1WIRESHARK(1) The Wireshark Network Analyzer WIRESHARK(1)
2
6 wireshark - Interactively dump and analyze network traffic
7
9 wireshark [ -a <capture autostop condition> ] ...
10 [ -b <capture ring buffer option> ] ... [ -B <capture buffer size> ]
11 [ -c <capture packet count> ] [ -C <configuration profile> ]
12 [ -d <display filter> ] [ -D ] [ --display=<X display to use> ]
13 [ -f <capture filter> ] [ -g <packet number> ] [ -h ] [ -H ]
14 [ -i <capture interface>|- ] [ -I ] [ -j ] [ -J <jump filter> ] [ -k ]
15 [ -K <keytab> ] [ -l ] [ -L ] [ -m <font> ] [ -n ]
16 [ -N <name resolving flags> ] [ -o <preference/recent setting> ] ...
17 [ -p ] [ -P <path setting>] [ -r <infile> ]
18 [ -R <read (display) filter> ] [ -s <capture snaplen> ] [ -S ]
19 [ -t ad|a|r|d|dd|e ] [ -v ] [ -w <outfile> ] [ -X <eXtension option> ]
20 [ -y <capture link type> ] [ -z <statistics> ] [ <infile> ]
21
23 Wireshark is a GUI network protocol analyzer. It lets you
24 interactively browse packet data from a live network or from a
25 previously saved capture file. Wireshark's native capture file format
26 is libpcap format, which is also the format used by tcpdump and various
27 other tools.
28 Wireshark can read / import the following file formats:
30 · libpcap - captures from Wireshark/TShark/dumpcap, tcpdump, and
32 various other tools using libpcap's/tcpdump's capture format
33 · pcap-ng - "next-generation" successor to libpcap format
35 · snoop and atmsnoop captures
37 · Shomiti/Finisar Surveyor captures
39 · Novell LANalyzer captures
41 · Microsoft Network Monitor captures
43 · AIX's iptrace captures
45 · Cinco Networks NetXRay captures
47 · Network Associates Windows-based Sniffer captures
49 · Network General/Network Associates DOS-based Sniffer (compressed or
51 uncompressed) captures
52 · AG Group/WildPackets
54 EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures
55 · RADCOM's WAN/LAN analyzer captures
57 · Network Instruments Observer version 9 captures
59 · Lucent/Ascend router debug output
61 · files from HP-UX's nettl
63 · Toshiba's ISDN routers dump output
65 · the output from i4btrace from the ISDN4BSD project
67 · traces from the EyeSDN USB S0.
69 · the output in IPLog format from the Cisco Secure Intrusion
71 Detection System
72 · pppd logs (pppdump format)
74 · the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities
76 · the text output from the DBS Etherwatch VMS utility
78 · Visual Networks' Visual UpTime traffic capture
80 · the output from CoSine L2 debug
82 · the output from InfoVista's 5View LAN agents
84 · Endace Measurement Systems' ERF format captures
86 · Linux Bluez Bluetooth stack hcidump -w traces
88 · Catapult DCT2000 .out files
90 · Gammu generated text output from Nokia DCT3 phones in Netmonitor
92 mode
93 · IBM Series (OS/400) Comm traces (ASCII & UNICODE)
95 · Juniper Netscreen snoop files
97 · Symbian OS btsnoop files
99 · TamoSoft CommView files
101 · Textronix K12xx 32bit .rf5 format files
103 · Textronix K12 text file format captures
105 · Apple PacketLogger files
107 · Files from Aethra Telecommunications' PC108 software for their test
109 instruments
110 There is no need to tell Wireshark what type of file you are reading;
112 it will determine the file type by itself. Wireshark is also capable
113 of reading any of these file formats if they are compressed using gzip.
114 Wireshark recognizes this directly from the file; the '.gz' extension
115 is not required for this purpose.
116 Like other protocol analyzers, Wireshark's main window shows 3 views of
118 a packet. It shows a summary line, briefly describing what the packet
119 is. A packet details display is shown, allowing you to drill down to
120 exact protocol or field that you interested in. Finally, a hex dump
121 shows you exactly what the packet looks like when it goes over the
122 wire.
123 In addition, Wireshark has some features that make it unique. It can
125 assemble all the packets in a TCP conversation and show you the ASCII
126 (or EBCDIC, or hex) data in that conversation. Display filters in
127 Wireshark are very powerful; more fields are filterable in Wireshark
128 than in other protocol analyzers, and the syntax you can use to create
129 your filters is richer. As Wireshark progresses, expect more and more
130 protocol fields to be allowed in display filters.
131 Packet capturing is performed with the pcap library. The capture
133 filter syntax follows the rules of the pcap library. This syntax is
134 different from the display filter syntax.
135 Compressed file support uses (and therefore requires) the zlib library.
137 If the zlib library is not present, Wireshark will compile, but will be
138 unable to read compressed files.
139 The pathname of a capture file to be read can be specified with the -r
141 option or can be specified as a command-line argument.
142
144 Most users will want to start Wireshark without options and configure
145 it from the menus instead. Those users may just skip this section.
146 -a <capture autostop condition>
148 Specify a criterion that specifies when Wireshark is to stop
149 writing to a capture file. The criterion is of the form
150 test:value, where test is one of:
151 duration:value Stop writing to a capture file after value seconds
153 have elapsed.
154 filesize:value Stop writing to a capture file after it reaches a
156 size of value kilobytes (where a kilobyte is 1024 bytes). If this
157 option is used together with the -b option, Wireshark will stop
158 writing to the current capture file and switch to the next one if
159 filesize is reached.
160 files:value Stop writing to capture files after value number of
162 files were written.
163 -b <capture ring buffer option>
165 Cause Wireshark to run in "multiple files" mode. In "multiple
166 files" mode, Wireshark will write to several capture files. When
167 the first capture file fills up, Wireshark will switch writing to
168 the next file and so on.
169 The created filenames are based on the filename given with the -w
171 flag, the number of the file and on the creation date and time,
172 e.g. outfile_00001_20050604120117.pcap,
173 outfile_00002_20050604120523.pcap, ...
174 With the files option it's also possible to form a "ring buffer".
176 This will fill up new files until the number of files specified, at
177 which point Wireshark will discard the data in the first file and
178 start writing to that file and so on. If the files option is not
179 set, new files filled up until one of the capture stop conditions
180 match (or until the disk is full).
181 The criterion is of the form key:value, where key is one of:
183 duration:value switch to the next file after value seconds have
185 elapsed, even if the current file is not completely filled up.
186 filesize:value switch to the next file after it reaches a size of
188 value kilobytes (where a kilobyte is 1024 bytes).
189 files:value begin again with the first file after value number of
191 files were written (form a ring buffer). This value must be less
192 than 100000. Caution should be used when using large numbers of
193 files: some filesystems do not handle many files in a single
194 directory well. The files criterion requires either duration or
195 filesize to be specified to control when to go to the next file.
196 It should be noted that each -b parameter takes exactly one
197 criterion; to specify two criterion, each must be preceded by the
198 -b option.
199 Example: -b filesize:1024 -b files:5 results in a ring buffer of
201 five files of size one megabyte.
202 -B <capture buffer size>
204 Set capture buffer size (in MB, default is 1MB). This is used by
205 the the capture driver to buffer packet data until that data can be
206 written to disk. If you encounter packet drops while capturing,
207 try to increase this size. Note that, while Wireshark attempts to
208 set the buffer size to 1MB by default, and can be told to set it to
209 a larger value, the system or interface on which you're capturing
210 might silently limit the capture buffer size to a lower value or
211 raise it to a higher value.
212 This is available on UNIX systems with libpcap 1.0.0 or later and
214 on Windows. It is not available on UNIX systems with earlier
215 versions of libpcap.
216 This option can occur multiple times. If used before the first
218 occurrence of the -i option, it sets the default capture buffer
219 size. If used after an -i option, it sets the capture buffer size
220 for the interface specified by the last -i option occurring before
221 this option. If the capture buffer size is not set specifically,
222 the default capture buffer size is used if provided.
223 -c <capture packet count>
225 Set the maximum number of packets to read when capturing live data.
226 -C <configuration profile>
228 Start with the given configuration profile.
229 -d <display filter>
231 Start with the given display filter.
232 -D Print a list of the interfaces on which Wireshark can capture, and
234 exit. For each network interface, a number and an interface name,
235 possibly followed by a text description of the interface, is
236 printed. The interface name or the number can be supplied to the
237 -i flag to specify an interface on which to capture.
238 This can be useful on systems that don't have a command to list
240 them (e.g., Windows systems, or UNIX systems lacking ifconfig -a);
241 the number can be useful on Windows 2000 and later systems, where
242 the interface name is a somewhat complex string.
243 Note that "can capture" means that Wireshark was able to open that
245 device to do a live capture; if, on your system, a program doing a
246 network capture must be run from an account with special privileges
247 (for example, as root), then, if Wireshark is run with the -D flag
248 and is not run from such an account, it will not list any
249 interfaces.
250 --display=<X display to use>
252 Specifies the X display to use. A hostname and screen
253 (otherhost:0.0) or just a screen (:0.0) can be specified. This
254 option is not available under Windows.
255 -f <capture filter>
257 Set the capture filter expression.
258 This option can occur multiple times. If used before the first
260 occurrence of the -i option, it sets the default capture filter
261 expression. If used after an -i option, it sets the capture filter
262 expression for the interface specified by the last -i option
263 occurring before this option. If the capture filter expression is
264 not set specifically, the default capture filter expression is used
265 if provided.
266 -g <packet number>
268 After reading in a capture file using the -r flag, go to the given
269 packet number.
270 -h Print the version and options and exit.
272 -H Hide the capture info dialog during live packet capture.
274 -i <capture interface>|-
276 Set the name of the network interface or pipe to use for live
277 packet capture.
278 Network interface names should match one of the names listed in
280 "wireshark -D" (described above); a number, as reported by
281 "wireshark -D", can also be used. If you're using UNIX, "netstat
282 -i" or "ifconfig -a" might also work to list interface names,
283 although not all versions of UNIX support the -a flag to ifconfig.
284 If no interface is specified, Wireshark searches the list of
286 interfaces, choosing the first non-loopback interface if there are
287 any non-loopback interfaces, and choosing the first loopback
288 interface if there are no non-loopback interfaces. If there are no
289 interfaces at all, Wireshark reports an error and doesn't start the
290 capture.
291 Pipe names should be either the name of a FIFO (named pipe) or
293 ``-'' to read data from the standard input. On Windows systems,
294 pipe names must be of the form ``\\pipe\.\pipename''. Data read
295 from pipes must be in standard libpcap format.
296 This option can occur multiple times. When capturing from multiple
298 interfaces, the capture file will be saved in pcap-ng format.
299 -I Put the interface in "monitor mode"; this is supported only on IEEE
301 802.11 Wi-Fi interfaces, and supported only on some operating
302 systems.
303 Note that in monitor mode the adapter might disassociate from the
305 network with which it's associated, so that you will not be able to
306 use any wireless networks with that adapter. This could prevent
307 accessing files on a network server, or resolving host names or
308 network addresses, if you are capturing in monitor mode and are not
309 connected to another network with another adapter.
310 This option can occur multiple times. If used before the first
312 occurrence of the -i option, it enables the monitor mode for all
313 interfaces. If used after an -i option, it enables the monitor
314 mode for the interface specified by the last -i option occurring
315 before this option.
316 -j Use after -J to change the behavior when no exact match is found
318 for the filter. With this option select the first packet before.
319 -J <jump filter>
321 After reading in a capture file using the -r flag, jump to the
322 packet matching the filter (display filter syntax). If no exact
323 match is found the first packet after that is selected.
324 -k Start the capture session immediately. If the -i flag was
326 specified, the capture uses the specified interface. Otherwise,
327 Wireshark searches the list of interfaces, choosing the first non-
328 loopback interface if there are any non-loopback interfaces, and
329 choosing the first loopback interface if there are no non-loopback
330 interfaces; if there are no interfaces, Wireshark reports an error
331 and doesn't start the capture.
332 -K <keytab>
334 Load kerberos crypto keys from the specified keytab file. This
335 option can be used multiple times to load keys from several files.
336 Example: -K krb5.keytab
338 -l Turn on automatic scrolling if the packet display is being updated
340 automatically as packets arrive during a capture (as specified by
341 the -S flag).
342 -L List the data link types supported by the interface and exit.
344 -m <font>
346 Set the name of the font used by Wireshark for most text.
347 Wireshark will construct the name of the bold font used for the
348 data in the byte view pane that corresponds to the field selected
349 in the packet details pane from the name of the main text font.
350 -n Disable network object name resolution (such as hostname, TCP and
352 UDP port names), the -N flag might override this one.
353 -N <name resolving flags>
355 Turn on name resolving only for particular types of addresses and
356 port numbers, with name resolving for other types of addresses and
357 port numbers turned off. This flag overrides -n if both -N and -n
358 are present. If both -N and -n flags are not present, all name
359 resolutions are turned on.
360 The argument is a string that may contain the letters:
362 m to enable MAC address resolution
364 n to enable network address resolution
366 t to enable transport-layer port number resolution
368 C to enable concurrent (asynchronous) DNS lookups
370 -o <preference/recent setting>
372 Set a preference or recent value, overriding the default value and
373 any value read from a preference/recent file. The argument to the
374 flag is a string of the form prefname:value, where prefname is the
375 name of the preference/recent value (which is the same name that
376 would appear in the preference/recent file), and value is the value
377 to which it should be set. Since Ethereal 0.10.12, the recent
378 settings replaces the formerly used -B, -P and -T flags to
379 manipulate the GUI dimensions.
380 If prefname is "uat", you can override settings in various user
382 access tables using the form uat:uat filename:uat record. uat
383 filename must be the name of a UAT file, e.g. user_dlts.
384 uat_record must be in the form of a valid record for that file,
385 including quotes. For instance, to specify a user DLT from the
386 command line, you would use
387 -o "uat:user_dlts:\"User 0
389 (DLT=147)\",\"cops\",\"0\",\"\",\"0\",\"\""
390 -p Don't put the interface into promiscuous mode. Note that the
392 interface might be in promiscuous mode for some other reason;
393 hence, -p cannot be used to ensure that the only traffic that is
394 captured is traffic sent to or from the machine on which Wireshark
395 is running, broadcast traffic, and multicast traffic to addresses
396 received by that machine.
397 This option can occur multiple times. If used before the first
399 occurrence of the -i option, no interface will be put into the
400 promiscuous mode. If used after an -i option, the interface
401 specified by the last -i option occurring before this option will
402 not be put into the promiscuous mode.
403 -P <path setting>
405 Special path settings usually detected automatically. This is used
406 for special cases, e.g. starting Wireshark from a known location on
407 an USB stick.
408 The criterion is of the form key:path, where key is one of:
410 persconf:path path of personal configuration files, like the
412 preferences files.
413 persdata:path path of personal data files, it's the folder
415 initially opened. After the very first initialization, the recent
416 file will keep the folder last used.
417 -r <infile>
419 Read packet data from infile, can be any supported capture file
420 format (including gzipped files). It's not possible to use named
421 pipes or stdin here! To capture from a pipe or from stdin use -i -
422 -R <read (display) filter>
424 When reading a capture file specified with the -r flag, causes the
425 specified filter (which uses the syntax of display filters, rather
426 than that of capture filters) to be applied to all packets read
427 from the capture file; packets not matching the filter are
428 discarded.
429 -s <capture snaplen>
431 Set the default snapshot length to use when capturing live data.
432 No more than snaplen bytes of each network packet will be read into
433 memory, or saved to disk. A value of 0 specifies a snapshot length
434 of 65535, so that the full packet is captured; this is the default.
435 This option can occur multiple times. If used before the first
437 occurrence of the -i option, it sets the default snapshot length.
438 If used after an -i option, it sets the snapshot length for the
439 interface specified by the last -i option occurring before this
440 option. If the snapshot length is not set specifically, the
441 default snapshot length is used if provided.
442 -S Automatically update the packet display as packets are coming in.
444 -t ad|a|r|d|dd|e
446 Set the format of the packet timestamp displayed in the packet list
447 window. The format can be one of:
448 ad absolute with date: The absolute date and time is the actual
450 time and date the packet was captured
451 a absolute: The absolute time is the actual time the packet was
453 captured, with no date displayed
454 r relative: The relative time is the time elapsed between the first
456 packet and the current packet
457 d delta: The delta time is the time since the previous packet was
459 captured
460 dd delta_displayed: The delta_displayed time is the time since the
462 previous displayed packet was captured
463 e epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00)
465 The default format is relative.
467 -v Print the version and exit.
469 -w <outfile>
471 Set the default capture file name.
472 -X <eXtension options>
474 Specify an option to be passed to an Wireshark module. The
475 eXtension option is in the form extension_key:value, where
476 extension_key can be:
477 lua_script:lua_script_filename tells Wireshark to load the given
479 script in addition to the default Lua scripts.
480 stdin_descr:description tells Wireshark to use the given
482 description when capturing from standard input (-i -).
483 -y <capture link type>
485 If a capture is started from the command line with -k, set the data
486 link type to use while capturing packets. The values reported by
487 -L are the values that can be used.
488 This option can occur multiple times. If used before the first
490 occurrence of the -i option, it sets the default capture link type.
491 If used after an -i option, it sets the capture link type for the
492 interface specified by the last -i option occurring before this
493 option. If the capture link type is not set specifically, the
494 default capture link type is used if provided.
495 -z <statistics>
497 Get Wireshark to collect various types of statistics and display
498 the result in a window that updates in semi-real time.
499 Currently implemented statistics are:
501 -z conv,type[,filter]
503 Create a table that lists all conversations that could be seen
504 in the capture. type specifies the conversation endpoint types
505 for which we want to generate the statistics; currently the
506 supported ones are:
507 "eth" Ethernet addresses
509 "fc" Fibre Channel addresses
510 "fddi" FDDI addresses
511 "ip" IPv4 addresses
512 "ipv6" IPv6 addresses
513 "ipx" IPX addresses
514 "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported
515 "tr" Token Ring addresses
516 "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported
517 If the optional filter is specified, only those packets that
519 match the filter will be used in the calculations.
520 The table is presented with one line for each conversation and
522 displays the number of packets/bytes in each direction as well
523 as the total number of packets/bytes. By default, the table is
524 sorted according to the total number of packets.
