Tethereal - Dump and analyze network traffic
SYNOPSYS
tethereal [ -c count ] [ -D ]
[ -f capture filter expression ] [ -F file format ] [ -h ]
[ -i interface ] [ -l ] [ -n ]
[ -o preference setting ] ... [ -p ] [ -r infile ]
[ -R display filter expression ] [ -s snaplen ]
[ -t time stamp format ] [ -v ] [ -V ] [ -w savefile ]
[ -x ] [ filter expression ]
DESCRIPTION
Tethereal is a network protocol analyzer. It lets you
capture packet data from a live network, or read packets
from a previously saved capture file, either printing a
decoded form of those packets to the standard output or
writing the packets to a file. Tethereal knows how to
read libpcap capture files, including those of tcpdump.
In addition, Tethereal can read capture files from snoop
(including Shomiti) and atmsnoop, LanAlyzer, Sniffer (com
pressed or uncompressed), Microsoft Network Monitor, AIX's
iptrace, NetXray, Sniffer Pro, Etherpeek, RADCOM's WAN/LAN
analyzer, Lucent/Ascend router debug output, HP-UX's
nettl, the dump output from Toshiba's ISDN routers, the
output from i4btrace from the ISDN4BSD project, and output
in IPLog format from the Cisco Secure Intrusion Detection
System. There is no need to tell Tethereal what type of
file you are reading; it will determine the file type by
itself. Tethereal is also capable of reading any of these
file formats if they are compressed using gzip. Tethereal
recognizes this directly from the file; the '.gz' exten
sion is not required for this purpose.
If the -w flag is not specified, Tethereal prints a
decoded form of the packets it captures or reads; other
wise, it writes those packets to the file specified by
that flag.
When printing a decoded form of packets, Tethereal prints,
by default, a summary line containing the fields specified
by the preferences file (which are also the fields dis
played in the packet list pane in Ethereal), although if
it's printing packets as it captures them, rather than
printing packets from a saved capture file, it won't print
the "frame number" field. If the -V flag is specified, it
prints intead a protocol tree, showing all the fields of
all protocols in the packet.
When writing packets to a file, Tethereal, by default,
writes the file in libpcap format, and writes all of the
packets it sees to the output file. The -F flag can be
used to specify the format in which to write the file; it
can write the file in libpcap format (standard libpcap
libpcap, or the format used by Red Hat Linux 6.1), snoop
format, uncompressed Sniffer format, Microsoft Network
Monitor 1.x format, and the format used by Windows-based
versions of the Sniffer software.
Read filters in Tethereal, which allow you to select which
packets are to be decoded or written to a file, are very
powerful; more fields are filterable in Tethereal than in
other protocol analyzers, and the syntax you can use to
create your filters is richer. As Tethereal progresses,
expect more and more protocol fields to be allowed in read
filters.
Packet capturing is performed with the pcap library. The
capture filter syntax follows the rules of the pcap
library. This syntax is different from the read filter
syntax. A read filter can also be specified when captur
ing, and only packets that pass the read filter will be
displayed or saved to the output file; note, however, that
capture filers are much more efficient than read filters,
and it may be more difficult for Tethereal to keep up with
a busy network if a read filter is specified for a live
capture.
Compressed file support uses (and therefore requires) the
zlib library. If the zlib library is not present, Tethe
real will compile, but will be unable to read compressed
files.
A capture or read filter can either be specified with the
-f or -R option, respectively, in which case the entire
filter expression must be specified as a single argument
(which means that if it contains spaces, it must be
quoted), or can be specified with command-line arguments
after the option arguments, in which case all the argu
ments after the filter arguments are treated as a filter
expression. If the filter is specified with command-line
arguments after the option arguments, it's a capture fil
ter if a capture is being done (i.e., if no -r flag was
specified) and a read filter if a capture file is being
read (i.e., if a -r flag was specified).
OPTIONS
-c Sets the default number of packets to read when cap
turing live data.
-D Prints a list of the interfaces on which Tethereal can
capture, and exits. Note that "can capture" means
that Tethereal was able to open that device to do a
live capture; if, on your system, a program doing a
network capture must be run from an account with spe
cial privileges (for example, as root), then, if Teth
ereal is run with the -D flag and is not run from such
-f Sets the capture filter expression.
-F Sets the file format of the output capture file.
-h Prints the version and options and exits.
-i Sets the name of the network interface to use for live
packet capture. It should match one of the names
listed in "netstat -i" or "ifconfig -a". If no inter
face is specified, Tethereal searches the list of
interfaces, choosing the first non-loopback interface
if there are any non-loopback interfaces, and choosing
the first loopback interface if there are no non-loop
back interfaces; if there are no interfaces, Tethereal
reports an error and doesn't start the capture.
-l Flush the standard output after the information for
each packet is printed. (This is not, strictly speak
ing, line-buffered if -V was specified; however, it is
the same as line-buffered if -V wasn't specified, as
only one line is printed for each packet, and, as -l
is normally used when piping a live capture to a pro
gram or script, so that output for a packet shows up
as soon as the packet is seen and dissected, it should
work just as well as true line-buffering. We do this
as a workaround for a deficiency in the Microsoft
Visual C++ C library.)
This may be useful when piping the output of Tethereal
to another program, as it means that the program to
which the output is piped will see the dissected data
for a packet as soon as Tethereal sees the packet and
generates that output, rather than seeing it only when
the standard output buffer containing that data fills
up.
-n Disables network object name resolution (such as host
name, TCP and UDP port names).
-o Sets a preference value, overriding the default value
and any value read from a preference file. The argu
ment to the flag is a string of the form pref
name:value, where prefname is the name of the prefer
ence (which is the same name that would appear in the
preference file), and value is the value to which it
should be set.
-p Don't put the interface into promiscuous mode. Note
that the interface might be in promiscuous mode for
some other reason; hence, -p cannot be used to ensure
that the only traffic that is captured is traffic sent
to or from the machine on which Tethereal is running,
received by that machine.
-r Reads packet data from file.
-R Causes the specified filter (which uses the syntax of
read filters, rather than that of capture filters) to
be applied before printing a decoded form of packets
or writing packets to a file; packets not matching the
filter are discarded rather than being printed or
written.
-s Sets the default snapshot length to use when capturing
live data. No more than snaplen bytes of each network
packet will be read into memory, or saved to disk.
-t Sets the format of the packet timestamp printed in
summary lines. The format can be one of 'r' (rela
tive), 'a' (absolute), 'ad' (absolute with date), or
'd' (delta). The relative time is the time elapsed
between the first packet and the current packet. The
absolute time is the actual time the packet was cap
tured, with no date displayed; the absolute date and
time is the actual time and date the packet was cap
tured. The delta time is the time since the previous
packet was captured. The default is relative.
-v Prints the version and exits.
-V Causes Tethereal to print a protocol tree for each
packet rather than a one-line summary of the packet.
-w Writes packet data to savefile.
-x Causes Tethereal to print a hex and ASCII dump of the
packet data after printing the summary or protocol
tree.
CAPTURE FILTER SYNTAX
See manual page of tcpdump(8).
READ FILTER SYNTAX
Read filters help you remove the noise from a packet trace
and let you see only the packets that interest you. If a
packet meets the requirements expressed in your read fil
ter, then it is printed. Read filters let you compare the
fields within a protocol against a specific value, compare
fields against fields, and to check the existence of spec
ified fields or protocols.
The simplest read filter allows you to check for the exis
tence of a protocol or field. If you want to see all
packets which contain the IPX protocol, the filter would
be "ipx". (Without the quotation marks) To see all
Fields can also be compared against values. The compari
son operators can be expressed either through C-like sym
bols, or through English-like abbreviations:
eq, == Equal
ne, != Not equal
gt, > Greater than
lt, < Less Than
ge, >= Greater than or Equal to
le, <= Less than or Equal to
Furthermore, each protocol field is typed. The types are:
Unsigned integer (either 8-bit, 16-bit, 24-bit, or 32-bit)
Signed integer (either 8-bit, 16-bit, 24-bit, or 32-bit)
Boolean
Ethernet address (6 bytes)
Byte string (n-number of bytes)
IPv4 address
IPv6 address
IPX network number
String (text)
Double-precision floating point number
An integer may be expressed in decimal, octal, or hexadec
imal notation. The following three read filters are
equivalent:
frame.pkt_len > 10
frame.pkt_len > 012
frame.pkt_len > 0xa
Boolean values are either true or false. In a read filter
expression testing the value of a Boolean field, "true" is
expressed as 1 or any other non-zero value, and "false" is
expressed as zero. For example, a token-ring packet's
source route field is boolean. To find any source-routed
packets, a read filter would be:
tr.sr == 1
Non source-routed packets can be found with:
tr.sr == 0
Ethernet addresses, as well as a string of bytes, are rep
resented in hex digits. The hex digits may be separated
by colons, periods, or hyphens:
fddi.dst eq ff:ff:ff:ff:ff:ff
ipx.srcnode == 0.0.0.0.0.1
eth.src == aa-aa-aa-aa-aa-aa
represented as an unsigned integer. That is, if you are
testing for hex value 'ff' in a one-byte byte-string, you
must compare it agains '0xff' and not 'ff'.
IPv4 addresses can be represented in either dotted decimal
notation, or by using the hostname:
ip.dst eq www.mit.edu
ip.src == 192.168.1.1
IPv4 address can be compared with the same logical rela
tions as numbers: eq, ne, gt, ge, lt, and le. The IPv4
address is stored in host order, so you do not have to
worry about how the endianness of an IPv4 address when
using it in a read filter.
IPX networks are represented by unsigned 32-bit integers.
Most likely you will be using hexadecimal when testing for
IPX network values:
ipx.srcnet == 0xc0a82c00
A slice operator also exists. You can check the substring
(byte-string) of any protocol or field. For example, you
can filter on the vendor portion of an ethernet address
(the first three bytes) like this:
eth.src[0:3] == 00:00:83
If the length of your byte-slice is only one byte, then it
is still represented in hex, but without the preceding
"0x":
llc[3] == aa
You can use the slice operator on a protocol name, too.
And remember, the "frame" protocol encompasses the entire
packet, allowing you to look at the nth byte of a packet
regardless of its frame type (Ethernet, token-ring, etc.).
token[0:5] ne 0.0.0.1.1
ipx[0:2] == ff:ff
llc[3:1] eq 0xaa
The following syntax governs slices:
[i:j] i = start_offset, j = length
[i-j] i = start_offet, j = end_offset, inclusive.
[i] i = start_offset, length = 1
[:j] start_offset = 0, length = j
[i:] start_offset = i, end_offset = end_of_field
Offsets and lengths can be negative, in which case they
how to check the last 4 bytes of a frame:
frame[-4:4] == 0.1.2.3
or
frame[-4:] == 0.1.2.3
You can create complex concatenations of slices using the
comma operator:
field[1,3-5,9:] == 01:03:04:05:09:0a:0b
All the above tests can be combined together with logical
expressions. These too are expressable in C-like syntax
or with English-like abbreviations:
and, && Logical AND
or, || Logical OR
not, ! Logical NOT
Expressions can be grouped by parentheses as well. The
following are all valid read filter expression:
tcp.port == 80 and ip.src == 192.168.2.1
not llc
(ipx.srcnet == 0xbad && ipx.srnode == 0.0.0.0.0.1) || ip
tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29
A special caveat must be given regarding fields that occur
more than once per packet. "ip.addr" occurs twice per IP
packet, once for the source address, and once for the des
tination address. Likewise, tr.rif.ring fields can occur
more than once per packet. The following two expressions
are not equivalent:
ip.addr ne 192.168.4.1
not ip.addr eq 192.168.4.1
The first filter says "show me all packets where an
ip.addr exists that does not equal 192.168.4.1". That is,
as long as one ip.addr in the packet does not equal
192.168.44.1, the packet passes the display filter. The
second filter "don't show me any packets that have at
least one ip.addr field equal to 192.168.4.1". If one
ip.addr is 192.168.4.1, the packet does not pass. If nei
ther ip.addr fields is 192.168.4.1, then the packet
passes.
It is easy to think of the 'ne' and 'eq' operators as hav
ing an implict "exists" modifier when dealing with multi
ply-recurring fields. "ip.addr ne 192.168.4.1" can be
thought of as "there exists an ip.addr that does not equal
192.168.4.1".
confusing.
The following is a table of protocol and protocol fields
that are filterable in Tethereal. The abbreviation of the
protocol or field is given. This abbreviation is what you
use in the read filter. The type of the field is also
given.
802.1q Virtual LAN (vlan)
vlan.cfi CFI
Unsigned 16-bit integer
vlan.etype Type
Unsigned 16-bit integer
vlan.id ID
Unsigned 16-bit integer
vlan.len Length
Unsigned 16-bit integer
vlan.priority Priority
Unsigned 16-bit integer
vlan.trailer Trailer
Byte array
AOL Instant Messenger (aim)
aim.channel Channel ID
Unsigned 8-bit integer
aim.cmd_start Command Start
Unsigned 8-bit integer
aim.datalen Data Field Length
Unsigned 16-bit integer
aim.fnac.family FNAC Family ID
Unsigned 16-bit integer
aim.fnac.subtype FNAC Subtype ID
Unsigned 16-bit integer
aim.seqno Sequence Number
Unsigned 16-bit integer
atm.vci VCI
Unsigned 16-bit integer
atm.vpi VPI
Unsigned 8-bit integer
ATM LAN Emulation (lane)
Address Resolution Protocol (arp)
arp.dst.atm_num_e164 Target ATM number (E.164)
String
arp.dst.atm_num_nsap Target ATM number (NSAP)
Byte array
arp.dst.atm_subaddr Target ATM subaddress
Byte array
arp.dst.hlen Target ATM number length
Unsigned 8-bit integer
arp.dst.htype Target ATM number type
Boolean
arp.dst.hw Target hardware address
Byte array
arp.dst.pln Target protocol size
Unsigned 8-bit integer
arp.dst.proto Target protocol address
Byte array
arp.dst.slen Target ATM subaddress length
Unsigned 8-bit integer
arp.dst.stype Target ATM subaddress type
Boolean
arp.hw.size Hardware size
Unsigned 8-bit integer
arp.hw.type Hardware type
Unsigned 16-bit integer
arp.opcode Opcode
Unsigned 16-bit integer
Unsigned 8-bit integer
arp.proto.type Protocol type
Unsigned 16-bit integer
arp.src.atm_num_e164 Sender ATM number (E.164)
String
arp.src.atm_num_nsap Sender ATM number (NSAP)
Byte array
arp.src.atm_subaddr Sender ATM subaddress
Byte array
arp.src.hlen Sender ATM number length
Unsigned 8-bit integer
arp.src.htype Sender ATM number type
Boolean
arp.src.hw Sender hardware address
Byte array
arp.src.pln Sender protocol size
Unsigned 8-bit integer
arp.src.proto Sender protocol address
Byte array
arp.src.slen Sender ATM subaddress length
Unsigned 8-bit integer
arp.src.stype Sender ATM subaddress type
Boolean
Andrew File System (AFS) (afs)
afs.backup Backup
Boolean
afs.backup.errcode Error Code
Unsigned 32-bit integer
afs.backup.opcode Operation
Unsigned 32-bit integer
afs.bos BOS
Boolean
afs.bos.baktime Backup Time
Date/Time stamp
String
afs.bos.cmd Command
String
afs.bos.content Content
String
afs.bos.data Data
Byte array
afs.bos.date Date
Unsigned 32-bit integer
afs.bos.errcode Error Code
Unsigned 32-bit integer
afs.bos.error Error
String
afs.bos.file File
String
afs.bos.flags Flags
Unsigned 32-bit integer
afs.bos.host Host
String
afs.bos.instance Instance
String
afs.bos.key Key
Byte array
