark\plugins\$VERSION (or, if %APPDATA% isn't
2126 defined, %USERPROFILE%\Application
2127 Data\Wireshark\plugins\$VERSION).
2128 $VERSION is the version number of the plugin interface, which is
2130 typically the version number of Wireshark. Note that a dissector
2131 plugin module may support more than one protocol; there is not
2132 necessarily a one-to-one correspondence between dissector plugin
2133 modules and protocols. Protocols supported by a dissector plugin
2134 module are enabled and disabled using the Edit:Protocols dialog
2135 box, just as protocols built into Wireshark are.
2136
2138 See the manual page of pcap-filter(7) or, if that doesn't exist,
2139 tcpdump(8), or, if that doesn't exist,
2140 <http://wiki.wireshark.org/CaptureFilters>.
2141
2143 For a complete table of protocol and protocol fields that are
2144 filterable in Wireshark see the wireshark-filter(4) manual page.
2145
2147 These files contains various Wireshark configuration settings.
2148 Preferences
2150 The preferences files contain global (system-wide) and personal
2151 preference settings. If the system-wide preference file exists, it
2152 is read first, overriding the default settings. If the personal
2153 preferences file exists, it is read next, overriding any previous
2154 values. Note: If the command line flag -o is used (possibly more
2155 than once), it will in turn override values from the preferences
2156 files.
2157 The preferences settings are in the form prefname:value, one per
2159 line, where prefname is the name of the preference and value is the
2160 value to which it should be set; white space is allowed between :
2161 and value. A preference setting can be continued on subsequent
2162 lines by indenting the continuation lines with white space. A #
2163 character starts a comment that runs to the end of the line:
2164 # Vertical scrollbars should be on right side?
2166 # TRUE or FALSE (case-insensitive).
2167 gui.scrollbar_on_right: TRUE
2168 The global preferences file is looked for in the wireshark
2170 directory under the share subdirectory of the main installation
2171 directory (for example, /usr/local/share/wireshark/preferences) on
2172 UNIX-compatible systems, and in the main installation directory
2173 (for example, C:\Program Files\Wireshark\preferences) on Windows
2174 systems.
2175 The personal preferences file is looked for in
2177 $HOME/.wireshark/preferences on UNIX-compatible systems and
2178 %APPDATA%\Wireshark\preferences (or, if %APPDATA% isn't defined,
2179 %USERPROFILE%\Application Data\Wireshark\preferences) on Windows
2180 systems.
2181 Note: Whenever the preferences are saved by using the Save button
2183 in the Edit:Preferences dialog box, your personal preferences file
2184 will be overwritten with the new settings, destroying any comments
2185 and unknown/obsolete settings that were in the file.
2186 Recent
2188 The recent file contains personal settings (mostly GUI related)
2189 such as the current Wireshark window size. The file is saved at
2190 program exit and read in at program start automatically. Note: The
2191 command line flag -o may be used to override settings from this
2192 file.
2193 The settings in this file have the same format as in the
2195 preferences files, and the same directory as for the personal
2196 preferences file is used.
2197 Note: Whenever Wireshark is closed, your recent file will be
2199 overwritten with the new settings, destroying any comments and
2200 unknown/obsolete settings that were in the file.
2201 Disabled (Enabled) Protocols
2203 The disabled_protos files contain system-wide and personal lists of
2204 protocols that have been disabled, so that their dissectors are
2205 never called. The files contain protocol names, one per line,
2206 where the protocol name is the same name that would be used in a
2207 display filter for the protocol:
2208 http
2210 tcp # a comment
2211 If a protocol is listed in the global disabled_protos file, it is
2213 not displayed in the Analyze:Enabled Protocols dialog box, and so
2214 cannot be enabled by the user.
2215 The global disabled_protos file uses the same directory as the
2217 global preferences file.
2218 The personal disabled_protos file uses the same directory as the
2220 personal preferences file.
2221 Note: Whenever the disabled protocols list is saved by using the
2223 Save button in the Analyze:Enabled Protocols dialog box, your
2224 personal disabled protocols file will be overwritten with the new
2225 settings, destroying any comments that were in the file.
2226 Name Resolution (hosts)
2228 If the personal hosts file exists, it is used to resolve IPv4 and
2229 IPv6 addresses before any other attempts are made to resolve them.
2230 The file has the standard hosts file syntax; each line contains one
2231 IP address and name, separated by whitespace. The same directory
2232 as for the personal preferences file is used.
2233 Capture filter name resolution is handled by libpcap on UNIX-
2235 compatible systems and WinPcap on Windows. As such the Wireshark
2236 personal hosts file will not be consulted for capture filter name
2237 resolution.
2238 Name Resolution (ethers)
2240 The ethers files are consulted to correlate 6-byte hardware
2241 addresses to names. First the personal ethers file is tried and if
2242 an address is not found there the global ethers file is tried next.
2243 Each line contains one hardware address and name, separated by
2245 whitespace. The digits of the hardware address are separated by
2246 colons (:), dashes (-) or periods (.). The same separator
2247 character must be used consistently in an address. The following
2248 three lines are valid lines of an ethers file:
2249 ff:ff:ff:ff:ff:ff Broadcast
2251 c0-00-ff-ff-ff-ff TR_broadcast
2252 00.00.00.00.00.00 Zero_broadcast
2253 The global ethers file is looked for in the /etc directory on UNIX-
2255 compatible systems, and in the main installation directory (for
2256 example, C:\Program Files\Wireshark) on Windows systems.
2257 The personal ethers file is looked for in the same directory as the
2259 personal preferences file.
2260 Capture filter name resolution is handled by libpcap on UNIX-
2262 compatible systems and WinPcap on Windows. As such the Wireshark
2263 personal ethers file will not be consulted for capture filter name
2264 resolution.
2265 Name Resolution (manuf)
2267 The manuf file is used to match the 3-byte vendor portion of a
2268 6-byte hardware address with the manufacturer's name; it can also
2269 contain well-known MAC addresses and address ranges specified with
2270 a netmask. The format of the file is the same as the ethers files,
2271 except that entries such as:
2272 00:00:0C Cisco
2274 can be provided, with the 3-byte OUI and the name for a vendor, and
2276 entries such as:
2277 00-00-0C-07-AC/40 All-HSRP-routers
2279 can be specified, with a MAC address and a mask indicating how many
2281 bits of the address must match. The above entry, for example, has
2282 40 significant bits, or 5 bytes, and would match addresses from
2283 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be
2284 a multiple of 8.
2285 The manuf file is looked for in the same directory as the global
2287 preferences file.
2288 Name Resolution (ipxnets)
2290 The ipxnets files are used to correlate 4-byte IPX network numbers
2291 to names. First the global ipxnets file is tried and if that
2292 address is not found there the personal one is tried next.
2293 The format is the same as the ethers file, except that each address
2295 is four bytes instead of six. Additionally, the address can be
2296 represented as a single hexadecimal number, as is more common in
2297 the IPX world, rather than four hex octets. For example, these
2298 four lines are valid lines of an ipxnets file:
2299 C0.A8.2C.00 HR
2301 c0-a8-1c-00 CEO
2302 00:00:BE:EF IT_Server1
2303 110f FileServer3
2304 The global ipxnets file is looked for in the /etc directory on
2306 UNIX-compatible systems, and in the main installation directory
2307 (for example, C:\Program Files\Wireshark) on Windows systems.
2308 The personal ipxnets file is looked for in the same directory as
2310 the personal preferences file.
2311 Capture Filters
2313 The cfilters files contain system-wide and personal capture
2314 filters. Each line contains one filter, starting with the string
2315 displayed in the dialog box in quotation marks, followed by the
2316 filter string itself:
2317 "HTTP" port 80
2319 "DCERPC" port 135
2320 The global cfilters file uses the same directory as the global
2322 preferences file.
2323 The personal cfilters file uses the same directory as the personal
2325 preferences file. It is written through the Capture:Capture
2326 Filters dialog.
2327 If the global cfilters file exists, it is used only if the personal
2329 cfilters file does not exist; global and personal capture filters
2330 are not merged.
2331 Display Filters
2333 The dfilters files contain system-wide and personal display
2334 filters. Each line contains one filter, starting with the string
2335 displayed in the dialog box in quotation marks, followed by the
2336 filter string itself:
2337 "HTTP" http
2339 "DCERPC" dcerpc
2340 The global dfilters file uses the same directory as the global
2342 preferences file.
2343 The personal dfilters file uses the same directory as the personal
2345 preferences file. It is written through the Analyze:Display
2346 Filters dialog.
2347 If the global dfilters file exists, it is used only if the personal
2349 dfilters file does not exist; global and personal display filters
2350 are not merged.
2351 Color Filters (Coloring Rules)
2353 The colorfilters files contain system-wide and personal color
2354 filters. Each line contains one filter, starting with the string
2355 displayed in the dialog box, followed by the corresponding display
2356 filter. Then the background and foreground colors are appended:
2357 # a comment
2359 @tcp@tcp@[59345,58980,65534][0,0,0]
2360 @udp@udp@[28834,57427,65533][0,0,0]
2361 The global colorfilters file uses the same directory as the global
2363 preferences file.
2364 The personal colorfilters file uses the same directory as the
2366 personal preferences file. It is written through the View:Coloring
2367 Rules dialog.
2368 If the global colorfilters file exists, it is used only if the
2370 personal colorfilters file does not exist; global and personal
2371 color filters are not merged.