525 These tables can also be generated at runtime by selecting the
527 appropriate conversation type from the menu
528 "Tools/Statistics/Conversation List/".
529 -z dcerpc,srt,uuid,major.minor[,filter]
531 Collect call/reply SRT (Service Response Time) data for DCERPC
532 interface uuid, version major.minor. Data collected is the
533 number of calls for each procedure, MinSRT, MaxSRT and AvgSRT.
534 Example: -z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0
536 will collect data for the CIFS SAMR Interface.
537 This option can be used multiple times on the command line.
539 If the optional filter is provided, the stats will only be
541 calculated on those calls that match that filter.
542 Example:
544 -z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4
545 will collect SAMR SRT statistics for a specific host.
546 -z fc,srt[,filter]
548 Collect call/reply SRT (Service Response Time) data for FC.
549 Data collected is the number of calls for each Fibre Channel
550 command, MinSRT, MaxSRT and AvgSRT.
551 Example: -z fc,srt will calculate the Service Response Time as
553 the time delta between the First packet of the exchange and the
554 Last packet of the exchange.
555 The data will be presented as separate tables for all normal FC
557 commands, Only those commands that are seen in the capture will
558 have its stats displayed.
559 This option can be used multiple times on the command line.
561 If the optional filter is provided, the stats will only be
563 calculated on those calls that match that filter.
564 Example: -z "fc,srt,fc.id==01.02.03" will collect stats only
566 for FC packets exchanged by the host at FC address 01.02.03 .
567 -z h225,counter[,filter]
569 Count ITU-T H.225 messages and their reasons. In the first
570 column you get a list of H.225 messages and H.225 message
571 reasons which occur in the current capture file. The number of
572 occurrences of each message or reason is displayed in the
573 second column.
574 Example: -z h225,counter
576 This option can be used multiple times on the command line.
578 If the optional filter is provided, the stats will only be
580 calculated on those calls that match that filter.
581 Example: -z "h225,counter,ip.addr==1.2.3.4" will collect stats
583 only for H.225 packets exchanged by the host at IP address
584 1.2.3.4 .
585 -z h225,srt[,filter]
587 Collect request/response SRT (Service Response Time) data for
588 ITU-T H.225 RAS. Data collected is the number of calls of each
589 ITU-T H.225 RAS Message Type, Minimum SRT, Maximum SRT, Average
590 SRT, Minimum in Packet, and Maximum in Packet. You will also
591 get the number of Open Requests (Unresponded Requests),
592 Discarded Responses (Responses without matching request) and
593 Duplicate Messages.
594 Example: -z h225,srt
596 This option can be used multiple times on the command line.
598 If the optional filter is provided, the stats will only be
600 calculated on those calls that match that filter.
601 Example: -z "h225,srt,ip.addr==1.2.3.4" will collect stats only
603 for ITU-T H.225 RAS packets exchanged by the host at IP address
604 1.2.3.4 .
605 -z io,stat
607 Collect packet/bytes statistics for the capture in intervals of
608 1 second. This option will open a window with up to 5 color-
609 coded graphs where number-of-packets-per-second or number-of-
610 bytes-per-second statistics can be calculated and displayed.
611 This option can be used multiple times on the command line.
613 This graph window can also be opened from the
615 Analyze:Statistics:Traffic:IO-Stat menu item.
616 -z ldap,srt[,filter]
618 Collect call/reply SRT (Service Response Time) data for LDAP.
619 Data collected is the number of calls for each implemented LDAP
620 command, MinSRT, MaxSRT and AvgSRT.
621 Example: -z ldap,srt will calculate the Service Response Time
623 as the time delta between the Request and the Response.
624 The data will be presented as separate tables for all
626 implemented LDAP commands, Only those commands that are seen in
627 the capture will have its stats displayed.
628 This option can be used multiple times on the command line.
630 If the optional filter is provided, the stats will only be
632 calculated on those calls that match that filter.
633 Example: use -z "ldap,srt,ip.addr==10.1.1.1" will collect stats
635 only for LDAP packets exchanged by the host at IP address
636 10.1.1.1 .
637 The only LDAP commands that are currently implemented and for
639 which the stats will be available are: BIND SEARCH MODIFY ADD
640 DELETE MODRDN COMPARE EXTENDED
641 -z megaco,srt[,filter]
643 Collect request/response SRT (Service Response Time) data for
644 MEGACO. (This is similar to -z smb,srt). Data collected is
645 the number of calls for each known MEGACO Command, Minimum SRT,
646 Maximum SRT and Average SRT.
647 Example: -z megaco,srt
649 This option can be used multiple times on the command line.
651 If the optional filter is provided, the stats will only be
653 calculated on those calls that match that filter.
654 Example: -z "megaco,srt,ip.addr==1.2.3.4" will collect stats
656 only for MEGACO packets exchanged by the host at IP address
657 1.2.3.4 .
658 -z mgcp,srt[,filter]
660 Collect request/response SRT (Service Response Time) data for
661 MGCP. (This is similar to -z smb,srt). Data collected is the
662 number of calls for each known MGCP Type, Minimum SRT, Maximum
663 SRT and Average SRT.
664 Example: -z mgcp,srt
666 This option can be used multiple times on the command line.
668 If the optional filter is provided, the stats will only be
670 calculated on those calls that match that filter.
671 Example: -z "mgcp,srt,ip.addr==1.2.3.4" will collect stats only
673 for MGCP packets exchanged by the host at IP address 1.2.3.4 .
674 -z rpc,programs
676 Collect call/reply SRT data for all known ONC-RPC
677 programs/versions. Data collected is the number of calls for
678 each protocol/version, MinSRT, MaxSRT and AvgSRT.
679 -z rpc,srt,program,version[,<filter>]
681 Collect call/reply SRT (Service Response Time) data for
682 program/version. Data collected is the number of calls for
683 each procedure, MinSRT, MaxSRT and AvgSRT.
684 Example: -z rpc,srt,100003,3 will collect data for NFS v3.
686 This option can be used multiple times on the command line.
688 If the optional filter is provided, the stats will only be
690 calculated on those calls that match that filter.
691 Example: -z rpc,srt,100003,3,nfs.fh.hash==0x12345678 will
693 collect NFS v3 SRT statistics for a specific file.
694 -z scsi,srt,cmdset[,<filter>]
696 Collect call/reply SRT (Service Response Time) data for SCSI
697 commandset <cmdset>.
698 Commandsets are 0:SBC 1:SSC 5:MMC
700 Data collected is the number of calls for each procedure,
702 MinSRT, MaxSRT and AvgSRT.
703 Example: -z scsi,srt,0 will collect data for SCSI BLOCK
705 COMMANDS (SBC).
706 This option can be used multiple times on the command line.
708 If the optional filter is provided, the stats will only be
710 calculated on those calls that match that filter.
711 Example: -z scsi,srt,0,ip.addr==1.2.3.4 will collect SCSI SBC
713 SRT statistics for a specific iscsi/ifcp/fcip host.
714 -z sip,stat[,filter]
716 This option will activate a counter for SIP messages. You will
717 get the number of occurrences of each SIP Method and of each
718 SIP Status-Code. Additionally you also get the number of
719 resent SIP Messages (only for SIP over UDP).
720 Example: -z sip,stat
722 This option can be used multiple times on the command line.
724 If the optional filter is provided, the stats will only be
726 calculated on those calls that match that filter.
727 Example: -z "sip,stat,ip.addr==1.2.3.4" will collect stats only
729 for SIP packets exchanged by the host at IP address 1.2.3.4 .
730 -z smb,srt[,filter]
732 Collect call/reply SRT (Service Response Time) data for SMB.
733 Data collected is the number of calls for each SMB command,
734 MinSRT, MaxSRT and AvgSRT.
735 Example: -z smb,srt
737 The data will be presented as separate tables for all normal
739 SMB commands, all Transaction2 commands and all NT Transaction
740 commands. Only those commands that are seen in the capture
741 will have their stats displayed. Only the first command in a
742 xAndX command chain will be used in the calculation. So for
743 common SessionSetupAndX + TreeConnectAndX chains, only the
744 SessionSetupAndX call will be used in the statistics. This is
745 a flaw that might be fixed in the future.
746 This option can be used multiple times on the command line.
748 If the optional filter is provided, the stats will only be
750 calculated on those calls that match that filter.
751 Example: -z "smb,srt,ip.addr==1.2.3.4" will collect stats only
753 for SMB packets exchanged by the host at IP address 1.2.3.4 .
754 -z voip,calls
756 This option will show a window that shows VoIP calls found in
757 the capture file. This is the same window shown as when you go
758 to the Statistics Menu and choose VoIP Calls.
759 Example: -z voip,calls
761
763 MENU ITEMS
764 File:Open
765 File:Open Recent
766 File:Merge
767 Merge another capture file to the currently loaded one. The
768 File:Merge dialog box allows the merge "Prepended",
769 "Chronologically" or "Appended", relative to the already loaded
770 one.
771 File:Close
773 Open or close a capture file. The File:Open dialog box allows a
774 filter to be specified; when the capture file is read, the filter
775 is applied to all packets read from the file, and packets not
776 matching the filter are discarded. The File:Open Recent is a
777 submenu and will show a list of previously opened files.
778 File:Save
780 File:Save As
781 Save the current capture, or the packets currently displayed from
782 that capture, to a file. Check boxes let you select whether to
783 save all packets, or just those that have passed the current
784 display filter and/or those that are currently marked, and an
785 option menu lets you select (from a list of file formats in which
786 at particular capture, or the packets currently displayed from that
787 capture, can be saved), a file format in which to save it.
788 File:File Set:List Files
790 Show a dialog box that lists all files of the file set matching the
791 currently loaded file. A file set is a compound of files resulting
792 from a capture using the "multiple files" / "ringbuffer" mode,
793 recognizable by the filename pattern, e.g.:
794 Filename_00001_20050604101530.pcap.
795 File:File Set:Next File
797 File:File Set:Previous File
798 If the currently loaded file is part of a file set (see above),
799 open the next / previous file in that set.
800 File:Export
802 Export captured data into an external format. Note: the data
803 cannot be imported back into Wireshark, so be sure to keep the
804 capture file.
805 File:Print
807 Print packet data from the current capture. You can select the
808 range of packets to be printed (which packets are printed), and the
809 output format of each packet (how each packet is printed). The
810 output format will be similar to the displayed values, so a summary
811 line, the packet details view, and/or the hex dump of the packet
812 can be printed.
813 Printing options can be set with the Edit:Preferences menu item, or
815 in the dialog box popped up by this menu item.
816 File:Quit
818 Exit the application.
819 Edit:Copy:Description
821 Copies the description of the selected field in the protocol tree
822 to the clipboard.
823 Edit:Copy:Fieldname
825 Copies the fieldname of the selected field in the protocol tree to
826 the clipboard.
827 Edit:Copy:Value
829 Copies the value of the selected field in the protocol tree to the
830 clipboard.
831 Edit:Copy:As Filter
833 Create a display filter based on the data currently highlighted in
834 the packet details and copy that filter to the clipboard.
835 If that data is a field that can be tested in a display filter
837 expression, the display filter will test that field; otherwise, the
838 display filter will be based on the absolute offset within the
839 packet. Therefore it could be unreliable if the packet contains
840 protocols with variable-length headers, such as a source-routed
841 token-ring packet.
842 Edit:Find Packet
844 Search forward or backward, starting with the currently selected
845 packet (or the most recently selected packet, if no packet is
846 selected). Search criteria can be a display filter expression, a
847 string of hexadecimal digits, or a text string.
848 When searching for a text string, you can search the packet data,
850 or you can search the text in the Info column in the packet list
851 pane or in the packet details pane.
852 Hexadecimal digits can be separated by colons, periods, or dashes.
854 Text string searches can be ASCII or Unicode (or both), and may be
855 case insensitive.
856 Edit:Find Next
858 Edit:Find Previous
859 Search forward / backward for a packet matching the filter from the
860 previous search, starting with the currently selected packet (or
861 the most recently selected packet, if no packet is selected).
862 Edit:Mark Packet (toggle)
864 Mark (or unmark if currently marked) the selected packet. The
865 field "frame.marked" is set for packets that are marked, so that,
866 for example, a display filters can be used to display only marked
867 packets, and so that the "Edit:Find Packet" dialog can be used to
868 find the next or previous marked packet.
869 Edit:Find Next Mark
871 Edit:Find Previous Mark
872 Find next/previous marked packet.
873 Edit:Mark All Packets
875 Edit:Unmark All Packets
876 Mark / Unmark all packets that are currently displayed.
877 Edit:Time Reference:Set Time Reference (toggle)
879 Set (or unset if currently set) the selected packet as a Time
880 Reference packet. When a packet is set as a Time Reference packet,
881 the timestamps in the packet list pane will be replaced with the
882 string "*REF*". The relative time timestamp in later packets will
883 then be calculated relative to the timestamp of this Time Reference
884 packet and not the first packet in the capture.
885 Packets that have been selected as Time Reference packets will
887 always be displayed in the packet list pane. Display filters will
888 not affect or hide these packets.
889 If there is a column displayed for "Cumulative Bytes" this counter
891 will be reset at every Time Reference packet.
892 Edit:Time Reference:Find Next
894 Edit:Time Reference:Find Previous
895 Search forward / backward for a time referenced packet.
896 Edit:Configuration Profiles
898 Manage configuration profiles to be able to use more than one set
899 of preferences and configurations.
900 Edit:Preferences
902 Set the GUI, capture, printing and protocol options (see
903 "Preferences" dialog below).
904 View:Main Toolbar
906 View:Filter Toolbar
907 View:Statusbar
908 Show or hide the main window controls.
909 View:Packet List
911 View:Packet Details
912 View:Packet Bytes
913 Show or hide the main window panes.
914 View:Time Display Format
916 Set the format of the packet timestamp displayed in the packet list
917 window.
918 View:Name Resolution:Resolve Name
920 Try to resolve a name for the currently selected item.
921 View:Name Resolution:Enable for ... Layer
923 Enable or disable translation of addresses to names in the display.
924 View:Colorize Packet List
926 Enable or disable the coloring rules. Disabling will improve
927 performance.
928 View:Auto Scroll in Live Capture
930 Enable or disable the automatic scrolling of the packet list while
931 a live capture is in progress.
932 View:Zoom In
934 View:Zoom Out
935 Zoom into / out of the main window data (by changing the font
936 size).
937 View:Normal Size
939 Reset the zoom factor of zoom in / zoom out back to normal font
940 size.
941 View:Resize All Columns
943 Resize all columns to best fit the current packet display.
944 View:Expand Subtrees
946 Expands the currently selected item and it's subtrees in the packet
947 details.
948 View:Expand All
950 View:Collapse All
951 Expand / Collapse all branches of the packet details.
952 View:Colorize Conversation
954 Select color for a conversation.
955 View:Reset Coloring 1-10
957 Reset Color for a conversation.
958 View:Coloring Rules
960 Change the foreground and background colors of the packet
961 information in the list of packets, based upon display filters.
962 The list of display filters is applied to each packet sequentially.
963 After the first display filter matches a packet, any additional
964 display filters in the list are ignored. Therefore, if you are
965 filtering on the existence of protocols, you should list the
966 higher-level protocols first, and the lower-level protocols last.
967 How Colorization Works
969 Packets are colored according to a list of color filters. Each
970 filter consists of a name, a filter expression and a
971 coloration. A packet is colored according to the first filter
972 that it matches. Color filter expressions use exactly the same
973 syntax as display filter expressions.
974 When Wireshark starts, the color filters are loaded from:
976 1. The user's personal color filters file or, if that does not
978 exist,
979 2. The global color filters file.
981 If neither of these exist then the packets will not be colored.
983 View:Show Packet In New Window
985 Create a new window containing a packet details view and a hex dump
986 window of the currently selected packet; this window will continue
987 to display that packet's details and data even if another packet is
988 selected.
989 View:Reload
991 Reload a capture file. Same as File:Close and File:Open the same
992 file again.
993 Go:Back
995 Go back in previously visited packets history.
996 Go:Forward
998 Go forward in previously visited packets history.
999 Go:Go To Packet
1001 Go to a particular numbered packet.
1002 Go:Go To Corresponding Packet
1004 If a field in the packet details pane containing a packet number is
1005 selected, go to the packet number specified by that field. (This
1006 works only if the dissector that put that entry into the packet
1007 details put it into the details as a filterable field rather than
1008 just as text.) This can be used, for example, to go to the packet
1009 for the request corresponding to a reply, or the reply
1010 corresponding to a request, if that packet number has been put into
1011 the packet details.
1012 Go:Previous Packet
1014 Go:Next Packet
1015 Go:First Packet
1016 Go:Last Packet
1017 Go to the previous / next / first / last packet in the capture.
1018 Go:Previous Packet In Conversation
1020 Go:Next Packet In Conversation
1021 Go to the previous / next packet of the conversation (TCP, UDP or
1022 IP)
1023 Capture:Interfaces
1025 Shows a dialog box with all currently known interfaces and
1026 displaying the current network traffic amount. Capture sessions
1027 can be started from here. Beware: keeping this box open results in
1028 high system load!
1029 Capture:Options
1031 Initiate a live packet capture (see "Capture Options Dialog"
1032 below). If no filename is specified, a temporary file will be
1033 created to hold the capture. The location of the file can be
1034 chosen by setting your TMPDIR environment variable before starting
1035 Wireshark. Otherwise, the default TMPDIR location is system-
1036 dependent, but is likely either /var/tmp or /tmp.
1037 Capture:Start
1039 Start a live packet capture with the previously selected options.
1040 This won't open the options dialog box, and can be convenient for
1041 repeatedly capturing with the same options.
1042 Capture:Stop
1044 Stop a running live capture.
1045 Capture:Restart
1047 While a live capture is running, stop it and restart with the same
1048 options again. This can be convenient to remove irrelevant
1049 packets, if no valuable packets were captured so far.
1050 Capture:Capture Filters
1052 Edit the saved list of capture filters, allowing filters to be
1053 added, changed, or deleted.
1054 Analyze:Display Filters
1056 Edit the saved list of display filters, allowing filters to be
1057 added, changed, or deleted.
1058 Analyze:Display Filter Macros
1060 Create shortcuts for complex macros
1061 Analyze:Apply as Filter
1063 Create a display filter based on the data currently highlighted in
1064 the packet details and apply the filter.