afs.bos.keychecksum Key Checksum
Unsigned 32-bit integer
afs.bos.keymodtime Key Modification Time
Date/Time stamp
afs.bos.keyspare2 Key Spare 2
Unsigned 32-bit integer
afs.bos.kvno Key Version Number
Unsigned 32-bit integer
afs.bos.newtime New Time
Date/Time stamp
afs.bos.number Number
Unsigned 32-bit integer
Date/Time stamp
afs.bos.opcode Operation
Unsigned 32-bit integer
afs.bos.parm Parm
String
afs.bos.path Path
String
afs.bos.size Size
Unsigned 32-bit integer
afs.bos.spare1 Spare1
String
afs.bos.spare2 Spare2
String
afs.bos.spare3 Spare3
String
afs.bos.status Status
Signed 32-bit integer
afs.bos.statusdesc Status Description
String
afs.bos.type Type
String
afs.bos.user User
String
afs.cb Callback
Boolean
afs.cb.callback.expires Expires
Date/Time stamp
afs.cb.callback.type Type
Unsigned 32-bit integer
afs.cb.callback.version Version
Unsigned 32-bit integer
afs.cb.errcode Error Code
Unsigned 32-bit integer
afs.cb.fid.uniq FileID (Uniqifier)
Unsigned 32-bit integer
Unsigned 32-bit integer
afs.cb.fid.volume FileID (Volume)
Unsigned 32-bit integer
afs.cb.opcode Operation
Unsigned 32-bit integer
afs.error Error
Boolean
afs.error.opcode Operation
Unsigned 32-bit integer
afs.fs File Server
Boolean
afs.fs.acl.a _A_dminister
Unsigned 8-bit integer
afs.fs.acl.count.negative ACL Count (Negative)
Unsigned 32-bit integer
afs.fs.acl.count.positive ACL Count (Positive)
Unsigned 32-bit integer
afs.fs.acl.d _D_elete
Unsigned 8-bit integer
afs.fs.acl.datasize ACL Size
Unsigned 32-bit integer
afs.fs.acl.entity Entity (User/Group)
String
afs.fs.acl.i _I_nsert
Unsigned 8-bit integer
afs.fs.acl.k _L_ock
Unsigned 8-bit integer
afs.fs.acl.l _L_ookup
Unsigned 8-bit integer
afs.fs.acl.r _R_ead
Unsigned 8-bit integer
afs.fs.acl.w _W_rite
Unsigned 8-bit integer
afs.fs.callback.expires Expires
Date/Time stamp
Unsigned 32-bit integer
afs.fs.callback.version Version
Unsigned 32-bit integer
afs.fs.cps.spare1 CPS Spare1
Unsigned 32-bit integer
afs.fs.cps.spare2 CPS Spare2
Unsigned 32-bit integer
afs.fs.cps.spare3 CPS Spare3
Unsigned 32-bit integer
afs.fs.data Data
Byte array
afs.fs.errcode Error Code
Unsigned 32-bit integer
afs.fs.fid.uniq FileID (Uniqifier)
Unsigned 32-bit integer
afs.fs.fid.vnode FileID (VNode)
Unsigned 32-bit integer
afs.fs.fid.volume FileID (Volume)
Unsigned 32-bit integer
afs.fs.flength FLength
Unsigned 32-bit integer
afs.fs.ipaddr IP Address
IPv4 address
afs.fs.length Length
Unsigned 32-bit integer
afs.fs.motd Message of the Day
String
afs.fs.name Name
String
afs.fs.newname New Name
String
afs.fs.offlinemsg Offline Message
String
afs.fs.offset Offset
Unsigned 32-bit integer
String
afs.fs.opcode Operation
Unsigned 32-bit integer
afs.fs.status.anonymousaccess Anonymous Access
Unsigned 32-bit integer
afs.fs.status.author Author
Unsigned 32-bit integer
afs.fs.status.calleraccess Caller Access
Unsigned 32-bit integer
afs.fs.status.clientmodtime Client Modification Time
Date/Time stamp
afs.fs.status.dataversion Data Version
Unsigned 32-bit integer
afs.fs.status.dataversionhigh Data Version (High)
Unsigned 32-bit integer
afs.fs.status.filetype File Type
Unsigned 32-bit integer
afs.fs.status.group Group
Unsigned 32-bit integer
afs.fs.status.interfaceversion Interface Version
Unsigned 32-bit integer
afs.fs.status.length Length
Unsigned 32-bit integer
afs.fs.status.linkcount Link Count
Unsigned 32-bit integer
afs.fs.status.mask Mask
Unsigned 32-bit integer
afs.fs.status.mask.fsync FSync
Unsigned 32-bit integer
afs.fs.status.mask.setgroup Set Group
Unsigned 32-bit integer
afs.fs.status.mask.setmode Set Mode
Unsigned 32-bit integer
afs.fs.status.mask.setmodtime Set Modification Time
Unsigned 32-bit integer
Unsigned 32-bit integer
afs.fs.status.mask.setsegsize Set Segment Size
Unsigned 32-bit integer
afs.fs.status.mode Unix Mode
Unsigned 32-bit integer
afs.fs.status.owner Owner
Unsigned 32-bit integer
afs.fs.status.parentunique Parent Unique
Unsigned 32-bit integer
afs.fs.status.parentvnode Parent VNode
Unsigned 32-bit integer
afs.fs.status.segsize Segment Size
Unsigned 32-bit integer
afs.fs.status.servermodtime Server Modification Time
Date/Time stamp
afs.fs.status.spare2 Spare 2
Unsigned 32-bit integer
afs.fs.status.spare3 Spare 3
Unsigned 32-bit integer
afs.fs.status.spare4 Spare 4
Unsigned 32-bit integer
afs.fs.status.synccounter Sync Counter
Unsigned 32-bit integer
afs.fs.symlink.content Symlink Content
String
afs.fs.symlink.name Symlink Name
String
afs.fs.timestamp Timestamp
Date/Time stamp
afs.fs.token Token
Byte array
afs.fs.viceid Vice ID
Unsigned 32-bit integer
afs.fs.vicelocktype Vice Lock Type
Unsigned 32-bit integer
Unsigned 32-bit integer
afs.fs.volname Volume Name
String
afs.fs.volsync.spare1 Spare 1
Unsigned 32-bit integer
afs.fs.volsync.spare2 Spare 2
Unsigned 32-bit integer
afs.fs.volsync.spare3 Spare 3
Unsigned 32-bit integer
afs.fs.volsync.spare4 Spare 4
Unsigned 32-bit integer
afs.fs.volsync.spare5 Spare 5
Unsigned 32-bit integer
afs.fs.volsync.spare6 Spare 6
Unsigned 32-bit integer
afs.fs.xstats.clientversion Client Version
Unsigned 32-bit integer
afs.fs.xstats.collnumber Collection Number
Unsigned 32-bit integer
afs.fs.xstats.timestamp XStats Timestamp
Unsigned 32-bit integer
afs.fs.xstats.version XStats Version
Unsigned 32-bit integer
afs.kauth KAuth
Boolean
afs.kauth.data Data
Byte array
afs.kauth.domain Domain
String
afs.kauth.errcode Error Code
Unsigned 32-bit integer
afs.kauth.kvno Key Version Number
Unsigned 32-bit integer
afs.kauth.name Name
String
Unsigned 32-bit integer
afs.kauth.princ Principal
String
afs.kauth.realm Realm
String
afs.prot Protection
Boolean
afs.prot.count Count
Unsigned 32-bit integer
afs.prot.errcode Error Code
Unsigned 32-bit integer
afs.prot.flag Flag
Unsigned 32-bit integer
afs.prot.gid Group ID
Unsigned 32-bit integer
afs.prot.id ID
Unsigned 32-bit integer
afs.prot.maxgid Maximum Group ID
Unsigned 32-bit integer
afs.prot.maxuid Maximum User ID
Unsigned 32-bit integer
afs.prot.name Name
String
afs.prot.newid New ID
Unsigned 32-bit integer
afs.prot.oldid Old ID
Unsigned 32-bit integer
afs.prot.opcode Operation
Unsigned 32-bit integer
afs.prot.pos Position
Unsigned 32-bit integer
afs.prot.uid User ID
Unsigned 32-bit integer
afs.rmtsys Rmtsys
Boolean
Unsigned 32-bit integer
afs.ubik Ubik
Boolean
afs.ubik.activewrite Active Write
Unsigned 32-bit integer
afs.ubik.addr Address
IPv4 address
afs.ubik.amsyncsite Am Sync Site
Unsigned 32-bit integer
afs.ubik.anyreadlocks Any Read Locks
Unsigned 32-bit integer
afs.ubik.anywritelocks Any Write Locks
Unsigned 32-bit integer
afs.ubik.beaconsincedown Beacon Since Down
Unsigned 32-bit integer
afs.ubik.currentdb Current DB
Unsigned 32-bit integer
afs.ubik.currenttran Current Transaction
Unsigned 32-bit integer
afs.ubik.epochtime Epoch Time
Date/Time stamp
afs.ubik.errcode Error Code
Unsigned 32-bit integer
afs.ubik.file File
Unsigned 32-bit integer
afs.ubik.interface Interface Address
IPv4 address
afs.ubik.isclone Is Clone
Unsigned 32-bit integer
afs.ubik.lastbeaconsent Last Beacon Sent
Date/Time stamp
afs.ubik.lastvote Last Vote
Unsigned 32-bit integer
afs.ubik.lastvotetime Last Vote Time
Date/Time stamp
Date/Time stamp
afs.ubik.lastyeshost Last Yes Host
IPv4 address
afs.ubik.lastyesstate Last Yes State
Unsigned 32-bit integer
afs.ubik.lastyesttime Last Yes Time
Date/Time stamp
afs.ubik.length Length
Unsigned 32-bit integer
afs.ubik.lockedpages Locked Pages
Unsigned 32-bit integer
afs.ubik.locktype Lock Type
Unsigned 32-bit integer
afs.ubik.lowesthost Lowest Host
IPv4 address
afs.ubik.lowesttime Lowest Time
Date/Time stamp
afs.ubik.now Now
Date/Time stamp
afs.ubik.nservers Number of Servers
Unsigned 32-bit integer
afs.ubik.opcode Operation
Unsigned 32-bit integer
afs.ubik.position Position
Unsigned 32-bit integer
afs.ubik.recoverystate Recovery State
Unsigned 32-bit integer
afs.ubik.site Site
IPv4 address
afs.ubik.state State
Unsigned 32-bit integer
afs.ubik.synchost Sync Host
IPv4 address
afs.ubik.syncsiteuntil Sync Site Until
Date/Time stamp
Date/Time stamp
afs.ubik.tidcounter TID Counter
Unsigned 32-bit integer
afs.ubik.up Up
Unsigned 32-bit integer
afs.ubik.version.counter Counter
Unsigned 32-bit integer
afs.ubik.version.epoch Epoch
Date/Time stamp
afs.ubik.voteend Vote Ends
Date/Time stamp
afs.ubik.votestart Vote Started
Date/Time stamp
afs.ubik.votetype Vote Type
Unsigned 32-bit integer
afs.ubik.writelockedpages Write Locked Pages
Unsigned 32-bit integer
afs.ubik.writetran Write Transaction
Unsigned 32-bit integer
afs.update Update
Boolean
afs.update.opcode Operation
Unsigned 32-bit integer
afs.vldb VLDB
Boolean
afs.vldb.bkvol Backup Volume ID
Unsigned 32-bit integer
afs.vldb.bump Bumped Volume ID
Unsigned 32-bit integer
afs.vldb.count Volume Count
Unsigned 32-bit integer
afs.vldb.errcode Error Code
Unsigned 32-bit integer
afs.vldb.id Volume ID
Unsigned 32-bit integer
Unsigned 32-bit integer
afs.vldb.name Volume Name
String
afs.vldb.nextindex Next Volume Index
Unsigned 32-bit integer
afs.vldb.numservers Number of Servers
Unsigned 32-bit integer
afs.vldb.opcode Operation
Unsigned 32-bit integer
afs.vldb.partition Partition
String
afs.vldb.rovol Read-Only Volume ID
Unsigned 32-bit integer
afs.vldb.rwvol Read-Write Volume ID
Unsigned 32-bit integer
afs.vldb.server Server
IPv4 address
afs.vldb.serveruuid Server UUID
Byte array
afs.vldb.type Volume Type
Unsigned 32-bit integer
afs.vol Volume Server
Boolean
afs.vol.count Volume Count
Unsigned 32-bit integer
afs.vol.errcode Error Code
Unsigned 32-bit integer
afs.vol.id Volume ID
Unsigned 32-bit integer
afs.vol.name Volume Name
String
afs.vol.opcode Operation
Unsigned 32-bit integer
aarp.dst.ether Target ether
Byte array
aarp.dst.id Target ID
Byte array
aarp.hard.size Hardware size
Unsigned 8-bit integer
aarp.hard.type Hardware type
Unsigned 16-bit integer
aarp.opcode Opcode
Unsigned 16-bit integer
aarp.proto.size Protocol size
Unsigned 8-bit integer
aarp.proto.type Protocol type
Unsigned 16-bit integer
aarp.src.ether Sender ether
Byte array
aarp.src.id Sender ID
Byte array
Async data over ISDN (V.120) (v120)
v120.address Link Address
Unsigned 16-bit integer
v120.control Control Field
Unsigned 16-bit integer
v120.header Header Field
String
Authentication Header (ah)
ah.sequence Sequence
Unsigned 32-bit integer
ah.spi SPI
Unsigned 32-bit integer
bvlc.bdt_ip IP
IPv4 address
bvlc.bdt_mask Mask
Byte array
bvlc.bdt_port Port
Unsigned 16-bit integer
bvlc.fdt_ip IP
IPv4 address
bvlc.fdt_port Port
Unsigned 16-bit integer
bvlc.fdt_timeout Timeout
Unsigned 16-bit integer
bvlc.fdt_ttl TTL
Unsigned 16-bit integer
bvlc.function Function
Unsigned 8-bit integer
bvlc.fwd_ip IP
IPv4 address
bvlc.fwd_port Port
Unsigned 16-bit integer
bvlc.length Length
Unsigned 16-bit integer
bvlc.reg_ttl TTL
Unsigned 16-bit integer
bvlc.result Result
Unsigned 16-bit integer
bvlc.type Type
Unsigned 8-bit integer
Banyan Vines (vines)
vines.protocol Protocol
Unsigned 8-bit integer
Banyan Vines SPP (vines_spp)
Blocks eXtensible eXchange Protocol (bxxp)
bxxp.channel Channel
Unsigned 32-bit integer
bxxp.end End
Boolean
bxxp.more.complete Complete
Boolean
bxxp.more.intermediate Intermediate
Boolean
bxxp.req Request
Boolean
bxxp.req.channel Request Channel Number
Unsigned 32-bit integer
bxxp.rsp Response
Boolean
bxxp.rsp.channel Response Channel Number
Unsigned 32-bit integer
bxxp.seq Sequence
Boolean
bxxp.seq.ackno Ackno
Unsigned 32-bit integer
bxxp.seq.channel Sequence Channel Number
Unsigned 32-bit integer
bxxp.seq.window Window
Unsigned 32-bit integer
bxxp.seqno Seqno
Unsigned 32-bit integer
bxxp.serial Serial
Unsigned 32-bit integer
bxxp.size Size
Unsigned 32-bit integer
Boolean
bxxp.status.positive Positive
Boolean
bxxp.violation Protocol Violation
Boolean
Boot Parameters (bootparams)
bootparams.domain Client Domain
String
bootparams.fileid File ID
String
bootparams.filepath File Path
String
bootparams.host Client Host
String
bootparams.hostaddr Client Address
IPv4 address
bootparams.routeraddr Router Address
IPv4 address
bootparams.type Address Type
Unsigned 32-bit integer
Bootstrap Protocol (bootp)
bootp.cookie Magic cookie
IPv4 address
bootp.dhcp Frame is DHCP
Boolean
bootp.file Boot file name
String
bootp.flag Broadcast flag
Unsigned 16-bit integer
bootp.hops Hops
Unsigned 8-bit integer
bootp.hw.addr Client hardware address
Byte array
Unsigned 8-bit integer
bootp.hw.type Hardware type
Unsigned 8-bit integer
bootp.id Transaction ID
Unsigned 32-bit integer
bootp.ip.client Client IP address
IPv4 address
bootp.ip.relay Relay agent IP address
IPv4 address
bootp.ip.server Next server IP address
IPv4 address
bootp.ip.your Your (client) IP address
IPv4 address
bootp.secs Seconds elapsed
Unsigned 16-bit integer
bootp.server Server host name
String
bootp.type Message type
Unsigned 8-bit integer
Border Gateway Protocol (bgp)
bgp.type BGP message type
Unsigned 8-bit integer
Building Automation and Control Network APDU (bacapp)
bacapp.bacapp_type APDU Type
Unsigned 8-bit integer
Building Automation and Control Network NPDU (bacnet)
bacnet.control Control
Unsigned 8-bit integer
bacnet.control_dest Destination Specifier
Boolean
bacnet.control_expect Expecting Reply
Boolean
Boolean
bacnet.control_prio_high Priority
Boolean
bacnet.control_prio_low Priority
Boolean
bacnet.control_res1 Reserved
Boolean
bacnet.control_res2 Reserved
Boolean
bacnet.control_src Source specifier
Boolean
bacnet.dadr_eth Destination ISO 8802-3 MAC Address
6-byte Hardware (MAC) Address
bacnet.dadr_tmp Unknown Destination MAC
Byte array
bacnet.dlen Destination MAC Layer Address Length
Unsigned 8-bit integer
bacnet.dnet Destination Network Address
Unsigned 16-bit integer
bacnet.hopc Hop Count
Unsigned 8-bit integer
bacnet.mesgtyp Message Type
Unsigned 8-bit integer
bacnet.perf Performance Index
Unsigned 8-bit integer
bacnet.pinfo Port Info
Unsigned 8-bit integer
bacnet.pinfolen Port Info Length
Unsigned 8-bit integer
bacnet.portid Port ID
Unsigned 8-bit integer
bacnet.rejectreason Reject Reason
Unsigned 8-bit integer
bacnet.rportnum Number of Port Mappings
Unsigned 8-bit integer
6-byte Hardware (MAC) Address
bacnet.sadr_tmp Unknown Source MAC
Byte array
bacnet.slen Source MAC Layer Address Length
Unsigned 8-bit integer
bacnet.snet Source Network Address
Unsigned 16-bit integer
bacnet.vendor Vendor ID
Unsigned 16-bit integer
bacnet.version Version
Unsigned 8-bit integer
Cisco Auto-RP (auto_rp)
auto_rp.group_prefix Prefix
IPv4 address
auto_rp.holdtime Holdtime
Unsigned 16-bit integer
auto_rp.mask_len Mask length
Unsigned 8-bit integer
auto_rp.pim_ver Version
Unsigned 8-bit integer
auto_rp.prefix_sign Sign
Unsigned 8-bit integer
auto_rp.rp_addr RP address
IPv4 address
auto_rp.rp_count RP count
Unsigned 8-bit integer
auto_rp.type Packet type
Unsigned 8-bit integer
auto_rp.version Protocol version
Unsigned 8-bit integer
Cisco Discovery Protocol (cdp)
cdp.checksum Checksum
Unsigned 16-bit integer
Unsigned 16-bit integer
cdp.tlv.type Type
Unsigned 16-bit integer
cdp.ttl TTL
Unsigned 16-bit integer
cdp.version Version
Unsigned 8-bit integer
Cisco Group Management Protocol (cgmp)
cgmp.count Count
Unsigned 8-bit integer
cgmp.gda Group Destination Address
6-byte Hardware (MAC) Address
cgmp.type Type
Unsigned 8-bit integer
cgmp.usa Unicast Source Address
6-byte Hardware (MAC) Address
cgmp.version Version
Unsigned 8-bit integer
Cisco HDLC (chdlc)
chdlc.address Address
Unsigned 8-bit integer
chdlc.protocol Protocol
Unsigned 16-bit integer
Cisco Hot Standby Router Protocol (hsrp)
hsrp.auth_data Authentication Data
String
hsrp.group Group
Unsigned 8-bit integer
hsrp.hellotime Hellotime
Unsigned 8-bit integer
hsrp.holdtime Holdtime
Unsigned 8-bit integer
Unsigned 8-bit integer
hsrp.priority Priority
Unsigned 8-bit integer
hsrp.reserved Reserved
Unsigned 8-bit integer
hsrp.state State
Unsigned 8-bit integer
hsrp.version Version
Unsigned 8-bit integer
hsrp.virt_ip Virtual IP Address
IPv4 address
Cisco ISL (isl)
isl.addr Source or Destination Address
6-byte Hardware (MAC) Address
isl.bpdu BPDU
Boolean
isl.crc CRC
Unsigned 32-bit integer
isl.dst Destination
6-byte Hardware (MAC) Address
isl.dst_route_desc Destination route descriptor
Unsigned 16-bit integer
isl.esize Esize
Unsigned 8-bit integer
isl.explorer Explorer
Boolean
isl.fcs_not_incl FCS Not Included
Boolean
isl.hsa HSA
Unsigned 24-bit integer
isl.index Index
Unsigned 16-bit integer
isl.len Length
Unsigned 16-bit integer
6-byte Hardware (MAC) Address
isl.src_route_desc Source-route descriptor
Unsigned 16-bit integer
isl.src_vlan_id Source VLAN ID
Unsigned 16-bit integer
isl.type Type
Unsigned 8-bit integer
isl.user User
Unsigned 8-bit integer
isl.user_eth User
Unsigned 8-bit integer
isl.vlan_id VLAN ID
Unsigned 16-bit integer
