Wireshark 1.0.0 Online Manual
- Overview
- Download
- Buy
- Screenshot
- Reviews
- Online Manual
- Publisher
- Internet
- Anti-Spam Tools
- Bookmark Manager
- Browsers
- Chat
- Communication
- Dial-up & Connectivity
- Download Manager
- File Sharing / P2P
- Firewall
- Ftp
- History Erasers
- Network Tools
- News Reader
- Offline Browser
- Online Privacy
- Other
- Ping & Trace Tools
- Popup/Ad/Spyware Blockers
- Searching Tools
- Telephony / SMS & GSM
- WebCam
A free network protocol analyzer for Windows and Unix
62 (57%) 
47 (43%)Tips: Convert Microsoft Excel to HTML | PDF to HTML | Convert paper documents to PDF / HTML
Wireshark User's Guide
- Preface
- Introduction
- Building and Installing Wireshark
- User Interface
Introduction- Start Wireshark
- The Main window
- The Menu
- The "File" menu
- The "Edit" menu
- The "View" menu
- The "Go" menu
- The "Capture" menu
- The "Analyze" menu
- The "Statistics" menu
- The "Help" menu
- The "Main" toolbar
- The "Filter" toolbar
- The "Packet List" pane
- The "Packet Details" pane
- The "Packet Bytes" pane
The Statusbar
- Capturing Live Network Data
- File Input / Output and Printing
- Working with captured packets
- Advanced Topics
- Statistics
- Customizing Wireshark
- Lua Support in Wireshark
- Introduction
- Example of Dissector written in Lua
- Example of Listener written in Lua
- Wireshark's Lua API Reference Manual
- saving capture files
- obtaining dissection data
- GUI support
- TextWindow
- Non Method Functions
- post-dissection packet analysis
- obtaining packet information
- Address
- Column
- Columns
- Pinfo
- pinfo.number
- pinfo.len
- pinfo.caplen
- pinfo.abs_ts
- pinfo.rel_ts
- pinfo.delta_ts
- pinfo.delta_dis_ts
- pinfo.visited
- pinfo.src
- pinfo.dst
- pinfo.lo
- pinfo.hi
- pinfo.dl_src
- pinfo.dl_dst
- pinfo.net_src
- pinfo.net_dst
- pinfo.ptype
- pinfo.src_port
- pinfo.dst_port
- pinfo.ipproto
- pinfo.circuit_id
- pinfo.match
- pinfo.curr_proto
- pinfo.columns
- pinfo.cols
- functions for writing dissectors
- Dissector
- DissectorTable
- Pref
- Prefs
- Proto
- ProtoField
- ProtoField.new(name, abbr, type, [valuestring], [base], [mask], [descr])
- ProtoField.uint8(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint16(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint24(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint32(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.uint64(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int8(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int16(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int24(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int32(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.int64(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.framenum(abbr, [name], [base], [valuestring], [mask], [desc])
- ProtoField.ipv4(abbr, [name], [desc])
- ProtoField.ipv6(abbr, [name], [desc])
- ProtoField.ether(abbr, [name], [desc])
- ProtoField.float(abbr, [name], [desc])
- ProtoField.double(abbr, [name], [desc])
- ProtoField.string(abbr, [name], [desc])
- ProtoField.strigz(abbr, [name], [desc])
- ProtoField.bytes(abbr, [name], [desc])
- ProtoField.ubytes(abbr, [name], [desc])
- ProtoField.guid(abbr, [name], [desc])
- ProtoField.oid(abbr, [name], [desc])
- ProtoField.bool(abbr, [name], [desc])
- Non Method Functions
- adding information to the dissection tree
- functions for handling packet data
- ByteArray
- Tvb
- TvbRange
- Utility Functions
- Files and Folders
- Protocols and Protocol Fields
- Wireshark Messages
- Related command line tools
- Introduction
- tshark: Terminal-based Wireshark
- tcpdump: Capturing with tcpdump for viewing with Wireshark
- dumpcap: Capturing with dumpcap for viewing with Wireshark
- capinfos: Print information about capture files
- editcap: Edit capture files
- mergecap: Merging multiple capture files into one