2372 GTK rc files
2374 The gtkrc files contain system-wide and personal GTK theme
2375 settings.
2376 The global gtkrc file uses the same directory as the global
2378 preferences file.
2379 The personal gtkrc file uses the same directory as the personal
2381 preferences file.
2382 Plugins
2384 See above in the description of the About:Plugins page.
2385
2387 WIRESHARK_DEBUG_EP_NO_CHUNKS
2388 Normally per-packet memory is allocated in large "chunks." This
2389 behavior doesn't work well with debugging tools such as Valgrind or
2390 ElectricFence. Export this environment variable to force
2391 individual allocations. Note: disabling chunks also disables
2392 canaries (see below).
2393 WIRESHARK_DEBUG_SE_NO_CHUNKS
2395 Normally per-file memory is allocated in large "chunks." This
2396 behavior doesn't work well with debugging tools such as Valgrind or
2397 ElectricFence. Export this environment variable to force
2398 individual allocations. Note: disabling chunks also disables
2399 canaries (see below).
2400 WIRESHARK_DEBUG_EP_NO_CANARY
2402 Normally per-packet memory allocations are separated by "canaries"
2403 which allow detection of memory overruns. This comes at the
2404 expense of some extra memory usage. Exporting this environment
2405 variable disables these canaries.
2406 WIRESHARK_DEBUG_SE_USE_CANARY
2408 Exporting this environment variable causes per-file memory
2409 allocations to be protected with "canaries" which allow for
2410 detection of memory overruns. This comes at the expense of
2411 significant extra memory usage.
2412 WIRESHARK_DEBUG_SCRUB_MEMORY
2414 If this environment variable is set, the contents of per-packet and
2415 per-file memory is initialized to 0xBADDCAFE when the memory is
2416 allocated and is reset to 0xDEADBEEF when the memory is freed.
2417 This functionality is useful mainly to developers looking for bugs
2418 in the way memory is handled.
2419 WIRESHARK_DEBUG_WMEM_OVERRIDE
2421 Setting this environment variable forces the wmem framework to use
2422 the specified allocator backend for *all* allocations, regardless
2423 of which backend is normally specified by the code. This is mainly
2424 useful to developers when testing or debugging. See README.wmem in
2425 the source distribution for details.
2426 WIRESHARK_RUN_FROM_BUILD_DIRECTORY
2428 This environment variable causes the plugins and other data files
2429 to be loaded from the build directory (where the program was
2430 compiled) rather than from the standard locations. It has no
2431 effect when the program in question is running with root (or
2432 setuid) permissions on *NIX.
2433 WIRESHARK_DATA_DIR
2435 This environment variable causes the various data files to be
2436 loaded from a directory other than the standard locations. It has
2437 no effect when the program in question is running with root (or
2438 setuid) permissions on *NIX.
2439 WIRESHARK_PYTHON_DIR
2441 This environment variable points to an alternate location for
2442 Python. It has no effect when the program in question is running
2443 with root (or setuid) permissions on *NIX.
2444 ERF_RECORDS_TO_CHECK
2446 This environment variable controls the number of ERF records
2447 checked when deciding if a file really is in the ERF format.
2448 Setting this environment variable a number higher than the default
2449 (20) would make false positives less likely.
2450 IPFIX_RECORDS_TO_CHECK
2452 This environment variable controls the number of IPFIX records
2453 checked when deciding if a file really is in the IPFIX format.
2454 Setting this environment variable a number higher than the default
2455 (20) would make false positives less likely.
2456 WIRESHARK_ABORT_ON_DISSECTOR_BUG
2458 If this environment variable is set, Wireshark will call abort(3)
2459 when a dissector bug is encountered. abort(3) will cause the
2460 program to exit abnormally; if you are running Wireshark in a
2461 debugger, it should halt in the debugger and allow inspection of
2462 the process, and, if you are not running it in a debugger, it will,
2463 on some OSes, assuming your environment is configured correctly,
2464 generate a core dump file. This can be useful to developers
2465 attempting to troubleshoot a problem with a protocol dissector.
2466 WIRESHARK_EP_VERIFY_POINTERS
2468 This environment variable, if set, causes certain uses of pointers
2469 to be audited to ensure they do not point to memory that is
2470 deallocated after each packet has been fully dissected. This can
2471 be useful to developers writing or auditing code.
2472 WIRESHARK_SE_VERIFY_POINTERS
2474 This environment variable, if set, causes certain uses of pointers
2475 to be audited to ensure they do not point to memory that is
2476 deallocated after when a capture file is closed. This can be
2477 useful to developers writing or auditing code.
2478 WIRESHARK_QUIT_AFTER_CAPTURE
2480 Cause Wireshark to exit after the end of the capture session. This
2481 doesn't automatically start a capture; you must still use -k to do
2482 that. You must also specify an autostop condition, e.g. -c or -a
2483 duration:.... This means that you will not be able to see the
2484 results of the capture after it stops; it's primarily useful for
2485 testing.
2486 WIRESHARK_ABORT_ON_OUT_OF_MEMORY
2488 This environment variable, if present, causes abort(3) to be called
2489 if certain out-of-memory conditions (which normally result in an
2490 exception and an explanatory error message) are experienced. This
2491 can be useful to developers debugging out-of-memory conditions.
2492
2494 wireshark-filter(4), tshark(1), editcap(1), pcap(3), dumpcap(1),
2495 mergecap(1), text2pcap(1), pcap-filter(7) or tcpdump(8)
2496
2498 The latest version of Wireshark can be found at
2499 <http://www.wireshark.org>.
2500 HTML versions of the Wireshark project man pages are available at:
2502 <http://www.wireshark.org/docs/man-pages>.
2503
2505 Original Author
2506 -------- ------
2507 Gerald Combs <gerald[AT]wireshark.org>
2508 Contributors
2510 ------------
2511 Gilbert Ramirez <gram[AT]alumni.rice.edu>
2512 Thomas Bottom <tom.bottom[AT]labxtechnologies.com>
2513 Chris Pane <chris.pane[AT]labxtechnologies.com>
2514 Hannes R. Boehm <hannes[AT]boehm.org>
2515 Mike Hall <mike[AT]hallzone.net>
2516 Bobo Rajec <bobo[AT]bsp-consulting.sk>
2517 Laurent Deniel <laurent.deniel[AT]free.fr>
2518 Don Lafontaine <lafont02[AT]cn.ca>
2519 Guy Harris <guy[AT]alum.mit.edu>