Cisco Interior Gateway Routing Protocol (igrp)
igrp.as Autonomous System
Unsigned 16-bit integer
igrp.update Update Release
Unsigned 8-bit integer
Cisco SLARP (slarp)
slarp.address Address
IPv4 address
slarp.mysequence Outgoing sequence number
Unsigned 32-bit integer
slarp.ptype Packet type
Unsigned 32-bit integer
slarp.yoursequence Returned sequence number
Unsigned 32-bit integer
Common Open Policy Service (cops)
cops.accttimer.value Contents: ACCT Timer Value
Unsigned 16-bit integer
cops.c_num C-Num
Unsigned 8-bit integer
Unsigned 8-bit integer
cops.client_type Client Type
Unsigned 16-bit integer
cops.context.m_type M-Type
Unsigned 16-bit integer
cops.context.r_type R-Type
Unsigned 16-bit integer
cops.decision.cmd Command-Code
Unsigned 16-bit integer
cops.decision.flags Flags
Unsigned 16-bit integer
cops.error Error
Unsigned 16-bit integer
cops.error_sub Error Sub-code
Unsigned 16-bit integer
cops.flags Flags
Unsigned 8-bit integer
cops.in-int.ipv4 IPv4 address
IPv4 address
cops.in-int.ipv6 IPv6 address
IPv6 address
cops.in-out-int.ifindex ifIndex
Unsigned 32-bit integer
cops.integrity.key_id Contents: Key ID
Unsigned 32-bit integer
cops.integrity.seq_num Contents: Sequence Number
Unsigned 32-bit integer
cops.katimer.value Contents: KA Timer Value
Unsigned 16-bit integer
cops.lastpdpaddr.ipv4 IPv4 address
IPv4 address
cops.lastpdpaddr.ipv6 IPv6 address
IPv6 address
cops.msg_len Message Length
Unsigned 32-bit integer
Unsigned 32-bit integer
cops.op_code Op Code
Unsigned 8-bit integer
cops.out-int.ipv4 IPv4 address
IPv4 address
cops.out-int.ipv6 IPv6 address
IPv6 address
cops.pdp.tcp_port TCP Port Number
Unsigned 32-bit integer
cops.pdprediraddr.ipv4 IPv4 address
IPv4 address
cops.pdprediraddr.ipv6 IPv6 address
IPv6 address
cops.pepid.id Contents: PEP Id
String
cops.reason Reason
Unsigned 16-bit integer
cops.reason_sub Reason Sub-code
Unsigned 16-bit integer
cops.report_type Contents: Report-Type
Unsigned 16-bit integer
cops.ver_flags Version and Flags
Unsigned 8-bit integer
cops.version Version
Unsigned 8-bit integer
Common Unix Printing System (CUPS) Browsing Protocol
(cups)
cups.ptype Type
Unsigned 32-bit integer
cups.state State
Unsigned 8-bit integer
DCE RPC (dcerpc)
dcerpc.cn_ack_reason Ack reason
Unsigned 16-bit integer
Unsigned 16-bit integer
dcerpc.cn_alloc_hint Alloc hint
Unsigned 32-bit integer
dcerpc.cn_assoc_group Assoc Group
Unsigned 32-bit integer
dcerpc.cn_auth_len Auth Length
Unsigned 16-bit integer
dcerpc.cn_bind_if_ver Interface Ver
Unsigned 32-bit integer
dcerpc.cn_bind_to_uuid Interface UUID
String
dcerpc.cn_bind_trans_id Transfer Syntax
String
dcerpc.cn_bind_trans_ver Syntax ver
Unsigned 32-bit integer
dcerpc.cn_call_id Call ID
Unsigned 32-bit integer
dcerpc.cn_ctx_id Context ID
Unsigned 16-bit integer
dcerpc.cn_flags Packet Flags
Unsigned 8-bit integer
dcerpc.cn_flags.cancel_pending Cancel Pending
Boolean
dcerpc.cn_flags.dne Did Not Execute
Boolean
dcerpc.cn_flags.first_frag First Frag
Boolean
dcerpc.cn_flags.last_frag Last Frag
Boolean
dcerpc.cn_flags.maybe Maybe
Boolean
dcerpc.cn_flags.mpx Multiplex
Boolean
dcerpc.cn_flags.object Object
Boolean
Boolean
dcerpc.cn_frag_len Frag Length
Unsigned 16-bit integer
dcerpc.cn_max_recv Max Recv Frag
Unsigned 16-bit integer
dcerpc.cn_max_xmit Max Xmit Frag
Unsigned 16-bit integer
dcerpc.cn_num_ctx_items Num Ctx Items
Unsigned 8-bit integer
dcerpc.cn_num_results Num results
Unsigned 8-bit integer
dcerpc.cn_num_trans_items Num Trans Items
Unsigned 16-bit integer
dcerpc.cn_sec_addr_len Scndry Addr len
Unsigned 16-bit integer
dcerpc.dg_act_id Activitiy
String
dcerpc.dg_ahint Activity Hint
Unsigned 16-bit integer
dcerpc.dg_auth_proto Auth proto
Unsigned 8-bit integer
dcerpc.dg_flags1 Flags1
Unsigned 8-bit integer
dcerpc.dg_flags1_broadcast Broadcast
Boolean
dcerpc.dg_flags1_frag Fragment
Boolean
dcerpc.dg_flags1_idempotent Idempotent
Boolean
dcerpc.dg_flags1_last_frag Last Fragment
Boolean
dcerpc.dg_flags1_maybe Maybe
Boolean
dcerpc.dg_flags1_nofack No Fack
Boolean
Boolean
dcerpc.dg_flags1_rsrvd_80 Reserved
Boolean
dcerpc.dg_flags2 Flags2
Unsigned 8-bit integer
dcerpc.dg_flags2_cancel_pending Cancel Pending
Boolean
dcerpc.dg_flags2_rsrvd_01 Reserved
Boolean
dcerpc.dg_flags2_rsrvd_04 Reserved
Boolean
dcerpc.dg_flags2_rsrvd_08 Reserved
Boolean
dcerpc.dg_flags2_rsrvd_10 Reserved
Boolean
dcerpc.dg_flags2_rsrvd_20 Reserved
Boolean
dcerpc.dg_flags2_rsrvd_40 Reserved
Boolean
dcerpc.dg_flags2_rsrvd_80 Reserved
Boolean
dcerpc.dg_frag_len Fragment len
Unsigned 16-bit integer
dcerpc.dg_frag_num Fragment num
Unsigned 16-bit integer
dcerpc.dg_if_id Interface
String
dcerpc.dg_if_ver Interface Ver
Unsigned 32-bit integer
dcerpc.dg_ihint Interface Hint
Unsigned 16-bit integer
dcerpc.dg_seqnum Sequence num
Unsigned 32-bit integer
dcerpc.dg_serial_hi Serial High
Unsigned 8-bit integer
Unsigned 8-bit integer
dcerpc.dg_server_boot Server boot time
Unsigned 32-bit integer
dcerpc.obj_id Object
String
dcerpc.opnum Opnum
Unsigned 16-bit integer
dcerpc.pkt_type Packet type
Unsigned 8-bit integer
dcerpc.ver Version
Unsigned 8-bit integer
dcerpc.ver_minor Version (minor)
Unsigned 8-bit integer
DEC Spanning Tree Protocol (dec_stp)
Data (data)
Datagram Delivery Protocol (ddp)
ddp.checksum Checksum
Unsigned 16-bit integer
ddp.dst.net Destination Net
Unsigned 16-bit integer
ddp.dst.node Destination Node
Unsigned 8-bit integer
ddp.dst.socket Destination Socket
Unsigned 8-bit integer
ddp.hopcount Hop count
Unsigned 8-bit integer
ddp.len Datagram length
Unsigned 16-bit integer
ddp.src.net Source Net
Unsigned 16-bit integer
ddp.src.node Source Node
Unsigned 8-bit integer
Unsigned 8-bit integer
ddp.type Protocol type
Unsigned 8-bit integer
Diameter Protocol (diameter)
diameter.avp.code AVP Code
Unsigned 32-bit integer
diameter.avp.data.bytes AVP Data
Byte array
diameter.avp.data.int32 AVP Data
Signed 32-bit integer
diameter.avp.data.string AVP Data
String
diameter.avp.data.time AVP Data
Date/Time stamp
diameter.avp.data.uint32 AVP Data
Unsigned 32-bit integer
diameter.avp.data.v4addr AVP Data
IPv4 address
diameter.avp.data.v6addr AVP Data
IPv6 address
diameter.avp.flags AVP Flags
Unsigned 8-bit integer
diameter.avp.length AVP length
Unsigned 16-bit integer
diameter.avp.reserved AVP Reserved
Unsigned 8-bit integer
diameter.avp.vendorId AVP Vendor Id
Unsigned 32-bit integer
diameter.code Command Code
Unsigned 32-bit integer
diameter.endtoendid End-to-End Identifier
Unsigned 32-bit integer
diameter.flags Flags
Unsigned 8-bit integer
Unsigned 32-bit integer
diameter.length Length
Unsigned 16-bit integer
diameter.reserved Reserved
Unsigned 8-bit integer
diameter.vendorId VendorId
Unsigned 32-bit integer
diameter.version Version
Unsigned 8-bit integer
Domain Name Service (dns)
dns.count.add_rr Additional RRs
Unsigned 16-bit integer
dns.count.answers Answer RRs
Unsigned 16-bit integer
dns.count.auth_rr Authority RRs
Unsigned 16-bit integer
dns.count.queries Questions
Unsigned 16-bit integer
dns.flags Flags
Unsigned 16-bit integer
dns.id Transaction ID
Unsigned 16-bit integer
dns.query Query
Boolean
dns.response Response
Boolean
Dynamic DNS Tools Protocol (ddtp)
ddtp.encrypt Encryption
Unsigned 32-bit integer
ddtp.hostid Hostid
Unsigned 32-bit integer
ddtp.ipaddr IP address
IPv4 address
Unsigned 32-bit integer
ddtp.opcode Opcode
Unsigned 32-bit integer
ddtp.status Status
Unsigned 32-bit integer
ddtp.version Version
Unsigned 32-bit integer
Encapsulating Security Payload (esp)
esp.sequence Sequence
Unsigned 32-bit integer
esp.spi SPI
Unsigned 32-bit integer
Enhanced Interior Gateway Routing Protocol (eigrp)
eigrp.as Autonomous System
Unsigned 16-bit integer
eigrp.opcode Opcode
Unsigned 8-bit integer
eigrp.tlv Entry
Unsigned 16-bit integer
Ethernet (eth)
eth.addr Source or Destination Address
6-byte Hardware (MAC) Address
eth.dst Destination
6-byte Hardware (MAC) Address
eth.len Length
Unsigned 16-bit integer
eth.src Source
6-byte Hardware (MAC) Address
eth.trailer Trailer
Byte array
eth.type Type
Unsigned 16-bit integer
Fiber Distributed Data Interface (fddi)
fddi.addr Source or Destination Address
6-byte Hardware (MAC) Address
fddi.dst Destination
6-byte Hardware (MAC) Address
fddi.fc Frame Control
Unsigned 8-bit integer
fddi.src Source
6-byte Hardware (MAC) Address
File Transfer Protocol (FTP) (ftp)
ftp.reponse.data Response data
String
ftp.request Request
Boolean
ftp.request.command Request command
String
ftp.request.data Request data
String
ftp.response Response
Boolean
ftp.response.code Response code
Unsigned 8-bit integer
Frame (frame)
frame.cap_len Capture Frame Length
Unsigned 32-bit integer
frame.number Frame Number
Unsigned 32-bit integer
frame.p2p_dir Point-to-Point Direction
Unsigned 8-bit integer
frame.pkt_len Total Frame Length
Unsigned 32-bit integer
Date/Time stamp
frame.time_delta Time delta from previous packet
Time duration
frame.time_relative Time relative to first packet
Time duration
Frame Relay (fr)
fr.becn BECN
Boolean
fr.chdlctype Type
Unsigned 16-bit integer
fr.cr CR
Boolean
fr.dc DC
Boolean
fr.de DE
Boolean
fr.dlci DLCI
Unsigned 16-bit integer
fr.ea EA
Boolean
fr.fecn FECN
Boolean
fr.nlpid NLPID
Unsigned 8-bit integer
fr.snap.oui Organization Code
Unsigned 24-bit integer
fr.snap.pid Protocol ID
Unsigned 16-bit integer
fr.snaptype Type
Unsigned 16-bit integer
GARP VLAN Registration Protocol (gvrp)
garp.attribute_event Event
Unsigned 8-bit integer
Unsigned 8-bit integer
garp.attribute_type Type
Unsigned 8-bit integer
garp.attribute_value Value
Unsigned 16-bit integer
garp.protocol_id Protocol ID
Unsigned 16-bit integer
GPRS Tunneling Protocol (gtp)
gtp.ext Extension header
Unsigned 8-bit integer
gtp.ext.apn APN
String
gtp.ext.cause Cause
Unsigned 8-bit integer
gtp.ext.chrg_addr CG address
IPv4 address
gtp.ext.chrg_id Charging ID
Unsigned 32-bit integer
gtp.ext.ext_id Ext id
Unsigned 16-bit integer
gtp.ext.ext_val Ext val
String
gtp.ext.flow_ii Downlink flow label data
Unsigned 16-bit integer
gtp.ext.flow_ii_nsapi NSAPI
Unsigned 8-bit integer
gtp.ext.flow_label Flow label
Unsigned 16-bit integer
gtp.ext.flow_sig Flow label signature
Unsigned 16-bit integer
gtp.ext.gsn_addr GSN address
IPv4 address
gtp.ext.imsi IMSI
String
Unsigned 16-bit integer
gtp.ext.map Ext type
Unsigned 8-bit integer
gtp.ext.mcc MCC
Unsigned 16-bit integer
gtp.ext.mnc MNC
Unsigned 8-bit integer
gtp.ext.ms MS validated
Boolean
gtp.ext.msisdn MSISDN
String
gtp.ext.node_addr Node address
IPv4 address
gtp.ext.proto_conf Protocol configuration
String
gtp.ext.ptmsi P-TMSI
Unsigned 32-bit integer
gtp.ext.ptmsi_sig P-TMSI signature
Unsigned 24-bit integer
gtp.ext.qos_delay QoS delay
Unsigned 8-bit integer
gtp.ext.qos_mean QoS mean
Unsigned 8-bit integer
gtp.ext.qos_peak QoS peak
Unsigned 8-bit integer
gtp.ext.qos_precedence QoS precedence
Unsigned 8-bit integer
gtp.ext.qos_reliabilty QoS reliability
Unsigned 8-bit integer
gtp.ext.rac RAC
Unsigned 8-bit integer
gtp.ext.recover Restart counter
Unsigned 8-bit integer
gtp.ext.reorder Reordering required
Boolean
Unsigned 8-bit integer
gtp.ext.tlli TLLI
Unsigned 32-bit integer
gtp.ext.tr_comm Transfer command
Unsigned 8-bit integer
gtp.ext.unknown Unknown data (length)
Unsigned 16-bit integer
gtp.ext.user_addr End user address
IPv4 address
gtp.ext.user_addr_pdp_org PDP type organization
Unsigned 8-bit integer
gtp.ext.user_addr_pdp_type PDP type
Unsigned 8-bit integer
gtp.flags Flags
Unsigned 8-bit integer
gtp.flags.payload_type Payload Type
Unsigned 8-bit integer
gtp.flags.snn Is seq number
Unsigned 8-bit integer
gtp.flags.spare Reserved
Unsigned 8-bit integer
gtp.flags.version Version
Unsigned 8-bit integer
gtp.flow_label Flow label
Unsigned 16-bit integer
gtp.length Length
Unsigned 16-bit integer
gtp.message_type Message type
Unsigned 8-bit integer
gtp.seq_number Sequence number
Unsigned 16-bit integer
gtp.sndcp_number SNDCP N-PDU LLC Number
Unsigned 8-bit integer
gtp.tid Tunnel ID
String
giop.len Message size
Unsigned 32-bit integer
giop.type Message type
Unsigned 8-bit integer
Generic Routing Encapsulation (gre)
gre.proto Protocol Type
Unsigned 16-bit integer
Hummingbird NFS Daemon (hclnfsd)
hclnfsd.access Access
Unsigned 32-bit integer
hclnfsd.cookie Cookie
Unsigned 32-bit integer
hclnfsd.copies Copies
Unsigned 32-bit integer
hclnfsd.device Device
String
hclnfsd.exclusive Exclusive
Unsigned 32-bit integer
hclnfsd.fileext File Extension
Unsigned 32-bit integer
hclnfsd.filename Filename
String
hclnfsd.gid GID
Unsigned 32-bit integer
hclnfsd.group Group
String
hclnfsd.host_ip Host IP
IPv4 address
hclnfsd.hostname Hostname
String
hclnfsd.jobstatus Job Status
Unsigned 32-bit integer
Unsigned 32-bit integer
hclnfsd.lockname Lockname
String
hclnfsd.lockowner Lockowner
String
hclnfsd.logintext Login Text
String
hclnfsd.mode Mode
Unsigned 32-bit integer
hclnfsd.npp Number of Physical Printers
Unsigned 32-bit integer
hclnfsd.offset Offset
Unsigned 32-bit integer
hclnfsd.pqn Print Queue Number
Unsigned 32-bit integer
hclnfsd.printername Printer Name
String
hclnfsd.printparameters Print Parameters
String
hclnfsd.printqueuecomment Comment
String
hclnfsd.printqueuename Name
String
hclnfsd.queuestatus Queue Status
Unsigned 32-bit integer
hclnfsd.request_type Request Type
Unsigned 32-bit integer
hclnfsd.sequence Sequence
Unsigned 32-bit integer
hclnfsd.server_ip Server IP
IPv4 address
hclnfsd.size Size
Unsigned 32-bit integer
hclnfsd.status Status
Unsigned 32-bit integer
Unsigned 32-bit integer
hclnfsd.uid UID
Unsigned 32-bit integer
hclnfsd.unknown_data Unknown
String
hclnfsd.username Username
String
Hypertext Transfer Protocol (http)
http.notification Notification
Boolean
http.request Request
Boolean
http.response Response
Boolean
ICQ Protocol (icq)
icq.checkcode Checkcode
Unsigned 32-bit integer
icq.cmd Command
Unsigned 16-bit integer
icq.decode Decode
String
icq.sessionid Session ID
Unsigned 32-bit integer
icq.type Type
Unsigned 16-bit integer
icq.uin UIN
Unsigned 32-bit integer
IEEE 802.11 wireless LAN (wlan)
wlan.aid Association ID
Unsigned 16-bit integer
wlan.bssid BSS Id
6-byte Hardware (MAC) Address
6-byte Hardware (MAC) Address
wlan.duration Duration
Unsigned 16-bit integer
wlan.fc Frame Control Field
Unsigned 16-bit integer
wlan.fc.ds DS status
Unsigned 8-bit integer
wlan.fc.frag Fragments
Boolean
wlan.fc.fromds From DS
Boolean
wlan.fc.moredata More Data
Boolean
wlan.fc.order Order flag
Boolean
wlan.fc.pwrmgt PWR MGT
Boolean
wlan.fc.retry Retry
Boolean
wlan.fc.subtype Subtype
Unsigned 8-bit integer
wlan.fc.tods To DS
Boolean
wlan.fc.type Type
Unsigned 8-bit integer
wlan.fc.version Version
Unsigned 8-bit integer
wlan.fc.wep WEP flag
Boolean
wlan.fcs Frame Check Sequence (not verified)
Unsigned 32-bit integer
wlan.fixed.aid Association ID
Unsigned 16-bit integer
wlan.fixed.all Fixed parameters
Unsigned 16-bit integer
Unsigned 16-bit integer
wlan.fixed.auth_seq Authentication SEQ
Unsigned 16-bit integer
wlan.fixed.beacon Beacon Interval
Unsigned 16-bit integer
wlan.fixed.capabilities Capabilities
Unsigned 16-bit integer
wlan.fixed.capabilities.cfpoll.ap CFP participation capabilities
Unsigned 16-bit integer
wlan.fixed.capabilities.cfpoll.sta CFP participation capabilities
Unsigned 16-bit integer
wlan.fixed.capabilities.ess ESS capabilities
Boolean
wlan.fixed.capabilities.ibss IBSS status
Boolean
wlan.fixed.capabilities.privacy Privacy
Boolean
wlan.fixed.current_ap Current AP
6-byte Hardware (MAC) Address
wlan.fixed.listen_ival Listen Interval
Unsigned 16-bit integer
wlan.fixed.reason_code Reason code
Unsigned 16-bit integer
wlan.fixed.status_code Status code
Unsigned 16-bit integer
wlan.fixed.timestamp Timestamp
String
wlan.flags Protocol Flags
Unsigned 8-bit integer
wlan.frag Fragment number
Unsigned 16-bit integer
wlan.ra Receiver address
6-byte Hardware (MAC) Address
wlan.sa Source address
6-byte Hardware (MAC) Address
Unsigned 16-bit integer
wlan.ta Transmitter address
6-byte Hardware (MAC) Address
wlan.tag.interpretation Tag interpretation
String
wlan.tag.length Tag length
Unsigned 16-bit integer
wlan.tag.number Tag
Unsigned 16-bit integer
wlan.tagged.all Tagged parameters
Unsigned 16-bit integer
ILMI (ilmi)
IP Payload Compression (ipcomp)
ipcomp.cpi CPI
Unsigned 16-bit integer
ipcomp.flags Flags
Unsigned 8-bit integer
IPX Message (ipxmsg)
ipxmsg.conn Connection Number
Unsigned 8-bit integer
ipxmsg.sigchar Signature Char
Unsigned 8-bit integer
IPX Routing Information Protocol (ipxrip)
ipxrip.request Request
Boolean
ipxrip.response Response
Boolean
ISDN Q.921-User Adaptation Layer (iua)
hf.iua.one_bit One bit
Boolean
Unsigned 8-bit integer
hf.iua.spare_bit Spare bit
Boolean
hf.iua.tei TEI
Unsigned 8-bit integer
hf.iua.zero_bit Zero bit
Boolean