1065 If that data is a field that can be tested in a display filter
1067 expression, the display filter will test that field; otherwise, the
1068 display filter will be based on the absolute offset within the
1069 packet. Therefore it could be unreliable if the packet contains
1070 protocols with variable-length headers, such as a source-routed
1071 token-ring packet.
1072 The Selected option creates a display filter that tests for a match
1074 of the data; the Not Selected option creates a display filter that
1075 tests for a non-match of the data. The And Selected, Or Selected,
1076 And Not Selected, and Or Not Selected options add to the end of the
1077 display filter in the strip at the top (or bottom) an AND or OR
1078 operator followed by the new display filter expression.
1079 Analyze:Prepare a Filter
1081 Create a display filter based on the data currently highlighted in
1082 the packet details. The filter strip at the top (or bottom) is
1083 updated but it is not yet applied.
1084 Analyze:Enabled Protocols
1086 Allow protocol dissection to be enabled or disabled for a specific
1087 protocol. Individual protocols can be enabled or disabled by
1088 clicking on them in the list or by highlighting them and pressing
1089 the space bar. The entire list can be enabled, disabled, or
1090 inverted using the buttons below the list.
1091 When a protocol is disabled, dissection in a particular packet
1093 stops when that protocol is reached, and Wireshark moves on to the
1094 next packet. Any higher-layer protocols that would otherwise have
1095 been processed will not be displayed. For example, disabling TCP
1096 will prevent the dissection and display of TCP, HTTP, SMTP, Telnet,
1097 and any other protocol exclusively dependent on TCP.
1098 The list of protocols can be saved, so that Wireshark will start up
1100 with the protocols in that list disabled.
1101 Analyze:Decode As
1103 If you have a packet selected, present a dialog allowing you to
1104 change which dissectors are used to decode this packet. The dialog
1105 has one panel each for the link layer, network layer and transport
1106 layer protocol/port numbers, and will allow each of these to be
1107 changed independently. For example, if the selected packet is a
1108 TCP packet to port 12345, using this dialog you can instruct
1109 Wireshark to decode all packets to or from that TCP port as HTTP
1110 packets.
1111 Analyze:User Specified Decodes
1113 Create a new window showing whether any protocol ID to dissector
1114 mappings have been changed by the user. This window also allows
1115 the user to reset all decodes to their default values.
1116 Analyze:Follow TCP Stream
1118 If you have a TCP packet selected, display the contents of the data
1119 stream for the TCP connection to which that packet belongs, as
1120 text, in a separate window, and leave the list of packets in a
1121 filtered state, with only those packets that are part of that TCP
1122 connection being displayed. You can revert to your old view by
1123 pressing ENTER in the display filter text box, thereby invoking
1124 your old display filter (or resetting it back to no display
1125 filter).
1126 The window in which the data stream is displayed lets you select:
1128 · whether to display the entire conversation, or one or the
1130 other side of it;
1131 · whether the data being displayed is to be treated as ASCII
1133 or EBCDIC text or as raw hex data;
1134 and lets you print what's currently being displayed, using the same
1136 print options that are used for the File:Print Packet menu item, or
1137 save it as text to a file.
1138 Analyze:Follow UDP Stream
1140 Analyze:Follow SSL Stream
1141 (Similar to Analyze:Follow TCP Stream)
1142 Analyze:Expert Info
1144 Analyze:Expert Info Composite
1145 (Kind of) a log of anomalies found by Wireshark in a capture file.
1146 Analyze:Conversation Filter
1148 Statistics:Summary
1149 Show summary information about the capture, including elapsed time,
1150 packet counts, byte counts, and the like. If a display filter is
1151 in effect, summary information will be shown about the capture and
1152 about the packets currently being displayed.
1153 Statistics:Protocol Hierarchy
1155 Show the number of packets, and the number of bytes in those
1156 packets, for each protocol in the trace. It organizes the
1157 protocols in the same hierarchy in which they were found in the
1158 trace. Besides counting the packets in which the protocol exists,
1159 a count is also made for packets in which the protocol is the last
1160 protocol in the stack. These last-protocol counts show you how
1161 many packets (and the byte count associated with those packets)
1162 ended in a particular protocol. In the table, they are listed
1163 under "End Packets" and "End Bytes".
1164 Statistics:Conversations
1166 Lists of conversations; selectable by protocol. See
1167 Statistics:Conversation List below.
1168 Statistics:End Points
1170 List of End Point Addresses by protocol with packets/bytes/....
1171 counts.
1172 Statistics:Packet Lengths
1174 Grouped counts of packet lengths (0-19 bytes, 20-39 bytes, ...)
1175 Statistics:IO Graphs
1177 Open a window where up to 5 graphs in different colors can be
1178 displayed to indicate number of packets or number of bytes per
1179 second for all packets matching the specified filter. By default
1180 only one graph will be displayed showing number of packets per
1181 second.
1182 The top part of the window contains the graphs and scales for the X
1184 and Y axis. If the graph is too long to fit inside the window
1185 there is a horizontal scrollbar below the drawing area that can
1186 scroll the graphs to the left or the right. The horizontal axis
1187 displays the time into the capture and the vertical axis will
1188 display the measured quantity at that time.
1189 Below the drawing area and the scrollbar are the controls. On the
1191 bottom left there will be five similar sets of controls to control
1192 each individual graph such as "Display:<button>" which button will
1193 toggle that individual graph on/off. If <button> is ticked, the
1194 graph will be displayed. "Color:<color>" which is just a button to
1195 show which color will be used to draw that graph (color is only
1196 available in Gtk2 version) and finally "Filter:<filter-text>" which
1197 can be used to specify a display filter for that particular graph.
1198 If filter-text is empty then all packets will be used to calculate
1200 the quantity for that graph. If filter-text is specified only
1201 those packets that match that display filter will be considered in
1202 the calculation of quantity.
1203 To the right of the 5 graph controls there are four menus to
1205 control global aspects of the draw area and graphs. The "Unit:"
1206 menu is used to control what to measure; "packets/tick",
1207 "bytes/tick" or "advanced..."
1208 packets/tick will measure the number of packets matching the (if
1210 specified) display filter for the graph in each measurement
1211 interval.
1212 bytes/tick will measure the total number of bytes in all packets
1214 matching the (if specified) display filter for the graph in each
1215 measurement interval.
1216 advanced... see below
1218 "Tick interval:" specifies what measurement intervals to use. The
1220 default is 1 second and means that the data will be counted over 1
1221 second intervals.
1222 "Pixels per tick:" specifies how many pixels wide each measurement
1224 interval will be in the drawing area. The default is 5 pixels per
1225 tick.
1226 "Y-scale:" controls the max value for the y-axis. Default value is
1228 "auto" which means that Wireshark will try to adjust the maxvalue
1229 automatically.
1230 "advanced..." If Unit:advanced... is selected the window will
1232 display two more controls for each of the five graphs. One control
1233 will be a menu where the type of calculation can be selected from
1234 SUM,COUNT,MAX,MIN,AVG and LOAD, and one control, textbox, where the
1235 name of a single display filter field can be specified.
1236 The following restrictions apply to type and field combinations:
1238 SUM: available for all types of integers and will calculate the SUM
1240 of all occurrences of this field in the measurement interval. Note
1241 that some field can occur multiple times in the same packet and
1242 then all instances will be summed up. Example: 'tcp.len' which
1243 will count the amount of payload data transferred across TCP in
1244 each interval.
1245 COUNT: available for all field types. This will COUNT the number
1247 of times certain field occurs in each interval. Note that some
1248 fields may occur multiple times in each packet and if that is the
1249 case then each instance will be counted independently and COUNT
1250 will be greater than the number of packets.
1251 MAX: available for all integer and relative time fields. This will
1253 calculate the max seen integer/time value seen for the field during
1254 the interval. Example: 'smb.time' which will plot the maximum SMB
1255 response time.
1256 MIN: available for all integer and relative time fields. This will
1258 calculate the min seen integer/time value seen for the field during
1259 the interval. Example: 'smb.time' which will plot the minimum SMB
1260 response time.
1261 AVG: available for all integer and relative time fields.This will
1263 calculate the average seen integer/time value seen for the field
1264 during the interval. Example: 'smb.time' which will plot the
1265 average SMB response time.
1266 LOAD: available only for relative time fields (response times).
1268 Example of advanced: Display how NFS response time MAX/MIN/AVG
1270 changes over time:
1271 Set first graph to:
1273 filter:nfs&&rpc.time
1275 Calc:MAX rpc.time
1276 Set second graph to
1278 filter:nfs&&rpc.time
1280 Calc:AVG rpc.time
1281 Set third graph to
1283 filter:nfs&&rpc.time
1285 Calc:MIN rpc.time
1286 Example of advanced: Display how the average packet size from host
1288 a.b.c.d changes over time.
1289 Set first graph to
1291 filter:ip.addr==a.b.c.d&&frame.pkt_len
1293 Calc:AVG frame.pkt_len
1294 LOAD: The LOAD io-stat type is very different from anything you
1296 have ever seen before! While the response times themselves as
1297 plotted by MIN,MAX,AVG are indications on the Server load (which
1298 affects the Server response time), the LOAD measurement measures
1299 the Client LOAD. What this measures is how much workload the
1300 client generates, i.e. how fast will the client issue new commands
1301 when the previous ones completed. i.e. the level of concurrency
1302 the client can maintain. The higher the number, the more and
1303 faster is the client issuing new commands. When the LOAD goes
1304 down, it may be due to client load making the client slower in
1305 issuing new commands (there may be other reasons as well, maybe the
1306 client just doesn't have any commands it wants to issue right
1307 then).
1308 Load is measured in concurrency/number of overlapping i/o and the
1310 value 1000 means there is a constant load of one i/o.
1311 In each tick interval the amount of overlap is measured. See the
1313 graph below containing three commands: Below the graph are the LOAD
1314 values for each interval that would be calculated.
1315 | | | | | | | | |
1317 | | | | | | | | |
1318 | | o=====* | | | | | |
1319 | | | | | | | | |
1320 | o========* | o============* | | |
1321 | | | | | | | | |
1322 --------------------------------------------------> Time
1323 500 1500 500 750 1000 500 0 0
1324 Statistics:Conversation List
1326 This option will open a new window that displays a list of all
1327 conversations between two endpoints. The list has one row for each
1328 unique conversation and displays total number of packets/bytes seen
1329 as well as number of packets/bytes in each direction.
1330 By default the list is sorted according to the number of packets
1332 but by clicking on the column header; it is possible to re-sort the
1333 list in ascending or descending order by any column.
1334 By first selecting a conversation by clicking on it and then using
1336 the right mouse button (on those platforms that have a right mouse
1337 button) wireshark will display a popup menu offering several
1338 different filter operations to apply to the capture.
1339 These statistics windows can also be invoked from the Wireshark
1341 command line using the -z conv argument.
1342 Statistics:Service Response Time
1344 · AFP
1345 · CAMEL
1347 · DCE-RPC
1349 Open a window to display Service Response Time statistics for
1351 an arbitrary DCE-RPC program interface and display Procedure,
1352 Number of Calls, Minimum SRT, Maximum SRT and Average SRT for
1353 all procedures for that program/version. These windows opened
1354 will update in semi-real time to reflect changes when doing
1355 live captures or when reading new capture files into Wireshark.
1356 This dialog will also allow an optional filter string to be
1358 used. If an optional filter string is used only such DCE-RPC
1359 request/response pairs that match that filter will be used to
1360 calculate the statistics. If no filter string is specified all
1361 request/response pairs will be used.
1362 · Diameter
1364 · Fibre Channel
1366 Open a window to display Service Response Time statistics for
1368 Fibre Channel and display FC Type, Number of Calls, Minimum
1369 SRT, Maximum SRT and Average SRT for all FC types. These
1370 windows opened will update in semi-real time to reflect changes
1371 when doing live captures or when reading new capture files into
1372 Wireshark. The Service Response Time is calculated as the time
1373 delta between the First packet of the exchange and the Last
1374 packet of the exchange.
1375 This dialog will also allow an optional filter string to be
1377 used. If an optional filter string is used only such FC
1378 first/last exchange pairs that match that filter will be used
1379 to calculate the statistics. If no filter string is specified
1380 all request/response pairs will be used.
1381 · GTP
1383 · H.225 RAS
1385 Collect requests/response SRT (Service Response Time) data for
1387 ITU-T H.225 RAS. Data collected is number of calls for each
1388 known ITU-T H.225 RAS Message Type, Minimum SRT, Maximum SRT,
1389 Average SRT, Minimum in Packet, and Maximum in Packet. You
1390 will also get the number of Open Requests (Unresponded
1391 Requests), Discarded Responses (Responses without matching
1392 request) and Duplicate Messages. These windows opened will
1393 update in semi-real time to reflect changes when doing live
1394 captures or when reading new capture files into Wireshark.
1395 You can apply an optional filter string in a dialog box, before
1397 starting the calculation. The statistics will only be
1398 calculated on those calls matching that filter.
1399 · LDAP
1401 · MEGACO
1403 · MGCP
1405 Collect requests/response SRT (Service Response Time) data for
1407 MGCP. Data collected is number of calls for each known MGCP
1408 Type, Minimum SRT, Maximum SRT, Average SRT, Minimum in Packet,
1409 and Maximum in Packet. These windows opened will update in
1410 semi-real time to reflect changes when doing live captures or
1411 when reading new capture files into Wireshark.
1412 You can apply an optional filter string in a dialog box, before
1414 starting the calculation. The statistics will only be
1415 calculated on those calls matching that filter.
1416 · NCP
1418 · ONC-RPC
1420 Open a window to display statistics for an arbitrary ONC-RPC
1422 program interface and display Procedure, Number of Calls,
1423 Minimum SRT, Maximum SRT and Average SRT for all procedures for
1424 that program/version. These windows opened will update in
1425 semi-real time to reflect changes when doing live captures or
1426 when reading new capture files into Wireshark.
1427 This dialog will also allow an optional filter string to be
1429 used. If an optional filter string is used only such ONC-RPC
1430 request/response pairs that match that filter will be used to
1431 calculate the statistics. If no filter string is specified all
1432 request/response pairs will be used.
1433 By first selecting a conversation by clicking on it and then
1435 using the right mouse button (on those platforms that have a
1436 right mouse button) wireshark will display a popup menu
1437 offering several different filter operations to apply to the
1438 capture.
1439 · RADIUS
1441 · SCSI
1443 · SMB
1445 Collect call/reply SRT (Service Response Time) data for SMB.
1447 Data collected is the number of calls for each SMB command,
1448 MinSRT, MaxSRT and AvgSRT.
1449 The data will be presented as separate tables for all normal
1451 SMB commands, all Transaction2 commands and all NT Transaction
1452 commands. Only those commands that are seen in the capture
1453 will have its stats displayed. Only the first command in a
1454 xAndX command chain will be used in the calculation. So for
1455 common SessionSetupAndX + TreeConnectAndX chains, only the
1456 SessionSetupAndX call will be used in the statistics. This is
1457 a flaw that might be fixed in the future.
1458 You can apply an optional filter string in a dialog box, before
1460 starting the calculation. The stats will only be calculated on
1461 those calls matching that filter.
1462 By first selecting a conversation by clicking on it and then
1464 using the right mouse button (on those platforms that have a
1465 right mouse button) wireshark will display a popup menu
1466 offering several different filter operations to apply to the
1467 capture.
1468 · SMB2
1470 Statistics:BOOTP-DHCP
1472 Statistics:Compare
1473 Compare two Capture Files
1474 Statistics:Flow Graph
1476 Flow Graph: General/TCP
1477 Statistics:HTTP
1479 HTTP Load Distribution, Packet Counter & Requests
1480 Statistics:IP Addresses
1482 Count/Rate/Percent by IP Address
1483 Statistics:IP Destinations
1485 Count/Rate/Percent by IP Address/protocol/port
1486 Statistics:IP Protocol Types
1488 Count/Rate/Percent by IP Protocol Types
1489 Statistics:ONC-RPC Programs
1491 This dialog will open a window showing aggregated SRT statistics
1492 for all ONC-RPC Programs/versions that exist in the capture file.
1493 Statistics:TCP Stream Graph
1495 Graphs: Round Trip; Throughput; Time-Sequence (Stevens); Time-
1496 Sequence (tcptrace)
1497 Statistics:UDP Multicast streams
1499 Multicast Streams Counts/Rates/... by Source/Destination
1500 Address/Port pairs
1501 Statistics:WLAN Traffic
1503 WLAN Traffic Statistics
1504 Telephony:ITU-T H.225
1506 Count ITU-T H.225 messages and their reasons. In the first column
1507 you get a list of H.225 messages and H.225 message reasons, which
1508 occur in the current capture file. The number of occurrences of
1509 each message or reason will be displayed in the second column.
1510 This window opened will update in semi-real time to reflect changes
1511 when doing live captures or when reading new capture files into
1512 Wireshark.
1513 You can apply an optional filter string in a dialog box, before
1515 starting the counter. The statistics will only be calculated on
1516 those calls matching that filter.
1517 Telephony:SIP
1519 Activate a counter for SIP messages. You will get the number of
1520 occurrences of each SIP Method and of each SIP Status-Code.
1521 Additionally you also get the number of resent SIP Messages (only
1522 for SIP over UDP).
1523 This window opened will update in semi-real time to reflect changes
1525 when doing live captures or when reading new capture files into
1526 Wireshark.
1527 You can apply an optional filter string in a dialog box, before
1529 starting the counter. The statistics will only be calculated on
1530 those calls matching that filter.
1531 Tools:Firewall ACL Rules
1533 Help:Contents
1534 Some help texts.
1535 Help:Supported Protocols
1537 List of supported protocols and display filter protocol fields.
1538 Help:Manual Pages
1540 Display locally installed HTML versions of these manual pages in a
1541 web browser.
1542 Help:Wireshark Online
1544 Various links to online resources to be open in a web browser, like
1545 <http://www.wireshark.org>.
1546 Help:About Wireshark
1548 See various information about Wireshark (see "About" dialog below),
1549 like the version, the folders used, the available plugins, ...
1550 WINDOWS
1552 Main Window
1553 The main window contains the usual things like the menu, some
1554 toolbars, the main area and a statusbar. The main area is split
1555 into three panes, you can resize each pane using a "thumb" at the
1556 right end of each divider line.