2520 Simon Wilkinson <sxw[AT]dcs.ed.ac.uk>
2521 Joerg Mayer <jmayer[AT]loplof.de>
2522 Martin Maciaszek <fastjack[AT]i-s-o.net>
2523 Didier Jorand <Didier.Jorand[AT]alcatel.fr>
2524 Jun-ichiro itojun Hagino <itojun[AT]itojun.org>
2525 Richard Sharpe <sharpe[AT]ns.aus.com>
2526 John McDermott <jjm[AT]jkintl.com>
2527 Jeff Jahr <jjahr[AT]shastanets.com>
2528 Brad Robel-Forrest <bradr[AT]watchguard.com>
2529 Ashok Narayanan <ashokn[AT]cisco.com>
2530 Aaron Hillegass <aaron[AT]classmax.com>
2531 Jason Lango <jal[AT]netapp.com>
2532 Johan Feyaerts <Johan.Feyaerts[AT]siemens.com>
2533 Olivier Abad <oabad[AT]noos.fr>
2534 Thierry Andry <Thierry.Andry[AT]advalvas.be>
2535 Jeff Foster <jfoste[AT]woodward.com>
2536 Peter Torvals <petertv[AT]xoommail.com>
2537 Christophe Tronche <ch.tronche[AT]computer.org>
2538 Nathan Neulinger <nneul[AT]umr.edu>
2539 Tomislav Vujec <tvujec[AT]carnet.hr>
2540 Kojak <kojak[AT]bigwig.net>
2541 Uwe Girlich <Uwe.Girlich[AT]philosys.de>
2542 Warren Young <tangent[AT]mail.com>
2543 Heikki Vatiainen <hessu[AT]cs.tut.fi>
2544 Greg Hankins <gregh[AT]twoguys.org>
2545 Jerry Talkington <jtalkington[AT]users.sourceforge.net>
2546 Dave Chapeskie <dchapes[AT]ddm.on.ca>
2547 James Coe <jammer[AT]cin.net>
2548 Bert Driehuis <driehuis[AT]playbeing.org>
2549 Stuart Stanley <stuarts[AT]mxmail.net>
2550 John Thomes <john[AT]ensemblecom.com>
2551 Laurent Cazalet <laurent.cazalet[AT]mailclub.net>
2552 Thomas Parvais <thomas.parvais[AT]advalvas.be>
2553 Gerrit Gehnen <G.Gehnen[AT]atrie.de>
2554 Craig Newell <craign[AT]cheque.uq.edu.au>
2555 Ed Meaney <emeaney[AT]cisco.com>
2556 Dietmar Petras <DPetras[AT]ELSA.de>
2557 Fred Reimer <fwr[AT]ga.prestige.net>
2558 Florian Lohoff <flo[AT]rfc822.org>
2559 Jochen Friedrich <jochen+ethereal[AT]scram.de>
2560 Paul Welchinski <paul.welchinski[AT]telusplanet.net>
2561 Doug Nazar <nazard[AT]dragoninc.on.ca>
2562 Andreas Sikkema <h323[AT]ramdyne.nl>
2563 Mark Muhlestein <mmm[AT]netapp.com>
2564 Graham Bloice <graham.bloice[AT]trihedral.com>
2565 Ralf Schneider <ralf.schneider[AT]alcatel.se>
2566 Yaniv Kaul <mykaul[AT]gmail.com>
2567 Paul Ionescu <paul[AT]acorp.ro>
2568 Mark Burton <markb[AT]ordern.com>
2569 Stefan Raab <sraab[AT]cisco.com>
2570 Mark Clayton <clayton[AT]shore.net>
2571 Michael Rozhavsky <mike[AT]tochna.technion.ac.il>
2572 Dug Song <dugsong[AT]monkey.org>
2573 Michael Tuexen <tuexen[AT]fh-muenster.de>
2574 Bruce Korb <bkorb[AT]sco.com>
2575 Jose Pedro Oliveira <jpo[AT]di.uminho.pt>
2576 David Frascone <dave[AT]frascone.com>
2577 Peter Kjellerstedt <pkj[AT]axis.com>
2578 Phil Techau <phil_t[AT]altavista.net>
2579 Wes Hardaker <hardaker[AT]users.sourceforge.net>
2580 Robert Tsai <rtsai[AT]netapp.com>
2581 Craig Metz <cmetz[AT]inner.net>
2582 Per Flock <per.flock[AT]axis.com>
2583 Jack Keane <jkeane[AT]OpenReach.com>
2584 Brian Wellington <bwelling[AT]xbill.org>
2585 Santeri Paavolainen <santtu[AT]ssh.com>
2586 Ulrich Kiermayr <uk[AT]ap.univie.ac.at>
2587 Neil Hunter <neil.hunter[AT]energis-squared.com>
2588 Ralf Holzer <ralf[AT]well.com>
2589 Craig Rodrigues <rodrigc[AT]attbi.com>
2590 Ed Warnicke <hagbard[AT]physics.rutgers.edu>
2591 Johan Jorgensen <johan.jorgensen[AT]axis.com>
2592 Frank Singleton <frank.singleton[AT]ericsson.com>
2593 Kevin Shi <techishi[AT]ms22.hinet.net>
2594 Mike Frisch <mfrisch[AT]isurfer.ca>
2595 Burke Lau <burke_lau[AT]agilent.com>
2596 Martti Kuparinen <martti.kuparinen[AT]iki.fi>
2597 David Hampton <dhampton[AT]mac.com>
2598 Kent Engstroem <kent[AT]unit.liu.se>
2599 Ronnie Sahlberg <ronnie_sahlberg[AT]ozemail.com.au>
2600 Borosa Tomislav <tomislav.borosa[AT]SIEMENS.HR>
2601 Alexandre P. Ferreira <alexandref[AT]tcoip.com.br>
2602 Simharajan Srishylam <Simharajan.Srishylam[AT]netapp.com>
2603 Greg Kilfoyle <gregk[AT]redback.com>
2604 James E. Flemer <jflemer[AT]acm.jhu.edu>
2605 Peter Lei <peterlei[AT]cisco.com>
2606 Thomas Gimpel <thomas.gimpel[AT]ferrari.de>
2607 Albert Chin <china[AT]thewrittenword.com>
2608 Charles Levert <charles[AT]comm.polymtl.ca>
2609 Todd Sabin <tas[AT]webspan.net>
2610 Eduardo Perez Ureta <eperez[AT]dei.inf.uc3m.es>
2611 Martin Thomas <martin_a_thomas[AT]yahoo.com>
2612 Hartmut Mueller <hartmut[AT]wendolene.ping.de>
2613 Michal Melerowicz <Michal.Melerowicz[AT]nokia.com>
2614 Hannes Gredler <hannes[AT]juniper.net>
2615 Inoue <inoue[AT]ainet.or.jp>
2616 Olivier Biot <obiot.ethereal[AT]gmail.com>
2617 Patrick Wolfe <pjw[AT]zocalo.cellular.ameritech.com>
2618 Martin Held <Martin.Held[AT]icn.siemens.de>
2619 Riaan Swart <rswart[AT]cs.sun.ac.za>
2620 Christian Lacunza <celacunza[AT]gmx.net>
2621 Scott Renfro <scott[AT]renfro.org>
2622 Juan Toledo <toledo[AT]users.sourceforge.net>
2623 Jean-Christian Pennetier <jeanchristian.pennetier[AT]rd.francetelecom.fr>
2624 Jian Yu <bgp4news[AT]yahoo.com>
2625 Eran Mann <emann[AT]opticalaccess.com>
2626 Andy Hood <ajhood[AT]fl.net.au>
2627 Randy McEoin <rmceoin[AT]ahbelo.com>
2628 Edgar Iglesias <edgar.iglesias[AT]axis.com>
2629 Martina Obermeier <Martina.Obermeier[AT]icn.siemens.de>
2630 Javier Achirica <achirica[AT]ttd.net>
2631 B. Johannessen <bob[AT]havoq.com>
2632 Thierry Pelle <thierry.pelle[AT]laposte.net>
2633 Francisco Javier Cabello <fjcabello[AT]vtools.es>
2634 Laurent Rabret <laurent.rabret[AT]rd.francetelecom.fr>
2635 nuf si <gnippiks[AT]yahoo.com>
2636 Jeff Morriss <jeff.morriss.ws[AT]gmail.com>
2637 Aamer Akhter <aakhter[AT]cisco.com>
2638 Pekka Savola <pekkas[AT]netcore.fi>
2639 David Eisner <cradle[AT]Glue.umd.edu>
2640 Steve Dickson <steved[AT]talarian.com>
2641 Markus Seehofer <Markus.Seehofer[AT]hirschmann.de>
2642 Lee Berger <lberger[AT]roy.org>
2643 Motonori Shindo <motonori[AT]shin.do>
2644 Terje Krogdahl <tekr[AT]nextra.com>
2645 Jean-Francois Mule <jfm[AT]cablelabs.com>
2646 Thomas Wittwer <thomas.wittwer[AT]iclip.ch>
2647 Matthias Nyffenegger <matthias.nyffenegger[AT]iclip.ch>
2648 Palle Lyckegaard <Palle[AT]lyckegaard.dk>
2649 Nicolas Balkota <balkota[AT]mac.com>
2650 Tom Uijldert <Tom.Uijldert[AT]cmg.nl>
2651 Akira Endoh <endoh[AT]netmarks.co.jp>
2652 Graeme Hewson <graeme.hewson[AT]oracle.com>
2653 Pasi Eronen <pe[AT]iki.fi>
2654 Georg von Zezschwitz <gvz[AT]2scale.net>
2655 Steffen Weinreich <steve[AT]weinreich.org>
2656 Marc Milgram <ethereal[AT]mmilgram.NOSPAMmail.net>
2657 Gordon McKinney <gordon[AT]night-ray.com>
2658 Pavel Novotny <Pavel.Novotny[AT]icn.siemens.de>
2659 Shinsuke Suzuki <suz[AT]kame.net>
2660 Andrew C. Feren <acferen[AT]yahoo.com>