iua.asp_reason Reason
Unsigned 32-bit integer
iua.error_code Error code
Unsigned 32-bit integer
iua.info_string Info string
String
iua.int_interface_identifier Integer interface identifier
Unsigned 32-bit integer
iua.interface_range_end End
Unsigned 32-bit integer
iua.interface_range_start Start
Unsigned 32-bit integer
iua.message_class Message class
Unsigned 8-bit integer
iua.message_length Message length
Unsigned 32-bit integer
iua.message_type Message Type
Unsigned 8-bit integer
iua.parameter_length Parameter length
Unsigned 16-bit integer
iua.parameter_tag Parameter Tag
Unsigned 16-bit integer
iua.release_reason Reason
Unsigned 32-bit integer
iua.reserved Reserved
Unsigned 8-bit integer
iua.status_identification Status identification
Unsigned 16-bit integer
Unsigned 16-bit integer
iua.tei_status TEI status
Unsigned 32-bit integer
iua.text_interface_identifier Text interface identifier
String
iua.traffic_mode_type Traffic mode type
Unsigned 32-bit integer
iua.version Version
Unsigned 8-bit integer
ISIS HELLO (isis_hello)
isis_hello.circuite_type Circuit type
Unsigned 8-bit integer
isis_hello.clv_ipv4_int_addr IPv4 interface address
IPv4 address
isis_hello.clv_ipv6_int_addr IPv6 interface address
IPv6 address
isis_hello.holding_timer Holding timer
Unsigned 16-bit integer
isis_hello.lan_id SystemID{ Designated IS }
Byte array
isis_hello.local_circuit_id Local circuit ID
Unsigned 8-bit integer
isis_hello.pdu_length PDU length
Unsigned 16-bit integer
isis_hello.priority Priority
Unsigned 8-bit integer
isis_hello.source_id SystemID{ Sender of PDU }
Byte array
ISO 10589 ISIS Complete Sequence Numbers Protocol Data
Unit (isis_csnp)
isis_csnp.pdu_length PDU length
Unsigned 16-bit integer
Protocol (isis)
isis.irpd Intra Domain Routing Protocol Discriminator
Unsigned 8-bit integer
isis.len PDU Header Length
Unsigned 8-bit integer
isis.max_area_adr Max.AREAs: (0==3)
Unsigned 8-bit integer
isis.reserved Reserved (==0)
Unsigned 8-bit integer
isis.sysid_len System ID Length
Unsigned 8-bit integer
isis.type PDU Type :
Unsigned 8-bit integer
isis.version Version (==1)
Unsigned 8-bit integer
isis.version2 Version2 (==1)
Unsigned 8-bit integer
ISO 10589 ISIS Link State Protocol Data Unit (isis_lsp)
isis_lsp.checksum Checksum
Unsigned 16-bit integer
isis_lsp.clv_ipv4_int_addr IPv4 interface address:
IPv4 address
isis_lsp.clv_ipv6_int_addr IPv6 interface address
IPv6 address
isis_lsp.clv_te_router_id Traffic Engineering Router ID:
IPv4 address
isis_lsp.pdu_length PDU length
Unsigned 16-bit integer
isis_lsp.remaining_life Remaining life
Unsigned 16-bit integer
isis_lsp.sequence_number Sequence number
Unsigned 32-bit integer
(isis_psnp)
isis_psnp.pdu_length PDU length
Unsigned 16-bit integer
ISO 8073 COTP Connection-Oriented Transport Protocol
(cotp)
ISO 8473 CLNP ConnectionLess Network Protocol (clnp)
clnp.checksum Checksum
Unsigned 16-bit integer
clnp.dsap DA
Byte array
clnp.dsap.len DAL
Unsigned 8-bit integer
clnp.len HDR Length
Unsigned 8-bit integer
clnp.nlpi Network Layer Protocol Identifier
Unsigned 8-bit integer
clnp.pdu.len PDU length
Unsigned 16-bit integer
clnp.ssap SA
Byte array
clnp.ssap.len SAL
Unsigned 8-bit integer
clnp.ttl Holding Time
Unsigned 8-bit integer
clnp.type PDU Type
Unsigned 8-bit integer
clnp.version Version
Unsigned 8-bit integer
ISO 8602 CLTP ConnectionLess Transport Protocol (cltp)
ISO 9542 ESIS Routeing Information Exchange Protocol
(esis)
Unsigned 16-bit integer
esis.htime Holding Time
Unsigned 16-bit integer
esis.length PDU Length
Unsigned 8-bit integer
esis.nlpi Network Layer Protocol Identifier
Unsigned 8-bit integer
esis.res Reserved(==0)
Unsigned 8-bit integer
esis.type PDU Type
Unsigned 8-bit integer
esis.ver Version (==1)
Unsigned 8-bit integer
ITU-T Recommendation H.261 (h261)
h261.ebit End bit position
Unsigned 8-bit integer
h261.gobn GOB Number
Unsigned 8-bit integer
h261.hmvd Horizontal motion vctor data
Unsigned 8-bit integer
h261.i Intra frame encoded data flag
Boolean
h261.mbap Macroblock address predictor
Unsigned 8-bit integer
h261.quant Quantizer
Unsigned 8-bit integer
h261.sbit Start bit position
Unsigned 8-bit integer
h261.stream H.261 stream
Byte array
h261.v Motion vector flag
Boolean
h261.vmvd Vertical motion vector data
Unsigned 8-bit integer
icp.length Length
Unsigned 16-bit integer
icp.nr Request Number
Unsigned 32-bit integer
icp.opcode Opcode
Unsigned 8-bit integer
icp.version Version
Unsigned 8-bit integer
Internet Control Message Protocol (icmp)
icmp.checksum Checksum
Unsigned 16-bit integer
icmp.checksum_bad Bad Checksum
Boolean
icmp.code Code
Unsigned 8-bit integer
icmp.type Type
Unsigned 8-bit integer
Internet Control Message Protocol v6 (icmpv6)
icmpv6.checksum Checksum
Unsigned 16-bit integer
icmpv6.checksum_bad Bad Checksum
Boolean
icmpv6.code Code
Unsigned 8-bit integer
icmpv6.type Type
Unsigned 8-bit integer
Internet Group Management Protocol (igmp)
igmp.checksum Checksum
Unsigned 16-bit integer
igmp.group Group address
IPv4 address
Unsigned 8-bit integer
igmp.unused Unused
Unsigned 8-bit integer
igmp.version Version
Unsigned 8-bit integer
Internet Message Access Protocol (imap)
imap.request Request
Boolean
imap.response Response
Boolean
Internet Printing Protocol (ipp)
Internet Protocol (ip)
ip.addr Source or Destination Address
IPv4 address
ip.checksum Header checksum
Unsigned 16-bit integer
ip.checksum_bad Bad Header checksum
Boolean
ip.dsfield Differentiated Services field
Unsigned 8-bit integer
ip.dsfield.ce ECN-CE
Unsigned 8-bit integer
ip.dsfield.dscp Differentiated Services Codepoint
Unsigned 8-bit integer
ip.dsfield.ect ECN-Capable Transport (ECT)
Unsigned 8-bit integer
ip.dst Destination
IPv4 address
ip.flags Flags
Unsigned 8-bit integer
ip.flags.df Don't fragment
Boolean
Boolean
ip.frag_offset Fragment offset
Unsigned 16-bit integer
ip.fragment IP Fragment
String
ip.fragment.error Defragmentation error
String
ip.fragment.multipletails Multiple tail fragments found
Boolean
ip.fragment.overlap Fragment overlap
Boolean
ip.fragment.overlap.conflict Conflicting data in fragment overlap
Boolean
ip.fragment.toolongfragment Fragment too long
Boolean
ip.fragments IP Fragments
String
ip.hdr_len Header Length
Unsigned 8-bit integer
ip.id Identification
Unsigned 16-bit integer
ip.len Total Length
Unsigned 16-bit integer
ip.proto Protocol
Unsigned 8-bit integer
ip.src Source
IPv4 address
ip.tos Type of Service
Unsigned 8-bit integer
ip.tos.cost Cost
Boolean
ip.tos.delay Delay
Boolean
ip.tos.precedence Precedence
Unsigned 8-bit integer
Boolean
ip.tos.throughput Throughput
Boolean
ip.ttl Time to live
Unsigned 8-bit integer
ip.version Version
Unsigned 8-bit integer
Internet Protocol Version 6 (ipv6)
ipv6.addr Address
IPv6 address
ipv6.class Traffic class
Unsigned 8-bit integer
ipv6.dst Destination
IPv6 address
ipv6.flow Flowlabel
Unsigned 32-bit integer
ipv6.hlim Hop limit
Unsigned 8-bit integer
ipv6.mipv6_a_flag Acknowledge (A)
Boolean
ipv6.mipv6_b_flag Bicasting all (B)
Boolean
ipv6.mipv6_d_flag Duplicate Address Detection (D)
Boolean
ipv6.mipv6_h_flag Home Registration (H)
Boolean
ipv6.mipv6_home_address Home Address
IPv6 address
ipv6.mipv6_length Option Length
Unsigned 8-bit integer
ipv6.mipv6_life_time Life Time
Unsigned 32-bit integer
ipv6.mipv6_m_flag MAP Registration (M)
Boolean
Unsigned 8-bit integer
ipv6.mipv6_r_flag Router (R)
Boolean
ipv6.mipv6_refresh Refresh
Unsigned 32-bit integer
ipv6.mipv6_sequence_number Sequence Number
Unsigned 16-bit integer
ipv6.mipv6_status Status
Unsigned 8-bit integer
ipv6.mipv6_sub_alternative_COA Alternative Care of Address
IPv6 address
ipv6.mipv6_sub_length Sub-Option Length
Unsigned 8-bit integer
ipv6.mipv6_sub_type Sub-Option Type
Unsigned 8-bit integer
ipv6.mipv6_sub_unique_ID Unique Identifier
Unsigned 16-bit integer
ipv6.mipv6_type Option Type
Unsigned 8-bit integer
ipv6.nxt Next header
Unsigned 8-bit integer
ipv6.plen Payload length
Unsigned 16-bit integer
ipv6.src Source
IPv6 address
ipv6.version Version
Unsigned 8-bit integer
Internet Relay Chat (irc)
irc.command Command
String
irc.request Request
Boolean
irc.response Response
Boolean
(isakmp)
Internetwork Packet eXchange (ipx)
ipx.checksum Checksum
Unsigned 16-bit integer
ipx.dst.net Destination Network
IPX network or server name
ipx.dst.node Destination Node
6-byte Hardware (MAC) Address
ipx.dst.socket Destination Socket
Unsigned 16-bit integer
ipx.hops Transport Control (Hops)
Unsigned 8-bit integer
ipx.len Length
Unsigned 16-bit integer
ipx.packet_type Packet Type
Unsigned 8-bit integer
ipx.src.net Source Network
IPX network or server name
ipx.src.node Source Node
6-byte Hardware (MAC) Address
ipx.src.socket Source Socket
Unsigned 16-bit integer
Kerberos (kerberos)
Kernel Lock Manager (klm)
klm.block block
Boolean
klm.exclusive exclusive
Boolean
klm.holder holder
No value
klm.len length
Unsigned 32-bit integer
No value
klm.offset offset
Unsigned 32-bit integer
klm.pid pid
Unsigned 32-bit integer
klm.servername server name
String
klm.stats stats
Unsigned 32-bit integer
Label Distribution Protocol (ldp)
ldp,msg.tlv.hello.requested Hello Requested
Boolean
ldp.hdr.ldpid.lsid Label Space ID
Unsigned 16-bit integer
ldp.hdr.ldpid.lsr LSR ID
Unsigned 32-bit integer
ldp.hdr.pdu_len PDU Length
Unsigned 16-bit integer
ldp.hdr.version Version
Unsigned 16-bit integer
ldp.msg.id Message ID
Unsigned 32-bit integer
ldp.msg.len Message Length
Unsigned 16-bit integer
ldp.msg.tlv.fec.af FEC Element Address Type
Unsigned 16-bit integer
ldp.msg.tlv.fec.len FEC Element Length
Unsigned 8-bit integer
ldp.msg.tlv.fec.pfval FEC Element Prefix Value
Unsigned 32-bit integer
ldp.msg.tlv.fec.type FEC Element Type
Unsigned 8-bit integer
ldp.msg.tlv.hello.cnf_seqno Configuration Sequence Number
Unsigned 32-bit integer
Unsigned 16-bit integer
ldp.msg.tlv.hello.res Reserved
Unsigned 16-bit integer
ldp.msg.tlv.hello.targeted Targeted Hello
Boolean
ldp.msg.tlv.label Generic Label
Unsigned 32-bit integer
ldp.msg.tlv.len TLV Length
Unsigned 16-bit integer
ldp.msg.tlv.type TLV Type
Unsigned 16-bit integer
ldp.msg.tlv.value TLV Value
Byte array
ldp.msg.type Message Type
Unsigned 16-bit integer
ldp.req Request
Boolean
ldp.rsp Response
Boolean
Layer 2 Tunneling Protocol (l2tp)
l2tp.Nr Nr
Unsigned 16-bit integer
l2tp.Ns Ns
Unsigned 16-bit integer
l2tp.length Length
Unsigned 16-bit integer
l2tp.offset Offset
Unsigned 16-bit integer
l2tp.session Session ID
Unsigned 16-bit integer
l2tp.tunnel Tunnel ID
Unsigned 16-bit integer
lt2p.code code
Unsigned 16-bit integer
Boolean
lt2p.offset_bit Offset bit
Boolean
lt2p.priority Priority
Boolean
lt2p.seq_bit Sequence Bit
Boolean
lt2p.type Type
Unsigned 16-bit integer
lt2p.version Version
Unsigned 16-bit integer
Lightweight Directory Access Protocol (ldap)
ldap.abandon.msgid Abandon Msg Id
Unsigned 32-bit integer
ldap.attribute Attribute
String
ldap.bind.auth_type Auth Type
Unsigned 8-bit integer
ldap.bind.dn DN
String
ldap.bind.password Password
String
ldap.bind.version Version
Unsigned 32-bit integer
ldap.compare.test Test
String
ldap.dn Distinguished Name
String
ldap.length Length
Unsigned 32-bit integer
ldap.message_id Message Id
Unsigned 32-bit integer
ldap.message_length Message Length
Unsigned 32-bit integer
Unsigned 8-bit integer
ldap.modify.add Add
String
ldap.modify.delete Delete
String
ldap.modify.replace Replace
String
ldap.modrdn.delete Delete Values
Boolean
ldap.modrdn.name New Name
String
ldap.modrdn.superior New Location
String
ldap.result.code Result Code
Unsigned 8-bit integer
ldap.result.errormsg Error Message
String
ldap.result.matcheddn Matched DN
String
ldap.result.referral Referral
String
ldap.search.basedn Base DN
String
ldap.search.dereference Dereference
Unsigned 8-bit integer
ldap.search.filter Filter
String
ldap.search.scope Scope
Unsigned 8-bit integer
ldap.search.sizelimit Size Limit
Unsigned 32-bit integer
ldap.search.timelimit Time Limit
Unsigned 32-bit integer
ldap.search.typesonly Attributes Only
Boolean
String
Line Printer Daemon Protocol (lpd)
lpd.request Request
Boolean
lpd.response Response
Boolean
Link Access Procedure Balanced (LAPB) (lapb)
lapb.address Address Field
Unsigned 8-bit integer
lapb.control Control Field
Unsigned 8-bit integer
Link Access Procedure Balanced Ethernet (LAPBETHER) (lap
bether)
lapbether.length Length Field
Unsigned 16-bit integer
Link Access Procedure, Channel D (LAPD) (lapd)
lapd.address Address Field
Unsigned 16-bit integer
lapd.control Control Field
Unsigned 16-bit integer
lapd.cr C/R
Unsigned 16-bit integer
lapd.ea1 EA1
Unsigned 16-bit integer
lapd.ea2 EA2
Unsigned 16-bit integer
lapd.sapi SAPI
Unsigned 16-bit integer
lapd.tei TEI
Unsigned 16-bit integer
sll.etype Protocol
Unsigned 16-bit integer
sll.halen Link-layer address length
Unsigned 16-bit integer
sll.hatype Link-layer address type
Unsigned 16-bit integer
sll.ltype Protocol
Unsigned 16-bit integer
sll.pkttype Packet type
Unsigned 16-bit integer
sll.src.eth Source
6-byte Hardware (MAC) Address
sll.src.other Source
Byte array
sll.trailer Trailer
Byte array
Local Management Interface (lmi)
lmi.cmd Call reference
Unsigned 8-bit integer
lmi.dlci_act DLCI Active
Unsigned 8-bit integer
lmi.dlci_hi DLCI High
Unsigned 8-bit integer
lmi.dlci_low DLCI Low
Unsigned 8-bit integer
lmi.dlci_new DLCI New
Unsigned 8-bit integer
lmi.ele_rcd_type Record Type
Unsigned 8-bit integer
lmi.inf_ele Information Element
Unsigned 8-bit integer
lmi.inf_ele_len Length
Unsigned 8-bit integer
Unsigned 8-bit integer
lmi.msg_type Message Type
Unsigned 8-bit integer
lmi.recv_seq Recv Seq
Unsigned 8-bit integer
lmi.send_seq Send Seq
Unsigned 8-bit integer
Logical-Link Control (llc)
llc.control Control
Unsigned 16-bit integer
llc.dsap DSAP
Unsigned 8-bit integer
llc.dsap.ig IG Bit
Boolean
llc.oui Organization Code
Unsigned 24-bit integer
llc.pid Protocol ID
Unsigned 16-bit integer
llc.ssap SSAP
Unsigned 8-bit integer
llc.ssap.cr CR Bit
Boolean
llc.type Type
Unsigned 16-bit integer
Lucent/Ascend debug output (ascend)
ascend.chunk WDD Chunk
Unsigned 32-bit integer
ascend.number Called number
String
ascend.sess Session ID
Unsigned 32-bit integer
ascend.task Task
Unsigned 32-bit integer
Unsigned 32-bit integer
ascend.user User name
String
MAPI (mapi)
mapi.request Request
Boolean
mapi.response Response
Boolean
MS Proxy Protocol (msproxy)
msproxy.bindaddr Destination
IPv4 address
msproxy.bindid Bound Port Id
Unsigned 32-bit integer
msproxy.bindport Bind Port
Unsigned 16-bit integer
msproxy.boundport Bound Port
Unsigned 16-bit integer
msproxy.clntport Client Port
Unsigned 16-bit integer
msproxy.command Command
Unsigned 16-bit integer
msproxy.dstaddr Destination Address
IPv4 address
msproxy.dstport Destination Port
Unsigned 16-bit integer
msproxy.resolvaddr Address
IPv4 address
msproxy.server_ext_addr Server External Address
IPv4 address
msproxy.server_ext_port Server External Port
Unsigned 16-bit integer
msproxy.server_int_addr Server Internal Address
IPv4 address
Unsigned 16-bit integer
msproxy.serveraddr Server Address
IPv4 address
msproxy.serverport Server Port
Unsigned 16-bit integer
msproxy.srcport Source Port
Unsigned 16-bit integer
MTP 3 User Adaptation Layer (m3ua)
m3ua.affected_dpc Affected DPC
Unsigned 24-bit integer
m3ua.congestion_level Congestion level
Unsigned 8-bit integer
m3ua.error_code Error code
Unsigned 32-bit integer
m3ua.info_string Info string
String
m3ua.mask Mask
Unsigned 8-bit integer
m3ua.message_class Message class
Unsigned 8-bit integer
m3ua.message_length Message length
Unsigned 32-bit integer
m3ua.message_type Message Type
Unsigned 8-bit integer
m3ua.network_appearance Network appearance
Unsigned 32-bit integer
m3ua.parameter_length Parameter length
Unsigned 16-bit integer
m3ua.parameter_tag Parameter Tag
Unsigned 16-bit integer
m3ua.reason Reason
Unsigned 32-bit integer
m3ua.reserved Reserved
Unsigned 8-bit integer
Unsigned 32-bit integer
m3ua.status_info Status info
Unsigned 16-bit integer
m3ua.status_type Status type
Unsigned 16-bit integer
m3ua.traffic_mode_type Traffic mode Type
Unsigned 32-bit integer
m3ua.unavailability_cause Unavailability cause
Unsigned 16-bit integer
m3ua.user_identity User Identity
Unsigned 16-bit integer
m3ua.version Version
Unsigned 8-bit integer
Malformed Frame (malformed)
Microsoft Windows Browser Protocol (browser)
Microsoft Windows Lanman Protocol (lanman)
Microsoft Windows Logon Protocol (netlogon)
Mobile IP (mip)
mip.auth.auth Authenticator
Byte array
mip.auth.spi SPI
Signed 32-bit integer
mip.b Broadcast Datagrams
Boolean
mip.coa Care of Address
IPv4 address
mip.code Reply Code
Unsigned 8-bit integer
mip.d Co-lcated Care-of Address
Boolean
Signed 8-bit integer
mip.ext.type Extension Type
Signed 8-bit integer