1557 The main window is much more flexible than before. The layout of
1559 the main window can be customized by the Layout page in the dialog
1560 box popped up by Edit:Preferences, the following will describe the
1561 layout with the default settings.
1562 Main Toolbar
1564 Some menu items are available for quick access here. There
1565 is no way to customize the items in the toolbar, however the
1566 toolbar can be hidden by View:Main Toolbar.
1567 Filter Toolbar
1569 A display filter can be entered into the filter toolbar. A
1570 filter for HTTP, HTTPS, and DNS traffic might look like this:
1571 tcp.port == 80 || tcp.port == 443 || tcp.port == 53
1573 Selecting the Filter: button lets you choose from a list of
1575 named filters that you can optionally save. Pressing the
1576 Return or Enter keys, or selecting the Apply button, will
1577 cause the filter to be applied to the current list of
1578 packets. Selecting the Reset button clears the display
1579 filter so that all packets are displayed (again).
1580 There is no way to customize the items in the toolbar,
1582 however the toolbar can be hidden by View:Filter Toolbar.
1583 Packet List Pane
1585 The top pane contains the list of network packets that you
1586 can scroll through and select. By default, the packet
1587 number, packet timestamp, source and destination addresses,
1588 protocol, and description are displayed for each packet; the
1589 Columns page in the dialog box popped up by Edit:Preferences
1590 lets you change this (although, unfortunately, you currently
1591 have to save the preferences, and exit and restart Wireshark,
1592 for those changes to take effect).
1593 If you click on the heading for a column, the display will be
1595 sorted by that column; clicking on the heading again will
1596 reverse the sort order for that column.
1597 An effort is made to display information as high up the
1599 protocol stack as possible, e.g. IP addresses are displayed
1600 for IP packets, but the MAC layer address is displayed for
1601 unknown packet types.
1602 The right mouse button can be used to pop up a menu of
1604 operations.
1605 The middle mouse button can be used to mark a packet.
1607 Packet Details Pane
1609 The middle pane contains a display of the details of the
1610 currently-selected packet. The display shows each field and
1611 its value in each protocol header in the stack. The right
1612 mouse button can be used to pop up a menu of operations.
1613 Packet Bytes Pane
1615 The lowest pane contains a hex and ASCII dump of the actual
1616 packet data. Selecting a field in the packet details
1617 highlights the corresponding bytes in this section.
1618 The right mouse button can be used to pop up a menu of
1620 operations.
1621 Statusbar
1623 The statusbar is divided into three parts, on the left some
1624 context dependent things are shown, like information about
1625 the loaded file, in the center the number of packets are
1626 displayed, and on the right the current configuration
1627 profile.
1628 The statusbar can be hidden by View:Statusbar.
1630 Preferences
1632 The Preferences dialog lets you control various personal
1633 preferences for the behavior of Wireshark.
1634 User Interface Preferences
1636 The User Interface page is used to modify small aspects of
1637 the GUI to your own personal taste:
1638 Selection Bars
1640 The selection bar in the packet list and packet details
1641 can have either a "browse" or "select" behavior. If
1642 the selection bar has a "browse" behavior, the arrow
1643 keys will move an outline of the selection bar,
1644 allowing you to browse the rest of the list or details
1645 without changing the selection until you press the
1646 space bar. If the selection bar has a "select"
1647 behavior, the arrow keys will move the selection bar
1648 and change the selection to the new item in the packet
1649 list or packet details.
1650 Save Window Position
1652 If this item is selected, the position of the main
1653 Wireshark window will be saved when Wireshark exits,
1654 and used when Wireshark is started again.
1655 Save Window Size
1657 If this item is selected, the size of the main
1658 Wireshark window will be saved when Wireshark exits,
1659 and used when Wireshark is started again.
1660 Save Window Maximized state
1662 If this item is selected the maximize state of the main
1663 Wireshark window will be saved when Wireshark exists,
1664 and used when Wireshark is started again.
1665 File Open Dialog Behavior
1667 This item allows the user to select how Wireshark
1668 handles the listing of the "File Open" Dialog when
1669 opening trace files. "Remember Last Directory" causes
1670 Wireshark to automatically position the dialog in the
1671 directory of the most recently opened file, even
1672 between launches of Wireshark. "Always Open in
1673 Directory" allows the user to define a persistent
1674 directory that the dialog will always default to.
1675 Directory
1677 Allows the user to specify a persistent File Open
1678 directory. Trailing slashes or backslashes will
1679 automatically be added.
1680 File Open Preview timeout
1682 This items allows the user to define how much time is
1683 spend reading the capture file to present preview data
1684 in the File Open dialog.
1685 Open Recent maximum list entries
1687 The File menu supports a recent file list. This items
1688 allows the user to specify how many files are kept
1689 track of in this list.
1690 Ask for unsaved capture files
1692 When closing a capture file or Wireshark itself if the
1693 file isn't saved yet the user is presented the option
1694 to save the file when this item is set.
1695 Wrap during find
1697 This items determines the behavior when reaching the
1698 beginning or the end of a capture file. When set the
1699 search wraps around and continues, otherwise it stops.
1700 Settings dialogs show a save button
1702 This item determines if the various dialogs sport an
1703 explicit Save button or that save is implicit in OK /
1704 Apply.
1705 Web browser command
1707 This entry specifies the command line to launch a web
1708 browser. It is used to access online content, like the
1709 Wiki and user guide. Use '%s' to place the request URL
1710 in the command line.
1711 Display LEDs in the Expert Infos dialog tab labels
1713 This item determines if LED-like colored images are
1714 displayed in the Expert Infos dialog tab labels.
1715 Layout Preferences
1717 The Layout page lets you specify the general layout of the
1718 main window. You can choose from six different layouts and
1719 fill the three panes with the contents you like.
1720 Scrollbars
1722 The vertical scrollbars in the three panes can be set
1723 to be either on the left or the right.
1724 Alternating row colors
1726 Hex Display
1727 The highlight method in the hex dump display for the
1728 selected protocol item can be set to use either inverse
1729 video, or bold characters.
1730 Toolbar style
1732 Filter toolbar placement
1733 Custom window title
1734 Column Preferences
1735 The Columns page lets you specify the number, title, and
1736 format of each column in the packet list.
1737 The Column title entry is used to specify the title of the
1739 column displayed at the top of the packet list. The type of
1740 data that the column displays can be specified using the
1741 Column format option menu. The row of buttons on the left
1742 perform the following actions:
1743 New Adds a new column to the list.
1745 Delete
1747 Deletes the currently selected list item.
1748 Up / Down
1750 Moves the selected list item up or down one position.
1751 Font Preferences
1753 The Font page lets you select the font to be used for most
1754 text.
1755 Color Preferences
1757 The Colors page can be used to change the color of the text
1758 displayed in the TCP stream window and for marked packets.
1759 To change a color, simply select an attribute from the "Set:"
1760 menu and use the color selector to get the desired color.
1761 The new text colors are displayed as a sample text.
1762 Capture Preferences
1764 The Capture page lets you specify various parameters for
1765 capturing live packet data; these are used the first time a
1766 capture is started.
1767 The Interface: combo box lets you specify the interface from
1769 which to capture packet data, or the name of a FIFO from
1770 which to get the packet data.
1771 The Data link type: option menu lets you, for some
1773 interfaces, select the data link header you want to see on
1774 the packets you capture. For example, in some OSes and with
1775 some versions of libpcap, you can choose, on an 802.11
1776 interface, whether the packets should appear as Ethernet
1777 packets (with a fake Ethernet header) or as 802.11 packets.
1778 The Limit each packet to ... bytes check box lets you set the
1780 snapshot length to use when capturing live data; turn on the
1781 check box, and then set the number of bytes to use as the
1782 snapshot length.
1783 The Filter: text entry lets you set a capture filter
1785 expression to be used when capturing.
1786 If any of the environment variables SSH_CONNECTION,
1788 SSH_CLIENT, REMOTEHOST, DISPLAY, or SESSIONNAME are set,
1789 Wireshark will create a default capture filter that excludes
1790 traffic from the hosts and ports defined in those variables.
1791 The Capture packets in promiscuous mode check box lets you
1793 specify whether to put the interface in promiscuous mode when
1794 capturing.
1795 The Update list of packets in real time check box lets you
1797 specify that the display should be updated as packets are
1798 seen.
1799 The Automatic scrolling in live capture check box lets you
1801 specify whether, in an "Update list of packets in real time"
1802 capture, the packet list pane should automatically scroll to
1803 show the most recently captured packets.
1804 Printing Preferences
1806 The radio buttons at the top of the Printing page allow you
1807 choose between printing packets with the File:Print Packet
1808 menu item as text or PostScript, and sending the output
1809 directly to a command or saving it to a file. The Command:
1810 text entry box, on UNIX-compatible systems, is the command to
1811 send files to (usually lpr), and the File: entry box lets you
1812 enter the name of the file you wish to save to.
1813 Additionally, you can select the File: button to browse the
1814 file system for a particular save file.
1815 Name Resolution Preferences
1817 The Enable MAC name resolution, Enable network name
1818 resolution and Enable transport name resolution check boxes
1819 let you specify whether MAC addresses, network addresses, and
1820 transport-layer port numbers should be translated to names.
1821 The Enable concurrent DNS name resolution allows Wireshark to
1823 send out multiple name resolution requests and not wait for
1824 the result before continuing dissection. This speeds up
1825 dissection with network name resolution but initially may
1826 miss resolutions. The number of concurrent requests can be
1827 set here as well.
1828 SMI paths
1830 SMI modules
1832 RTP Player Preferences
1834 This page allows you to select the number of channels visible
1835 in the RTP player window. It determines the height of the
1836 window, more channels are possible and visible by means of a
1837 scroll bar.
1838 Protocol Preferences
1840 There are also pages for various protocols that Wireshark
1841 dissects, controlling the way Wireshark handles those
1842 protocols.
1843 Edit Capture Filter List
1845 Edit Display Filter List
1846 Capture Filter
1847 Display Filter
1848 Read Filter
1849 Search Filter
1850 The Edit Capture Filter List dialog lets you create, modify, and
1851 delete capture filters, and the Edit Display Filter List dialog
1852 lets you create, modify, and delete display filters.
1853 The Capture Filter dialog lets you do all of the editing operations
1855 listed, and also lets you choose or construct a filter to be used
1856 when capturing packets.
1857 The Display Filter dialog lets you do all of the editing operations
1859 listed, and also lets you choose or construct a filter to be used
1860 to filter the current capture being viewed.
1861 The Read Filter dialog lets you do all of the editing operations
1863 listed, and also lets you choose or construct a filter to be used
1864 to as a read filter for a capture file you open.
1865 The Search Filter dialog lets you do all of the editing operations
1867 listed, and also lets you choose or construct a filter expression
1868 to be used in a find operation.
1869 In all of those dialogs, the Filter name entry specifies a
1871 descriptive name for a filter, e.g. Web and DNS traffic. The
1872 Filter string entry is the text that actually describes the
1873 filtering action to take, as described above.The dialog buttons
1874 perform the following actions:
1875 New If there is text in the two entry boxes, creates a new
1877 associated list item.
1878 Edit Modifies the currently selected list item to match what's in
1880 the entry boxes.
1881 Delete
1883 Deletes the currently selected list item.
1884 Add Expression...
1886 For display filter expressions, pops up a dialog box to allow
1887 you to construct a filter expression to test a particular
1888 field; it offers lists of field names, and, when appropriate,
1889 lists from which to select tests to perform on the field and
1890 values with which to compare it. In that dialog box, the OK
1891 button will cause the filter expression you constructed to be
1892 entered into the Filter string entry at the current cursor
1893 position.
1894 OK In the Capture Filter dialog, closes the dialog box and makes
1896 the filter in the Filter string entry the filter in the
1897 Capture Preferences dialog. In the Display Filter dialog,
1898 closes the dialog box and makes the filter in the Filter
1899 string entry the current display filter, and applies it to
1900 the current capture. In the Read Filter dialog, closes the
1901 dialog box and makes the filter in the Filter string entry
1902 the filter in the Open Capture File dialog. In the Search
1903 Filter dialog, closes the dialog box and makes the filter in
1904 the Filter string entry the filter in the Find Packet dialog.
1905 Apply Makes the filter in the Filter string entry the current
1907 display filter, and applies it to the current capture.
1908 Save If the list of filters being edited is the list of capture
1910 filters, saves the current filter list to the personal
1911 capture filters file, and if the list of filters being edited
1912 is the list of display filters, saves the current filter list
1913 to the personal display filters file.
1914 Close Closes the dialog without doing anything with the filter in
1916 the Filter string entry.
1917 The Color Filters Dialog
1919 This dialog displays a list of color filters and allows it to be
1920 modified.
1921 THE FILTER LIST
1923 Single rows may be selected by clicking. Multiple rows may be
1924 selected by using the ctrl and shift keys in combination with
1925 the mouse button.
1926 NEW Adds a new filter at the bottom of the list and opens the Edit
1928 Color Filter dialog box. You will have to alter the filter
1929 expression at least before the filter will be accepted. The
1930 format of color filter expressions is identical to that of
1931 display filters. The new filter is selected, so it may
1932 immediately be moved up and down, deleted or edited. To avoid
1933 confusion all filters are unselected before the new filter is
1934 created.
1935 EDIT
1937 Opens the Edit Color Filter dialog box for the selected filter.
1938 (If this button is disabled you may have more than one filter
1939 selected, making it ambiguous which is to be edited.)
1940 ENABLE
1942 Enables the selected color filter(s).
1943 DISABLE
1945 Disables the selected color filter(s).
1946 DELETE
1948 Deletes the selected color filter(s).
1949 EXPORT
1951 Allows you to choose a file in which to save the current list
1952 of color filters. You may also choose to save only the
1953 selected filters. A button is provided to save the filters in
1954 the global color filters file (you must have sufficient
1955 permissions to write this file, of course).
1956 IMPORT
1958 Allows you to choose a file containing color filters which are
1959 then added to the bottom of the current list. All the added
1960 filters are selected, so they may be moved to the correct
1961 position in the list as a group. To avoid confusion, all
1962 filters are unselected before the new filters are imported. A
1963 button is provided to load the filters from the global color
1964 filters file.
1965 CLEAR
1967 Deletes your personal color filters file, reloads the global
1968 color filters file, if any, and closes the dialog.
1969 UP Moves the selected filter(s) up the list, making it more likely
1971 that they will be used to color packets.
1972 DOWN
1974 Moves the selected filter(s) down the list, making it less
1975 likely that they will be used to color packets.
1976 OK Closes the dialog and uses the color filters as they stand.
1978 APPLY
1980 Colors the packets according to the current list of color
1981 filters, but does not close the dialog.
1982 SAVE
1984 Saves the current list of color filters in your personal color
1985 filters file. Unless you do this they will not be used the
1986 next time you start Wireshark.
1987 CLOSE
1989 Closes the dialog without changing the coloration of the
1990 packets. Note that changes you have made to the current list
1991 of color filters are not undone.
1992 Capture Options Dialog
1994 The Capture Options Dialog lets you specify various parameters for
1995 capturing live packet data.
1996 The Interface: field lets you specify the interface from which to
1998 capture packet data or a command from which to get the packet data
1999 via a pipe.
2000 The Link layer header type: field lets you specify the interfaces
2002 link layer header type. This field is usually disabled, as most
2003 interface have only one header type.
2004 The Capture packets in promiscuous mode check box lets you specify
2006 whether the interface should be put into promiscuous mode when
2007 capturing.
2008 The Limit each packet to ... bytes check box and field lets you
2010 specify a maximum number of bytes per packet to capture and save;
2011 if the check box is not checked, the limit will be 65535 bytes.
2012 The Capture Filter: entry lets you specify the capture filter using
2014 a tcpdump-style filter string as described above.
2015 The File: entry lets you specify the file into which captured
2017 packets should be saved, as in the Printer Options dialog above.
2018 If not specified, the captured packets will be saved in a temporary
2019 file; you can save those packets to a file with the File:Save As
2020 menu item.
2021 The Use multiple files check box lets you specify that the capture
2023 should be done in "multiple files" mode. This option is disabled,
2024 if the Update list of packets in real time option is checked.
2025 The Next file every ... megabyte(s) check box and fields lets you
2027 specify that a switch to a next file should be done if the
2028 specified filesize is reached. You can also select the appropriate
2029 unit, but beware that the filesize has a maximum of 2 GB. The
2030 check box is forced to be checked, as "multiple files" mode
2031 requires a file size to be specified.
2032 The Next file every ... minute(s) check box and fields lets you
2034 specify that the switch to a next file should be done after the
2035 specified time has elapsed, even if the specified capture size is
2036 not reached.
2037 The Ring buffer with ... files field lets you specify the number of
2039 files of a ring buffer. This feature will capture into to the
2040 first file again, after the specified amount of files were used.
2041 The Stop capture after ... files field lets you specify the number
2043 of capture files used, until the capture is stopped.
2044 The Stop capture after ... packet(s) check box and field let you
2046 specify that Wireshark should stop capturing after having captured
2047 some number of packets; if the check box is not checked, Wireshark
2048 will not stop capturing at some fixed number of captured packets.
2049 The Stop capture after ... megabyte(s) check box and field lets you
2051 specify that Wireshark should stop capturing after the file to
2052 which captured packets are being saved grows as large as or larger
2053 than some specified number of megabytes. If the check box is not
2054 checked, Wireshark will not stop capturing at some capture file
2055 size (although the operating system on which Wireshark is running,
2056 or the available disk space, may still limit the maximum size of a
2057 capture file). This option is disabled, if "multiple files" mode
2058 is used,
2059 The Stop capture after ... second(s) check box and field let you
2061 specify that Wireshark should stop capturing after it has been
2062 capturing for some number of seconds; if the check box is not
2063 checked, Wireshark will not stop capturing after some fixed time
2064 has elapsed.
2065 The Update list of packets in real time check box lets you specify
2067 whether the display should be updated as packets are captured and,
2068 if you specify that, the Automatic scrolling in live capture check
2069 box lets you specify the packet list pane should automatically
2070 scroll to show the most recently captured packets as new packets
2071 arrive.