2661 Tomas Kukosa <tomas.kukosa[AT]siemens.com>
2662 Andreas Stockmeier <a.stockmeier[AT]avm.de>
2663 Pekka Nikander <pekka.nikander[AT]nomadiclab.com>
2664 Hamish Moffatt <hamish[AT]cloud.net.au>
2665 Kazushi Sugyo <k-sugyou[AT]nwsl.mesh.ad.jp>
2666 Tim Potter <tpot[AT]samba.org>
2667 Raghu Angadi <rangadi[AT]inktomi.com>
2668 Taisuke Sasaki <sasaki[AT]soft.net.fujitsu.co.jp>
2669 Tim Newsham <newsham[AT]lava.net>
2670 Tom Nisbet <Tnisbet[AT]VisualNetworks.com>
2671 Darren New <dnew[AT]san.rr.com>
2672 Pavel Mores <pvl[AT]uh.cz>
2673 Bernd Becker <bb[AT]bernd-becker.de>
2674 Heinz Prantner <Heinz.Prantner[AT]radisys.com>
2675 Irfan Khan <ikhan[AT]qualcomm.com>
2676 Jayaram V.R <vjayar[AT]cisco.com>
2677 Dinesh Dutt <ddutt[AT]cisco.com>
2678 Nagarjuna Venna <nvenna[AT]Brixnet.com>
2679 Jirka Novak <j.novak[AT]netsystem.cz>
2680 Ricardo Barroetaven~a <rbarroetavena[AT]veufort.com>
2681 Alan Harrison <alanharrison[AT]mail.com>
2682 Mike Frantzen <frantzen[AT]w4g.org>
2683 Charlie Duke <cduke[AT]fvc.com>
2684 Alfred Arnold <Alfred.Arnold[AT]elsa.de>
2685 Dermot Bradley <dermot.bradley[AT]openwave.com>
2686 Adam Sulmicki <adam[AT]cfar.umd.edu>
2687 Kari Tiirikainen <kari.tiirikainen[AT]nokia.com>
2688 John Mackenzie <John.A.Mackenzie[AT]t-online.de>
2689 Peter Valchev <pvalchev[AT]openbsd.org>
2690 Alex Rozin <Arozin[AT]mrv.com>
2691 Jouni Malinen <jkmaline[AT]cc.hut.fi>
2692 Paul E. Erkkila <pee[AT]erkkila.org>
2693 Jakob Schlyter <jakob[AT]openbsd.org>
2694 Jim Sienicki <sienicki[AT]issanni.com>
2695 Steven French <sfrench[AT]us.ibm.com>
2696 Diana Eichert <deicher[AT]sandia.gov>
2697 Blair Cooper <blair[AT]teamon.com>
2698 Kikuchi Ayamura <ayamura[AT]ayamura.org>
2699 Didier Gautheron <dgautheron[AT]magic.fr>
2700 Phil Williams <csypbw[AT]comp.leeds.ac.uk>
2701 Kevin Humphries <khumphries[AT]networld.com>
2702 Erik Nordstroem <erik.nordstrom[AT]it.uu.se>
2703 Devin Heitmueller <dheitmueller[AT]netilla.com>
2704 Chenjiang Hu <chu[AT]chiaro.com>
2705 Kan Sasaki <sasaki[AT]fcc.ad.jp>
2706 Stefan Wenk <stefan.wenk[AT]gmx.at>
2707 Ruud Linders <ruud[AT]lucent.com>
2708 Andrew Esh <Andrew.Esh[AT]tricord.com>
2709 Greg Morris <GMORRIS[AT]novell.com>
2710 Dirk Steinberg <dws[AT]dirksteinberg.de>
2711 Kari Heikkila <kari.o.heikkila[AT]nokia.com>
2712 Olivier Dreux <Olivier.Dreux[AT]alcatel.fr>
2713 Michael Stiller <ms[AT]2scale.net>
2714 Antti Tuominen <ajtuomin[AT]tml.hut.fi>
2715 Martin Gignac <lmcgign[AT]mobilitylab.net>
2716 John Wells <wells[AT]ieee.org>
2717 Loic Tortay <tortay[AT]cc.in2p3.fr>
2718 Steve Housley <Steve_Housley[AT]eur.3com.com>
2719 Peter Hawkins <peter[AT]hawkins.emu.id.au>
2720 Bill Fumerola <billf[AT]FreeBSD.org>
2721 Chris Waters <chris[AT]waters.co.nz>
2722 Solomon Peachy <pizza[AT]shaftnet.org>
2723 Jaime Fournier <Jaime.Fournier[AT]hush.com>
2724 Markus Steinmann <ms[AT]seh.de>
2725 Tsutomu Mieno <iitom[AT]utouto.com>
2726 Yasuhiro Shirasaki <yasuhiro[AT]gnome.gr.jp>
2727 Anand V. Narwani <anand[AT]narwani.org>
2728 Christopher K. St. John <cks[AT]distributopia.com>
2729 Nix <nix[AT]esperi.demon.co.uk>
2730 Liviu Daia <Liviu.Daia[AT]imar.ro>
2731 Richard Urwin <richard[AT]soronlin.org.uk>
2732 Prabhakar Krishnan <Prabhakar.Krishnan[AT]netapp.com>
2733 Jim McDonough <jmcd[AT]us.ibm.com>
2734 Sergei Shokhor <sshokhor[AT]uroam.com>
2735 Hidetaka Ogawa <ogawa[AT]bs2.qnes.nec.co.jp>
2736 Jan Kratochvil <short[AT]ucw.cz>
2737 Alfred Koebler <ak[AT]icon-sult.de>
2738 Vassilii Khachaturov <Vassilii.Khachaturov[AT]comverse.com>
2739 Bill Studenmund <wrstuden[AT]wasabisystems.com>
2740 Brian Bruns <camber[AT]ais.org>
2741 Flavio Poletti <flavio[AT]polettix.it>
2742 Marcus Haebler <haeblerm[AT]yahoo.com>
2743 Ulf Lamping <ulf.lamping[AT]web.de>
2744 Matthew Smart <smart[AT]monkey.org>
2745 Luke Howard <lukeh[AT]au.padl.com>
2746 PC Drew <drewpc[AT]ibsncentral.com>
2747 Renzo Tomas <renzo.toma[AT]xs4all.nl>
2748 Clive A. Stubbings <eth[AT]vjet.demon.co.uk>
2749 Steve Langasek <vorlon[AT]netexpress.net>
2750 Brad Hards <bhards[AT]bigpond.net.au>
2751 cjs 2895 <cjs2895[AT]hotmail.com>
2752 Lutz Jaenicke <Lutz.Jaenicke[AT]aet.TU-Cottbus.DE>
2753 Senthil Kumar Nagappan <sknagappan[AT]yahoo.com>
2754 Jason House <jhouse[AT]mitre.org>
2755 Peter Fales <psfales[AT]lucent.com>
2756 Fritz Budiyanto <fritzb88[AT]yahoo.com>
2757 Jean-Baptiste Marchand <Jean-Baptiste.Marchand[AT]hsc.fr>
2758 Andreas Trauer <andreas.trauer[AT]siemens.com>
2759 Ronald Henderson <Ronald.Henderson[AT]CognicaseUSA.com>
2760 Brian Ginsbach <ginsbach[AT]cray.com>
2761 Dave Richards <d_m_richards[AT]comcast.net>
2762 Martin Regner <martin.regner[AT]chello.se>
2763 Jason Greene <jason[AT]inetgurus.net>
2764 Marco Molteni <mmolteni[AT]cisco.com>
2765 James Harris <jharris[AT]fourhorsemen.org>
2766 rmkml <rmkml[AT]wanadoo.fr>
2767 Anders Broman <anders.broman[AT]ericsson.com>
2768 Christian Falckenberg <christian.falckenberg[AT]nortelnetworks.com>
2769 Huagang Xie <xie[AT]lids.org>
2770 Pasi Kovanen <Pasi.Kovanen[AT]tahoenetworks.fi>
2771 Teemu Rinta-aho <teemu.rinta-aho[AT]nomadiclab.com>
2772 Martijn Schipper <mschipper[AT]globespanvirata.com>
2773 Wayne Parrott <wayne_p[AT]pacific.net.au>
2774 Laurent Meyer <laurent.meyer6[AT]wanadoo.fr>
2775 Lars Roland <Lars.Roland[AT]gmx.net>
2776 Miha Jemec <m.jemec[AT]iskratel.si>
2777 Markus Friedl <markus[AT]openbsd.org>
2778 Todd Montgomery <tmontgom[AT]tibco.com>
2779 emre <emre[AT]flash.net>
2780 Stephen Shelley <steve.shelley[AT]attbi.com>
2781 Erwin Rol <erwin[AT]erwinrol.com>
2782 Duncan Laurie <duncan[AT]sun.com>
2783 Tony Schene <schene[AT]pcisys.net>
2784 Matthijs Melchior <mmelchior[AT]xs4all.nl>
2785 Garth Bushell <gbushell[AT]elipsan.com>
2786 Mark C. Brown <mbrown[AT]hp.com>
2787 Can Erkin Acar <canacar[AT]eee.metu.edu.tr>
2788 Martin Warnes <martin.warnes[AT]ntlworld.com>
2789 J Bruce Fields <bfields[AT]fieldses.org>
2790 tz <tz1[AT]mac.com>
2791 Jeff Liu <jqliu[AT]broadcom.com>
2792 Niels Koot <Niels.Koot[AT]logicacmg.com>
2793 Lionel Ains <lains[AT]gmx.net>
2794 Joakim Wiberg <jow[AT]hms-networks.com>
2795 Jeff Rizzo <riz[AT]boogers.sf.ca.us>
2796 Christoph Wiest <ch.wiest[AT]tesionmail.de>
2797 Xuan Zhang <xz[AT]aemail4u.com>
2798 Thierry Martin <thierry.martin[AT]accellent-group.com>
2799 Oleg Terletsky <oleg.terletsky[AT]comverse.com>
2800 Michael Lum <mlum[AT]telostech.com>
2801 Shiang-Ming Huang <smhuang[AT]pcs.csie.nctu.edu.tw>
2802 Tony Lindstrom <tony.lindstrom[AT]ericsson.com>