mip.g GRE
Boolean
mip.haaddr Home Agent
IPv4 address
mip.homeaddr Home Address
IPv4 address
mip.ident Identification
Date/Time stamp
mip.life Lifetime
Unsigned 16-bit integer
mip.m Minimal Encapsulation
Boolean
mip.nai NAI
String
mip.s Simultaneous Bindings
Boolean
mip.t Reverse Tunneling
Boolean
mip.type Message Type
Signed 8-bit integer
mip.v Van Jacobson
Boolean
Modbus/TCP (mbtcp)
modbus_tcp.func_code function code
Unsigned 8-bit integer
modbus_tcp.len length
Unsigned 16-bit integer
modbus_tcp.prot_id protocol identifier
Unsigned 16-bit integer
modbus_tcp.trans_id transaction identifier
Unsigned 16-bit integer
Unsigned 8-bit integer
Mount Service (mount)
mount.dump.directory Directory
String
mount.dump.entry Mount List Entry
No value
mount.dump.hostname Hostname
String
mount.export.directory Directory
String
mount.export.entry Export List Entry
No value
mount.export.group Group
String
mount.export.groups Groups
No value
mount.flavor Flavor
Unsigned 32-bit integer
mount.flavors Flavors
Unsigned 32-bit integer
mount.path Path
String
mount.pathconf.link_max Maximum number of links to a file
Unsigned 32-bit integer
mount.pathconf.mask Reply error/status bits
Unsigned 16-bit integer
mount.pathconf.mask.chown_restricted CHOWN_RESTRICTED
Boolean
mount.pathconf.mask.error_all ERROR_ALL
Boolean
mount.pathconf.mask.error_link_max ERROR_LINK_MAX
Boolean
mount.pathconf.mask.error_max_canon ERROR_MAX_CANON
Boolean
Boolean
mount.pathconf.mask.error_name_max ERROR_NAME_MAX
Boolean
mount.pathconf.mask.error_path_max ERROR_PATH_MAX
Boolean
mount.pathconf.mask.error_pipe_buf ERROR_PIPE_BUF
Boolean
mount.pathconf.mask.error_vdisable ERROR_VDISABLE
Boolean
mount.pathconf.mask.no_trunc NO_TRUNC
Boolean
mount.pathconf.max_canon Maximum terminal input line length
Unsigned 16-bit integer
mount.pathconf.max_input Terminal input buffer size
Unsigned 16-bit integer
mount.pathconf.name_max Maximum file name length
Unsigned 16-bit integer
mount.pathconf.path_max Maximum path name length
Unsigned 16-bit integer
mount.pathconf.pipe_buf Pipe buffer size
Unsigned 16-bit integer
mount.pathconf.vdisable_char VDISABLE character
Unsigned 8-bit integer
mount.status Status
Unsigned 32-bit integer
MultiProtocol Label Switching Header (mpls)
mpls.bottom MPLS Bottom Of Label Stack
Unsigned 8-bit integer
mpls.exp MPLS Experimental Bits
Unsigned 8-bit integer
mpls.label MPLS Label
Unsigned 32-bit integer
mpls.ttl MPLS TTL
Unsigned 8-bit integer
.nisplus.dummy
String
nisplus.access.mask access mask
No value
nisplus.aticks aticks
Unsigned 32-bit integer
nisplus.attr Attribute
No value
nisplus.attr.name name
String
nisplus.attr.val val
String
nisplus.attributes Attributes
No value
nisplus.callback.status status
Boolean
nisplus.checkpoint.dticks dticks
Unsigned 32-bit integer
nisplus.checkpoint.status status
Unsigned 32-bit integer
nisplus.checkpoint.zticks zticks
Unsigned 32-bit integer
nisplus.cookie cookie
String
nisplus.cticks cticks
Unsigned 32-bit integer
nisplus.ctime ctime
Date/Time stamp
nisplus.directory directory
No value
nisplus.directory.mask mask
No value
nisplus.directory.mask.group_create GROUP CREATE
Boolean
Boolean
nisplus.directory.mask.group_modify GROUP MODIFY
Boolean
nisplus.directory.mask.group_read GROUP READ
Boolean
nisplus.directory.mask.nobody_create NOBODY CREATE
Boolean
nisplus.directory.mask.nobody_destroy NOBODY DESTROY
Boolean
nisplus.directory.mask.nobody_modify NOBODY MODIFY
Boolean
nisplus.directory.mask.nobody_read NOBODY READ
Boolean
nisplus.directory.mask.owner_create OWNER CREATE
Boolean
nisplus.directory.mask.owner_destroy OWNER DESTROY
Boolean
nisplus.directory.mask.owner_modify OWNER MODIFY
Boolean
nisplus.directory.mask.owner_read OWNER READ
Boolean
nisplus.directory.mask.world_create WORLD CREATE
Boolean
nisplus.directory.mask.world_destroy WORLD DESTROY
Boolean
nisplus.directory.mask.world_modify WORLD MODIFY
Boolean
nisplus.directory.mask.world_read WORLD READ
Boolean
nisplus.directory.mask_list mask list
No value
nisplus.directory.name directory name
String
nisplus.directory.ttl ttl
Unsigned 32-bit integer
Unsigned 32-bit integer
nisplus.dticks dticks
Unsigned 32-bit integer
nisplus.dump.dir directory
String
nisplus.dump.time time
Date/Time stamp
nisplus.endpoint endpoint
No value
nisplus.endpoint.family family
String
nisplus.endpoint.proto proto
String
nisplus.endpoint.uaddr addr
String
nisplus.endpoints nis endpoints
No value
nisplus.entry entry
No value
nisplus.entry.col column
No value
nisplus.entry.cols columns
No value
nisplus.entry.flags flags
Unsigned 32-bit integer
nisplus.entry.flags.asn ASN.1
Boolean
nisplus.entry.flags.binary BINARY
Boolean
nisplus.entry.flags.encrypted ENCRYPTED
Boolean
nisplus.entry.flags.modified MODIFIED
Boolean
nisplus.entry.flags.xdr XDR
Boolean
String
nisplus.entry.val val
String
nisplus.fd.dir.data data
String
nisplus.fd.dirname dirname
String
nisplus.fd.requester requester
String
nisplus.fd.sig signature
String
nisplus.group Group
No value
nisplus.group.flags flags
Unsigned 32-bit integer
nisplus.group.name group name
String
nisplus.grps Groups
No value
nisplus.ib.bufsize bufsize
Unsigned 32-bit integer
nisplus.ib.flags flags
Unsigned 32-bit integer
nisplus.key.data key data
String
nisplus.key.type type
Unsigned 32-bit integer
nisplus.link link
No value
nisplus.log.entries log entries
No value
nisplus.log.entry log entry
No value
nisplus.log.entry.type type
Unsigned 32-bit integer
String
nisplus.log.time time
Date/Time stamp
nisplus.mtime mtime
Date/Time stamp
nisplus.object NIS Object
No value
nisplus.object.domain domain
String
nisplus.object.group group
String
nisplus.object.name name
String
nisplus.object.oid Object Identity Verifier
No value
nisplus.object.owner owner
String
nisplus.object.private private
String
nisplus.object.ttl ttl
Unsigned 32-bit integer
nisplus.object.type type
Unsigned 32-bit integer
nisplus.ping.dir directory
String
nisplus.ping.time time
Date/Time stamp
nisplus.server server
No value
nisplus.server.name name
String
nisplus.servers nis servers
No value
nisplus.status status
Unsigned 32-bit integer
No value
nisplus.table.col column
No value
nisplus.table.col.flags flags
No value
nisplus.table.col.name column name
String
nisplus.table.cols columns
No value
nisplus.table.flags.asn asn
Boolean
nisplus.table.flags.binary binary
Boolean
nisplus.table.flags.casesensitive casesensitive
Boolean
nisplus.table.flags.encrypted encrypted
Boolean
nisplus.table.flags.modified modified
Boolean
nisplus.table.flags.searchable searchable
Boolean
nisplus.table.flags.xdr xdr
Boolean
nisplus.table.maxcol max columns
Unsigned 16-bit integer
nisplus.table.path path
String
nisplus.table.separator separator
Unsigned 8-bit integer
nisplus.table.type type
String
nisplus.tag tag
No value
nisplus.tag.type type
Unsigned 32-bit integer
String
nisplus.taglist taglist
No value
nisplus.zticks zticks
Unsigned 32-bit integer
NIS+ Callback (nispluscb)
nispluscb.entries entries
No value
nispluscb.entry entry
No value
Name Binding Protocol (nbp)
nbp.count Count
Unsigned 8-bit integer
nbp.enum Enumerator
Unsigned 8-bit integer
nbp.info Info
Unsigned 8-bit integer
nbp.net Network
Unsigned 16-bit integer
nbp.node Node
Unsigned 8-bit integer
nbp.object Object
String
nbp.op Operation
Unsigned 8-bit integer
nbp.port Port
Unsigned 8-bit integer
nbp.tid Transaction ID
Unsigned 8-bit integer
nbp.type Type
String
nbp.zone Zone
String
NetBIOS (netbios)
netbios.ack Acknowledge
Boolean
netbios.ack_expected Acknowledge expected
Boolean
netbios.ack_with_data Acknowledge with data
Boolean
netbios.call_name_type Call Name Type
Signed 16-bit integer
netbios.command Command
Unsigned 16-bit integer
netbios.data2 DATA2 value
Unsigned 16-bit integer
netbios.hdr_len Header Length
Unsigned 16-bit integer
netbios.largest_frame Largest Frame
Unsigned 8-bit integer
netbios.local_session Local Session No.
Unsigned 8-bit integer
netbios.name Netbios Name
String
netbios.name_type Netbios Name Type
Unsigned 16-bit integer
netbios.recv_cont_req RECEIVE_CONTINUE requested
Boolean
netbios.remote_session Remote Session No.
Unsigned 8-bit integer
netbios.resp_corrl Response Correlator
Signed 16-bit integer
netbios.send_no_ack Handle SEND.NO.ACK
Boolean
netbios.version NetBIOS Version
Boolean
Signed 16-bit integer
NetBIOS Datagram Service (nbdgm)
nbdgm.dgram_id Datagram ID
Unsigned 16-bit integer
nbdgm.first First fragment
Boolean
nbdgm.next Fragmented
Boolean
nbdgm.node_type Node Type
Unsigned 8-bit integer
nbdgm.src.ip Source IP
IPv4 address
nbdgm.src.port Source Port
Unsigned 16-bit integer
nbdgm.type Message Type
Unsigned 8-bit integer
NetBIOS Name Service (nbns)
nbns.count.add_rr Additional RRs
Unsigned 16-bit integer
nbns.count.answers Answer RRs
Unsigned 16-bit integer
nbns.count.auth_rr Authority RRs
Unsigned 16-bit integer
nbns.count.queries Questions
Unsigned 16-bit integer
nbns.id Transaction ID
Unsigned 16-bit integer
nbns.query Query
Boolean
nbns.response Response
Boolean
nbss.flags Flags
Unsigned 8-bit integer
nbss.type Message Type
Unsigned 8-bit integer
NetBIOS over IPX (nbipx)
NetWare Core Protocol (ncp)
ncp.buffer_size Buffer Size
Unsigned 16-bit integer
ncp.completion_code Completion Code
Unsigned 8-bit integer
ncp.connection Connection Number
Unsigned 16-bit integer
ncp.connection_number Connection Number
Unsigned 32-bit integer
ncp.connection_status Connection Status
Unsigned 8-bit integer
ncp.file_handle File Handle
Byte array
ncp.file_offset File Offset
Unsigned 32-bit integer
ncp.file_size File Size
Unsigned 32-bit integer
ncp.func Function
Unsigned 8-bit integer
ncp.ip.length NCP over IP length
Unsigned 32-bit integer
ncp.ip.replybufsize NCP over IP Reply Buffer Size
Unsigned 32-bit integer
ncp.ip.signature NCP over IP signature
Unsigned 32-bit integer
ncp.ip.version NCP over IP Version
Unsigned 32-bit integer
Unsigned 16-bit integer
ncp.length Packet Length
Unsigned 16-bit integer
ncp.max_bytes Maximum Number of Bytes
Unsigned 16-bit integer
ncp.num_bytes Number of Bytes
Unsigned 16-bit integer
ncp.object_flags Object Flags
Unsigned 8-bit integer
ncp.object_has_properites Object Has Properties
Unsigned 8-bit integer
ncp.object_id Object ID
Unsigned 32-bit integer
ncp.object_name Object Name
ncp.object_name1 Object Name
String
ncp.object_security Object Security
Unsigned 8-bit integer
ncp.object_type Object Type
Unsigned 16-bit integer
ncp.property_data Property Data
Byte array
ncp.property_has_more_segments Property Has More Segments
Unsigned 8-bit integer
ncp.property_name Property Name
ncp.property_segment Property Segment
Unsigned 8-bit integer
ncp.property_type Property Type
Unsigned 8-bit integer
ncp.seq Sequence Number
Unsigned 8-bit integer
ncp.subfunc SubFunction
Unsigned 8-bit integer
ncp.task Task Number
Unsigned 8-bit integer
Unsigned 32-bit integer
ncp.type Type
Unsigned 16-bit integer
ncp.unknown_byte Unknown Byte
Unsigned 8-bit integer
Network File System (nfs)
nfs.ace ace
String
nfs.attr mand_attr
Unsigned 32-bit integer
nfs.call.operation Opcode
Unsigned 32-bit integer
nfs.change_info.atomic Atomic
Boolean
nfs.clientid Client ID
String
nfs.createmode Create Mode
Unsigned 32-bit integer
nfs.data Data
String
nfs.data_follows data_follows
Boolean
nfs.dirlist4.eof eof
Boolean
nfs.fattr4.attr_vals attr_vals
String
nfs.fattr4_archive fattr4_archive
Boolean
nfs.fattr4_cansettime fattr4_cansettime
Boolean
nfs.fattr4_case_insensitive fattr4_case_insensitive
Boolean
nfs.fattr4_case_preserving fattr4_case_preserving
Boolean
Boolean
nfs.fattr4_expire_type fattr4_expire_type
Unsigned 32-bit integer
nfs.fattr4_hidden fattr4_hidden
Boolean
nfs.fattr4_homogeneous fattr4_homogeneous
Boolean
nfs.fattr4_link_support fattr4_link_support
Boolean
nfs.fattr4_mimetype fattr4_mimetype
String
nfs.fattr4_named_attr fattr4_named_attr
Boolean
nfs.fattr4_no_trunc fattr4_no_trunc
Boolean
nfs.fattr4_owner fattr4_owner
String
nfs.fattr4_owner_group fattr4_owner_group
String
nfs.fattr4_symlink_support fattr4_symlink_support
Boolean
nfs.fattr4_system fattr4_system
Boolean
nfs.fattr4_unique_handles fattr4_unique_handles
Boolean
nfs.fh.dentry dentry
Unsigned 32-bit integer
nfs.fh.dev device
Unsigned 32-bit integer
nfs.fh.dirinode directory inode
Unsigned 32-bit integer
nfs.fh.fn file number
Unsigned 32-bit integer
nfs.fh.fn.generation generation
Unsigned 32-bit integer
Unsigned 32-bit integer
nfs.fh.fn.len length
Unsigned 32-bit integer
nfs.fh.fsid.major major
Unsigned 32-bit integer
nfs.fh.fsid.minor minor
Unsigned 32-bit integer
nfs.fh.fstype file system type
Unsigned 32-bit integer
nfs.fh.hp.len length
Unsigned 32-bit integer
nfs.fh.pinode pseudo inode
Unsigned 32-bit integer
nfs.fh.xdev exported device
Unsigned 32-bit integer
nfs.fh.xfn exported file number
Unsigned 32-bit integer
nfs.fh.xfn.generation generation
Unsigned 32-bit integer
nfs.fh.xfn.inode exported inode
Unsigned 32-bit integer
nfs.fh.xfn.len length
Unsigned 32-bit integer
nfs.fh.xfsid.major exported major
Unsigned 32-bit integer
nfs.fh.xfsid.minor exported minor
Unsigned 32-bit integer
nfs.fsinfo.dtpref dtpref
Unsigned 32-bit integer
nfs.fsinfo.propeties Properties
Unsigned 32-bit integer
nfs.fsinfo.rtmax rtmax
Unsigned 32-bit integer
nfs.fsinfo.rtmult rtmult
Unsigned 32-bit integer
Unsigned 32-bit integer
nfs.fsinfo.wtmax wtmax
Unsigned 32-bit integer
nfs.fsinfo.wtmult wtmult
Unsigned 32-bit integer
nfs.fsinfo.wtpref wtpref
Unsigned 32-bit integer
nfs.fsstat.invarsec invarsec
Unsigned 32-bit integer
nfs.name Name
String
nfs.nfs_ftype4 nfs_ftype4
Unsigned 32-bit integer
nfs.open.claim_type Claim Type
Unsigned 32-bit integer
nfs.open.delegation_type Delegation Type
Unsigned 32-bit integer
nfs.open.limit_by Space Limit
Unsigned 32-bit integer
nfs.open.opentype Open Type
Unsigned 32-bit integer
nfs.open4.share_access share_access
Unsigned 32-bit integer
nfs.open4.share_deny share_deny
Unsigned 32-bit integer
nfs.pathconf.case_insensitive case_insensitive
Boolean
nfs.pathconf.case_preserving case_preserving
Boolean
nfs.pathconf.chown_restricted chown_restricted
Boolean
nfs.pathconf.linkmax linkmax
Unsigned 32-bit integer
nfs.pathconf.name_max name_max
Unsigned 32-bit integer
Boolean
nfs.pathname.component Filename
String
nfs.read.count Count
Unsigned 32-bit integer
nfs.read.eof EOF
Boolean
nfs.read.offset Offset
Unsigned 32-bit integer
nfs.read.totalcount Total Count
Unsigned 32-bit integer
nfs.readdir.cookie Cookie
Unsigned 32-bit integer
nfs.readdir.count Count
Unsigned 32-bit integer
nfs.readdir.entry Entry
No value
nfs.readdir.entry.cookie Cookie
Unsigned 32-bit integer
nfs.readdir.entry.fileid File ID
Unsigned 32-bit integer
nfs.readdir.entry.name Name
String
nfs.readdir.eof EOF
Unsigned 32-bit integer
nfs.readdirplus.entry.name Name
String
nfs.readlink.data Data
String
nfs.recall EOF
Boolean
nfs.reply.operation Opcode
Unsigned 32-bit integer
nfs.seqid seqid
Unsigned 32-bit integer
String
nfs.set_it set_it
Unsigned 32-bit integer
nfs.stable_how4 stable_how4
Unsigned 32-bit integer
nfs.statfs.bavail Available Blocks
Unsigned 32-bit integer
nfs.statfs.bfree Free Blocks
Unsigned 32-bit integer
nfs.statfs.blocks Total Blocks
Unsigned 32-bit integer
nfs.statfs.bsize Block Size
Unsigned 32-bit integer
nfs.statfs.tsize Transfer Size
Unsigned 32-bit integer
nfs.status Status
Unsigned 32-bit integer
nfs.status2 Status
Unsigned 32-bit integer
nfs.symlink.linktext Name
String
nfs.symlink.to To
String
nfs.tag Tag
String
nfs.type Type
Unsigned 32-bit integer
nfs.who who
String
nfs.write.beginoffset Begin Offset
Unsigned 32-bit integer
nfs.write.committed Committed
Unsigned 32-bit integer
nfs.write.offset Offset
Unsigned 32-bit integer
Unsigned 32-bit integer
nfs.write.totalcount Total Count
Unsigned 32-bit integer
Network Lock Manager Protocol (nlm)
nlm.block block
Boolean
nlm.cookie cookie
String
nlm.exclusive exclusive
Boolean
nlm.holder holder
No value
nlm.lock lock
No value
nlm.lock.caller_name caller_name
String
nlm.lock.l_len l_len
Unsigned 32-bit integer
nlm.lock.l_offset l_offset
Unsigned 32-bit integer
nlm.lock.owner owner
String
nlm.lock.svid svid
Unsigned 32-bit integer
nlm.reclaim reclaim
Boolean
nlm.sequence sequence
Signed 32-bit integer
nlm.share share
No value
nlm.share.access access
Unsigned 32-bit integer
nlm.share.mode mode
Unsigned 32-bit integer
String
nlm.state state
Unsigned 32-bit integer
nlm.test_stat test_stat
No value
nlm.test_stat.stat stat
Unsigned 32-bit integer
Network News Transfer Protocol (nntp)
nntp.request Request
Boolean
nntp.response Response
Boolean
Network Status Monitor CallBack Protocol (stat-cb)
statnotify.name Name
String
statnotify.priv Priv
Byte array
statnotify.state State