- text2pcap: Converting ASCII hexdumps to network captures
- idl2wrs: Creating dissectors from CORBA IDL files
- This Document's License (GPL)
24665 for Wireshark 0.99.7
Copyright © 2004-2008 Ulf Lamping , Richard Sharpe , Ed Warnicke
Table of Contents
- Preface
- 1. Introduction
- 2. Building and Installing Wireshark
- 2.1. Introduction
- 2.2. Obtaining the source and binary distributions
- 2.3. Before you build Wireshark under UNIX
- 2.4. Building Wireshark from source under UNIX
- 2.5. Installing the binaries under UNIX
- 2.6. Troubleshooting during the install on Unix
- 2.7. Building from source under Windows
- 2.8. Installing Wireshark under Windows
- 3. User Interface
- 3.1. Introduction
- 3.2. Start Wireshark
- 3.3. The Main window
- 3.4. The Menu
- 3.5. The "File" menu
- 3.6. The "Edit" menu
- 3.7. The "View" menu
- 3.8. The "Go" menu
- 3.9. The "Capture" menu
- 3.10. The "Analyze" menu
- 3.11. The "Statistics" menu
- 3.12. The "Help" menu
- 3.13. The "Main" toolbar
- 3.14. The "Filter" toolbar
- 3.15. The "Packet List" pane
- 3.16. The "Packet Details" pane
- 3.17. The "Packet Bytes" pane
- 3.18. The Statusbar
- 4. Capturing Live Network Data
- 5. File Input / Output and Printing
- 5.1. Introduction
- 5.2. Open capture files
- 5.3. Saving captured packets
- 5.4. Merging capture files
- 5.5. File Sets
- 5.6. Exporting data
- 5.6.1. The "Export as Plain Text File" dialog box
- 5.6.2. The "Export as PostScript File" dialog box
- 5.6.3. The "Export as CSV (Comma Separated Values) File" dialog box
- 5.6.4. The "Export as PSML File" dialog box
- 5.6.5. The "Export as PDML File" dialog box
- 5.6.6. The "Export selected packet bytes" dialog box
- 5.6.7. The "Export Objects" dialog box
- 5.7. Printing packets
- 5.8. The Packet Range frame
- 5.9. The Packet Format frame
- 6. Working with captured packets
- 6.1. Viewing packets you have captured
- 6.2. Pop-up menus
- 6.3. Filtering packets while viewing
- 6.4. Building display filter expressions
- 6.5. The "Filter Expression" dialog box
- 6.6. Defining and saving filters
- 6.7. Finding packets
- 6.8. Go to a specific packet
- 6.9. Marking packets
- 6.10. Time display formats and time references
- 7. Advanced Topics
- 8. Statistics
- 9. Customizing Wireshark
- 9.1. Introduction
- 9.2. Start Wireshark from the command line
- 9.3. Packet colorization
- 9.4. Control Protocol dissection
- 9.5. Preferences
- 9.6. Configuration Profiles
- 9.7. User Table
- 9.8. Display Filter Macros
- 9.9. Tektronix K12xx/15 RF5 protocols Table
- 9.10. User DLTs protocol table
- 9.11. SNMP users Table
- 9.12. SCCP users Table
- 10. Lua Support in Wireshark
- 10.1. Introduction
- 10.2. Example of Dissector written in Lua
- 10.3. Example of Listener written in Lua
- 10.4. Wireshark's Lua API Reference Manual
- 10.4.1. saving capture files
- 10.4.2. obtaining dissection data
- 10.4.3. GUI support
- 10.4.4. post-dissection packet analysis
- 10.4.5. obtaining packet information
- 10.4.6. functions for writing dissectors
- 10.4.7. adding information to the dissection tree
- 10.4.8. functions for handling packet data
- 10.4.9. Utility Functions
- A. Files and Folders
- B. Protocols and Protocol Fields
- C. Wireshark Messages
- D. Related command line tools
- D.1. Introduction
- D.2. tshark: Terminal-based Wireshark
- D.3. tcpdump: Capturing with tcpdump for viewing with Wireshark
- D.4. dumpcap: Capturing with dumpcap for viewing with Wireshark
- D.5. capinfos: Print information about capture files
- D.6. editcap: Edit capture files
- D.7. mergecap: Merging multiple capture files into one
- D.8. text2pcap: Converting ASCII hexdumps to network captures
- D.9. idl2wrs: Creating dissectors from CORBA IDL files
- E. This Document's License (GPL)
List of Figures
- 1.1. Wireshark captures packets and allows you to examine their content.