2803 Niklas Ogren <niklas.ogren[AT]71.se>
2804 Jesper Peterson <jesper[AT]endace.com>
2805 Giles Scott <gscott[AT]arubanetworks.com>
2806 Vincent Jardin <vincent.jardin[AT]6wind.com>
2807 Jean-Michel Fayard <jean-michel.fayard[AT]moufrei.de>
2808 Josef Korelus <jkor[AT]quick.cz>
2809 Brian K. Teravskis <Brian_Teravskis[AT]Cargill.com>
2810 Nathan Jennings <njgm890[AT]gmail.com>
2811 Hans Viens <hviens[AT]mediatrix.com>
2812 Kevin A. Noll <kevin.noll[AT]versatile.com>
2813 Emanuele Caratti <wiz[AT]libero.it>
2814 Graeme Reid <graeme.reid[AT]norwoodsystems.com>
2815 Lars Ruoff <lars.ruoff[AT]sxb.bsf.alcatel.fr>
2816 Samuel Qu <samuel.qu[AT]utstar.com>
2817 Baktha Muralitharan <muralidb[AT]cisco.com>
2818 Loiec Minier <lool[AT]dooz.org>
2819 Marcel Holtmann <marcel[AT]holtmann.org>
2820 Scott Emberley <scotte[AT]netinst.com>
2821 Brian Fundakowski Feldman <bfeldman[AT]fla.fujitsu.com>
2822 Yuriy Sidelnikov <ysidelnikov[AT]hotmail.com>
2823 Matthias Drochner <M.Drochner[AT]fz-juelich.de>
2824 Dave Sclarsky <dave_sclarsky[AT]cnt.com>
2825 Scott Hovis <scott.hovis[AT]ums.msfc.nasa.gov>
2826 David Fort <david.fort[AT]irisa.fr>
2827 Felix Fei <felix.fei[AT]utstar.com>
2828 Christoph Neusch <christoph.neusch[AT]nortelnetworks.com>
2829 Jan Kiszka <jan.kiszka[AT]web.de>
2830 Joshua Craig Douglas <jdouglas[AT]enterasys.com>
2831 Dick Gooris <gooris[AT]alcatel-lucent.com>
2832 Michael Shuldman <michaels[AT]inet.no>
2833 Tadaaki Nagao <nagao[AT]iij.ad.jp>
2834 Aaron Woo <woo[AT]itd.nrl.navy.mil>
2835 Chris Wilson <chris[AT]mxtelecom.com>
2836 Rolf Fiedler <Rolf.Fiedler[AT]Innoventif.com>
2837 Alastair Maw <ethereal[AT]almaw.com>
2838 Sam Leffler <sam[AT]errno.com>
2839 Martin Mathieson <martin.r.mathieson[AT]googlemail.com>
2840 Christian Wagner <Christian.Wagner[AT]stud.uni-karlsruhe.de>
2841 Edwin Calo <calo[AT]fusemail.com>
2842 Ian Schorr <ischorr[AT]comcast.net>
2843 Rowan McFarland <rmcfarla[AT]cisco.com>
2844 John Engelhart <johne[AT]zang.com>
2845 Ryuji Somegawa <ryuji-so[AT]is.aist-nara.ac.jp>
2846 metatech <metatechbe[AT]gmail.com>
2847 Brian Wheeler <Brian.Wheeler[AT]arrisi.com>
2848 Josh Bailey <joshbailey[AT]lucent.com>
2849 Jelmer Vernooij <jelmer[AT]samba.org>
2850 Duncan Sargeant <dunc-ethereal-dev[AT]rcpt.to>
2851 Love Hoernquist Aastrand <lha[AT]it.su.se>
2852 Lukas Pokorny <maskis[AT]seznam.cz>
2853 Carlos Pignataro <cpignata[AT]cisco.com>
2854 Thomas Anders <thomas.anders[AT]blue-cable.de>
2855 Rich Coe <Richard.Coe[AT]med.ge.com>
2856 Dominic Bechaz <bdo[AT]zhwin.ch>
2857 Richard van der Hoff <richardv[AT]mxtelecom.com>
2858 Shaun Jackman <sjackman[AT]gmail.com>
2859 Jon Oberheide <jon[AT]oberheide.org>
2860 Henry Ptasinski <henryp[AT]broadcom.com>
2861 Roberto Morro <roberto.morro[AT]telecomitalia.it>
2862 Chris Maynard <Christopher.Maynard[AT]GTECH.COM>
2863 SEKINE Hideki <sekineh[AT]gf7.so-net.ne.jp>
2864 Jeff Connelly <shellreef+mp2p[AT]gmail.com>
2865 Irene Ruengeler <i.ruengeler[AT]fh-muenster.de
2866 M. Ortega y Strupp <moys[AT]loplof.de>
2867 Kelly Byrd <kbyrd-ethereal[AT]memcpy.com>
2868 Luis Ontanon <luis.ontanon[AT]gmail.com>
2869 Luca Deri <deri[AT]ntop.org>
2870 Viorel Suman <vsuman[AT]avmob.ro>
2871 Alejandro Vaquero <alejandro.vaquero[AT]verso.com>
2872 Francesco Fondelli <francesco.fondelli[AT]gmail.com>
2873 Artem Tamazov <artem.tamazov[AT]tellabs.com>
2874 Dmitry Trebich <dmitry.trebich[AT]gmail.com>
2875 Bill Meier <wmeier[AT]newsguy.com>
2876 Susanne Edlund <Susanne.Edlund[AT]ericsson.com>
2877 Victor Stratan <hidralisk[AT]yahoo.com>
2878 Peter Johansson <PeterJohansson73[AT]gmail.com>
2879 Stefan Metzmacher <metze[AT]samba.org>
2880 Abhijit Menon-Sen <ams[AT]oryx.com>
2881 James Fields <jvfields[AT]tds.net>
2882 Kevin Johnson <kjohnson[AT]secureideas.net>
2883 Mike Duigou <bondolo[AT]dev.java.net>
2884 Deepak Jain <jain1971[AT]yahoo.com>
2885 Stefano Pettini <spettini[AT]users.sourceforge.net>
2886 Jon Ringle <ml-ethereal[AT]ringle.org>
2887 Tim Endean <endeant[AT]hotmail.com>
2888 Charlie Lenahan <clenahan[AT]fortresstech.com>
2889 Takeshi Nakashima <T.Nakashima[AT]jp.yokogawa.com>
2890 Shoichi Sakane <sakane[AT]tanu.org>
2891 Michael Richardson <Michael.Richardson[AT]protiviti.com>
2892 Olivier Jacques <olivier.jacques[AT]hp.com>
2893 Francisco Alcoba <francisco.alcoba[AT]ericsson.com>
2894 Nils O. Selaasdal <noselasd[AT]asgaard.homelinux.org>
2895 Guillaume Chazarain <guichaz[AT]yahoo.fr>
2896 Angelo Bannack <angelo.bannack[AT]siemens.com>
2897 Paolo Frigo <paolofrigo[AT]gmail.com>
2898 Jeremy J Ouellette <jouellet[AT]scires.com>
2899 Aboo Valappil <valappil_aboo[AT]emc.com>
2900 Fred Hoekstra <fred.hoekstra[AT]philips.com>
2901 Ankur Aggarwal <ankur[AT]in.athenasemi.com>
2902 Lucian Piros <lpiros[AT]avmob.ro>
2903 Juan Gonzalez <juan.gonzalez[AT]pikatech.com>
2904 Brian Bogora <brian_bogora[AT]mitel.com>
2905 Jim Young <sysjhy[AT]langate.gsu.edu>
2906 Jeff Snyder <jeff[AT]mxtelecom.com>
2907 William Fiveash <William.Fiveash[AT]sun.com>
2908 Graeme Lunt <graeme.lunt[AT]smhs.co.uk>
2909 Menno Andriesse <s5066[AT]nc3a.nato.int>
2910 Stig Bjorlykke <stig[AT]bjorlykke.org>
2911 Kyle J. Harms <kyle.j.harms[AT]boeing.com>
2912 Eric Wedel <ewedel[AT]bluearc.com>
2913 Secfire <secfire[AT]gmail.com>
2914 Eric Hultin <Eric.Hultin[AT]arrisi.com>
2915 Paolo Abeni <paolo.abeni[AT]email.it>
2916 W. Borgert <debacle[AT]debian.org>
2917 Frederic Roudaut <frederic.roudaut[AT]irisa.fr>
2918 Christoph Scholz <scholz_ch[AT]web.de>
2919 Wolfgang Hansmann <hansmann[AT]cs.uni-bonn.de>
2920 Kees Cook <kees[AT]outflux.net>
2921 Thomas Dreibholz <dreibh[AT]iem.uni-due.de>
2922 Authesserre Samuel <sauthess[AT]gmail.com>
2923 Balint Reczey <balint[AT]balintreczey.hu>
2924 Stephen Fisher <stephenfisher-wireshark[AT]outlook.com>
2925 Krzysztof Burghardt <krzysztof[AT]burghardt.pl>
2926 Peter Racz <racz[AT]ifi.unizh.ch>
2927 Jakob Bratkovic <j.bratkovic[AT]iskratel.si>
2928 Mark Lewis <mlewis[AT]altera.com>
2929 David Buechi <bhd[AT]zhwin.ch>
2930 Bill Florac <bill.florac[AT]etcconnect.com>
2931 Alex Burlyga <Alex.Burlyga[AT]netapp.com>
2932 Douglas Pratley <Douglas.pratley[AT]detica.com>
2933 Giorgio Tino <giorgio.tino[AT]cacetech.com>
2934 Davide Schiera <davide.schiera[AT]riverbed.com>
2935 Sebastien Tandel <sebastien[AT]tandel.be>
2936 Clay Jones <clay.jones[AT]email.com>
2937 Kriang Lerdsuwanakij <lerdsuwa[AT]users.sourceforge.net>
2938 Abhik Sarkar <sarkar.abhik[AT]gmail.com>