Unsigned 32-bit integer
Network Status Monitor Protocol (stat)
stat.mon Monitor
No value
stat.mon_id.name Monitor ID Name
String
stat.my_id My ID
No value
stat.my_id.hostname Hostname
String
stat.my_id.proc Procedure
Unsigned 32-bit integer
stat.my_id.prog Program
Unsigned 32-bit integer
Unsigned 32-bit integer
stat.name Name
String
stat.priv Priv
Byte array
stat.stat_chge Status Change
No value
stat.stat_res Status Result
No value
stat.stat_res.res Result
Unsigned 32-bit integer
stat.stat_res.state State
Unsigned 32-bit integer
stat.state State
Unsigned 32-bit integer
Network Time Protocol (ntp)
ntp.flags Flags
Unsigned 8-bit integer
ntp.flags.li Leap Indicator
Unsigned 8-bit integer
ntp.flags.mode Mode
Unsigned 8-bit integer
ntp.flags.vn Version number
Unsigned 8-bit integer
ntp.keyid Key ID
Byte array
ntp.mac Message Authentication Code
Byte array
ntp.org Originate Time Stamp
Byte array
ntp.ppoll Peer Polling Interval
Unsigned 8-bit integer
ntp.precision Peer Clock Precision
Unsigned 8-bit integer
Byte array
ntp.refid Reference Clock ID
Byte array
ntp.reftime Reference Clock Update Time
Byte array
ntp.rootdelay Root Delay
Double-precision floating point
ntp.rootdispersion Clock Dispersion
Double-precision floating point
ntp.stratum Peer Clock Stratum
Unsigned 8-bit integer
ntp.xmt Transmit Time Stamp
Byte array
Null/Loopback (null)
null.family Family
Unsigned 32-bit integer
null.type Type
Unsigned 16-bit integer
Open Shortest Path First (ospf)
PPP IP Control Protocol (ipcp)
PPP Link Control Protocol (lcp)
PPP Multilink Protocol (mp)
mp.first First fragment
Boolean
mp.last Last fragment
Boolean
mp.seq Sequence number
Unsigned 24-bit integer
PPP-over-Ethernet Session (pppoes)
Point-to-Point Protocol (ppp)
Point-to-Point Tunnelling Protocol (pptp)
pptp.type Message type
Unsigned 16-bit integer
Portmap (portmap)
portmap.answer Answer
Boolean
portmap.args Arguments
Byte array
portmap.port Port
Unsigned 32-bit integer
portmap.proc Procedure
Unsigned 32-bit integer
portmap.prog Program
Unsigned 32-bit integer
portmap.proto Protocol
Unsigned 32-bit integer
portmap.result Result
Byte array
portmap.rpcb RPCB
No value
portmap.rpcb.addr Universal Address
String
portmap.rpcb.netid Network Id
String
portmap.rpcb.owner Owner of this Service
String
portmap.rpcb.prog Program
Unsigned 32-bit integer
Unsigned 32-bit integer
portmap.uaddr Universal Address
String
portmap.version Version
Unsigned 32-bit integer
Post Office Protocol (pop)
pop.request Request
Boolean
pop.response Response
Boolean
Protocol Independent Multicast (pim)
pim.cksum Checksum
Unsigned 16-bit integer
pim.type Type
Unsigned 8-bit integer
pim.version Version
Unsigned 8-bit integer
Q.2931 (q2931)
q2931.call_ref Call reference value
Byte array
q2931.call_ref_len Call reference value length
Unsigned 8-bit integer
q2931.disc Protocol discriminator
Unsigned 8-bit integer
q2931.message_action_indicator Action indicator
Unsigned 8-bit integer
q2931.message_flag Flag
Boolean
q2931.message_len Message length
Unsigned 16-bit integer
q2931.message_type Message type
Unsigned 8-bit integer
Unsigned 8-bit integer
Q.931 (q931)
q931.call_ref Call reference value
Byte array
q931.call_ref_len Call reference value length
Unsigned 8-bit integer
q931.disc Protocol discriminator
Unsigned 8-bit integer
q931.message_type Message type
Unsigned 8-bit integer
Quake Network Protocol (quake)
quake.control.accept.port Port
Unsigned 32-bit integer
quake.control.command Command
Unsigned 8-bit integer
quake.control.connect.game Game
String
quake.control.connect.version Version
Unsigned 8-bit integer
quake.control.player_info.address Address
String
quake.control.player_info.colors Colors
Unsigned 32-bit integer
quake.control.player_info.colors.pants Pants
Unsigned 8-bit integer
quake.control.player_info.colors.shirt Shirt
Unsigned 8-bit integer
quake.control.player_info.connect_time Connect Time
Unsigned 32-bit integer
quake.control.player_info.frags Frags
Unsigned 32-bit integer
quake.control.player_info.name Name
String
Unsigned 8-bit integer
quake.control.reject.reason Reason
String
quake.control.rule_info.lastrule Last Rule
String
quake.control.rule_info.rule Rule
String
quake.control.rule_info.value Value
String
quake.control.server_info.address Address
String
quake.control.server_info.game Game
String
quake.control.server_info.map Map
String
quake.control.server_info.max_player Maximal Number of Players
Unsigned 8-bit integer
quake.control.server_info.num_player Number of Players
Unsigned 8-bit integer
quake.control.server_info.server Server
String
quake.control.server_info.version Version
Unsigned 8-bit integer
quake.header.flags Flags
Unsigned 16-bit integer
quake.header.length Length
Unsigned 16-bit integer
quake.header.sequence Sequence
Unsigned 32-bit integer
RIPng (ripng)
ripng.cmd Command
Unsigned 8-bit integer
ripng.version Version
Unsigned 8-bit integer
rx.callnumber Call Number
Unsigned 32-bit integer
rx.cid CID
Unsigned 32-bit integer
rx.epoch Epoch
Date/Time stamp
rx.flags Flags
Unsigned 8-bit integer
rx.flags.client_init Client Initiated
Unsigned 8-bit integer
rx.flags.free_packet Free Packet
Unsigned 8-bit integer
rx.flags.last_packet Last Packet
Unsigned 8-bit integer
rx.flags.more_packets More Packets
Unsigned 8-bit integer
rx.flags.request_ack Request Ack
Unsigned 8-bit integer
rx.securityindex Security Index
Unsigned 32-bit integer
rx.seq Sequence Number
Unsigned 32-bit integer
rx.serial Serial
Unsigned 32-bit integer
rx.serviceid Service ID
Unsigned 16-bit integer
rx.spare Spare/Checksum
Unsigned 16-bit integer
rx.type Type
Unsigned 8-bit integer
rx.userstatus User Status
Unsigned 32-bit integer
ranap.CN_DomainIndicator CN-DomainIndicator
Unsigned 8-bit integer
ranap.IuSigConId IuSigConId
Byte array
ranap.NAS_PDU NAS-PDU
Byte array
ranap.PLMN_ID PLMN-ID
Byte array
ranap.ProtocolExtensionContainer_present ProtocolExtensionContainer
Unsigned 8-bit integer
ranap.ProtocolExtensionFields.octets Number of octets
Unsigned 16-bit integer
ranap.RAB_ID RAB-ID
Unsigned 8-bit integer
ranap.RAB_SetupOrModifyItemSecond.PDP_Type PDP-Type
Unsigned 8-bit integer
ranap.RAB_SetupOrModifyItemSecond.dataVolumeReportingIndication dataVolumeReportingIndication
Unsigned 8-bit integer
ranap.RAB_SetupOrModifyItemSecond.dl_GTP_PDU_SequenceNumber dl_GTP_PDU_SequenceNumber
Unsigned 16-bit integer
ranap.RAB_SetupOrModifyItemSecond.ul_GTP_PDU_SequenceNumber ul_GTP_PDU_SequenceNumber
Unsigned 16-bit integer
ranap.RAC RAC
Byte array
ranap.SAC SAC
Byte array
ranap.allocationOrRetentionPriority_present allocationOrRetentionPriority
Unsigned 8-bit integer
ranap.bindingID bindingID
Byte array
ranap.cause_choice cause choice
Unsigned 8-bit integer
ranap.cause_value cause value
Unsigned 8-bit integer
Unsigned 8-bit integer
ranap.dataVolumeReference_present dataVolumeReference
Unsigned 8-bit integer
ranap.dataVolumeReportingIndication_present dataVolumeReportingIndication
Unsigned 8-bit integer
ranap.dl-UnsuccessfullyTransmittedDataVolume dl-UnsuccessfullyTransmittedDataVolume
Unsigned 32-bit integer
ranap.dl_GTP_PDU_SequenceNumber_present dl_GTP_PDU_SequenceNumber
Unsigned 8-bit integer
ranap.dl_N_PDU_SequenceNumber_present dl_N_PDU_SequenceNumber
Unsigned 8-bit integer
ranap.dl_UnsuccessfullyTransmittedDataVolume_present dl-UnsuccessfullyTransmittedDataVolume
Unsigned 8-bit integer
ranap.dl_dataVolumes_present dl_dataVolumes
Unsigned 8-bit integer
ranap.gTP_TEI gTP_TEI
Byte array
ranap.guaranteedBitRate_present guaranteedBitRate
Unsigned 8-bit integer
ranap.iECriticality iECriticality
Unsigned 8-bit integer
ranap.iEsCriticalityDiagnostics_present iEsCriticalityDiagnostics
Unsigned 8-bit integer
ranap.ie.ProtocolExtensionFields.Id ProtocolExtensionField ID
Unsigned 16-bit integer
ranap.ie.ProtocolExtensionFields.criticality Criticality of ProtocolExtensionField
Unsigned 8-bit integer
ranap.ie.criticality Criticality of IE
Unsigned 8-bit integer
ranap.ie.iE-Extensions_present iE-Extensions
Unsigned 8-bit integer
ranap.ie.ie_id IE-ID
Unsigned 16-bit integer
ranap.ie.number_of_ProtocolExtensionFields Number of Protocol Extension Fields
Unsigned 16-bit integer
Unsigned 16-bit integer
ranap.ie.protocol_extension_present Protocol Extension
Unsigned 8-bit integer
ranap.ie_pair.first_criticality First Criticality
Unsigned 8-bit integer
ranap.ie_pair.first_value.number_of_octets Number of Octets in first value
Unsigned 16-bit integer
ranap.ie_pair.second_criticality Second Criticality
Unsigned 8-bit integer
ranap.ie_pair.second_value.number_of_octets Number of Octets in second value
Unsigned 16-bit integer
ranap.iuTransportAssociation_present iuTransportAssociation
Unsigned 8-bit integer
ranap.msg_extension_present Message Extension
Unsigned 8-bit integer
ranap.nAS-SynchronisationIndicator nAS-SynchronisationIndicator
Unsigned 8-bit integer
ranap.nAS-SynchronisationIndicator_present nAS-SynchronisationIndicator
Unsigned 8-bit integer
ranap.nas_pdu_length length of NAS-PDU
Unsigned 16-bit integer
ranap.num_of_CriticalityDiagnostics_IEs Number of CriticalityDiagnostics-IEs
Unsigned 16-bit integer
ranap.number_of_ProtocolExtensionFields Number of ProtocolExtensionFields
Unsigned 16-bit integer
ranap.number_of_RABs Number of RABs
Unsigned 8-bit integer
ranap.number_of_ies Number of IEs in list
Unsigned 16-bit integer
ranap.pDP_TypeInformation_present pDP_TypeInformation
Unsigned 8-bit integer
ranap.pdu.criticality Criticality of PDU
Unsigned 8-bit integer
ranap.pdu.num_of_octets Number of Octets in PDU
Unsigned 16-bit integer
Unsigned 16-bit integer
ranap.procedureCode_present procedureCode
Unsigned 8-bit integer
ranap.procedureCriticality procedureCriticality
Unsigned 8-bit integer
ranap.procedureCriticality_present procedureCriticality
Unsigned 8-bit integer
ranap.procedure_code Procedure Code
Unsigned 8-bit integer
ranap.rAB_Parameters_present rAB-Parameters
Unsigned 8-bit integer
ranap.rAB_SubflowCombinationBitRate_present subflowSDU_Size
Unsigned 8-bit integer
ranap.rab_Parameters.allocationOrRetentionPriority.pre_emptionCapability pre-emptionCapability
Unsigned 8-bit integer
ranap.rab_Parameters.allocationOrRetentionPriority.pre_emptionVulnerability pre-emptionVulnerability
Unsigned 8-bit integer
ranap.rab_Parameters.allocationOrRetentionPriority.priorityLevel priorityLevel
Unsigned 8-bit integer
ranap.rab_Parameters.allocationOrRetentionPriority.queuingAllowed queuingAllowed
Unsigned 8-bit integer
ranap.rab_Parameters.deliveryOrder deliveryOrder
Unsigned 8-bit integer
ranap.rab_Parameters.guaranteedBitrate guaranteedBitrate
Unsigned 32-bit integer
ranap.rab_Parameters.maxBitrate maxBitrate
Unsigned 32-bit integer
ranap.rab_Parameters.maxSDU_Size maxSDU_Size
Unsigned 16-bit integer
ranap.rab_Parameters.rAB_AsymmetryIndicator rAB_AsymmetryIndicator
Unsigned 8-bit integer
ranap.rab_Parameters.rAB_SubflowCombinationBitRate rAB_SubflowCombinationBitRate
Unsigned 32-bit integer
ranap.rab_Parameters.ranap_deliveryOfErroneousSDU deliveryOfErroneousSDU
Unsigned 8-bit integer
Unsigned 8-bit integer
ranap.rab_Parameters.residualBitErrorRatio.exponent residualBitErrorRatio: exponent
Unsigned 8-bit integer
ranap.rab_Parameters.residualBitErrorRatio.mantissa residualBitErrorRatio: mantissa
Unsigned 8-bit integer
ranap.rab_Parameters.sDU_ErrorRatio.exponent sDU_ErrorRatio: exponent
Unsigned 8-bit integer
ranap.rab_Parameters.sDU_ErrorRatio.mantissa sDU_ErrorRatio: mantissa
Unsigned 8-bit integer
ranap.rab_Parameters.sourceStatisticsDescriptor sourceStatisticsDescriptor
Unsigned 8-bit integer
ranap.rab_Parameters.subflowSDU_Size subflowSDU_Size
Unsigned 8-bit integer
ranap.rab_Parameters.trafficClass Traffic Class
Unsigned 8-bit integer
ranap.rab_Parameters.trafficHandlingPriority trafficHandlingPriority
Unsigned 8-bit integer
ranap.rab_Parameters.transferDelay transferDelay
Unsigned 16-bit integer
ranap.ranap_pdu_index RANAP-PDU Index
Unsigned 8-bit integer
ranap.relocationRequirement_present relocationRequirement
Unsigned 8-bit integer
ranap.repetitionNumber repetitionNumber
Unsigned 16-bit integer
ranap.repetitionNumber_present repetitionNumber
Unsigned 8-bit integer
ranap.sDU_ErrorRatio_present sDU_ErrorRatio
Unsigned 8-bit integer
ranap.sDU_FormatInformationParameters_present sDU_FormatInformationParameters
Unsigned 8-bit integer
ranap.service_Handover service-Handover
Unsigned 8-bit integer
ranap.service_Handover_present service-Handover
Unsigned 8-bit integer
Unsigned 8-bit integer
ranap.subflowSDU_Size_present subflowSDU_Size
Unsigned 8-bit integer
ranap.trafficHandlingPriority_present trafficHandlingPriority
Unsigned 8-bit integer
ranap.transferDelay_present transferDelay
Unsigned 8-bit integer
ranap.transportLayerAddress transportLayerAddress
Byte array
ranap.transportLayerAddress_length bit length of transportLayerAddress
Unsigned 8-bit integer
ranap.transportLayerAddress_present transportLayerAddress
Unsigned 8-bit integer
ranap.transportLayerInformation_present transportLayerInformation
Unsigned 8-bit integer
ranap.triggeringMessage triggeringMessage
Unsigned 8-bit integer
ranap.triggeringMessage_present triggeringMessage
Unsigned 8-bit integer
ranap.uP_ModeVersions uP_ModeVersions
Byte array
ranap.ul_GTP_PDU_SequenceNumber_present ul_GTP_PDU_SequenceNumber
Unsigned 8-bit integer
ranap.ul_N_PDU_SequenceNumber_present ul_N_PDU_SequenceNumber
Unsigned 8-bit integer
ranap.userPlaneInformation_present userPlaneInformation
Unsigned 8-bit integer
ranap.userPlaneMode userPlaneMode
Unsigned 8-bit integer
Radius Protocol (radius)
radius.code Code
Unsigned 8-bit integer
radius.id Identifier
Unsigned 8-bit integer
Unsigned 16-bit integer
Real Time Streaming Protocol (rtsp)
rtsp.method Method
String
rtsp.status Status
Unsigned 32-bit integer
rtsp.url URL
String
Real-Time Transport Protocol (rtp)
rtp.cc Contributing source identifiers count
Unsigned 8-bit integer
rtp.csrc.item CSRC item
Unsigned 32-bit integer
rtp.ext Extension
Boolean
rtp.ext.len Extension length
Unsigned 16-bit integer
rtp.ext.profile Defined by profile
Unsigned 16-bit integer
rtp.hdr_ext Header extension
Unsigned 32-bit integer
rtp.marker Marker
Boolean
rtp.p_type Payload type
Unsigned 8-bit integer
rtp.padding Padding
Boolean
rtp.padding.count Padding count
Unsigned 8-bit integer
rtp.padding.data Padding data
Byte array
rtp.payload Payload
Byte array
Unsigned 16-bit integer
rtp.ssrc Synchronization Source identifier
Unsigned 32-bit integer
rtp.timestamp Timestamp
Unsigned 32-bit integer
rtp.version Version
Unsigned 8-bit integer
Real-time Transport Control Protocol (rtcp)
rtcp.app.data Application specific data
Byte array
rtcp.app.name Name (ASCII)
String
rtcp.app.subtype Subtype
Unsigned 8-bit integer
rtcp.length Length
Unsigned 16-bit integer
rtcp.nack.blp Bitmask of following lost packets
Unsigned 16-bit integer
rtcp.nack.fsn First sequence number
Unsigned 16-bit integer
rtcp.padding Padding
Boolean
rtcp.padding.count Padding count
Unsigned 8-bit integer
rtcp.padding.data Padding data
Byte array
rtcp.pt Packet type
Unsigned 8-bit integer
rtcp.rc Reception report count
Unsigned 8-bit integer
rtcp.sc Source count
Unsigned 8-bit integer
rtcp.sdes.length Length
Unsigned 32-bit integer
Unsigned 8-bit integer
rtcp.sdes.prefix.string Prefix string
String
rtcp.sdes.ssrc_csrc SSRC / CSRC identifier
Unsigned 32-bit integer
rtcp.sdes.text Text
String
rtcp.sdes.type Type
Unsigned 8-bit integer
rtcp.sender.octetcount Sender's octet count
Unsigned 32-bit integer
rtcp.sender.packetcount Sender's packet count
Unsigned 32-bit integer
rtcp.senderssrc Sender SSRC
Unsigned 32-bit integer
rtcp.ssrc.cum_nr Cumulative number of packets lost
Unsigned 32-bit integer
rtcp.ssrc.dlsr Delay since last SR timestamp
Unsigned 32-bit integer
rtcp.ssrc.ext_high Extended highest sequence number received
Unsigned 32-bit integer
rtcp.ssrc.fraction Fraction lost
Unsigned 8-bit integer
rtcp.ssrc.high_cycles Sequence number cycles count
Unsigned 16-bit integer
rtcp.ssrc.high_seq Highest sequence number received
Unsigned 16-bit integer
rtcp.ssrc.identifier Identifier
Unsigned 32-bit integer
rtcp.ssrc.jitter Interarrival jitter
Unsigned 32-bit integer
rtcp.ssrc.lsr Last SR timestamp
Unsigned 32-bit integer
rtcp.timestamp.ntp NTP timestamp
String
Unsigned 32-bit integer
rtcp.version Version
Unsigned 8-bit integer
Remote Procedure Call (rpc)
rpc.array.len num
Unsigned 32-bit integer
rpc.auth.flavor Flavor
Unsigned 32-bit integer
rpc.auth.gid GID
Unsigned 32-bit integer
rpc.auth.length Length
Unsigned 32-bit integer
rpc.auth.machinename Machine Name
String
rpc.auth.stamp Stamp
Unsigned 32-bit integer
rpc.auth.uid UID
Unsigned 32-bit integer
rpc.authgss.checksum GSS Checksum
Byte array