2072 The Enable MAC name resolution, Enable network name resolution and
2074 Enable transport name resolution check boxes let you specify
2075 whether MAC addresses, network addresses, and transport-layer port
2076 numbers should be translated to names.
2077 About
2079 The About dialog lets you view various information about Wireshark.
2080 About:Wireshark
2082 The Wireshark page lets you view general information about
2083 Wireshark, like the installed version, licensing information and
2084 such.
2085 About:Authors
2087 The Authors page shows the author and all contributors.
2088 About:Folders
2090 The Folders page lets you view the directory names where Wireshark
2091 is searching it's various configuration and other files.
2092 About:Plugins
2094 The Plugins page lets you view the dissector plugin modules
2095 available on your system.
2096 The Plugins List shows the name and version of each dissector
2098 plugin module found on your system.
2099 On Unix-compatible systems, the plugins are looked for in the
2101 following directories: the lib/wireshark/plugins/$VERSION directory
2102 under the main installation directory (for example,
2103 /usr/local/lib/wireshark/plugins/$VERSION), and then
2104 $HOME/.wireshark/plugins.
2105 On Windows systems, the plugins are looked for in the following
2107 directories: plugins\$VERSION directory under the main installation
2108 directory (for example, C:\Program
2109 Files\Wireshark\plugins\$VERSION), and then
2110 %APPDATA%\Wireshark\plugins\$VERSION (or, if %APPDATA% isn't
2111 defined, %USERPROFILE%\Application
2112 Data\Wireshark\plugins\$VERSION).
2113 $VERSION is the version number of the plugin interface, which is
2115 typically the version number of Wireshark. Note that a dissector
2116 plugin module may support more than one protocol; there is not
2117 necessarily a one-to-one correspondence between dissector plugin
2118 modules and protocols. Protocols supported by a dissector plugin
2119 module are enabled and disabled using the Edit:Protocols dialog
2120 box, just as protocols built into Wireshark are.
2121
2123 See the manual page of pcap-filter(7) or, if that doesn't exist,
2124 tcpdump(8), or, if that doesn't exist,
2125 <http://wiki.wireshark.org/CaptureFilters>.
2126
2128 For a complete table of protocol and protocol fields that are
2129 filterable in Wireshark see the wireshark-filter(4) manual page.
2130
2132 These files contains various Wireshark configuration settings.
2133 Preferences
2135 The preferences files contain global (system-wide) and personal
2136 preference settings. If the system-wide preference file exists, it
2137 is read first, overriding the default settings. If the personal
2138 preferences file exists, it is read next, overriding any previous
2139 values. Note: If the command line flag -o is used (possibly more
2140 than once), it will in turn override values from the preferences
2141 files.
2142 The preferences settings are in the form prefname:value, one per
2144 line, where prefname is the name of the preference and value is the
2145 value to which it should be set; white space is allowed between :
2146 and value. A preference setting can be continued on subsequent
2147 lines by indenting the continuation lines with white space. A #
2148 character starts a comment that runs to the end of the line:
2149 # Vertical scrollbars should be on right side?
2151 # TRUE or FALSE (case-insensitive).
2152 gui.scrollbar_on_right: TRUE
2153 The global preferences file is looked for in the wireshark
2155 directory under the share subdirectory of the main installation
2156 directory (for example, /usr/local/share/wireshark/preferences) on
2157 UNIX-compatible systems, and in the main installation directory
2158 (for example, C:\Program Files\Wireshark\preferences) on Windows
2159 systems.
2160 The personal preferences file is looked for in
2162 $HOME/.wireshark/preferences on UNIX-compatible systems and
2163 %APPDATA%\Wireshark\preferences (or, if %APPDATA% isn't defined,
2164 %USERPROFILE%\Application Data\Wireshark\preferences) on Windows
2165 systems.
2166 Note: Whenever the preferences are saved by using the Save button
2168 in the Edit:Preferences dialog box, your personal preferences file
2169 will be overwritten with the new settings, destroying any comments
2170 and unknown/obsolete settings that were in the file.
2171 Recent
2173 The recent file contains personal settings (mostly GUI related)
2174 such as the current Wireshark window size. The file is saved at
2175 program exit and read in at program start automatically. Note: The
2176 command line flag -o may be used to override settings from this
2177 file.
2178 The settings in this file have the same format as in the
2180 preferences files, and the same directory as for the personal
2181 preferences file is used.
2182 Note: Whenever Wireshark is closed, your recent file will be
2184 overwritten with the new settings, destroying any comments and
2185 unknown/obsolete settings that were in the file.
2186 Disabled (Enabled) Protocols
2188 The disabled_protos files contain system-wide and personal lists of
2189 protocols that have been disabled, so that their dissectors are
2190 never called. The files contain protocol names, one per line,
2191 where the protocol name is the same name that would be used in a
2192 display filter for the protocol:
2193 http
2195 tcp # a comment
2196 If a protocol is listed in the global disabled_protos file, it is
2198 not displayed in the Analyze:Enabled Protocols dialog box, and so
2199 cannot be enabled by the user.
2200 The global disabled_protos file uses the same directory as the
2202 global preferences file.
2203 The personal disabled_protos file uses the same directory as the
2205 personal preferences file.
2206 Note: Whenever the disabled protocols list is saved by using the
2208 Save button in the Analyze:Enabled Protocols dialog box, your
2209 personal disabled protocols file will be overwritten with the new
2210 settings, destroying any comments that were in the file.
2211 Name Resolution (hosts)
2213 If the personal hosts file exists, it is used to resolve IPv4 and
2214 IPv6 addresses before any other attempts are made to resolve them.
2215 The file has the standard hosts file syntax; each line contains one
2216 IP address and name, separated by whitespace. The same directory
2217 as for the personal preferences file is used.
2218 Capture filter name resolution is handled by libpcap on UNIX-
2220 compatible systems and WinPCAP on Windows. As such the Wireshark
2221 personal hosts file will not be consulted for capture filter name
2222 resolution.
2223 Name Resolution (ethers)
2225 The ethers files are consulted to correlate 6-byte hardware
2226 addresses to names. First the personal ethers file is tried and if
2227 an address is not found there the global ethers file is tried next.
2228 Each line contains one hardware address and name, separated by
2230 whitespace. The digits of the hardware address are separated by
2231 colons (:), dashes (-) or periods (.). The same separator
2232 character must be used consistently in an address. The following
2233 three lines are valid lines of an ethers file:
2234 ff:ff:ff:ff:ff:ff Broadcast
2236 c0-00-ff-ff-ff-ff TR_broadcast
2237 00.00.00.00.00.00 Zero_broadcast
2238 The global ethers file is looked for in the /etc directory on UNIX-
2240 compatible systems, and in the main installation directory (for
2241 example, C:\Program Files\Wireshark) on Windows systems.
2242 The personal ethers file is looked for in the same directory as the
2244 personal preferences file.
2245 Capture filter name resolution is handled by libpcap on UNIX-
2247 compatible systems and WinPCAP on Windows. As such the Wireshark
2248 personal ethers file will not be consulted for capture filter name
2249 resolution.
2250 Name Resolution (manuf)
2252 The manuf file is used to match the 3-byte vendor portion of a
2253 6-byte hardware address with the manufacturer's name; it can also
2254 contain well-known MAC addresses and address ranges specified with
2255 a netmask. The format of the file is the same as the ethers files,
2256 except that entries such as:
2257 00:00:0C Cisco
2259 can be provided, with the 3-byte OUI and the name for a vendor, and
2261 entries such as:
2262 00-00-0C-07-AC/40 All-HSRP-routers
2264 can be specified, with a MAC address and a mask indicating how many
2266 bits of the address must match. The above entry, for example, has
2267 40 significant bits, or 5 bytes, and would match addresses from
2268 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be
2269 a multiple of 8.
2270 The manuf file is looked for in the same directory as the global
2272 preferences file.
2273 Name Resolution (ipxnets)
2275 The ipxnets files are used to correlate 4-byte IPX network numbers
2276 to names. First the global ipxnets file is tried and if that
2277 address is not found there the personal one is tried next.
2278 The format is the same as the ethers file, except that each address
2280 is four bytes instead of six. Additionally, the address can be
2281 represented as a single hexadecimal number, as is more common in
2282 the IPX world, rather than four hex octets. For example, these
2283 four lines are valid lines of an ipxnets file:
2284 C0.A8.2C.00 HR
2286 c0-a8-1c-00 CEO
2287 00:00:BE:EF IT_Server1
2288 110f FileServer3
2289 The global ipxnets file is looked for in the /etc directory on
2291 UNIX-compatible systems, and in the main installation directory
2292 (for example, C:\Program Files\Wireshark) on Windows systems.
2293 The personal ipxnets file is looked for in the same directory as
2295 the personal preferences file.
2296 Capture Filters
2298 The cfilters files contain system-wide and personal capture
2299 filters. Each line contains one filter, starting with the string
2300 displayed in the dialog box in quotation marks, followed by the
2301 filter string itself:
2302 "HTTP" port 80
2304 "DCERPC" port 135
2305 The global cfilters file uses the same directory as the global
2307 preferences file.
2308 The personal cfilters file uses the same directory as the personal
2310 preferences file. It is written through the Capture:Capture
2311 Filters dialog.
2312 If the global cfilters file exists, it is used only if the personal
2314 cfilters file does not exist; global and personal capture filters
2315 are not merged.
2316 Display Filters
2318 The dfilters files contain system-wide and personal display
2319 filters. Each line contains one filter, starting with the string
2320 displayed in the dialog box in quotation marks, followed by the
2321 filter string itself:
2322 "HTTP" http
2324 "DCERPC" dcerpc
2325 The global dfilters file uses the same directory as the global
2327 preferences file.
2328 The personal dfilters file uses the same directory as the personal
2330 preferences file. It is written through the Analyze:Display
2331 Filters dialog.
2332 If the global dfilters file exists, it is used only if the personal
2334 dfilters file does not exist; global and personal display filters
2335 are not merged.
2336 Color Filters (Coloring Rules)
2338 The colorfilters files contain system-wide and personal color
2339 filters. Each line contains one filter, starting with the string
2340 displayed in the dialog box, followed by the corresponding display
2341 filter. Then the background and foreground colors are appended:
2342 # a comment
2344 @tcp@tcp@[59345,58980,65534][0,0,0]
2345 @udp@udp@[28834,57427,65533][0,0,0]
2346 The global colorfilters file uses the same directory as the global
2348 preferences file.
2349 The personal colorfilters file uses the same directory as the
2351 personal preferences file. It is written through the View:Coloring
2352 Rules dialog.
2353 If the global colorfilters file exists, it is used only if the
2355 personal colorfilters file does not exist; global and personal
2356 color filters are not merged.
2357 GTK rc files
2359 The gtkrc files contain system-wide and personal GTK theme
2360 settings.
2361 The global gtkrc file uses the same directory as the global
2363 preferences file.
2364 The personal gtkrc file uses the same directory as the personal
2366 preferences file.
2367 Plugins
2369 See above in the description of the About:Plugins page.
2370
2372 WIRESHARK_DEBUG_EP_NO_CHUNKS
2373 Normally per-packet memory is allocated in large "chunks." This
2374 behavior doesn't work well with debugging tools such as Valgrind or
2375 ElectricFence. Export this environment variable to force
2376 individual allocations. Note: disabling chunks also disables
2377 canaries (see below).
2378 WIRESHARK_DEBUG_SE_NO_CHUNKS
2380 Normally per-file memory is allocated in large "chunks." This
2381 behavior doesn't work well with debugging tools such as Valgrind or
2382 ElectricFence. Export this environment variable to force
2383 individual allocations. Note: disabling chunks also disables
2384 canaries (see below).
2385 WIRESHARK_DEBUG_EP_NO_CANARY
2387 Normally per-packet memory allocations are separated by "canaries"
2388 which allow detection of memory overruns. This comes at the
2389 expense of some extra memory usage. Exporting this environment
2390 variable disables these canaries.
2391 WIRESHARK_DEBUG_SE_USE_CANARY
2393 Exporting this environment variable causes per-file memory
2394 allocations to be protected with "canaries" which allow for
2395 detection of memory overruns. This comes at the expense of
2396 significant extra memory usage.
2397 WIRESHARK_DEBUG_SCRUB_MEMORY
2399 If this environment variable is set, the contents of per-packet and
2400 per-file memory is initialized to 0xBADDCAFE when the memory is
2401 allocated and is reset to 0xDEADBEEF when the memory is freed.
2402 This functionality is useful mainly to developers looking for bugs
2403 in the way memory is handled.
2404 WIRESHARK_RUN_FROM_BUILD_DIRECTORY
2406 This environment variable causes the plugins and other data files
2407 to be loaded from the build directory (where the program was
2408 compiled) rather than from the standard locations. It has no
2409 effect when the program in question is running with root (or
2410 setuid) permissions on *NIX.
2411 WIRESHARK_DATA_DIR
2413 This environment variable causes the various data files to be
2414 loaded from a directory other than the standard locations. It has
2415 no effect when the program in question is running with root (or
2416 setuid) permissions on *NIX.
2417 WIRESHARK_PYTHON_DIR
2419 This environment variable points to an alternate location for
2420 Python. It has no effect when the program in question is running
2421 with root (or setuid) permissions on *NIX.
2422 ERF_RECORDS_TO_CHECK
2424 This environment variable controls the number of ERF records
2425 checked when deciding if a file really is in the ERF format.
2426 Setting this environment variable a number higher than the default
2427 (20) would make false positives less likely.
2428 IPFIX_RECORDS_TO_CHECK
2430 This environment variable controls the number of IPFIX records
2431 checked when deciding if a file really is in the IPFIX format.
2432 Setting this environment variable a number higher than the default
2433 (20) would make false positives less likely.
2434 WIRESHARK_ABORT_ON_DISSECTOR_BUG
2436 If this environment variable is set, Wireshark will call abort(3)
2437 when a dissector bug is encountered. abort(3) will cause the
2438 program to exit abnormally; if you are running Wireshark in a
2439 debugger, it should halt in the debugger and allow inspection of
2440 the process, and, if you are not running it in a debugger, it will,
2441 on some OSes, assuming your environment is configured correctly,
2442 generate a core dump file. This can be useful to developers
2443 attempting to troubleshoot a problem with a protocol dissector.
2444 WIRESHARK_EP_VERIFY_POINTERS
2446 This environment variable, if set, causes certain uses of pointers
2447 to be audited to ensure they do not point to memory that is
2448 deallocated after each packet has been fully dissected. This can
2449 be useful to developers writing or auditing code.
2450 WIRESHARK_SE_VERIFY_POINTERS
2452 This environment variable, if set, causes certain uses of pointers
2453 to be audited to ensure they do not point to memory that is
2454 deallocated after when a capture file is closed. This can be
2455 useful to developers writing or auditing code.
2456 WIRESHARK_QUIT_AFTER_CAPTURE
2458 Cause Wireshark to exit after the end of the capture session. This
2459 doesn't automatically start a capture; you must still use -k to do
2460 that. You must also specify an autostop condition, e.g. -c or -a
2461 duration:.... This means that you will not be able to see the
2462 results of the capture after it stops; it's primarily useful for
2463 testing.
2464 WIRESHARK_ABORT_ON_OUT_OF_MEMORY
2466 This environment variable, if present, causes abort(3) to be called
2467 if certain out-of-memory conditions (which normally result in an
2468 exception and an explanatory error message) are experienced. This
2469 can be useful to developers debugging out-of-memory conditions.
2470
2472 wireshark-filter(4), tshark(1), editcap(1), pcap(3), dumpcap(1),
2473 mergecap(1), text2pcap(1), pcap-filter(7) or tcpdump(8) if it doesn't
2474 exist.
2475
2477 The latest version of Wireshark can be found at
2478 <http://www.wireshark.org>.
2479 HTML versions of the Wireshark project man pages are available at:
2481 <http://www.wireshark.org/docs/man-pages>.