- 3.1. The Main window
- 3.2. The Menu
- 3.3. The "File" Menu
- 3.4. The "Edit" Menu
- 3.5. The "View" Menu
- 3.6. The "Go" Menu
- 3.7. The "Capture" Menu
- 3.8. The "Analyze" Menu
- 3.9. The "Statistics" Menu
- 3.10. The "Help" Menu
- 3.11. The "Main" toolbar
- 3.12. The "Filter" toolbar
- 3.13. The "Packet List" pane
- 3.14. The "Packet Details" pane
- 3.15. The "Packet Bytes" pane
- 3.16. The "Packet Bytes" pane with tabs
- 3.17. The initial Statusbar
- 3.18. The Statusbar with a loaded capture file
- 3.19. The Statusbar with a selected protocol field
- 4.1. The "Capture Interfaces" dialog box
- 4.2. The "Capture Options" dialog box
- 4.3. The "Capture Info" dialog box
- 5.1. "Open" on native Windows
- 5.2. "Open" - new GTK version
- 5.3. "Open" - old GTK version
- 5.4. "Save" on native Windows
- 5.5. "Save" - new GTK version
- 5.6. "Save" - old GTK version
- 5.7. "Merge" on native Windows
- 5.8. "Merge" - new GTK version
- 5.9. "Merge" - old GTK version
- 5.10. The "List Files" dialog box
- 5.11. The "Export as Plain Text File" dialog box
- 5.12. The "Export as PostScript File" dialog box
- 5.13. The "Export as PSML File" dialog box
- 5.14. The "Export as PDML File" dialog box
- 5.15. The "Export Selected Packet Bytes" dialog box
- 5.16. The "Export Objects" dialog box
- 5.17. The "Print" dialog box
- 5.18. The "Packet Range" frame
- 5.19. The "Packet Format" frame
- 6.1. Wireshark with a TCP packet selected for viewing
- 6.2. Viewing a packet in a separate window
- 6.3. Pop-up menu of the "Packet List" pane
- 6.4. Pop-up menu of the "Packet Details" pane
- 6.5. Filtering on the TCP protocol
- 6.6. The "Filter Expression" dialog box
- 6.7. The "Capture Filters" and "Display Filters" dialog boxes
- 6.8. The "Find Packet" dialog box
- 6.9. The "Go To Packet" dialog box
- 6.10. Wireshark showing a time referenced packet
- 7.1. The "Follow TCP Stream" dialog box
- 7.2. The "Packet Bytes" pane with a reassembled tab
- 8.1. The "Summary" window
- 8.2. The "Protocol Hierarchy" window
- 8.3. The "Conversations" window
- 8.4. The "Endpoints" window
- 8.5. The "IO Graphs" window
- 8.6. The "WLAN Traffic Statistics" window
- 8.7. The "Compute DCE-RPC statistics" window
- 8.8. The "DCE-RPC Statistic for ..." window
- 9.1. The "Coloring Rules" dialog box
- 9.2. The "Edit Color Filter" dialog box
- 9.3. The "Choose color" dialog box
- 9.4. Using color filters with Wireshark
- 9.5. The "Enabled Protocols" dialog box
- 9.6. The "Decode As" dialog box
- 9.7. The "Decode As: Show" dialog box
- 9.8. The preferences dialog box
- 9.9. The configuration profiles dialog box
List of Tables
- 3.1. Keyboard Navigation
- 3.2. File menu items
- 3.3. Edit menu items
- 3.4. View menu items
- 3.5. Go menu items
- 3.6. Capture menu items
- 3.7. Analyze menu items
- 3.8. Statistics menu items
- 3.9. Help menu items
- 3.10. Main toolbar items
- 3.11. Filter toolbar items
- 4.1. Capture file mode selected by capture options
- 5.1. The system specific "Open Capture File" dialog box
- 5.2. The system specific "Save Capture File As" dialog box
- 5.3. The system specific "Merge Capture File As" dialog box
- 6.1. The menu items of the "Packet List" pop-up menu
- 6.2. The menu items of the "Packet Details" pop-up menu
- 6.3. Display Filter comparison operators
- 6.4. Display Filter Field Types
- 6.5. Display Filter Logical Operations
- 7.1. Some example expert infos
- 7.2. Time zone examples for UTC arrival times (without DST)
- A.1. Configuration files and folders overview
List of Examples
- 2.1. Building GTK+ from source
- 2.2. Building and installing libpcap
- 2.3. Installing required RPMs under Red Hat Linux 6.2 and beyond
- 2.4. Installing debs under Debian
- 4.1. A capture filter for telnet that captures traffic to and from a particular host
- 4.2. Capturing all telnet traffic not from 10.0.0.5
- 9.1. Help information available from Wireshark
- D.1. Help information available from dumpcap
- D.2. Help information available from capinfos
- D.3. Help information available from editcap
- D.4. Help information available from mergecap
- D.5. Simple example of using mergecap
- D.6. Help information available for text2pcap