rpc.authgss.context GSS Context
Byte array
rpc.authgss.data GSS Data
Byte array
rpc.authgss.data.length Length
Unsigned 32-bit integer
rpc.authgss.major GSS Major Status
Unsigned 32-bit integer
rpc.authgss.minor GSS Minor Status
Unsigned 32-bit integer
rpc.authgss.procedure GSS Procedure
Unsigned 32-bit integer
rpc.authgss.seqnum GSS Sequence Number
Unsigned 32-bit integer
Unsigned 32-bit integer
rpc.authgss.token GSS Token
Byte array
rpc.authgss.version GSS Version
Unsigned 32-bit integer
rpc.authgss.window GSS Sequence Window
Unsigned 32-bit integer
rpc.call.dup Duplicate Call
Unsigned 32-bit integer
rpc.dup Duplicate Transaction
Unsigned 32-bit integer
rpc.fraglen Fragment Length
Unsigned 32-bit integer
rpc.lastfrag Last Fragment
Boolean
rpc.msgtyp Message Type
Unsigned 32-bit integer
rpc.procedure Procedure
Unsigned 32-bit integer
rpc.program Program
Unsigned 32-bit integer
rpc.programversion Program Version
Unsigned 32-bit integer
rpc.programversion.max Program Version (Maximum)
Unsigned 32-bit integer
rpc.programversion.min Program Version (Minimum)
Unsigned 32-bit integer
rpc.reply.dup Duplicate Reply
Unsigned 32-bit integer
rpc.replystat Reply State
Unsigned 32-bit integer
rpc.state_accept Accept State
Unsigned 32-bit integer
rpc.state_auth Auth State
Unsigned 32-bit integer
Unsigned 32-bit integer
rpc.value_follows Value Follows
Boolean
rpc.version RPC Version
Unsigned 32-bit integer
rpc.version.max RPC Version (Maximum)
Unsigned 32-bit integer
rpc.version.min RPC Version (Minimum)
Unsigned 32-bit integer
rpc.xid XID
Unsigned 32-bit integer
Remote Quota (rquota)
rquota.active active
Boolean
rquota.bhardlimit bhardlimit
Unsigned 32-bit integer
rquota.bsize bsize
Unsigned 32-bit integer
rquota.bsoftlimit bsoftlimit
Unsigned 32-bit integer
rquota.btimeleft btimeleft
Unsigned 32-bit integer
rquota.curblocks curblocks
Unsigned 32-bit integer
rquota.curfiles curfiles
Unsigned 32-bit integer
rquota.fhardlimit fhardlimit
Unsigned 32-bit integer
rquota.fsoftlimit fsoftlimit
Unsigned 32-bit integer
rquota.ftimeleft ftimeleft
Unsigned 32-bit integer
rquota.pathp pathp
String
No value
rquota.status status
Unsigned 32-bit integer
rquota.uid uid
Unsigned 32-bit integer
Remote Shell (rsh)
rsh.request Request
Boolean
rsh.response Response
Boolean
Remote Wall protocol (rwall)
rwall.message Message
String
Resource ReserVation Protocol (RSVP) (rsvp)
rsvp.ack MESSAGE-ID ACK
No value
rsvp.adspec ADSPEC
No value
rsvp.confirm CONFIRM
No value
rsvp.error ERROR
No value
rsvp.explicit_route EXPLICIT ROUTE
No value
rsvp.filter FILTERSPEC
No value
rsvp.flowspec FLOWSPEC
No value
rsvp.hop HOP
No value
rsvp.integrity INTEGRITY
No value
No value
rsvp.label_request LABEL REQUEST
No value
rsvp.msg Message Type
Unsigned 8-bit integer
rsvp.msgid MESSAGE-ID
No value
rsvp.msgid_list MESSAGE-ID LIST
No value
rsvp.obj_unknown Unknown object
No value
rsvp.object Object class
Unsigned 8-bit integer
rsvp.path Path Message
Boolean
rsvp.perr Path Error Message
Boolean
rsvp.policy POLICY
No value
rsvp.ptear Path Tear Message
Boolean
rsvp.record_route RECORD ROUTE
No value
rsvp.rerr Resv Error Message
Boolean
rsvp.resv Resv Message
Boolean
rsvp.resvconf Resv Confirm Message
Boolean
rsvp.rtear Resv Tear Message
Boolean
rsvp.rtearconf Resv Tear Confirm Message
Boolean
rsvp.scope SCOPE
No value
No value
rsvp.sender.ip Sender IPv4 address
IPv4 address
rsvp.sender.lsp_id Sender LSP ID
Unsigned 16-bit integer
rsvp.sender.port Sender port number
Unsigned 16-bit integer
rsvp.session SESSION
No value
rsvp.session.ext_tunnel_id Extended tunnel ID
Unsigned 32-bit integer
rsvp.session.ip Destination address
IPv4 address
rsvp.session.port Port number
Unsigned 16-bit integer
rsvp.session.proto Protocol
Unsigned 8-bit integer
rsvp.session.tunnel_id Tunnel ID
Unsigned 16-bit integer
rsvp.session_attribute SESSION ATTRIBUTE
No value
rsvp.style STYLE
No value
rsvp.time TIME VALUES
No value
rsvp.tspec SENDER TSPEC
No value
Rlogin Protocol (rlogin)
rlogin.user_info User Info
No value
rlogin.window_size Window Info
No value
rlogin.window_size.cols Columns
Unsigned 16-bit integer
Unsigned 16-bit integer
rlogin.window_size.x_pixels X Pixels
Unsigned 16-bit integer
rlogin.window_size.y_pixels Y Pixels
Unsigned 16-bit integer
Routing Information Protocol (rip)
Routing Table Maintenance Protocol (rtmp)
nbp.nodeid Node
Unsigned 8-bit integer
nbp.nodeid.length Node Length
Unsigned 8-bit integer
rtmp.function Function
Unsigned 8-bit integer
rtmp.net Net
Unsigned 16-bit integer
rtmp.tuple.dist Distance
Unsigned 16-bit integer
rtmp.tuple.net Net
Unsigned 16-bit integer
rtmp.tuple.range_end Range End
Unsigned 16-bit integer
rtmp.tuple.range_start Range Start
Unsigned 16-bit integer
SCCP user adaptation layer light (sual)
sual.error_code Error Code
Unsigned 16-bit integer
sual.message_length Message length
Unsigned 32-bit integer
sual.message_type Message Type
Unsigned 16-bit integer
sual.spare_1 Spare
Unsigned 8-bit integer
Unsigned 16-bit integer
sual.subsystem_number Subsystem number
Unsigned 16-bit integer
sual.version Version
Unsigned 8-bit integer
SMB (Server Message Block Protocol) (smb)
smb.cmd SMB Command
Unsigned 8-bit integer
SMB MailSlot Protocol (mailslot)
SNMP Multiplex Protocol (smux)
SPRAY (spray)
spray.clock clock
No value
spray.counter counter
Unsigned 32-bit integer
spray.sec sec
Unsigned 32-bit integer
spray.sprayarr Data
String
spray.usec usec
Unsigned 32-bit integer
SSCOP (sscop)
Sequenced Packet eXchange (spx)
spx.ack Acknowledgment Number
Unsigned 16-bit integer
spx.alloc Allocation Number
Unsigned 16-bit integer
spx.ctl Connection Control
Unsigned 8-bit integer
Unsigned 16-bit integer
spx.seq Sequence Number
Unsigned 16-bit integer
spx.src Source Connection ID
Unsigned 16-bit integer
spx.type Datastream type
Unsigned 8-bit integer
Service Advertisement Protocol (ipxsap)
ipxsap.request Request
Boolean
ipxsap.response Response
Boolean
Service Location Protocol (srvloc)
srvloc.err Error Code
Unsigned 16-bit integer
srvloc.flags Flags
Unsigned 8-bit integer
srvloc.function Function
Unsigned 8-bit integer
srvloc.version Version
Unsigned 8-bit integer
Session Announcement Protocol (sap)
sap.auth Authentication data
No value
sap.auth.flags Authentication data flags
Unsigned 8-bit integer
sap.auth.flags.p Padding Bit
Boolean
sap.auth.flags.t Authentication Type
Unsigned 8-bit integer
sap.auth.flags.v Version Number
Unsigned 8-bit integer
Unsigned 8-bit integer
sap.flags.a Address Type
Boolean
sap.flags.c Compression Bit
Boolean
sap.flags.e Encryption Bit
Boolean
sap.flags.r Reserved
Boolean
sap.flags.t Message Type
Boolean
sap.flags.v Version Number
Unsigned 8-bit integer
Session Description Protocol (sdp)
Session Initiation Protocol (sip)
sip.msg_hdr Message Header
No value
Short Frame (short)
Simple Mail Transfer Protocol (smtp)
smtp.req Request
Boolean
smtp.rsp Response
Boolean
Simple Network Management Protocol (snmp)
snmpv3.flags SNMPv3 Flags
Unsigned 8-bit integer
snmpv3.flags.auth Authenticated
Boolean
snmpv3.flags.crypt Encrypted
Boolean
Boolean
Sinec H1 Protocol (h1)
h1.dbnr Memory block number
Unsigned 8-bit integer
h1.dlen Length in words
Signed 16-bit integer
h1.dwnr Address within memory block
Unsigned 16-bit integer
h1.empty Empty field
Unsigned 8-bit integer
h1.empty_len Empty field length
Unsigned 8-bit integer
h1.header H1-Header
Unsigned 16-bit integer
h1.len Length indicator
Unsigned 16-bit integer
h1.opcode Opcode
Unsigned 8-bit integer
h1.opfield Operation identifier
Unsigned 8-bit integer
h1.oplen Operation length
Unsigned 8-bit integer
h1.org Memory type
Unsigned 8-bit integer
h1.reqlen Request length
Unsigned 8-bit integer
h1.request Request identifier
Unsigned 8-bit integer
h1.reslen Response length
Unsigned 8-bit integer
h1.response Response identifier
Unsigned 8-bit integer
h1.resvalue Response value
Unsigned 8-bit integer
socks.command Command
Unsigned 16-bit integer
socks.dst Remote Address
IPv4 address
socks.dstV6 Remote Address
IPv6 address
socks.dstport Remote Port
Unsigned 16-bit integer
socks.username User Name
String
socks.ver Version
Unsigned 8-bit integer
Spanning Tree Protocol (stp)
stp.bridge.hw Bridge Identifier
6-byte Hardware (MAC) Address
stp.flags BPDU flags
Unsigned 8-bit integer
stp.forward Forward Delay
Double-precision floating point
stp.hello Hello Time
Double-precision floating point
stp.max_age Max Age
Double-precision floating point
stp.msg_age Message Age
Double-precision floating point
stp.port Port identifier
Unsigned 16-bit integer
stp.protocol Protocol Identifier
Unsigned 16-bit integer
stp.root.cost Root Path Cost
Unsigned 32-bit integer
stp.root.hw Root Identifier
6-byte Hardware (MAC) Address
Unsigned 8-bit integer
stp.version Protocol Version Identifier
Unsigned 8-bit integer
Stream Control Transmission Protcol (sctp)
sctp.cause.code Cause code
Unsigned 16-bit integer
sctp.cause.length Cause length
Unsigned 16-bit integer
sctp.cause.measure_of_staleness Measure of staleness in usec
Unsigned 32-bit integer
sctp.cause.missing_parameter_type Missing parameters type
Unsigned 16-bit integer
sctp.cause.nr_of_missing_parameters Number of missing parameters
Unsigned 32-bit integer
sctp.cause.stream_identifier Stream identifier
Unsigned 16-bit integer
sctp.cause.tsn TSN
Unsigned 32-bit integer
sctp.checksum Adler-32 checksum
Unsigned 32-bit integer
sctp.chunk_flags Flags
Unsigned 8-bit integer
sctp.chunk_length Length
Unsigned 16-bit integer
sctp.chunk_type Identifier
Unsigned 8-bit integer
sctp.cumulative.tsn.ack Cumulative TSN Ack
Unsigned 32-bit integer
sctp.cwr.lowest_tsn Lowest TSN
Unsigned 32-bit integer
sctp.data.b_bit B-Bit
Boolean
sctp.data.e_bit E-Bit
Boolean
Boolean
sctp.dstport Destination port
Unsigned 16-bit integer
sctp.ecne.lowest_tsn Lowest TSN
Unsigned 32-bit integer
sctp.init.chunk.credit Advertised reciever window credit (a_rwnd)
Unsigned 32-bit integer
sctp.init.chunk.initial.tsn Initial TSN
Unsigned 32-bit integer
sctp.init.chunk.initiate.tag Initiate tag
Unsigned 32-bit integer
sctp.init.chunk.nr.in.streams Number of inbound streams
Unsigned 16-bit integer
sctp.init.chunk.nr.out.streams Number of outbound streams
Unsigned 16-bit integer
sctp.parameter.cookie_preservative_incr Suggested Cookie life-span increment (msec)
Unsigned 32-bit integer
sctp.parameter.hostname.hostname Hostname
String
sctp.parameter.ipv4_address IP Version 4 address
IPv4 address
sctp.parameter.ipv6_address IP Version 6 address
IPv6 address
sctp.parameter.length Parameter length
Unsigned 16-bit integer
sctp.parameter.supported_addres_type Supported address type
Unsigned 16-bit integer
sctp.parameter.type Parameter type
Unsigned 16-bit integer
sctp.payload_proto_id Payload Protocol identifier
Unsigned 32-bit integer
sctp.sack.a_rwnd Advertised receiver window credit (a_rwnd)
Unsigned 32-bit integer
sctp.sack.cumulative_tsn_ack Cumulative TSN ACK
Unsigned 32-bit integer
Unsigned 16-bit integer
sctp.sack.gap_block_end End
Unsigned 16-bit integer
sctp.sack.gap_block_start Start
Unsigned 16-bit integer
sctp.sack.number_of_duplicated_tsns Number of duplicated TSNs
Unsigned 16-bit integer
sctp.sack.number_of_gap_blocks Number of gap acknowldgement blocks
Unsigned 16-bit integer
sctp.shutdown.cumulative_tsn_ack Cumulative TSN Ack
Unsigned 32-bit integer
sctp.shutdown_complete.t_bit E-Bit
Boolean
sctp.srcport Source port
Unsigned 16-bit integer
sctp.stream_id Stream Identifier
Unsigned 16-bit integer
sctp.stream_seq_number Stream sequence number
Unsigned 16-bit integer
sctp.tsn TSN
Unsigned 32-bit integer
sctp.verfication_tag Verification tag
Unsigned 32-bit integer
Syslog message (syslog)
syslog.facility Facility
Unsigned 8-bit integer
syslog.level Level
Unsigned 8-bit integer
syslog.msg_len Message length
Unsigned 32-bit integer
Systems Network Architecture (sna)
sna.rh Request/Response Header
No value
Unsigned 8-bit integer
sna.rh.1 Request/Response Header Byte 1
Unsigned 8-bit integer
sna.rh.2 Request/Response Header Byte 2
Unsigned 8-bit integer
sna.rh.bbi Begin Bracket Indicator
Boolean
sna.rh.bci Begin Chain Indicator
Boolean
sna.rh.cdi Change Direction Indicator
Boolean
sna.rh.cebi Conditional End Bracket Indicator
Boolean
sna.rh.csi Code Selection Indicator
Unsigned 8-bit integer
sna.rh.dr1 Definite Response 1 Indicator
Boolean
sna.rh.dr2 Definite Response 2 Indicator
Boolean
sna.rh.ebi End Bracket Indicator
Boolean
sna.rh.eci End Chain Indicator
Boolean
sna.rh.edi Enciphered Data Indicator
Boolean
sna.rh.eri Exception Response Indicator
Boolean
sna.rh.fi Format Indicator
Boolean
sna.rh.lcci Length-Checked Compression Indicator
Boolean
sna.rh.pdi Padded Data Indicator
Boolean
sna.rh.pi Pacing Indicator
Boolean
Boolean
sna.rh.rlwi Request Larger Window Indicator
Boolean
sna.rh.rri Request/Response Indicator
Unsigned 8-bit integer
sna.rh.rti Response Type Indicator
Boolean
sna.rh.ru_category Request/Response Unit Category
Unsigned 8-bit integer
sna.rh.sdi Sense Data Included
Boolean
sna.th Transmission Header
No value
sna.th.0 Transmission Header Byte 0
Unsigned 8-bit integer
sna.th.cmd_fmt Command Format
Unsigned 8-bit integer
sna.th.cmd_sn Command Sequence Number
Unsigned 16-bit integer
sna.th.cmd_type Command Type
Unsigned 8-bit integer
sna.th.daf Destination Address Field
Unsigned 16-bit integer
sna.th.dcf Data Count Field
Unsigned 16-bit integer
sna.th.def Destination Element Field
Unsigned 16-bit integer
sna.th.dsaf Destination Subarea Address Field
Unsigned 32-bit integer
sna.th.efi Expedited Flow Indicator
Unsigned 8-bit integer
sna.th.er_vr_supp_ind ER and VR Support Indicator
Unsigned 8-bit integer
sna.th.ern Explicit Route Number
Unsigned 8-bit integer
Unsigned 8-bit integer
sna.th.iern Initial Explicit Route Number
Unsigned 8-bit integer
sna.th.lsid Local Session Identification
Unsigned 8-bit integer
sna.th.mft MPR FID4 Type
Boolean
sna.th.mpf Mapping Field
Unsigned 8-bit integer
sna.th.nlp_cp NLP Count or Padding
Unsigned 8-bit integer
sna.th.nlpoi NLP Offset Indicator
Unsigned 8-bit integer
sna.th.ntwk_prty Network Priority
Unsigned 8-bit integer
sna.th.oaf Origin Address Field
Unsigned 16-bit integer
sna.th.odai ODAI Assignment Indicator
Unsigned 8-bit integer
sna.th.oef Origin Element Field
Unsigned 16-bit integer
sna.th.osaf Origin Subarea Address Field
Unsigned 32-bit integer
sna.th.piubf PIU Blocking Field
Unsigned 8-bit integer
sna.th.sa Session Address
Byte array
sna.th.snai SNA Indicator
Boolean
sna.th.snf Sequence Number Field
Unsigned 16-bit integer
sna.th.tg_nonfifo_ind Transmission Group Non-FIFO Indicator
Boolean
sna.th.tg_snf Transmission Group Sequence Number Field
Unsigned 16-bit integer
Unsigned 8-bit integer
sna.th.tgsf Transmission Group Segmenting Field
Unsigned 8-bit integer
sna.th.tpf Transmission Priority Field
Unsigned 8-bit integer
sna.th.vr_cwi Virtual Route Change Window Indicator
Unsigned 16-bit integer
sna.th.vr_cwri Virtual Route Change Window Reply Indicator
Unsigned 16-bit integer
sna.th.vr_pac_cnt_ind Virtual Route Pacing Count Indicator
Unsigned 8-bit integer
sna.th.vr_rwi Virtual Route Reset Window Indicator
Boolean
sna.th.vr_snf_send Virtual Route Send Sequence Number Field
Unsigned 16-bit integer
sna.th.vr_sqti Virtual Route Sequence and Type Indicator
Unsigned 16-bit integer
sna.th.vrn Virtual Route Number
Unsigned 8-bit integer
sna.th.vrprq Virtual Route Pacing Request
Boolean
sna.th.vrprs Virtual Route Pacing Response
Boolean
TACACS (tacacs)
tacacs.request Request
Boolean
tacacs.response Response
Boolean
tacacs.version Tacacs Version
String
TPKT (tpkt)
tpkt.length Length
Unsigned 16-bit integer
Unsigned 8-bit integer
tpkt.version Version
Unsigned 8-bit integer
Telnet (telnet)
Time Protocol (time)
time.time Time
Unsigned 32-bit integer
Token-Ring (tr)
tr.ac Access Control
Unsigned 8-bit integer
tr.addr Source or Destination Address
6-byte Hardware (MAC) Address
tr.broadcast Broadcast Type
Unsigned 8-bit integer
tr.direction Direction
Unsigned 8-bit integer
tr.dst Destination
6-byte Hardware (MAC) Address
tr.fc Frame Control
Unsigned 8-bit integer
tr.frame Frame
Boolean
tr.frame_pcf Frame PCF
Unsigned 8-bit integer
tr.frame_type Frame Type
Unsigned 8-bit integer
tr.max_frame_size Maximum Frame Size
Unsigned 8-bit integer
tr.monitor_cnt Monitor Count
Unsigned 8-bit integer
tr.priority Priority
Unsigned 8-bit integer
Unsigned 8-bit integer
tr.rif Ring-Bridge Pairs
String
tr.rif.bridge RIF Bridge
Unsigned 8-bit integer
tr.rif.ring RIF Ring
Unsigned 16-bit integer
tr.rif_bytes RIF Bytes
Unsigned 8-bit integer
tr.sr Source Routed
Boolean
tr.src Source
6-byte Hardware (MAC) Address
Token-Ring Media Access Control (trmac)
trmac.dstclass Destination Class