2482
2484 Original Author
2485 -------- ------
2486 Gerald Combs <gerald[AT]wireshark.org>
2487 Contributors
2489 ------------
2490 Gilbert Ramirez <gram[AT]alumni.rice.edu>
2491 Thomas Bottom <tom.bottom[AT]labxtechnologies.com>
2492 Chris Pane <chris.pane[AT]labxtechnologies.com>
2493 Hannes R. Boehm <hannes[AT]boehm.org>
2494 Mike Hall <mike [AT] hallzone.net>
2495 Bobo Rajec <bobo[AT]bsp-consulting.sk>
2496 Laurent Deniel <laurent.deniel[AT]free.fr>
2497 Don Lafontaine <lafont02[AT]cn.ca>
2498 Guy Harris <guy[AT]alum.mit.edu>
2499 Simon Wilkinson <sxw[AT]dcs.ed.ac.uk>
2500 Joerg Mayer <jmayer[AT]loplof.de>
2501 Martin Maciaszek <fastjack[AT]i-s-o.net>
2502 Didier Jorand <Didier.Jorand[AT]alcatel.fr>
2503 Jun-ichiro itojun Hagino <itojun[AT]itojun.org>
2504 Richard Sharpe <sharpe[AT]ns.aus.com>
2505 John McDermott <jjm[AT]jkintl.com>
2506 Jeff Jahr <jjahr[AT]shastanets.com>
2507 Brad Robel-Forrest <bradr[AT]watchguard.com>
2508 Ashok Narayanan <ashokn[AT]cisco.com>
2509 Aaron Hillegass <aaron[AT]classmax.com>
2510 Jason Lango <jal[AT]netapp.com>
2511 Johan Feyaerts <Johan.Feyaerts[AT]siemens.com>
2512 Olivier Abad <oabad[AT]noos.fr>
2513 Thierry Andry <Thierry.Andry[AT]advalvas.be>
2514 Jeff Foster <jfoste[AT]woodward.com>
2515 Peter Torvals <petertv[AT]xoommail.com>
2516 Christophe Tronche <ch.tronche[AT]computer.org>
2517 Nathan Neulinger <nneul[AT]umr.edu>
2518 Tomislav Vujec <tvujec[AT]carnet.hr>
2519 Kojak <kojak[AT]bigwig.net>
2520 Uwe Girlich <Uwe.Girlich[AT]philosys.de>
2521 Warren Young <tangent[AT]mail.com>
2522 Heikki Vatiainen <hessu[AT]cs.tut.fi>
2523 Greg Hankins <gregh[AT]twoguys.org>
2524 Jerry Talkington <jtalkington[AT]users.sourceforge.net>
2525 Dave Chapeskie <dchapes[AT]ddm.on.ca>
2526 James Coe <jammer[AT]cin.net>
2527 Bert Driehuis <driehuis[AT]playbeing.org>
2528 Stuart Stanley <stuarts[AT]mxmail.net>
2529 John Thomes <john[AT]ensemblecom.com>
2530 Laurent Cazalet <laurent.cazalet[AT]mailclub.net>
2531 Thomas Parvais <thomas.parvais[AT]advalvas.be>
2532 Gerrit Gehnen <G.Gehnen[AT]atrie.de>
2533 Craig Newell <craign[AT]cheque.uq.edu.au>
2534 Ed Meaney <emeaney[AT]cisco.com>
2535 Dietmar Petras <DPetras[AT]ELSA.de>
2536 Fred Reimer <fwr[AT]ga.prestige.net>
2537 Florian Lohoff <flo[AT]rfc822.org>
2538 Jochen Friedrich <jochen+ethereal[AT]scram.de>
2539 Paul Welchinski <paul.welchinski[AT]telusplanet.net>
2540 Doug Nazar <nazard[AT]dragoninc.on.ca>
2541 Andreas Sikkema <h323 [AT] ramdyne.nl>
2542 Mark Muhlestein <mmm[AT]netapp.com>
2543 Graham Bloice <graham.bloice[AT]trihedral.com>
2544 Ralf Schneider <ralf.schneider[AT]alcatel.se>
2545 Yaniv Kaul <mykaul [AT] gmail.com>
2546 Paul Ionescu <paul[AT]acorp.ro>
2547 Mark Burton <markb[AT]ordern.com>
2548 Stefan Raab <sraab[AT]cisco.com>
2549 Mark Clayton <clayton[AT]shore.net>
2550 Michael Rozhavsky <mike[AT]tochna.technion.ac.il>
2551 Dug Song <dugsong[AT]monkey.org>
2552 Michael Tuexen <tuexen [AT] fh-muenster.de>
2553 Bruce Korb <bkorb[AT]sco.com>
2554 Jose Pedro Oliveira <jpo[AT]di.uminho.pt>
2555 David Frascone <dave[AT]frascone.com>
2556 Peter Kjellerstedt <pkj[AT]axis.com>
2557 Phil Techau <phil_t[AT]altavista.net>
2558 Wes Hardaker <hardaker[AT]users.sourceforge.net>
2559 Robert Tsai <rtsai[AT]netapp.com>
2560 Craig Metz <cmetz[AT]inner.net>
2561 Per Flock <per.flock[AT]axis.com>
2562 Jack Keane <jkeane[AT]OpenReach.com>
2563 Brian Wellington <bwelling[AT]xbill.org>
2564 Santeri Paavolainen <santtu[AT]ssh.com>
2565 Ulrich Kiermayr <uk[AT]ap.univie.ac.at>
2566 Neil Hunter <neil.hunter[AT]energis-squared.com>
2567 Ralf Holzer <ralf[AT]well.com>
2568 Craig Rodrigues <rodrigc [AT] attbi.com>
2569 Ed Warnicke <hagbard[AT]physics.rutgers.edu>
2570 Johan Jorgensen <johan.jorgensen[AT]axis.com>
2571 Frank Singleton <frank.singleton[AT]ericsson.com>
2572 Kevin Shi <techishi[AT]ms22.hinet.net>
2573 Mike Frisch <mfrisch[AT]isurfer.ca>
2574 Burke Lau <burke_lau[AT]agilent.com>
2575 Martti Kuparinen <martti.kuparinen[AT]iki.fi>
2576 David Hampton <dhampton[AT]mac.com>
2577 Kent Engstroem <kent[AT]unit.liu.se>
2578 Ronnie Sahlberg <ronnie_sahlberg[AT]ozemail.com.au>
2579 Borosa Tomislav <tomislav.borosa[AT]SIEMENS.HR>
2580 Alexandre P. Ferreira <alexandref[AT]tcoip.com.br>
2581 Simharajan Srishylam <Simharajan.Srishylam[AT]netapp.com>
2582 Greg Kilfoyle <gregk[AT]redback.com>
2583 James E. Flemer <jflemer[AT]acm.jhu.edu>
2584 Peter Lei <peterlei[AT]cisco.com>
2585 Thomas Gimpel <thomas.gimpel[AT]ferrari.de>
2586 Albert Chin <china[AT]thewrittenword.com>
2587 Charles Levert <charles[AT]comm.polymtl.ca>
2588 Todd Sabin <tas[AT]webspan.net>
2589 Eduardo Perez Ureta <eperez[AT]dei.inf.uc3m.es>
2590 Martin Thomas <martin_a_thomas[AT]yahoo.com>
2591 Hartmut Mueller <hartmut[AT]wendolene.ping.de>
2592 Michal Melerowicz <Michal.Melerowicz[AT]nokia.com>
2593 Hannes Gredler <hannes[AT]juniper.net>
2594 Inoue <inoue[AT]ainet.or.jp>
2595 Olivier Biot <obiot.ethereal[AT]gmail.com>
2596 Patrick Wolfe <pjw[AT]zocalo.cellular.ameritech.com>
2597 Martin Held <Martin.Held[AT]icn.siemens.de>
2598 Riaan Swart <rswart[AT]cs.sun.ac.za>
2599 Christian Lacunza <celacunza[AT]gmx.net>
2600 Scott Renfro <scott[AT]renfro.org>
2601 Juan Toledo <toledo[AT]users.sourceforge.net>
2602 Jean-Christian Pennetier <jeanchristian.pennetier[AT]rd.francetelecom.fr>
2603 Jian Yu <bgp4news[AT]yahoo.com>
2604 Eran Mann <emann[AT]opticalaccess.com>
2605 Andy Hood <ajhood [AT] fl.net.au>
2606 Randy McEoin <rmceoin[AT]ahbelo.com>
2607 Edgar Iglesias <edgar.iglesias[AT]axis.com>
2608 Martina Obermeier <Martina.Obermeier[AT]icn.siemens.de>
2609 Javier Achirica <achirica[AT]ttd.net>
2610 B. Johannessen <bob[AT]havoq.com>
2611 Thierry Pelle <thierry.pelle[AT]laposte.net>
2612 Francisco Javier Cabello <fjcabello[AT]vtools.es>
2613 Laurent Rabret <laurent.rabret[AT]rd.francetelecom.fr>
2614 nuf si <gnippiks[AT]yahoo.com>
2615 Jeff Morriss <jeff.morriss.ws[AT]gmail.com>
2616 Aamer Akhter <aakhter[AT]cisco.com>
2617 Pekka Savola <pekkas[AT]netcore.fi>
2618 David Eisner <cradle[AT]Glue.umd.edu>
2619 Steve Dickson <steved[AT]talarian.com>
2620 Markus Seehofer <Markus.Seehofer [AT] hirschmann.de>
2621 Lee Berger <lberger[AT]roy.org>
2622 Motonori Shindo <motonori[AT]shin.do>
2623 Terje Krogdahl <tekr[AT]nextra.com>
2624 Jean-Francois Mule <jfm[AT]cablelabs.com>
2625 Thomas Wittwer <thomas.wittwer[AT]iclip.ch>
2626 Matthias Nyffenegger <matthias.nyffenegger[AT]iclip.ch>
2627 Palle Lyckegaard <Palle[AT]lyckegaard.dk>
2628 Nicolas Balkota <balkota[AT]mac.com>
2629 Tom Uijldert <Tom.Uijldert[AT]cmg.nl>
2630 Akira Endoh <endoh[AT]netmarks.co.jp>
2631 Graeme Hewson <graeme.hewson[AT]oracle.com>
2632 Pasi Eronen <pe[AT]iki.fi>
2633 Georg von Zezschwitz <gvz[AT]2scale.net>
2634 Steffen Weinreich <steve[AT]weinreich.org>
2635 Marc Milgram <ethereal[AT]mmilgram.NOSPAMmail.net>
2636 Gordon McKinney <gordon[AT]night-ray.com>
2637 Pavel Novotny <Pavel.Novotny[AT]icn.siemens.de>
2638 Shinsuke Suzuki <suz[AT]kame.net>
2639 Andrew C. Feren <acferen[AT]yahoo.com>
2640 Tomas Kukosa <tomas.kukosa [AT] siemens.com>
2641 Andreas Stockmeier <a.stockmeier[AT]avm.de>
2642 Pekka Nikander <pekka.nikander[AT]nomadiclab.com>
2643 Hamish Moffatt <hamish[AT]cloud.net.au>
2644 Kazushi Sugyo <k-sugyou[AT]nwsl.mesh.ad.jp>
2645 Tim Potter <tpot[AT]samba.org>
2646 Raghu Angadi <rangadi[AT]inktomi.com>
2647 Taisuke Sasaki <sasaki[AT]soft.net.fujitsu.co.jp>
2648 Tim Newsham <newsham[AT]lava.net>
2649 Tom Nisbet <Tnisbet[AT]VisualNetworks.com>
2650 Darren New <dnew[AT]san.rr.com>
2651 Pavel Mores <pvl[AT]uh.cz>
2652 Bernd Becker <bb[AT]bernd-becker.de>
2653 Heinz Prantner <Heinz.Prantner[AT]radisys.com>
2654 Irfan Khan <ikhan[AT]qualcomm.com>
2655 Jayaram V.R <vjayar[AT]cisco.com>
2656 Dinesh Dutt <ddutt[AT]cisco.com>
2657 Nagarjuna Venna <nvenna[AT]Brixnet.com>
2658 Jirka Novak <j.novak[AT]netsystem.cz>
2659 Ricardo Barroetaven~a <rbarroetavena[AT]veufort.com>
2660 Alan Harrison <alanharrison[AT]mail.com>
2661 Mike Frantzen <frantzen[AT]w4g.org>
2662 Charlie Duke <cduke[AT]fvc.com>
2663 Alfred Arnold <Alfred.Arnold[AT]elsa.de>
2664 Dermot Bradley <dermot.bradley[AT]openwave.com>
2665 Adam Sulmicki <adam[AT]cfar.umd.edu>
2666 Kari Tiirikainen <kari.tiirikainen[AT]nokia.com>
2667 John Mackenzie <John.A.Mackenzie[AT]t-online.de>
2668 Peter Valchev <pvalchev[AT]openbsd.org>
2669 Alex Rozin <Arozin[AT]mrv.com>
2670 Jouni Malinen <jkmaline[AT]cc.hut.fi>
2671 Paul E. Erkkila <pee[AT]erkkila.org>
2672 Jakob Schlyter <jakob[AT]openbsd.org>
2673 Jim Sienicki <sienicki[AT]issanni.com>
2674 Steven French <sfrench[AT]us.ibm.com>
2675 Diana Eichert <deicher[AT]sandia.gov>
2676 Blair Cooper <blair[AT]teamon.com>
2677 Kikuchi Ayamura <ayamura[AT]ayamura.org>
2678 Didier Gautheron <dgautheron[AT]magic.fr>
2679 Phil Williams <csypbw[AT]comp.leeds.ac.uk>
2680 Kevin Humphries <khumphries[AT]networld.com>
2681 Erik Nordstroem <erik.nordstrom[AT]it.uu.se>
2682 Devin Heitmueller <dheitmueller[AT]netilla.com>
2683 Chenjiang Hu <chu[AT]chiaro.com>
2684 Kan Sasaki <sasaki[AT]fcc.ad.jp>
2685 Stefan Wenk <stefan.wenk[AT]gmx.at>
2686 Ruud Linders <ruud[AT]lucent.com>
2687 Andrew Esh <Andrew.Esh[AT]tricord.com>
2688 Greg Morris <GMORRIS[AT]novell.com>
2689 Dirk Steinberg <dws[AT]dirksteinberg.de>
2690 Kari Heikkila <kari.o.heikkila[AT]nokia.com>
2691 Olivier Dreux <Olivier.Dreux[AT]alcatel.fr>
2692 Michael Stiller <ms[AT]2scale.net>
2693 Antti Tuominen <ajtuomin[AT]tml.hut.fi>
2694 Martin Gignac <lmcgign[AT]mobilitylab.net>
2695 John Wells <wells[AT]ieee.org>
2696 Loic Tortay <tortay[AT]cc.in2p3.fr>
2697 Steve Housley <Steve_Housley[AT]eur.3com.com>
2698 Peter Hawkins <peter[AT]hawkins.emu.id.au>
2699 Bill Fumerola <billf[AT]FreeBSD.org>
2700 Chris Waters <chris[AT]waters.co.nz>
2701 Solomon Peachy <pizza[AT]shaftnet.org>
2702 Jaime Fournier <Jaime.Fournier [AT] hush.com>
2703 Markus Steinmann <ms[AT]seh.de>
2704 Tsutomu Mieno <iitom[AT]utouto.com>
2705 Yasuhiro Shirasaki <yasuhiro[AT]gnome.gr.jp>
2706 Anand V. Narwani <anand[AT]narwani.org>
2707 Christopher K. St. John <cks[AT]distributopia.com>
2708 Nix <nix[AT]esperi.demon.co.uk>
2709 Liviu Daia <Liviu.Daia[AT]imar.ro>
2710 Richard Urwin <richard[AT]soronlin.org.uk>
2711 Prabhakar Krishnan <Prabhakar.Krishnan[AT]netapp.com>
2712 Jim McDonough <jmcd[AT]us.ibm.com>
2713 Sergei Shokhor <sshokhor[AT]uroam.com>
2714 Hidetaka Ogawa <ogawa[AT]bs2.qnes.nec.co.jp>
2715 Jan Kratochvil <short[AT]ucw.cz>
2716 Alfred Koebler <ak[AT]icon-sult.de>
2717 Vassilii Khachaturov <Vassilii.Khachaturov[AT]comverse.com>
2718 Bill Studenmund <wrstuden[AT]wasabisystems.com>
2719 Brian Bruns <camber[AT]ais.org>
2720 Flavio Poletti <flavio[AT]polettix.it>
2721 Marcus Haebler <haeblerm[AT]yahoo.com>
2722 Ulf Lamping <ulf.lamping[AT]web.de>
2723 Matthew Smart <smart[AT]monkey.org>
2724 Luke Howard <lukeh[AT]au.padl.com>
2725 PC Drew <drewpc[AT]ibsncentral.com>
2726 Renzo Tomas <renzo.toma [AT] xs4all.nl>
2727 Clive A. Stubbings <eth [AT] vjet.demon.co.uk>
2728 Steve Langasek <vorlon [AT] netexpress.net>
2729 Brad Hards <bhards[AT]bigpond.net.au>
2730 cjs 2895 <cjs2895[AT]hotmail.com>
2731 Lutz Jaenicke <Lutz.Jaenicke [AT] aet.TU-Cottbus.DE>
2732 Senthil Kumar Nagappan <sknagappan [AT] yahoo.com>
2733 Jason House <jhouse [AT] mitre.org>
2734 Peter Fales <psfales [AT] lucent.com>
2735 Fritz Budiyanto <fritzb88 [AT] yahoo.com>
2736 Jean-Baptiste Marchand <Jean-Baptiste.Marchand [AT] hsc.fr>
2737 Andreas Trauer <andreas.trauer [AT] siemens.com>
2738 Ronald Henderson <Ronald.Henderson [AT] CognicaseUSA.com>
2739 Brian Ginsbach <ginsbach [AT] cray.com>
2740 Dave Richards <d_m_richards [AT] comcast.net>
2741 Martin Regner <martin.regner [AT] chello.se>
2742 Jason Greene <jason [AT] inetgurus.net>
2743 Marco Molteni <mmolteni [AT] cisco.com>
2744 James Harris <jharris [AT] fourhorsemen.org>
2745 rmkml <rmkml [AT] wanadoo.fr>
2746 Anders Broman <anders.broman [AT] ericsson.com>
2747 Christian Falckenberg <christian.falckenberg [AT] nortelnetworks.com>
2748 Huagang Xie <xie [AT] lids.org>
2749 Pasi Kovanen <Pasi.Kovanen [AT] tahoenetworks.fi>
2750 Teemu Rinta-aho <teemu.rinta-aho [AT] nomadiclab.com>
2751 Martijn Schipper <mschipper [AT] globespanvirata.com>
2752 Wayne Parrott <wayne_p [AT] pacific.net.au>
2753 Laurent Meyer <laurent.meyer6 [AT] wanadoo.fr>
2754 Lars Roland <Lars.Roland [AT] gmx.net>
2755 Miha Jemec <m.jemec [AT] iskratel.si>
2756 Markus Friedl <markus [AT] openbsd.org>
2757 Todd Montgomery <tmontgom [AT] tibco.com>
2758 emre <emre [AT] flash.net>
2759 Stephen Shelley <steve.shelley [AT] attbi.com>
2760 Erwin Rol <erwin [AT] erwinrol.com>
2761 Duncan Laurie <duncan [AT] sun.com>
2762 Tony Schene <schene [AT] pcisys.net>
2763 Matthijs Melchior <mmelchior [AT] xs4all.nl>
2764 Garth Bushell <gbushell [AT] elipsan.com>
2765 Mark C. Brown <mbrown [AT] hp.com>
2766 Can Erkin Acar <canacar [AT] eee.metu.edu.tr>
2767 Martin Warnes <martin.warnes [AT] ntlworld.com>
