Wireshark 1.0.0 Online Manual
- Overview
- Download
- Buy
- Screenshot
- Reviews
- Online Manual
- Publisher
- Internet
- Anti-Spam Tools
- Bookmark Manager
- Browsers
- Chat
- Communication
- Dial-up & Connectivity
- Download Manager
- File Sharing / P2P
- Firewall
- Ftp
- History Erasers
- Network Tools
- News Reader
- Offline Browser
- Online Privacy
- Other
- Ping & Trace Tools
- Popup/Ad/Spyware Blockers
- Searching Tools
- Telephony / SMS & GSM
- WebCam
A free network protocol analyzer for Windows and Unix
68 (57%) 
52 (43%)Tips: Convert Microsoft Excel to HTML | PDF to HTML | Convert paper documents to PDF / HTML
Wireshark User's Guide
- Preface
- Introduction
- Building and Installing Wireshark
- User Interface
Introduction- Start Wireshark
- The Main window
- The Menu
- The "File" menu
- The "Edit" menu
- The "View" menu
- The "Go" menu
- The "Capture" menu
- The "Analyze" menu
- The "Statistics" menu
- The "Help" menu
- The "Main" toolbar
- The "Filter" toolbar
- The "Packet List" pane
- The "Packet Details" pane
- The "Packet Bytes" pane
The Statusbar
- Capturing Live Network Data
- File Input / Output and Printing
- Working with captured packets
- Advanced Topics
- Statistics
- Customizing Wireshark
- Lua Support in Wireshark
- Introduction
- Example of Dissector written in Lua
- Example of Listener written in Lua
- Wireshark's Lua API Reference Manual
- saving capture files
- obtaining dissection data
- GUI support
- TextWindow
- Non Method Functions
- post-dissection packet analysis
- obtaining packet information
- Address
- Column
- Columns
- Pinfo
- pinfo.number
- pinfo.len
- pinfo.caplen
- pinfo.abs_ts
- pinfo.rel_ts
- pinfo.delta_ts
- pinfo.delta_dis_ts
- pinfo.visited
- pinfo.src
- pinfo.dst
- pinfo.lo
- pinfo.hi
- pinfo.dl_src
- pinfo.dl_dst
- pinfo.net_src
- pinfo.net_dst
- pinfo.ptype
- pinfo.src_port
- pinfo.dst_port
- pinfo.ipproto
- pinfo.circuit_id
- pinfo.match
- pinfo.curr_proto
- pinfo.columns
- pinfo.cols
- functions for writing dissectors
- Dissector
- DissectorTable
- Pref
- Prefs
- Proto
- ProtoField
- ProtoField.new(name, abbr, type, [valuestring], [base], [mask], [descr])
- ProtoField.uint8(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint16(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint24(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint32(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint64(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int8(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int16(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int24(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int32(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int64(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.framenum(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.ipv4(abbr, [name], [desc])
- ProtoField.ipv6(abbr, [name], [desc])
- ProtoField.ether(abbr, [name], [desc])
- ProtoField.float(abbr, [name], [desc])
- ProtoField.double(abbr, [name], [desc])
- ProtoField.string(abbr, [name], [desc])
- ProtoField.strigz(abbr, [name], [desc])
- ProtoField.bytes(abbr, [name], [desc])
- ProtoField.ubytes(abbr, [name], [desc])
- ProtoField.guid(abbr, [name], [desc])
- ProtoField.oid(abbr, [name], [desc])
- ProtoField.bool(abbr, [name], [desc])
- Non Method Functions
- adding information to the dissection tree
- functions for handling packet data
- ByteArray
- Tvb
- TvbRange
- Utility Functions
- Files and Folders
- Protocols and Protocol Fields
- Wireshark Messages
- Related command line tools
- Introduction
- tshark: Terminal-based Wireshark
- tcpdump: Capturing with tcpdump for viewing with Wireshark
- dumpcap: Capturing with dumpcap for viewing with Wireshark
- capinfos: Print information about capture files
- editcap: Edit capture files
- mergecap: Merging multiple capture files into one
- text2pcap: Converting ASCII hexdumps to network captures
- idl2wrs: Creating dissectors from CORBA IDL files
- This Document's License (GPL)
You can get the latest copy of the program from the Wireshark website: http://www.wireshark.org/download.html. The website allows you to choose from among several mirrors for downloading.
A new Wireshark version will typically become available every 4-8 months.
If you want to be notified about new Wireshark releases, you should subscribe to the wireshark-announce mailing list. You will find more details in Section 1.6.4, “Mailing Lists”.