2939 Robin Seggelmann <seggelmann[AT]fh-muenster.de>
2940 Chris Bontje <cbontje[AT]gmail.com>
2941 Ryan Wamsley <wamslers[AT]sbcglobal.net>
2942 Dave Butt <davidbutt[AT]mxtelecom.com>
2943 Julian Cable <julian_cable[AT]yahoo.com>
2944 Joost Yervante Damad <joost[AT]teluna.org>
2945 Martin Sustrik <sustrik[AT]imatix.com>
2946 Jon Smirl <jonsmirl[AT]gmail.com>
2947 David Kennedy <sgsguy[AT]gmail.com>
2948 Matthijs Mekking <matthijs[AT]mlnetlabs.nl>
2949 Dustin Johnson <dustin[AT]dustinj.us>
2950 Victor Fajardo <vfajardo[AT]tari.toshiba.com>
2951 Tamas Regos <tamas.regos[AT]ericsson.com>
2952 Moshe van der Sterre <moshevds[AT]gmail.com>
2953 Rob Casey <rcasey[AT]gmail.com>
2954 Ted Percival <ted[AT]midg3t.net>
2955 Marc Petit-Huguenin <marc[AT]petit-huguenin.org>
2956 Florent Drouin <florent.drouin[AT]alcatel-lucent.fr>
2957 Karen Feng <kfeng[AT]fas.harvard.edu>
2958 Stephen Croll <croll[AT]mobilemetrics.net>
2959 Jens Braeuer <jensb[AT]cs.tu-berlin.de>
2960 Sake Blok <sake[AT]euronet.nl>
2961 Fulko Hew <fulko.hew[AT]gmail.com>
2962 Yukiyo Akisada <Yukiyo.Akisada[AT]jp.yokogawa.com>
2963 Andy Chu <chu.dev[AT]gmail.com>
2964 Shane Kearns <shane.kearns[AT]symbian.com>
2965 Loris Degioanni <loris.degioanni[AT]riverbed.com>
2966 Sven Meier <msv[AT]zhwin.ch>
2967 Holger Pfrommer <hpfrommer[AT]hilscher.com>
2968 Hariharan Ananthakrishnan <hariharan.a[AT]gmail.com>
2969 Hannes Kaelber <hannes.kaelber--wireshark[AT]x2e.de>
2970 Stephen Donnelly <stephen[AT]endace.com>
2971 Philip Frey <frey.philip[AT]gmail.com>
2972 Yves Geissbuehler <yves.geissbuehler[AT]gmail.com>
2973 Shigeo Nakamura <naka_shigeo[AT]yahoo.co.jp>
2974 Sven Eckelmann <sven[AT]narfation.org>
2975 Edward J. Paradise <pdice[AT]cisco.com>
2976 Brian Stormont <nospam[AT]stormyprods.com>
2977 Vincent Helfre <vincent.helfre[AT]ericsson.com>
2978 Brooss <brooss.teambb[AT]gmail.com>
2979 Joan Ramio <joan[AT]ramio.cat>
2980 David Castleford <david.castleford[AT]orange-ftgroup.com>
2981 Peter Harris <pharris[AT]opentext.com>
2982 Martin Lutz <MartinL[AT]copadata.at>
2983 Johnny Mitrevski <mitrevj[AT]hotmail.com>
2984 Neil Horman <nhorman[AT]tuxdriver.com>
2985 Andreas Schuler <krater[AT]badterrorist.com>
2986 Matthias Wenzel <dect[AT]mazzoo.de>
2987 Christian Durrer <christian.durrer[AT]sensemail.ch>
2988 Naoyoshi Ueda <piyomaru3141[AT]gmail.com>
2989 Javier Cardona <javier[AT]cozybit.com>
2990 Jens Steinhauser <jens.steinhauser[AT]omicron.at>
2991 Julien Kerihuel <j.kerihuel[AT]openchange.org>
2992 Vincenzo Condoleo <vcondole[AT]hsr.ch>
2993 Mohammad Ebrahim Mohammadi Panah <mebrahim[AT]gmail.com>
2994 Greg Schwendimann <gregs[AT]iol.unh.edu>
2995 Nick Lewis <nick.lewis[AT]atltelecom.com>
2996 Fred Fierling <fff[AT]exegin.com>
2997 Samu Varjonen <samu.varjonen[AT]hiit.fi>
2998 Alexis La Goutte <alexis.lagoutte[AT]gmail.com>
2999 Varun Notibala <nbvarun[AT]gmail.com>
3000 Nathan Hartwell <nhartwell[AT]gmail.com>
3001 Don Chirieleison <donc[AT]mitre.org>
3002 Harald Welte <laforge[AT]gnumonks.org>
3003 Chris Costa <chcosta75[AT]hotmail.com>
3004 Bruno Premont <bonbons[AT]linux-vserver.org>
3005 Florian Forster <octo[AT]verplant.org>
3006 Ivan Sy Jr. <ivan_jr[AT]yahoo.com>
3007 Matthieu Patou <mat[AT]matws.net>
3008 Kovarththanan Rajaratnam <kovarththanan.rajaratnam[AT]gmail.com>
3009 Matt Watchinski <mwatchinski[AT]sourcefire.com>
3010 Ravi Kondamuru <Ravi.Kondamuru[AT]citrix.com>
3011 Jan Gerbecks <jan.gerbecks[AT]stud.uni-due.de>
3012 Vladimir Smrekar <vladimir.smrekar[AT]gmail.com>
3013 Tobias Erichsen <t.erichsen[AT]gmx.de>
3014 Erwin van Eijk <erwin.vaneijk[AT]gmail.com>
3015 Venkateshwaran Dorai <venkateshwaran.d[AT]gmail.com>
3016 Ben Greear <greearb[AT]candelatech.com>
3017 Richard Kuemmel <r.kuemmel[AT]beckhoff.de>
3018 Yi Yu <yiyu.inbox[AT]gmail.com>
3019 Aniruddha A <aniruddha.a[AT]gmail.com>
3020 David Aggeler <david_aggeler[AT]hispeed.ch>
3021 Jens Kilian <jjk[AT]acm.org>
3022 David Bond <mokon[AT]mokon.net>
3023 Paul J. Metzger <pjm[AT]ll.mit.edu>
3024 Robert Hogan <robert[AT]roberthogan.net>
3025 Torrey Atcitty <torrey.atcitty[AT]harman.com>
3026 Dave Olsen <dave.olsen[AT]harman.com>
3027 Craig Gunther <craig.gunther[AT]harman.com>
3028 Levi Pearson <levi.pearson[AT]harman.com>
3029 Allan M. Madsen <allan.m[AT]madsen.dk>
3030 Slava <slavak[AT]gmail.com>
3031 H.sivank <hsivank[AT]gmail.com>
3032 Edgar Gladkich <edgar.gladkich[AT]inacon.de>
3033 Michael Bernhard <michael.bernhard[AT]bfh.ch>
3034 Holger Hans Peter Freyther <zecke[AT]selfish.org>
3035 Jose Pico <jose[AT]taddong.com>
3036 David Perez <david[AT]taddong.com>
3037 Haakon Nessjoen <haakon.nessjoen[AT]gmail.com>
3038 Herbert Lischka <herbert[AT]lischka-berlin.de>
3039 Felix Kraemer <sauter-cumulus[AT]de.sauter-bc.com>
3040 Tom Hughes <tom[AT]compton.nu>
3041 Owen Kirby <osk[AT]exegin.com>
3042 Colin O'Flynn <coflynn[AT]newae.com>
3043 Juha Siltanen <juha.siltanen[AT]nsn.com>
3044 Cal Turney <turney_cal[AT]emc.com>
3045 Lukasz Kotasa <lukasz.kotasa[AT]tieto.com>
3046 Jason Masker <jason[AT]masker.net>
3047 Giuliano Fabris <giuliano.fabris[AT]appeartv.com>
3048 Alexander Koeppe <format_c[AT]online.de>
3049 Holger Grandy <Holger.Grandy[AT]bmw-carit.de>
3050 Hadriel Kaplan <hadrielk[AT]yahoo.com>
3051 Srinivasa Pradeep <sippyemail-wireshark[AT]yahoo.com>
3052 Lori Tribble <ljtconsulting[AT]gmail.com>
3053 Thomas Boehne <TBoehne[AT]ADwin.de>
3054 Gerhard Gappmeier <gerhard.gappmeier[AT]ascolab.com>
3055 David Katz <dkatz[AT]airspan.com>
3056 Toralf Foerster <toralf.foerster[AT]gmx.de>
3057 Stephane Bryant <stephane[AT]glycon.org>
3058 Emil Wojak <emil[AT]wojak.eu>
3059 Steve Huston <shuston[AT]riverace.com>
3060 Lorand Jakab <ljakab[AT]ac.upc.edu>
3061 Grzegorz Szczytowski <Grzegorz.Szczytowski[AT]gmail.com>
3062 Martin Kaiser <martin[AT]kaiser.cx>
3063 Jakub Zawadzki <darkjames-ws[AT]darkjames.pl>
3064 Roland Knall <rknall[AT]gmail.com>
3065 Xiao Xiangquan <xiaoxiangquan[AT]gmail.com>
3066 Hans-Christoph Schemmel <hans-christoph.schemmel[AT]cinterion.com>
3067 Tyson Key <tyson.key[AT]gmail.com>
3068 Johannes Jochen <johannes.jochen[AT]belden.com>
3069 Florian Fainelli <florian[AT]openwrt.org>
3070 Daniel Willmann <daniel[AT]totalueberwachung.de>
3071 Brian Cavagnolo <brian[AT]cozybit.com>
3072 Allison <aobourn[AT]isilon.com>
3073 Edwin Groothuis <wireshark[AT]mavetju.org>
3074 Andrew Kampjes <andrew.kampjes[AT]endace.com>
3075 Kurnia Hendrawan <kurnia.hendrawan[AT]consistec.de>
3076 Leonard Tracy <letracy[AT]cisco.com>