2768 J Bruce Fields <bfields [AT] fieldses.org>
2769 tz <tz1 [AT] mac.com>
2770 Jeff Liu <jqliu [AT] broadcom.com>
2771 Niels Koot <Niels.Koot [AT] logicacmg.com>
2772 Lionel Ains <lains [AT] gmx.net>
2773 Joakim Wiberg <jow [AT] hms-networks.com>
2774 Jeff Rizzo <riz [AT] boogers.sf.ca.us>
2775 Christoph Wiest <ch.wiest [AT] tesionmail.de>
2776 Xuan Zhang <xz [AT] aemail4u.com>
2777 Thierry Martin <thierry.martin [AT] accellent-group.com>
2778 Oleg Terletsky <oleg.terletsky [AT] comverse.com>
2779 Michael Lum <mlum [AT] telostech.com>
2780 Shiang-Ming Huang <smhuang [AT] pcs.csie.nctu.edu.tw>
2781 Tony Lindstrom <tony.lindstrom [AT] ericsson.com>
2782 Niklas Ogren <niklas.ogren [AT] 71.se>
2783 Jesper Peterson <jesper [AT] endace.com>
2784 Giles Scott <gscott [AT] arubanetworks.com>
2785 Vincent Jardin <vincent.jardin [AT] 6wind.com>
2786 Jean-Michel Fayard <jean-michel.fayard [AT] moufrei.de>
2787 Josef Korelus <jkor [AT] quick.cz>
2788 Brian K. Teravskis <Brian_Teravskis [AT] Cargill.com>
2789 Nathan Jennings <njen [AT] triad.rr.com>
2790 Hans Viens <hviens [AT] mediatrix.com>
2791 Kevin A. Noll <kevin.noll [AT] versatile.com>
2792 Emanuele Caratti <wiz [AT] libero.it>
2793 Graeme Reid <graeme.reid [AT] norwoodsystems.com>
2794 Lars Ruoff <lars.ruoff [AT] sxb.bsf.alcatel.fr>
2795 Samuel Qu <samuel.qu [AT] utstar.com>
2796 Baktha Muralitharan <muralidb [AT] cisco.com>
2797 Loiec Minier <lool [AT] dooz.org>
2798 Marcel Holtmann <marcel [AT] holtmann.org>
2799 Scott Emberley <scotte [AT] netinst.com>
2800 Brian Fundakowski Feldman <bfeldman [AT] fla.fujitsu.com>
2801 Yuriy Sidelnikov <ysidelnikov [AT] hotmail.com>
2802 Matthias Drochner <M.Drochner [AT] fz-juelich.de>
2803 Dave Sclarsky <dave_sclarsky [AT] cnt.com>
2804 Scott Hovis <scott.hovis [AT] ums.msfc.nasa.gov>
2805 David Fort <david.fort [AT] irisa.fr>
2806 Felix Fei <felix.fei [AT] utstar.com>
2807 Christoph Neusch <christoph.neusch [AT] nortelnetworks.com>
2808 Jan Kiszka <jan.kiszka [AT] web.de>
2809 Joshua Craig Douglas <jdouglas [AT] enterasys.com>
2810 Dick Gooris <gooris [AT] alcatel-lucent.com>
2811 Michael Shuldman <michaels [AT] inet.no>
2812 Tadaaki Nagao <nagao [AT] iij.ad.jp>
2813 Aaron Woo <woo [AT] itd.nrl.navy.mil>
2814 Chris Wilson <chris [AT] mxtelecom.com>
2815 Rolf Fiedler <Rolf.Fiedler [AT] Innoventif.com>
2816 Alastair Maw <ethereal [AT] almaw.com>
2817 Sam Leffler <sam [AT] errno.com>
2818 Martin Mathieson <martin.r.mathieson [AT] googlemail.com>
2819 Christian Wagner <Christian.Wagner [AT] stud.uni-karlsruhe.de>
2820 Edwin Calo <calo [AT] fusemail.com>
2821 Ian Schorr <ischorr [AT] comcast.net>
2822 Rowan McFarland <rmcfarla[AT]cisco.com>
2823 John Engelhart <johne [AT] zang.com>
2824 Ryuji Somegawa <ryuji-so [AT] is.aist-nara.ac.jp>
2825 metatech <metatechbe [AT] gmail.com>
2826 Brian Wheeler <Brian.Wheeler [AT] arrisi.com>
2827 Josh Bailey <joshbailey [AT] lucent.com>
2828 Jelmer Vernooij <jelmer [AT] samba.org>
2829 Duncan Sargeant <dunc-ethereal-dev [AT] rcpt.to>
2830 Love Hoernquist Aastrand <lha [AT] it.su.se>
2831 Lukas Pokorny <maskis [AT] seznam.cz>
2832 Carlos Pignataro <cpignata [AT] cisco.com>
2833 Thomas Anders <thomas.anders [AT] blue-cable.de>
2834 Rich Coe <Richard.Coe [AT] med.ge.com>
2835 Dominic Bechaz <bdo [AT] zhwin.ch>
2836 Richard van der Hoff <richardv [AT] mxtelecom.com>
2837 Shaun Jackman <sjackman [AT] gmail.com>
2838 Jon Oberheide <jon [AT] oberheide.org>
2839 Henry Ptasinski <henryp [AT] broadcom.com>
2840 Roberto Morro <roberto.morro [AT] telecomitalia.it>
2841 Chris Maynard <Christopher.Maynard [AT] GTECH.COM>
2842 SEKINE Hideki <sekineh [AT] gf7.so-net.ne.jp>
2843 Jeff Connelly <shellreef+mp2p [AT] gmail.com>
2844 Irene Ruengeler <i.ruengeler [AT] fh-muenster.de
2845 M. Ortega y Strupp <moys [AT] loplof.de>
2846 Kelly Byrd <kbyrd-ethereal [AT] memcpy.com>
2847 Luis Ontanon <luis.ontanon[AT]gmail.com>
2848 Luca Deri <deri [AT] ntop.org>
2849 Viorel Suman <vsuman [AT] avmob.ro>
2850 Alejandro Vaquero <alejandro.vaquero [AT] verso.com>
2851 Francesco Fondelli <francesco.fondelli [AT] gmail.com>
2852 Artem Tamazov <artem.tamazov [AT] tellabs.com>
2853 Dmitry Trebich <dmitry.trebich [AT] gmail.com>
2854 Bill Meier <wmeier [AT] newsguy.com>
2855 Susanne Edlund <Susanne.Edlund [AT] ericsson.com>
2856 Victor Stratan <hidralisk [AT] yahoo.com>
2857 Peter Johansson <PeterJohansson73 [AT] gmail.com>
2858 Stefan Metzmacher <metze [AT] samba.org>
2859 Abhijit Menon-Sen <ams [AT] oryx.com>
2860 James Fields <jvfields [AT] tds.net>
2861 Kevin Johnson <kjohnson [AT] secureideas.net>
2862 Mike Duigou <bondolo [AT] dev.java.net>
2863 Deepak Jain <jain1971 [AT] yahoo.com>
2864 Stefano Pettini <spettini [AT] users.sourceforge.net>
2865 Jon Ringle <ml-ethereal [AT] ringle.org>
2866 Tim Endean <endeant [AT] hotmail.com>
2867 Charlie Lenahan <clenahan [AT] fortresstech.com>
2868 Takeshi Nakashima <T.Nakashima [AT] jp.yokogawa.com>
2869 Shoichi Sakane <sakane [AT] tanu.org>
2870 Michael Richardson <Michael.Richardson [AT] protiviti.com>
2871 Olivier Jacques <olivier.jacques [AT] hp.com>
2872 Francisco Alcoba <francisco.alcoba [AT] ericsson.com>
2873 Nils O. Selaasdal <noselasd [AT] asgaard.homelinux.org>
2874 Guillaume Chazarain <guichaz [AT] yahoo.fr>
2875 Angelo Bannack <angelo.bannack[AT]siemens.com>
2876 Paolo Frigo <paolofrigo [AT] gmail.com>
2877 Jeremy J Ouellette <jouellet [AT] scires.com>
2878 Aboo Valappil <valappil_aboo [AT] emc.com>
2879 Fred Hoekstra <fred.hoekstra [AT] philips.com>
2880 Ankur Aggarwal <ankur [AT] in.athenasemi.com>
2881 Lucian Piros <lpiros [AT] avmob.ro>
2882 Juan Gonzalez <juan.gonzalez [AT] pikatech.com>
2883 Brian Bogora <brian_bogora [AT] mitel.com>
2884 Jim Young <sysjhy [AT] langate.gsu.edu>
2885 Jeff Snyder <jeff [AT] mxtelecom.com>
2886 William Fiveash <William.Fiveash [AT] sun.com>
2887 Graeme Lunt <graeme.lunt [AT] smhs.co.uk>
2888 Menno Andriesse <s5066 [AT] nc3a.nato.int>
2889 Stig Bjorlykke <stig [AT] bjorlykke.org>
2890 Kyle J. Harms <kyle.j.harms [AT] boeing.com>
2891 Eric Wedel <ewedel [AT] bluearc.com>
2892 Secfire <secfire[AT]gmail.com>
2893 Eric Hultin <Eric.Hultin[AT]arrisi.com>
2894 Paolo Abeni <paolo.abeni [AT] email.it>
2895 W. Borgert <debacle [AT] debian.org>
2896 Frederic Roudaut <frederic.roudaut [AT] irisa.fr>
2897 Christoph Scholz <scholz_ch [AT] web.de>
2898 Wolfgang Hansmann <hansmann [AT] cs.uni-bonn.de>
2899 Kees Cook <kees [AT] outflux.net>
2900 Thomas Dreibholz <dreibh [AT] iem.uni-due.de>
2901 Authesserre Samuel <sauthess [AT] gmail.com>
2902 Balint Reczey <balint.reczey [AT] ericsson.com>
2903 Stephen Fisher <steve [AT] stephen-fisher.com>
2904 Krzysztof Burghardt <krzysztof [AT] burghardt.pl>
2905 Peter Racz <racz [AT] ifi.unizh.ch>
2906 Jakob Bratkovic <j.bratkovic [AT] iskratel.si>
2907 Mark Lewis <mlewis [AT] altera.com>
2908 David Buechi <bhd [AT] zhwin.ch>
2909 Bill Florac <bill.florac [AT] etcconnect.com>
2910 Alex Burlyga <Alex.Burlyga [AT] netapp.com>
2911 Douglas Pratley <Douglas.pratley [AT] detica.com>
2912 Giorgio Tino <giorgio.tino [AT] cacetech.com>
2913 Davide Schiera <davide.schiera [AT] riverbed.com>
2914 Sebastien Tandel <sebastien [AT] tandel.be>
2915 Clay Jones <clay.jones [AT] email.com>
2916 Kriang Lerdsuwanakij <lerdsuwa [AT] users.sourceforge.net>
2917 Abhik Sarkar <sarkar.abhik [AT] gmail.com>
2918 Robin Seggelmann <seggelmann [AT] fh-muenster.de>
2919 Chris Bontje <cbontje [AT] gmail.com>
2920 Ryan Wamsley <wamslers [AT] sbcglobal.net>
2921 Dave Butt <davidbutt [AT] mxtelecom.com>
2922 Julian Cable <julian_cable [AT] yahoo.com>
2923 Joost Yervante Damad <joost [AT] teluna.org>
2924 Martin Sustrik <sustrik [AT] imatix.com>
2925 Jon Smirl <jonsmirl [AT] gmail.com>
2926 David Kennedy <sgsguy [AT] gmail.com>
2927 Matthijs Mekking <matthijs [AT] mlnetlabs.nl>
2928 Dustin Johnson <dustin [AT] dustinj.us>
2929 Victor Fajardo <vfajardo [AT] tari.toshiba.com>
2930 Tamas Regos <tamas.regos [AT] ericsson.com>
2931 Moshe van der Sterre <moshevds [AT] gmail.com>
2932 Rob Casey <rcasey [AT] gmail.com>
2933 Ted Percival <ted [AT] midg3t.net>
2934 Marc Petit-Huguenin <marc [AT] petit-huguenin.org>
2935 Florent Drouin <florent.drouin [AT] alcatel-lucent.fr>
2936 Karen Feng <kfeng [AT] fas.harvard.edu>
2937 Stephen Croll <croll [AT] mobilemetrics.net>
2938 Jens Braeuer <jensb [AT] cs.tu-berlin.de>
2939 Sake Blok <sake [AT] euronet.nl>
2940 Fulko Hew <fulko.hew [AT] gmail.com>
2941 Yukiyo Akisada <Yukiyo.Akisada [AT] jp.yokogawa.com>
2942 Andy Chu <chu.dev [AT] gmail.com>
2943 Shane Kearns <shane.kearns [AT] symbian.com>
2944 Loris Degioanni <loris.degioanni [AT] riverbed.com>
2945 Sven Meier <msv [AT] zhwin.ch>
2946 Holger Pfrommer <hpfrommer [AT] hilscher.com>
2947 Hariharan Ananthakrishnan <hariharan.a [AT] gmail.com>
2948 Hannes Kaelber <hannes.kaelber--wireshark [AT] x2e.de>
2949 Stephen Donnelly <stephen [AT] endace.com>
2950 Philip Frey <frey.philip [AT] gmail.com>
2951 Yves Geissbuehler <yves.geissbuehler [AT] gmail.com>
2952 Shigeo Nakamura <naka_shigeo [AT] yahoo.co.jp>
2953 Sven Eckelmann <sven [AT] narfation.org>
2954 Edward J. Paradise <pdice [AT] cisco.com>
2955 Brian Stormont <nospam [AT] stormyprods.com>
2956 Vincent Helfre <vincent.helfre [AT] ericsson.com>
2957 Brooss <brooss.teambb [AT] gmail.com>
2958 Joan Ramio <joan[AT]ramio.cat>
2959 David Castleford <david.castleford [AT] orange-ftgroup.com>
2960 Peter Harris <pharris[AT]opentext.com>
2961 Martin Lutz <MartinL [AT] copadata.at>
2962 Johnny Mitrevski <mitrevj [AT] hotmail.com>
2963 Neil Horman <nhorman [AT] tuxdriver.com>
2964 Andreas Schuler <krater [AT] badterrorist.com>
2965 Matthias Wenzel <dect [AT] mazzoo.de>
2966 Christian Durrer <christian.durrer [AT] sensemail.ch>
2967 Naoyoshi Ueda <piyomaru3141 [AT] gmail.com>
2968 Javier Cardona <javier [AT] cozybit.com>
2969 Jens Steinhauser <jens.steinhauser [AT] omicron.at>
2970 Julien Kerihuel <j.kerihuel [AT] openchange.org>
2971 Vincenzo Condoleo <vcondole [AT] hsr.ch>
2972 Mohammad Ebrahim Mohammadi Panah <mebrahim [AT] gmail.com>
2973 Greg Schwendimann <gregs [AT] iol.unh.edu>
2974 Nick Lewis <nick.lewis [AT] atltelecom.com>
2975 Fred Fierling <fff [AT] exegin.com>
2976 Samu Varjonen <samu.varjonen [AT] hiit.fi>
2977 Alexis La Goutte <alexis.lagoutte [AT] gmail.com>
2978 Varun Notibala <nbvarun [AT] gmail.com>
2979 Nathan Hartwell <nhartwell [AT] gmail.com>
2980 Don Chirieleison <donc [AT] mitre.org>
2981 Harald Welte <laforge [AT] gnumonks.org>
2982 Chris Costa <chcosta75 [AT] hotmail.com>
2983 Bruno Premont <bonbons [AT] linux-vserver.org>
2984 Florian Forster <octo [AT] verplant.org>
2985 Ivan Sy Jr. <ivan_jr [AT] yahoo.com>
2986 Matthieu Patou <mat [AT] matws.net>
2987 Kovarththanan Rajaratnam <kovarththanan.rajaratnam [AT] gmail.com>
2988 Matt Watchinski <mwatchinski [AT] sourcefire.com>
2989 Ravi Kondamuru <Ravi.Kondamuru [AT] citrix.com>
2990 Jan Gerbecks <jan.gerbecks [AT] stud.uni-due.de>
2991 Vladimir Smrekar <vladimir.smrekar [AT] gmail.com>
2992 Tobias Erichsen <t.erichsen [AT] gmx.de>
2993 Erwin van Eijk <erwin.vaneijk [AT] gmail.com>
2994 Venkateshwaran Dorai <venkateshwaran.d [AT] gmail.com>
2995 Ben Greear <greearb [AT] candelatech.com>
2996 Richard Kuemmel <r.kuemmel [AT] beckhoff.de>
2997 Yi Yu <yiyu.inbox [AT] gmail.com>
2998 Aniruddha A <aniruddha.a [AT] gmail.com>
2999 David Aggeler <david_aggeler [AT] hispeed.ch>
3000 Jens Kilian <jjk [AT] acm.org>
3001 David Bond <mokon [AT] mokon.net>
3002 Paul J. Metzger <pjm [AT] ll.mit.edu>
3003 Robert Hogan <robert [AT] roberthogan.net>
3004 Torrey Atcitty <torrey.atcitty [AT] harman.com>
3005 Dave Olsen <dave.olsen [AT] harman.com>
3006 Craig Gunther <craig.gunther [AT] harman.com>
3007 Levi Pearson <levi.pearson [AT] harman.com>
3008 Allan M. Madsen <allan.m [AT] madsen.mail.dk>
3009 Slava <slavak [AT] gmail.com>
3010 H.sivank <hsivank [AT] gmail.com>
3011 Edgar Gladkich <edgar.gladkich [AT] inacon.de>
3012 Michael Bernhard <michael.bernhard [AT] bfh.ch>
3013 Holger Hans Peter Freyther <zecke [AT] selfish.org>
3014 Jose Pico <jose [AT] taddong.com>
3015 David Perez <david [AT] taddong.com>
3016 Haakon Nessjoen <haakon.nessjoen [AT] gmail.com>
3017 Herbert Lischka <herbert [AT] lischka-berlin.de>
3018 Felix Kraemer <sauter-cumulus [AT] de.sauter-bc.com>
3019 Tom Hughes <tom [AT] compton.nu>
3020 Owen Kirby <osk [AT] exegin.com>
3021 Colin O'Flynn <coflynn [AT] newae.com>
3022 Juha Siltanen <juha.siltanen [AT] nsn.com>
3023 Cal Turney <turney_cal [AT] emc.com>
3024 Lukasz Kotasa <lukasz.kotasa [AT] tieto.com>
3025 Jason Masker <jason [AT] masker.net>
3026 Giuliano Fabris <giuliano.fabris [AT] appeartv.com>
3027 Alexander Koeppe <format_c [AT] online.de>
3028 Holger Grandy <Holger.Grandy [AT] bmw-carit.de>
3029 Hadriel Kaplan <hadrielk [AT] yahoo.com>
3030 Srinivasa Pradeep <sippyemail-wireshark [AT] yahoo.com>
