Wireshark 1.0.0 Online Manual
- Overview
- Download
- Buy
- Screenshot
- Reviews
- Online Manual
- Publisher
- Internet
- Anti-Spam Tools
- Bookmark Manager
- Browsers
- Chat
- Communication
- Dial-up & Connectivity
- Download Manager
- File Sharing / P2P
- Firewall
- Ftp
- History Erasers
- Network Tools
- News Reader
- Offline Browser
- Online Privacy
- Other
- Ping & Trace Tools
- Popup/Ad/Spyware Blockers
- Searching Tools
- Telephony / SMS & GSM
- WebCam
66 (57%) 
50 (43%)Tips: Convert Microsoft Excel to HTML | PDF to HTML | Convert paper documents to PDF / HTML
Wireshark User's Guide
- Preface
- Introduction
- Building and Installing Wireshark
- User Interface
Introduction- Start Wireshark
- The Main window
- The Menu
- The "File" menu
- The "Edit" menu
- The "View" menu
- The "Go" menu
- The "Capture" menu
- The "Analyze" menu
- The "Statistics" menu
- The "Help" menu
- The "Main" toolbar
- The "Filter" toolbar
- The "Packet List" pane
- The "Packet Details" pane
- The "Packet Bytes" pane
The Statusbar
- Capturing Live Network Data
- File Input / Output and Printing
- Working with captured packets
- Advanced Topics
- Statistics
- Customizing Wireshark
- Lua Support in Wireshark
- Introduction
- Example of Dissector written in Lua
- Example of Listener written in Lua
- Wireshark's Lua API Reference Manual
- saving capture files
- obtaining dissection data
- GUI support
- TextWindow
- Non Method Functions
- post-dissection packet analysis
- obtaining packet information
- Address
- Column
- Columns
- Pinfo
- pinfo.number
- pinfo.len
- pinfo.caplen
- pinfo.abs_ts
- pinfo.rel_ts
- pinfo.delta_ts
- pinfo.delta_dis_ts
- pinfo.visited
- pinfo.src
- pinfo.dst
- pinfo.lo
- pinfo.hi
- pinfo.dl_src
- pinfo.dl_dst
- pinfo.net_src
- pinfo.net_dst
- pinfo.ptype
- pinfo.src_port
- pinfo.dst_port
- pinfo.ipproto
- pinfo.circuit_id
- pinfo.match
- pinfo.curr_proto
- pinfo.columns
- pinfo.cols
- functions for writing dissectors
- Dissector
- DissectorTable
- Pref
- Prefs
- Proto
- ProtoField
- ProtoField.new(name, abbr, type, [valuestring], [base], [mask], [descr])
- ProtoField.uint8(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint16(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint24(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint32(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint64(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int8(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int16(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int24(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int32(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int64(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.framenum(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.ipv4(abbr, [name], [desc])
- ProtoField.ipv6(abbr, [name], [desc])
- ProtoField.ether(abbr, [name], [desc])
- ProtoField.float(abbr, [name], [desc])
- ProtoField.double(abbr, [name], [desc])
- ProtoField.string(abbr, [name], [desc])
- ProtoField.strigz(abbr, [name], [desc])
- ProtoField.bytes(abbr, [name], [desc])
- ProtoField.ubytes(abbr, [name], [desc])
- ProtoField.guid(abbr, [name], [desc])
- ProtoField.oid(abbr, [name], [desc])
- ProtoField.bool(abbr, [name], [desc])
- Non Method Functions
- adding information to the dissection tree
- functions for handling packet data
- ByteArray
- Tvb
- TvbRange
- Utility Functions
- Files and Folders
- Protocols and Protocol Fields
- Wireshark Messages
- Related command line tools
- Introduction
- tshark: Terminal-based Wireshark
- tcpdump: Capturing with tcpdump for viewing with Wireshark
- dumpcap: Capturing with dumpcap for viewing with Wireshark
- capinfos: Print information about capture files
- editcap: Edit capture files
- mergecap: Merging multiple capture files into one
- text2pcap: Converting ASCII hexdumps to network captures
- idl2wrs: Creating dissectors from CORBA IDL files
- This Document's License (GPL)
Use the following general steps if you are building Wireshark from source under a UNIX operating system:
Unpack the source from its gzip'd tar file. If you are using Linux, or your version of UNIX uses GNU tar, you can use the following command:
tar zxvf wireshark-0.99.7-tar.gz
For other versions of UNIX, you will want to use the following commands:
gzip -d wireshark-0.99.7-tar.gz tar xvf wireshark-0.99.7-tar
![[Note]](wsug_graphics/note.png)
Note! The pipeline gzip -dc wireshark-0.99.7-tar.gz | tar xvf - will work here as well.
Note! If you have downloaded the Wireshark tarball under Windows, you may find that your browser has created a file with underscores rather than periods in its file name.
Change directory to the Wireshark source directory.
Configure your source so it will build correctly for your version of UNIX. You can do this with the following command:
./configure
If this step fails, you will have to rectify the problems and rerun configure. Troubleshooting hints are provided in Section 2.6, “Troubleshooting during the install on Unix”.
Build the sources into a binary, with the make command. For example:
make
Install the software in its final destination, using the command:
make install
Once you have installed Wireshark with make install above, you should be able to run it by entering wireshark.