3077 Elliott Aldrich <elliott[AT]aldrichart.com>
3078 Glenn Matthews <glenn.matthews[AT]cisco.com>
3079 Donnie Savage <dsavage[AT]cisco.com>
3080 Spenser Sheng <spenser.sheng[AT]ericsson.com>
3081 Benjamin Stocks <bmstocks[AT]ra.rockwell.com>
3082 Florian Reichert <refl[AT]zhaw.ch>
3083 Martin Renold <reld[AT]zhaw.ch>
3084 Iain Arnell <iarnell[AT]epo.org>
3085 Mariusz Okroj <okrojmariusz[AT]gmail.com>
3086 Ivan Lawrow <ivan.lawrow[AT]jennic.com>
3087 Kari Vatjus-Anttila <kari.vatjus-anttila[AT]cie.fi>
3088 Shobhank Sharma <ssharma5[AT]ncsu.edu>
3089 Salil Kanitkar <sskanitk[AT]ncsu.edu>
3090 Michael Sakaluk <mdsakalu[AT]ncsu.edu>
3091 Mayuresh Raut <msraut[AT]ncsu.edu>
3092 Sheetal Kshirsagar <sdkshirs[AT]ncsu.edu>
3093 Andrew Williams <anwilli5[AT]ncsu.edu>
3094 Per Liedberg <per.liedberg[AT]ericsson.com>
3095 Gaurav Tungatkar <gauravstt[AT]gmail.com>
3096 Bill Schiller <bill.schiller[AT]emerson.com>
3097 Aditya Ambadkar <arambadk[AT]ncsu.edu>
3098 Diana Chris <dvchris[AT]ncsu.edu>
3099 Guy Martin <gmsoft[AT]tuxicoman.be>
3100 Deepti Ragha <dlragha[AT]ncsu.edu>
3101 Niels de Vos <ndevos[AT]redhat.com>
3102 Clement Marrast <clement.marrast[AT]molex.com>
3103 Jacob Nordgren <jnordgren[AT]gmail.com>
3104 Rishie Sharma <rishie[AT]kth.se>
3105 Richard Stearn <richard[AT]rns-stearn.demon.co.uk>
3106 Tobias Rutz <tobias.rutz[AT]work-microwave.de>
3107 Michal Labedzki <michal.labedzki[AT]tieto.com>
3108 Wido Kelling <kellingwido[AT]aol.com>
3109 Kaushal Shah <kshah3[AT]ncsu.edu>
3110 Subramanian Ramachandran <sramach6[AT]ncsu.edu>
3111 Manuel Hofer <manuel[At]mnlhfr.at>
3112 Gaurav Patwardhan <gspatwar[AT]ncsu.edu>
3113 Peter Hatina <phatina[AT]redhat.com>
3114 Tomasz MoX <desowin[AT]gmail.com>
3115 and by:
3117 Georgi Guninski <guninski[AT]guninski.com>
3119 Jason Copenhaver <jcopenha[AT]typedef.org>
3120 Eric Perie <eric.perie[AT]colubris.com>
3121 David Yon <yon[AT]tacticalsoftware.com>
3122 Marcio Franco <franco.marcio[AT]rd.francetelecom.fr>
3123 Kaloian Stoilov <kalkata[AT]yahoo.com>
3124 Steven Lass <stevenlass[AT]mail.com>
3125 Gregory Stark <gsstark[AT]mit.edu>
3126 Darren Steele <steeley[AT]steeley.co.uk>
3127 Michael Kopp <michael.kopp[AT]isarnet.de>
3128 Bernd Leibing <bernd.leibing[AT]kiz.uni-ulm.de>
3129 Chris Heath <chris[AT]heathens.co.nz>
3130 Gisle Vanem <gvanem[AT]broadpark.no>
3131 Ritchie <ritchie[AT]tipsybottle.com>
3132 Aki Immonen <aki.immonen[AT]golftalma.fi>
3133 David E. Weekly <david[AT]weekly.org>
3134 Steve Ford <sford[AT]geeky-boy.com>
3135 Masaki Chikama <masaki-c[AT]is.aist-nara.ac.jp>
3136 Mohammad Hanif <mhanif[AT]nexthop.com>
3137 Reinhard Speyerer <rspmn[AT]arcor.de>
3138 Patrick Kursawe <phosphan[AT]gentoo.org>
3139 Arsen Chaloyan <achaloyan[AT]yahoo.com>
3140 <melerski[AT]poczta.onet.pl>
3141 Arnaud Jacques <webmaster[AT]securiteinfo.com>
3142 D. Manzella <manzella[AT]lucent.com>
3143 Jari Mustajarvi <jari.mustajarvi[AT]nokia.com>
3144 Pierre Juhen <pierre.juhen[AT]wanadoo.fr>
3145 David Richards <drichards[AT]alum.mit.edu>
3146 Shusaku Ueda <ueda[AT]sra.co.jp>
3147 Jonathan Perkins <jonathan.perkins[AT]ipaccess.com>
3148 Holger Schurig <h.schurig[AT]mn-logistik.de>
3149 Peter J. Creath <peter-ethereal[AT]creath.net>
3150 Magnus Hansson <mah[AT]hms.se>
3151 Pavel Kankovsky <kan[AT]dcit.cz>
3152 Nick Black <dank[AT]reflexsecurity.com>
3153 Bill Guyton <guyton[AT]bguyton.com>
3154 Chernishov Yury <Chernishov[AT]iskrauraltel.ru>
3155 Thomas Palmer <Thomas.Palmer[AT]Gunter.AF.mil>
3156 Clinton Work <clinton[AT]scripty.com>
3157 Joe Marcus Clarke <marcus[AT]marcuscom.com>
3158 Kendy Kutzner <kutzner[AT]tm.uka.de>
3159 James H. Cloos Jr. <cloos[AT]jhcloos.com>
3160 Tim Farley <tfarley[AT]iss.net>
3161 Daniel Thompson <daniel.thompson[AT]st.com>
3162 Chris Jepeway <thai-dragon[AT]eleven29.com>
3163 Matthew Bradley <matthew.bradley[AT]cnsonline.net>
3164 Nathan Alger <nathan[AT]wasted.com>
3165 Stas Grabois <sagig[AT]radware.com>
3166 Ainsley Pereira <APereira[AT]Witness.com>
3167 Philippe Mazeau <philippe.mazeau[AT]swissvoice.net>
3168 Carles Kishimoto <ckishimo[AT]ac.upc.es>
3169 Dennis Lim <Dennis.Lim[AT]motorola.com>
3170 <postadal[AT]suse.cz>
3171 Martin van der Werff <martin[AT]vanderwerff.org>
3172 Marco van den Bovenkamp <marco[AT]linuxgoeroe.dhs.org>
3173 Ming Zhang <mingz[AT]ele.uri.edu>
3174 Neil Piercy <Neil.Piercy[AT]ipaccess.com>
3175 Remi Denis-Courmont <courmisch[AT]via.ecp.fr>
3176 Thomas Palmer <tpalmer[AT]elmore.rr.com>
3177 Maarten Svantesson <f95-msv[AT]f.kth.se>
3178 Steve Sommars (e-mail address removed at contributor's request)
3179 Kestutis Kupciunas <kesha[AT]soften.ktu.lt>
3180 Rene Pilz <rene.pilz[AT]ftw.at>
3181 Laurent Constantin <laurent.constantin[AT]aql.fr>
3182 Martin Pichlmaier <martin.pichlmaier[AT]siemens.com>
3183 Mark Phillips <msp[AT]nortelnetworks.com>
3184 Nils Ohlmeier <lists[AT]ohlmeier.org>
3185 Ignacio Goyret <igoyret[AT]lucent.com>
3186 Bart Braem <bart.braem[AT]gmail.com>
3187 Shingo Horisawa <name4n5[AT]hotmail.com>
3188 Lane Hu <lane.hu[AT]utstar.com>
3189 Marc Poulhies <marc.poulhies[AT]epfl.ch>
3190 Tomasz Mrugalski <thomson[AT]klub.com.pl>
3191 Brett Kuskie <mstrprgmmr[AT]chek.com>
3192 Brian Caswell <bmc[AT]sourcefire.com>
3193 Yann <yann_eads[AT]hotmail.com>
3194 Julien Leproust <julien[AT]via.ecp.fr>
3195 Mutsuya Irie <irie[AT]sakura-catv.ne.jp>
3196 Yoshihiro Oyama <y.oyama[AT]netagent.co.jp>
3197 Chris Eagle <cseagle[AT]nps.edu>
3198 Dominique Bastien <dbastien[AT]accedian.com>
3199 Nicolas Dichtel <nicolas.dichtel[AT]6wind.com>
3200 Ricardo Muggli <ricardo.muggli[AT]mnsu.edu>
3201 Vladimir Kondratiev <vladimir.kondratiev[AT]gmail.com>
3202 Jaap Keuter <jaap.keuter[AT]xs4all.nl>
3203 Frederic Peters <fpeters[AT]debian.org>
3204 Anton Ivanov <anthony_johnson[AT]mail.ru>
3205 Ilya Konstantinov <future[AT]shiny.co.il>
3206 Neil Kettle <mu-b[AT]65535.com>
3207 Steve Karg <skarg[AT]users.sourceforge.net>
3208 Javier Acuna <javier.acuna[AT]sixbell.cl>
3209 Miklos Szurdi <szurdimiklos[AT]yahoo.com>
3210 Cvetan Ivanov <zezo[AT]spnet.net>
3211 Vasanth Manickam <vasanth.manickam[AT]bt.com>
3212 Julian Onions <julian.onions[AT]gmail.com>
3213 Samuel Thibault <samuel.thibault[AT]ens-lyon.org>
3214 Peter KovaX <peter.kovar[AT]gmail.com>
3215 Paul Ollis <paul.ollis[AT]roke.co.uk>
3216 Dominik Kuhlen <dkuhlen[AT]gmx.net>
3217 Karl Knoebl <karl.knoebl[AT]siemens.com>
3218 Maria-Luiza Crivat <luizacri[AT]gmail.com>