3031 Lori Tribble <ljtconsulting [AT] gmail.com>
3032 Thomas Boehne <TBoehne [AT] ADwin.de>
3033 Gerhard Gappmeier <gerhard.gappmeier [AT] ascolab.com>
3034 David Katz <dkatz [AT] airspan.com>
3035 Toralf Foerster <toralf.foerster [AT] gmx.de>
3036 Stephane Bryant <stephane [AT] glycon.org>
3037 Emil Wojak <emil [AT] wojak.eu>
3038 Steve Huston <shuston [AT] riverace.com>
3039 Lorand Jakab <ljakab [AT] ac.upc.edu>
3040 Grzegorz Szczytowski <Grzegorz.Szczytowski [AT] gmail.com>
3041 Martin Kaiser <martin [AT] kaiser.cx>
3042 Jakub Zawadzki <darkjames-ws [AT] darkjames.pl>
3043 Roland Knall <rknall [AT] gmail.com>
3044 Xiao Xiangquan <xiaoxiangquan [AT] gmail.com>
3045 Hans-Christoph Schemmel <hans-christoph.schemmel [AT] cinterion.com>
3046 Tyson Key <tyson.key [AT] gmail.com>
3047 Johannes Jochen <johannes.jochen [AT] belden.com>
3048 Florian Fainelli <florian [AT] openwrt.org>
3049 Daniel Willmann <daniel [AT] totalueberwachung.de>
3050 Brian Cavagnolo <brian [AT] cozybit.com>
3051 Allison <aobourn [AT] isilon.com>
3052 Edwin Groothuis <wireshark [AT] mavetju.org>
3053 Andrew Kampjes <andrew.kampjes [AT] endace.com>
3054 Kurnia Hendrawan <kurnia.hendrawan [AT] consistec.de>
3055 Leonard Tracy <letracy [AT] cisco.com>
3056 Elliott Aldrich <elliott [AT] aldrichart.com>
3057 Glenn Matthews <glenn.matthews [AT] cisco.com>
3058 Donnie Savage <dsavage [AT] cisco.com>
3059 Spenser Sheng <spenser.sheng [AT] ericsson.com>
3060 Benjamin Stocks <bmstocks [AT] ra.rockwell.com>
3061 Florian Reichert <refl [AT] zhaw.ch>
3062 Martin Renold <reld [AT] zhaw.ch>
3063 Iain Arnell <iarnell [AT] epo.org>
3064 Mariusz Okroj <okrojmariusz [AT] gmail.com>
3065 Ivan Lawrow <ivan.lawrow [AT] jennic.com>
3066 Kari Vatjus-Anttila <kari.vatjus-anttila [AT] cie.fi>
3067 Shobhank Sharma <ssharma5 [AT] ncsu.edu>
3068 Salil Kanitkar <sskanitk [AT] ncsu.edu>
3069 Michael Sakaluk <mdsakalu [AT] ncsu.edu>
3070 Mayuresh Raut <msraut [AT] ncsu.edu>
3071 Sheetal Kshirsagar <sdkshirs [AT] ncsu.edu>
3072 Andrew Williams <anwilli5 [AT] ncsu.edu>
3073 Per Liedberg <per.liedberg [AT] ericsson.com>
3074 Gaurav Tungatkar <gauravstt [AT] gmail.com>
3075 Paul Erkkila <pee [AT] erkkila.org>
3076 Bill Schiller <bill.schiller [AT] emerson.com>
3077 Aditya Ambadkar <arambadk [AT] ncsu.edu>
3078 Diana Chris <dvchris [AT] ncsu.edu>
3079 Guy Martin <gmsoft [AT] tuxicoman.be>
3080 Deepti Ragha <dlragha [AT] ncsu.edu>
3081 Niels de Vos <ndevos [AT] redhat.com>
3082 Clement MARRAST clement.marrast [AT] molex.com
3083 and by:
3084 Pavel Roskin <proski [AT] gnu.org>
3086 Georgi Guninski <guninski [AT] guninski.com>
3087 Jason Copenhaver <jcopenha [AT] typedef.org>
3088 Eric Perie <eric.perie [AT] colubris.com>
3089 David Yon <yon [AT] tacticalsoftware.com>
3090 Marcio Franco <franco.marcio [AT] rd.francetelecom.fr>
3091 Kaloian Stoilov <kalkata [AT] yahoo.com>
3092 Steven Lass <stevenlass [AT] mail.com>
3093 Gregory Stark <gsstark [AT] mit.edu>
3094 Darren Steele <steeley [AT] steeley.co.uk>
3095 Michael Kopp <michael.kopp [AT] isarnet.de>
3096 Bernd Leibing <bernd.leibing [AT] kiz.uni-ulm.de>
3097 Chris Heath <chris [AT] heathens.co.nz>
3098 Gisle Vanem <giva [AT] bgnett.no>
3099 Ritchie <ritchie [AT] tipsybottle.com>
3100 Aki Immonen <aki.immonen [AT] golftalma.fi>
3101 David E. Weekly <david [AT] weekly.org>
3102 Steve Ford <sford [AT] geeky-boy.com>
3103 Masaki Chikama <masaki-c [AT] is.aist-nara.ac.jp>
3104 Mohammad Hanif <mhanif [AT] nexthop.com>
3105 Reinhard Speyerer <rspmn [AT] arcor.de>
3106 Patrick Kursawe <phosphan [AT] gentoo.org>
3107 Arsen Chaloyan <achaloyan [AT] yahoo.com>
3108 <melerski [AT] poczta.onet.pl>
3109 Arnaud Jacques <webmaster [AT] securiteinfo.com>
3110 D. Manzella <manzella [AT] lucent.com>
3111 Jari Mustajarvi <jari.mustajarvi [AT] nokia.com>
3112 Pierre Juhen <pierre.juhen [AT] wanadoo.fr>
3113 David Richards <drichards [AT] alum.mit.edu>
3114 Shusaku Ueda <ueda [AT] sra.co.jp>
3115 Jonathan Perkins <jonathan.perkins [AT] ipaccess.com>
3116 Holger Schurig <h.schurig [AT] mn-logistik.de>
3117 Peter J. Creath <peter-ethereal [AT] creath.net>
3118 Magnus Hansson <mah [AT] hms.se>
3119 Pavel Kankovsky <kan [AT] dcit.cz>
3120 Nick Black <dank [AT] reflexsecurity.com>
3121 Bill Guyton <guyton [AT] bguyton.com>
3122 Chernishov Yury <Chernishov [AT] iskrauraltel.ru>
3123 Thomas Palmer <Thomas.Palmer [AT] Gunter.AF.mil>
3124 Clinton Work <clinton [AT] scripty.com>
3125 Joe Marcus Clarke <marcus [AT] marcuscom.com>
3126 Kendy Kutzner <kutzner[AT]tm.uka.de>
3127 James H. Cloos Jr. <cloos [AT] jhcloos.com>
3128 Tim Farley <tfarley[AT]iss.net>
3129 Daniel Thompson <daniel.thompson[AT]st.com>
3130 Chris Jepeway <thai-dragon[AT]eleven29.com>
3131 Matthew Bradley <matthew.bradley [AT] cnsonline.net>
3132 Nathan Alger <nathan [AT] wasted.com>
3133 Stas Grabois <sagig [AT] radware.com>
3134 Ainsley Pereira <APereira [AT] Witness.com>
3135 Philippe Mazeau <philippe.mazeau [AT] swissvoice.net>
3136 Carles Kishimoto <ckishimo [AT] ac.upc.es>
3137 Dennis Lim <Dennis.Lim [AT] motorola.com>
3138 <postadal [AT] suse.cz>
3139 Martin van der Werff <martin [AT] vanderwerff.org>
3140 Marco van den Bovenkamp <marco [AT] linuxgoeroe.dhs.org>
3141 Ming Zhang <mingz [AT] ele.uri.edu>
3142 Neil Piercy <Neil.Piercy [AT] ipaccess.com>
3143 Remi Denis-Courmont <courmisch [AT] via.ecp.fr>
3144 Thomas Palmer <tpalmer [AT] elmore.rr.com>
3145 Maarten Svantesson <f95-msv [AT] f.kth.se>
3146 Steve Sommars (e-mail address removed at contributor's request)
3147 Kestutis Kupciunas <kesha [AT] soften.ktu.lt>
3148 Rene Pilz <rene.pilz [AT] ftw.at>
3149 Laurent Constantin <laurent.constantin [AT] aql.fr>
3150 Martin Pichlmaier <martin.pichlmaier [AT] siemens.com>
3151 Mark Phillips <msp [AT] nortelnetworks.com>
3152 Nils Ohlmeier <lists [AT] ohlmeier.org>
3153 Ignacio Goyret <igoyret [AT] lucent.com>
3154 Bart Braem <bart.braem [AT] gmail.com>
3155 Shingo Horisawa <name4n5 [AT] hotmail.com>
3156 Lane Hu <lane.hu [AT] utstar.com>
3157 Marc Poulhies <marc.poulhies [AT] epfl.ch>
3158 Tomasz Mrugalski <thomson [AT] klub.com.pl>
3159 Brett Kuskie <mstrprgmmr [AT] chek.com>
3160 Brian Caswell <bmc [AT] sourcefire.com>
3161 Yann <yann_eads [AT] hotmail.com>
3162 Julien Leproust <julien [AT] via.ecp.fr>
3163 Mutsuya Irie <irie [AT] sakura-catv.ne.jp>
3164 Yoshihiro Oyama <y.oyama [AT] netagent.co.jp>
3165 Chris Eagle <cseagle [AT] nps.edu>
3166 Dominique Bastien <dbastien [AT] accedian.com>
3167 Nicolas Dichtel <nicolas.dichtel [AT] 6wind.com>
3168 Ricardo Muggli <ricardo.muggli [AT] mnsu.edu>
3169 Vladimir Kondratiev <vladimir.kondratiev [AT] gmail.com>
3170 Jaap Keuter <jaap.keuter [AT] xs4all.nl>
3171 Frederic Peters <fpeters [AT] debian.org>
3172 Anton Ivanov <anthony_johnson [AT] mail.ru>
3173 Ilya Konstantinov <future [AT] shiny.co.il>
3174 Neil Kettle <mu-b [AT] 65535.com>
3175 Steve Karg <skarg [AT] users.sourceforge.net>
3176 Javier Acuna <javier.acuna [AT] sixbell.cl>
3177 Miklos Szurdi <szurdimiklos [AT] yahoo.com>
3178 Cvetan Ivanov <zezo [AT] spnet.net>
3179 Vasanth Manickam <vasanth.manickam [AT] bt.com>
3180 Julian Onions <julian.onions [AT] gmail.com>
3181 Samuel Thibault <samuel.thibault [AT] ens-lyon.org>
3182 Peter KovaX <peter.kovar [AT] gmail.com>
3183 Paul Ollis <paul.ollis [AT] roke.co.uk>
3184 Dominik Kuhlen <dkuhlen [AT] gmx.net>
3185 Karl Knoebl <karl.knoebl [AT] siemens.com>
3186 Maria-Luiza Crivat <luizacri [AT] gmail.com>
3187 Brice Augustin <bricecotte [AT] gmail.com>
3188 Matt Thornton <MATT_THORNTON [AT] appsig.com>
3189 Timo Metsala <timo.metsala [AT] gmail.com>
3190 Tomer Shani <thetour [AT] japan.com>
3191 Manu Pathak <mapathak [AT] cisco.com>
3192 John Sullivan <john [AT] kanargh.force9.co.uk>
3193 Martin Andre <andre [AT] clarinet.u-strasbg.fr>
3194 Andrei Emeltchenko <Andrei.Emeltchenko [AT] nokia.com>
3195 Kirby Files <kfiles [AT] masergy.com>
3196 Ravi Valmikam <rvalmikam [AT] airvananet.com>
3197 Diego Petteno <flameeyes [AT] gentoo.org>
3198 Daniel Black <dragonheart [AT] gentoo.org>
3199 Christoph Werle <Christoph.Werle [AT] ira.uka.de>
3200 Aaron Christensen <aaronmf [AT] gmail.com>
3201 Ian Abel <ianabel [AT] mxtelecom.com>
3202 Bryant Eastham <beastham [AT] slc.mew.com>
3203 Taner Kurtulus <taner.kurtulus [AT] tubitak.gov.tr>
3204 Joe Breher <linux [AT] q-music.com>
3205 Patrick vd Lageweg <patrick [AT] bitwizard.nl>
3206 Thomas Sillaber <Thomas.Sillaber [AT] gmx.de>
3207 Mike Davies <m.davies [AT] btinternet.com>
3208 Boris Misenov <Boris.Misenov [AT] oktelabs.ru>
3209 Joe McEachern <joe [AT] qacafe.com>
3210 Charles Lepple <clepple [AT] gmail.com>
3211 Tuomas Maattanen <maattanen [AT] iki.fi>
3212 Joe Eykholt <joe [AT] nuovasystems.com>
3213 Ian Brumby <ian.brumby [AT] baesystems.com>
3214 Todd J Martin <todd.martin [AT] acm.org>
3215 Scott Robinson <scott.robinson [AT] flukenetworks.com>
3216 Martin Peylo <wireshark [AT] izac.de>
3217 Stephane Loeuillet <leroutier [AT] gmail.com>
3218 Andrei Rubaniuk <rubaniuk [AT] mail.ru>
3219 Mikael Magnusson <mikma264 [AT] gmail.com>
3220 Timo Teraes <timo.teras [AT] iki.fi>
3221 Marton Nemeth <nm127 [AT] freemail.hu>
3222 Kai Blin <kai [AT] samba.org>
3223 Olivier Montanuy <olivier.montanuy [AT] orange-ftgroup.com>
3224 Thomas Morin <thomas.morin [AT] orange-ftgroup.com>
3225 Jesus Roman <jroman [AT] teldat.com>
3226 Giodi Giorgi <g.giorgi [AT] gmail.com>
3227 Peter Hertting <Peter.Hertting [AT] gmx.net>
3228 Jess Balint <jbalint [AT] gmail.com>
3229 Bahaa Naamneh <b.naamneh [AT] gmail.com>
3230 Magnus Soerman <magnus.sorman [AT] ericsson.com
3231 Pascal Quantin <pascal.quantin [AT] gmail.com>
3232 Roy Marples <roy [AT] marples.name>
3233 Ward van Wanrooij <ward [AT] ward.nu>
3234 Federico Mena Quintero <federico [AT] novell.com>
3235 Andreas Heise <andreas.heise [AT] nextiraone.de>
3236 Alex Lindberg <alindber [AT] yahoo.com>
3237 Rama Chitta <rama [AT] gear6.com>
3238 Roberto Mariani <jelot-wireshark [AT] jelot.it>
3239 Sandhya Gopinath <Sandhya.Gopinath [AT] citrix.com>
3240 Raghav SN <Raghav.SN [AT] citrix.com>
3241 Murali Raja <Murali.Raja [AT] citrix.com>
3242 Devesh Prakash <Devesh.Prakash [AT] citrix.com>
3243 Darryl Champagne <dchampagne [AT] sta.samsung.com>
3244 Michael Speck <Michael.Speck [AT] avl.com>
3245 Gerasimos Dimitriadis <dimeg [AT] intracom.gr>
3246 Robert Simac <rsimac [AT] cronsult.com>
3247 Johanna Sochos <johanna.sochos [AT] swissqual.com>
3248 Felix Obenhuber <felix [AT] obenhuber.de>
3249 Hilko Bengen <bengen--wireshark [AT] hilluzination.de>
3250 Hadar Shoham <hadar [AT] ti.com>
3251 Robert Bullen <robert [AT] bitcricket.com>
3252 Chuck Kristofek <chuck.kristofek [AT] ngc.com>
3253 Markus Renz <Markus.Renz [AT] hirschmann.de>
3254 Toshihiro Kataoka <kataoka.toshihiro [AT] gmail.com>
3255 Petr Lautrbach <plautrba [AT] redhat.com>
3256 Frank Lahm <franklahm [AT] googlemail.com>
3257 Jon Ellch <jellch [AT] harris.com>
3258 Alex Badea <vamposdecampos [AT] gmail.com>
3259 Dirk Jagdmann <doj [AT] cubic.org>
3260 RSA <ryazanov.s.a [AT] gmail.com>
3261 Juliusz Chroboczek <jch [AT] pps.jussieu.fr>
3262 Vladimir Kazansky <vovjo [AT] yandex.ru>
3263 Peter Paluch <peter.paluch [AT] fri.uniza.sk>
3264 Tom Brezinski <tombr [AT] netinst.com>
3265 Nick Glass <nick.glass [AT] lycos.com>
3266 Michael Mann <mmann78 [AT] netscape.net>
3267 Romain Fliedel <romain.fliedel+wireshark [AT] gmail.com>
3268 Michael Chen <michaelc [AT] idssoftware.com>
3269 Paul Stath <pstath [AT] axxcelera.com>
3270 DeCount <aatrade [AT] libero.it>
3271 Andras Veres-Szentkiralyi <vsza [AT] vsza.hu>
3272 Jakob Hirsch <jh.wireshark-bugzilla [AT] plonk.de>
3273 XXXXX XXXXXXXX <DXDragon [AT] yandex.ru>
3274 <billyjeans [AT] gmail.com>
3275 Evan Huus <eapache [AT] gmail.com>
3276 Tom Cook <tcook [AT] ixiacom.com>
3277 Tom Alexander <talexander [AT] ixiacom.com>
3278 Klaus Heckelmann <klaus.heckelmann [AT] nashtech.com>
3279 Dan Lasley <dlasley[AT]promus.com> gave permission for his
3281 dumpit() hex-dump routine to be used.
3282 Mattia Cazzola <mattiac[AT]alinet.it> provided a patch to the
3284 hex dump display routine.
3285 We use the exception module from Kazlib, a C library written by
3287 Kaz Kylheku <kaz[AT]ashi.footprints.net>. Thanks go to him for
3288 his well-written library. The Kazlib home page can be found at
3289 http://users.footprints.net/~kaz/kazlib.html
3290 We use Lua BitOp, written by Mike Pall, for bitwise operations
3292 on numbers in Lua. The Lua BitOp home page can be found at
3293 http://bitop.luajit.org/
3294 Henrik Brix Andersen <brix[AT]gimp.org> gave permission for his
3296 webbrowser calling routine to be used.
3297 Christophe Devine <c.devine[AT]cr0.net> gave permission for his
3299 SHA1 routines to be used.
3300 snax <snax[AT]shmoo.com> gave permission to use his(?) weak key
3302 detection code from Airsnort.
3303 IANA gave permission for their port-numbers file to be used.
33051.8.10 2017-03-22 WIRESHARK(1)