3219 Brice Augustin <bricecotte[AT]gmail.com>
3220 Matt Thornton <MATT_THORNTON[AT]appsig.com>
3221 Timo Metsala <timo.metsala[AT]gmail.com>
3222 Tomer Shani <thetour[AT]japan.com>
3223 Manu Pathak <mapathak[AT]cisco.com>
3224 John Sullivan <john[AT]kanargh.force9.co.uk>
3225 Martin Andre <andre[AT]clarinet.u-strasbg.fr>
3226 Andrei Emeltchenko <Andrei.Emeltchenko[AT]nokia.com>
3227 Kirby Files <kfiles[AT]masergy.com>
3228 Ravi Valmikam <rvalmikam[AT]airvananet.com>
3229 Diego Petteno <flameeyes[AT]gentoo.org>
3230 Daniel Black <dragonheart[AT]gentoo.org>
3231 Christoph Werle <Christoph.Werle[AT]ira.uka.de>
3232 Aaron Christensen <aaronmf[AT]gmail.com>
3233 Ian Abel <ianabel[AT]mxtelecom.com>
3234 Bryant Eastham <beastham[AT]slc.mew.com>
3235 Taner Kurtulus <taner.kurtulus[AT]tubitak.gov.tr>
3236 Joe Breher <linux[AT]q-music.com>
3237 Patrick vd Lageweg <patrick[AT]bitwizard.nl>
3238 Thomas Sillaber <Thomas.Sillaber[AT]gmx.de>
3239 Mike Davies <m.davies[AT]btinternet.com>
3240 Boris Misenov <Boris.Misenov[AT]oktelabs.ru>
3241 Joe McEachern <joe[AT]qacafe.com>
3242 Charles Lepple <clepple[AT]gmail.com>
3243 Tuomas Maattanen <maattanen[AT]iki.fi>
3244 Joe Eykholt <joe[AT]nuovasystems.com>
3245 Ian Brumby <ian.brumby[AT]baesystems.com>
3246 Todd J Martin <todd.martin[AT]acm.org>
3247 Scott Robinson <scott.robinson[AT]flukenetworks.com>
3248 Martin Peylo <wireshark[AT]izac.de>
3249 Stephane Loeuillet <leroutier[AT]gmail.com>
3250 Andrei Rubaniuk <rubaniuk[AT]mail.ru>
3251 Mikael Magnusson <mikma264[AT]gmail.com>
3252 Timo Teraes <timo.teras[AT]iki.fi>
3253 Marton Nemeth <nm127[AT]freemail.hu>
3254 Kai Blin <kai[AT]samba.org>
3255 Olivier Montanuy <olivier.montanuy[AT]orange-ftgroup.com>
3256 Thomas Morin <thomas.morin[AT]orange-ftgroup.com>
3257 Jesus Roman <jroman[AT]teldat.com>
3258 Giodi Giorgi <g.giorgi[AT]gmail.com>
3259 Peter Hertting <Peter.Hertting[AT]gmx.net>
3260 Jess Balint <jbalint[AT]gmail.com>
3261 Bahaa Naamneh <b.naamneh[AT]gmail.com>
3262 Magnus Soerman <magnus.sorman[AT]ericsson.com
3263 Pascal Quantin <pascal.quantin[AT]gmail.com>
3264 Roy Marples <roy[AT]marples.name>
3265 Ward van Wanrooij <ward[AT]ward.nu>
3266 Federico Mena Quintero <federico[AT]novell.com>
3267 Andreas Heise <andreas.heise[AT]nextiraone.de>
3268 Alex Lindberg <alindber[AT]yahoo.com>
3269 Rama Chitta <rama[AT]gear6.com>
3270 Roberto Mariani <jelot-wireshark[AT]jelot.it>
3271 Sandhya Gopinath <Sandhya.Gopinath[AT]citrix.com>
3272 Raghav SN <Raghav.SN[AT]citrix.com>
3273 Murali Raja <Murali.Raja[AT]citrix.com>
3274 Devesh Prakash <Devesh.Prakash[AT]citrix.com>
3275 Darryl Champagne <dchampagne[AT]sta.samsung.com>
3276 Michael Speck <Michael.Speck[AT]avl.com>
3277 Gerasimos Dimitriadis <dimeg[AT]intracom.gr>
3278 Robert Simac <rsimac[AT]cronsult.com>
3279 Johanna Sochos <johanna.sochos[AT]swissqual.com>
3280 Felix Obenhuber <felix[AT]obenhuber.de>
3281 Hilko Bengen <bengen--wireshark[AT]hilluzination.de>
3282 Hadar Shoham <hadar[AT]ti.com>
3283 Robert Bullen <robert[AT]bitcricket.com>
3284 Chuck Kristofek <chuck.kristofek[AT]ngc.com>
3285 Markus Renz <Markus.Renz[AT]hirschmann.de>
3286 Toshihiro Kataoka <kataoka.toshihiro[AT]gmail.com>
3287 Petr Lautrbach <plautrba[AT]redhat.com>
3288 Frank Lahm <franklahm[AT]googlemail.com>
3289 Jon Ellch <jellch[AT]harris.com>
3290 Alex Badea <vamposdecampos[AT]gmail.com>
3291 Dirk Jagdmann <doj[AT]cubic.org>
3292 RSA <ryazanov.s.a[AT]gmail.com>
3293 Juliusz Chroboczek <jch[AT]pps.jussieu.fr>
3294 Vladimir Kazansky <vovjo[AT]yandex.ru>
3295 Peter Paluch <peter.paluch[AT]fri.uniza.sk>
3296 Tom Brezinski <tombr[AT]netinst.com>
3297 Nick Glass <nick.glass[AT]lycos.com>
3298 Michael Mann <mmann78[AT]netscape.net>
3299 Romain Fliedel <romain.fliedel+wireshark[AT]gmail.com>
3300 Michael Chen <michaelc[AT]idssoftware.com>
3301 Paul Stath <pstath[AT]axxcelera.com>
3302 DeCount <aatrade[AT]libero.it>
3303 Andras Veres-Szentkiralyi <vsza[AT]vsza.hu>
3304 Jakob Hirsch <jh.wireshark-bugzilla[AT]plonk.de>
3305 XXXXX XXXXXXXX <DXDragon[AT]yandex.ru>
3306 <billyjeans[AT]gmail.com>
3307 Evan Huus <eapache[AT]gmail.com>
3308 Tom Cook <tcook[AT]ixiacom.com>
3309 Tom Alexander <talexander[AT]ixiacom.com>
3310 Klaus Heckelmann <klaus.heckelmann[AT]nashtech.com>
3311 Ben Bowen <bbowen[AT]godaddy.com>
3312 Bodo Petermann <bp245[AT]hotmail.com>
3313 Martin Kupec <martin.kupec[AT]kupson.cz>
3314 Litao Gao <ltgao[AT]juniper.net>
3315 Niels Widger <niels[AT]qacafe.com>
3316 Pontus Fuchs <pontus.fuchs[AT]gmail.com>
3317 Bill Parker <wp02855[AT]gmail.com>
3318 Tomofumi Hayashi <s1061123[AT]gmail.com>
3319 Tim Hentenaar <tim.hentenaar[AT]gmail.com>
3320 Krishnamurthy Mayya <krishnamurthymayya[AT]gmail.com>
3321 Nikitha Malgi <nikitha01[AT]gmail.com>
3322 Adam Butcher <adam[AT]jessamine.co.uk>
3323 Hendrik Uhlmann <Hendrik.Uhlmann[AT]rheinmetall.com>
3324 Alex Gaertner <gaertner.alex[AT]gmx.de>
3325 Sebastiano Di Paola <sebastiano.dipaola[AT]gmail.com>
3326 Steven J. Magnani <steve[AT]digidescorp.com>
3327 David Arnold <davida[AT]pobox.com>
3328 Dario Lombardo <lomato[AT]gmail.com>
3329 Alexander Chemeris <alexander.chemeris[AT]gmail.com>
3330 Ivan Klyuchnikov <kluchnikovi[AT]gmail.com>
3331 Max Baker <max[AT]warped.org>
3332 Mike Garratt <mg.wireshark[AT]evn.co.nz>
3333 Bart Van Assche <bvanassche[AT]acm.org>
3334 Karl Beldan <karl.beldan[AT]gmail.com>
3335 Masayuki Takemura <masayuki.takemura[AT]gmail.com>
3336 Dan Lasley <dlasley[AT]promus.com> gave permission for his
3338 dumpit() hex-dump routine to be used.
3339 Mattia Cazzola <mattiac[AT]alinet.it> provided a patch to the
3341 hex dump display routine.
3342 We use the exception module from Kazlib, a C library written by
3344 Kaz Kylheku <kaz[AT]ashi.footprints.net>. Thanks go to him for
3345 his well-written library. The Kazlib home page can be found at
3346 http://users.footprints.net/~kaz/kazlib.html
3347 We use Lua BitOp, written by Mike Pall, for bitwise operations
3349 on numbers in Lua. The Lua BitOp home page can be found at
3350 http://bitop.luajit.org/
3351 Henrik Brix Andersen <brix[AT]gimp.org> gave permission for his
3353 webbrowser calling routine to be used.
3354 Christophe Devine <c.devine[AT]cr0.net> gave permission for his
3356 SHA1 routines to be used.
3357 snax <snax[AT]shmoo.com> gave permission to use his(?) weak key
3359 detection code from Airsnort.
3360 IANA gave permission for their port-numbers file to be used.
33621.10.14 2018-10-30 WIRESHARK(1)