Unsigned 8-bit integer
trmac.errors.abort Abort Delimiter Transmitted Errors
Unsigned 8-bit integer
trmac.errors.ac A/C Errors
Unsigned 8-bit integer
trmac.errors.burst Burst Errors
Unsigned 8-bit integer
trmac.errors.congestion Receiver Congestion Errors
Unsigned 8-bit integer
trmac.errors.fc Frame-Copied Errors
Unsigned 8-bit integer
trmac.errors.freq Frequency Errors
Unsigned 8-bit integer
trmac.errors.internal Internal Errors
Unsigned 8-bit integer
trmac.errors.iso Isolating Errors
Unsigned 16-bit integer
trmac.errors.line Line Errors
Unsigned 8-bit integer
Unsigned 8-bit integer
trmac.errors.noniso Non-Isolating Errors
Unsigned 16-bit integer
trmac.errors.token Token Errors
Unsigned 8-bit integer
trmac.length Total Length
Unsigned 8-bit integer
trmac.mvec Major Vector
Unsigned 8-bit integer
trmac.naun NAUN
6-byte Hardware (MAC) Address
trmac.srcclass Source Class
Unsigned 8-bit integer
trmac.svec Sub-Vector
Unsigned 8-bit integer
Transmission Control Protocol (tcp)
tcp.ack Acknowledgement number
Unsigned 32-bit integer
tcp.checksum Checksum
Unsigned 16-bit integer
tcp.checksum_bad Bad Checksum
Boolean
tcp.dstport Destination Port
Unsigned 16-bit integer
tcp.flags Flags
Unsigned 8-bit integer
tcp.flags.ack Acknowledgment
Boolean
tcp.flags.cwr Congestion Window Reduced (CWR)
Boolean
tcp.flags.ecn ECN-Echo
Boolean
tcp.flags.fin Fin
Boolean
Boolean
tcp.flags.reset Reset
Boolean
tcp.flags.syn Syn
Boolean
tcp.flags.urg Urgent
Boolean
tcp.hdr_len Header Length
Unsigned 8-bit integer
tcp.nxtseq Next sequence number
Unsigned 32-bit integer
tcp.port Source or Destination Port
Unsigned 16-bit integer
tcp.seq Sequence number
Unsigned 32-bit integer
tcp.srcport Source Port
Unsigned 16-bit integer
tcp.urgent_pointer Urgent pointer
Unsigned 16-bit integer
tcp.window_size Window size
Unsigned 16-bit integer
Transparent Network Substrate Protocol (tns)
tns.compat_version Version (Compatible)
Unsigned 16-bit integer
tns.connect Connect
Boolean
tns.data_flag Data Flag
Unsigned 16-bit integer
tns.header_checksum Header Checksum
Unsigned 16-bit integer
tns.length Packet Length
Unsigned 32-bit integer
tns.packet_checksum Packet Checksum
Unsigned 16-bit integer
Boolean
tns.reserved_byte Reserved Byte
Byte array
tns.response Response
Boolean
tns.service_options Service Options
Unsigned 16-bit integer
tns.sns Secure Network Services
Boolean
tns.type Packet Type
Unsigned 8-bit integer
tns.version Version
Unsigned 16-bit integer
Trivial File Transfer Protocol (tftp)
tftp.block Block
Unsigned 16-bit integer
tftp.destination_file DESTINATION File
String
tftp.error.code Error code
Unsigned 16-bit integer
tftp.error.message Error message
String
tftp.opcode Opcode
Unsigned 16-bit integer
tftp.source_file Source File
String
tftp.type Type
String
User Datagram Protocol (udp)
udp.checksum Checksum
Unsigned 16-bit integer
udp.checksum_bad Bad Checksum
Boolean
Unsigned 16-bit integer
udp.length Length
Unsigned 16-bit integer
udp.port Source or Destination Port
Unsigned 16-bit integer
udp.srcport Source Port
Unsigned 16-bit integer
Virtual Router Redundancy Protocol (vrrp)
vrrp.type VRRP packet type
Unsigned 8-bit integer
vrrp.typever VRRP message version and type
Unsigned 8-bit integer
vrrp.version VRRP protocol version
Unsigned 8-bit integer
Virtual Trunking Protocol (vtp)
vtp.code Code
Unsigned 8-bit integer
vtp.conf_rev_num Configuration Revision Number
Unsigned 32-bit integer
vtp.followers Followers
Unsigned 8-bit integer
vtp.md Management Domain
String
vtp.md5_digest MD5 Digest
Byte array
vtp.md_len Management Domain Length
Unsigned 8-bit integer
vtp.seq_num Sequence Number
Unsigned 8-bit integer
vtp.start_value Start Value
Unsigned 16-bit integer
vtp.upd_id Updater Identity
IPv4 address
String
vtp.version Version
Unsigned 8-bit integer
vtp.vlan_info.802_10_index 802.10 Index
Unsigned 32-bit integer
vtp.vlan_info.isl_vlan_id ISL VLAN ID
Unsigned 16-bit integer
vtp.vlan_info.len VLAN Information Length
Unsigned 8-bit integer
vtp.vlan_info.mtu_size MTU Size
Unsigned 16-bit integer
vtp.vlan_info.status.vlan_susp VLAN suspended
Boolean
vtp.vlan_info.tlv_len Length
Unsigned 8-bit integer
vtp.vlan_info.tlv_type Type
Unsigned 8-bit integer
vtp.vlan_info.vlan_name VLAN Name
String
vtp.vlan_info.vlan_name_len VLAN Name Length
Unsigned 8-bit integer
vtp.vlan_info.vlan_type VLAN Type
Unsigned 8-bit integer
Web Cache Coordination Protocol (wccp)
wccp.cache_ip Web Cache IP address
IPv4 address
wccp.change_num Change Number
Unsigned 32-bit integer
wccp.hash_revision Hash Revision
Unsigned 32-bit integer
wccp.message WCCP Message Type
Unsigned 32-bit integer
wccp.recvd_id Received ID
Unsigned 32-bit integer
Unsigned 32-bit integer
Wellfleet Compression (wcp)
wcp.alg Alg
Unsigned 8-bit integer
wcp.alg1 Alg 1
Unsigned 8-bit integer
wcp.alg2 Alg 2
Unsigned 8-bit integer
wcp.alg3 Alg 3
Unsigned 8-bit integer
wcp.alg4 Alg 4
Unsigned 8-bit integer
wcp.alg_cnt Alg Count
Unsigned 8-bit integer
wcp.checksum Checksum
Unsigned 8-bit integer
wcp.cmd Command
Unsigned 8-bit integer
wcp.ext_cmd Extended Command
Unsigned 8-bit integer
wcp.flag Compress Flag
Unsigned 8-bit integer
wcp.hist History
Unsigned 8-bit integer
wcp.init Initiator
Unsigned 8-bit integer
wcp.long_comp Long Compression
Unsigned 16-bit integer
wcp.long_len Compress Length
Unsigned 8-bit integer
wcp.mark Compress Marker
Unsigned 8-bit integer
wcp.off Source offset
Unsigned 16-bit integer
Unsigned 8-bit integer
wcp.ppc PerPackComp
Unsigned 8-bit integer
wcp.rev Revision
Unsigned 8-bit integer
wcp.rexmit Rexmit
Unsigned 8-bit integer
wcp.seq SEQ
Unsigned 16-bit integer
wcp.seq_size Seq Size
Unsigned 8-bit integer
wcp.short_comp Short Compression
Unsigned 8-bit integer
wcp.short_len Compress Length
Unsigned 8-bit integer
wcp.tid TID
Unsigned 16-bit integer
Who (who)
who.boottime Boot Time
Date/Time stamp
who.hostname Hostname
String
who.idle Time Idle
Unsigned 32-bit integer
who.loadav_10 Load Average Over Past 10 Minutes
Double-precision floating point
who.loadav_15 Load Average Over Past 15 Minutes
Double-precision floating point
who.loadav_5 Load Average Over Past 5 Minutes
Double-precision floating point
who.recvtime Receive Time
Date/Time stamp
who.sendtime Send Time
Date/Time stamp
Date/Time stamp
who.tty TTY Name
String
who.type Type
Unsigned 8-bit integer
who.uid User ID
String
who.vers Version
Unsigned 8-bit integer
who.whoent Who utmp Entry
No value
Wireless Session Protocol (wap-wsp)
wsp.TID Transmission ID
Unsigned 8-bit integer
wsp.capabilities Capabilities
No value
wsp.capability.length Capability Length
Unsigned 32-bit integer
wsp.content_type.parameter.charset Charset
Unsigned 16-bit integer
wsp.content_type.type Content Type
Unsigned 8-bit integer
wsp.header.accept Accept
Unsigned 8-bit integer
wsp.header.accept.string Accept
String
wsp.header.accept_charset Accept-Charset
Unsigned 16-bit integer
wsp.header.accept_charset.string Accept-Charset
String
wsp.header.accept_language Accept-Language
Unsigned 8-bit integer
wsp.header.accept_language.string Accept-Language
String
Unsigned 8-bit integer
wsp.header.age Age
Unsigned 32-bit integer
wsp.header.application_header Application Header
String
wsp.header.application_header.value Application Header Value
String
wsp.header.cache_control Cache-Control
Unsigned 8-bit integer
wsp.header.content_length Content-Length
Unsigned 32-bit integer
wsp.header.date Date
Date/Time stamp
wsp.header.etag Etag
String
wsp.header.expires Expires
Date/Time stamp
wsp.header.if_modified_since If-Modified-Since
Date/Time stamp
wsp.header.last_modified Last-Modified
Date/Time stamp
wsp.header.location Location
String
wsp.header.server Server
String
wsp.header.transfer_enc Transfer Encoding
Unsigned 8-bit integer
wsp.header.transfer_enc_str Transfer Encoding
String
wsp.header.user_agent User-Agent
String
wsp.header.via Via
String
wsp.header.x_wap_tod X-WAP.TOD
Date/Time stamp
No value
wsp.headers.header Header
No value
wsp.headers_length Headers Length
Unsigned 32-bit integer
wsp.pdu_type PDU Type
Unsigned 8-bit integer
wsp.post.data Post Data
No value
wsp.reply.data Data
No value
wsp.reply.status Status
Unsigned 8-bit integer
wsp.server.session_id Server Session ID
Unsigned 32-bit integer
wsp.uri URI
String
wsp.uri_length URI Length
Unsigned 32-bit integer
wsp.version.major Version (Major)
Unsigned 8-bit integer
wsp.version.minor Version (Minor)
Unsigned 8-bit integer
Wireless Transaction Protocol (wap-wsp-wtp)
wtp.RID Re-transmission Indicator
Boolean
wtp.TID Transmission ID
Unsigned 16-bit integer
wtp.TID.response TID Response
Boolean
wtp.abort.reason.provider Abort Reason
Unsigned 8-bit integer
wtp.abort.reason.user Abort Reason
Unsigned 8-bit integer
Unsigned 8-bit integer
wtp.ack.tvetok Tve/Tok flag
Boolean
wtp.continue_flag Continue Flag
Boolean
wtp.header.TIDNew TIDNew
Boolean
wtp.header.UP U/P flag
Boolean
wtp.header.missing_packets Missing Packets
Unsigned 8-bit integer
wtp.header.sequence Packet Sequence Number
Unsigned 8-bit integer
wtp.header.version Version
Unsigned 8-bit integer
wtp.header_data Data
Byte array
wtp.header_fixed_part Header
Byte array
wtp.header_variable_part Header: Variable part
Byte array
wtp.inv.reserved Reserved
Unsigned 8-bit integer
wtp.inv.transaction_class Transaction Class
Unsigned 8-bit integer
wtp.pdu_type PDU Type
Unsigned 8-bit integer
wtp.trailer_flags Trailer Flags
Unsigned 8-bit integer
Wireless Transport Layer Security (wap-wtls)
wsp.wtls.alert Alert
No value
wsp.wtls.alert.description Description
Unsigned 8-bit integer
Unsigned 8-bit integer
wsp.wtls.handshake Handshake
Unsigned 8-bit integer
wsp.wtls.handshake.certificate Certificate
No value
wsp.wtls.handshake.certificate.after Valid not after
Date/Time stamp
wsp.wtls.handshake.certificate.before Valid not before
Date/Time stamp
wsp.wtls.handshake.certificate.issuer.charset Charset
Unsigned 16-bit integer
wsp.wtls.handshake.certificate.issuer.name Name
String
wsp.wtls.handshake.certificate.issuer.type Issuer
Unsigned 8-bit integer
wsp.wtls.handshake.certificate.parameter Parameter Set
String
wsp.wtls.handshake.certificate.parameter_index Parameter Index
Unsigned 8-bit integer
wsp.wtls.handshake.certificate.public.type Public Key Type
Unsigned 8-bit integer
wsp.wtls.handshake.certificate.rsa.exponent RSA Exponent Size
Unsigned 32-bit integer
wsp.wtls.handshake.certificate.rsa.modules RSA Modulus Size
Unsigned 32-bit integer
wsp.wtls.handshake.certificate.signature.signature Signature Size
Unsigned 32-bit integer
wsp.wtls.handshake.certificate.signature.type Signature Type
Unsigned 8-bit integer
wsp.wtls.handshake.certificate.subject.charset Charset
Unsigned 16-bit integer
wsp.wtls.handshake.certificate.subject.name Name
String
wsp.wtls.handshake.certificate.subject.type Subject
Unsigned 8-bit integer
Unsigned 8-bit integer
wsp.wtls.handshake.certificate.version Version
Unsigned 8-bit integer
wsp.wtls.handshake.certificates Certificates
No value
wsp.wtls.handshake.client_hello Client Hello
No value
wsp.wtls.handshake.client_hello.cipher Cipher
String
wsp.wtls.handshake.client_hello.ciphers Cipher Suites
No value
wsp.wtls.handshake.client_hello.client_keys_id Client Keys
No value
wsp.wtls.handshake.client_hello.client_keys_len Length
Unsigned 16-bit integer
wsp.wtls.handshake.client_hello.comp_methods Compression Methods
No value
wsp.wtls.handshake.client_hello.compression Compression
Unsigned 8-bit integer
wsp.wtls.handshake.client_hello.gmt Time GMT
Date/Time stamp
wsp.wtls.handshake.client_hello.ident_charset Identifier CharSet
Unsigned 16-bit integer
wsp.wtls.handshake.client_hello.ident_name Identifier Name
String
wsp.wtls.handshake.client_hello.ident_size Identifier Size
Unsigned 8-bit integer
wsp.wtls.handshake.client_hello.ident_type Identifier Type
Unsigned 8-bit integer
wsp.wtls.handshake.client_hello.identifier Identifier
No value
wsp.wtls.handshake.client_hello.key.key_exchange Key Exchange
Unsigned 8-bit integer
wsp.wtls.handshake.client_hello.key.key_exchange.suite Suite
Unsigned 8-bit integer
String
wsp.wtls.handshake.client_hello.parameter_index Parameter Index
Unsigned 8-bit integer
wsp.wtls.handshake.client_hello.random Random
No value
wsp.wtls.handshake.client_hello.refresh Refresh
Unsigned 8-bit integer
wsp.wtls.handshake.client_hello.sequence_mode Sequence Mode
Unsigned 8-bit integer
wsp.wtls.handshake.client_hello.session.str Session ID
String
wsp.wtls.handshake.client_hello.sessionid Session ID
Unsigned 32-bit integer
wsp.wtls.handshake.client_hello.trusted_keys_id Trusted Keys
No value
wsp.wtls.handshake.client_hello.version Version
Unsigned 8-bit integer
wsp.wtls.handshake.length Length
Unsigned 16-bit integer
wsp.wtls.handshake.server_hello Server Hello
No value
wsp.wtls.handshake.server_hello.cipher Cipher
No value
wsp.wtls.handshake.server_hello.cipher.bulk Cipher Bulk
Unsigned 8-bit integer
wsp.wtls.handshake.server_hello.cipher.mac Cipher MAC
Unsigned 8-bit integer
wsp.wtls.handshake.server_hello.compression Compression
Unsigned 8-bit integer
wsp.wtls.handshake.server_hello.gmt Time GMT
Date/Time stamp
wsp.wtls.handshake.server_hello.key Client Key ID
Unsigned 8-bit integer
wsp.wtls.handshake.server_hello.random Random
No value
Unsigned 8-bit integer
wsp.wtls.handshake.server_hello.sequence_mode Sequence Mode
Unsigned 8-bit integer
wsp.wtls.handshake.server_hello.session.str Session ID
String
wsp.wtls.handshake.server_hello.sessionid Session ID
Unsigned 32-bit integer
wsp.wtls.handshake.server_hello.version Version
Unsigned 8-bit integer
wsp.wtls.handshake.type Type
Unsigned 8-bit integer
wsp.wtls.rec_cipher Record Ciphered
No value
wsp.wtls.rec_length Record Length
Unsigned 16-bit integer
wsp.wtls.rec_seq Record Sequence
Unsigned 16-bit integer
wsp.wtls.rec_type Record Type
Unsigned 8-bit integer
wsp.wtls.record Record
Unsigned 8-bit integer
X.25 (x.25)
x.25.a A Bit
Boolean
x.25.d D Bit
Boolean
x.25.gfi GFI
Unsigned 16-bit integer
x.25.lcn Logical Channel
Unsigned 16-bit integer
x.25.m M Bit
Boolean
x.25.mod Modulo
Unsigned 16-bit integer
Unsigned 8-bit integer
x.25.p_s P(S)
Unsigned 8-bit integer
x.25.q Q Bit
Boolean
x.25.type Packet Type
Unsigned 8-bit integer
X.25 over TCP (xot)
X11 (x11)
x11.acceleration-denominator acceleration-denominator
Signed 16-bit integer
x11.acceleration-numerator acceleration-numerator
Signed 16-bit integer
x11.access-mode access-mode
Unsigned 8-bit integer
x11.address address
Byte array
x11.address-length address-length
Unsigned 16-bit integer
x11.alloc alloc
Unsigned 8-bit integer
x11.allow-events-mode allow-events-mode
Unsigned 8-bit integer
x11.allow-exposures allow-exposures
Unsigned 8-bit integer
x11.arc arc
No value
x11.arc.angle1 angle1
Signed 16-bit integer
x11.arc.angle2 angle2
Signed 16-bit integer
x11.arc.height height
Unsigned 16-bit integer
Unsigned 8-bit integer
x11.arc.width width
Unsigned 16-bit integer
x11.arc.x x
Signed 16-bit integer
x11.arc.y y
Signed 16-bit integer
x11.arcs arcs
No value
x11.atom atom
Unsigned 32-bit integer
x11.auto-repeat-mode auto-repeat-mode
Unsigned 8-bit integer
x11.back-blue back-blue
Unsigned 16-bit integer
x11.back-green back-green
Unsigned 16-bit integer
x11.back-red back-red
Unsigned 16-bit integer
x11.background background
Unsigned 32-bit integer
x11.background-pixel background-pixel
Unsigned 32-bit integer
x11.background-pixmap background-pixmap
Unsigned 32-bit integer
x11.backing-pixel backing-pixel
Unsigned 32-bit integer
x11.backing-planes backing-planes
Unsigned 32-bit integer
x11.backing-store backing-store
Unsigned 8-bit integer
x11.bell-duration bell-duration
Signed 16-bit integer
x11.bell-percent bell-percent
Signed 8-bit integer
Signed 16-bit integer
x11.bit-gravity bit-gravity
Unsigned 8-bit integer
x11.bit-plane bit-plane
Unsigned 32-bit integer
x11.blue blue
Unsigned 16-bit integer
x11.blues blues
Unsigned 16-bit integer
x11.border-pixel border-pixel
Unsigned 32-bit integer
x11.border-pixmap border-pixmap
Unsigned 32-bit integer
x11.border-width border-width
Unsigned 16-bit integer
x11.button button
Unsigned 8-bit integer
x11.cap-style cap-style
Unsigned 8-bit integer
x11.change-host-mode change-host-mode
Unsigned 8-bit integer
x11.cid cid
Unsigned 32-bit integer
x11.class class
Unsigned 8-bit integer
x11.clip-mask clip-mask
Unsigned 32-bit integer
x11.clip-x-origin clip-x-origin
Signed 16-bit integer
x11.clip-y-origin clip-y-origin
Signed 16-bit integer
x11.close-down-mode close-down-mode
Unsigned 8-bit integer
x11.cmap cmap
Unsigned 32-bit integer
No value
x11.coloritem coloritem
No value
x11.coloritem.blue blue
Unsigned 16-bit integer
x11.coloritem.flags flags
Unsigned 8-bit integer
x11.coloritem.flags.do-blue do-blue
Boolean
x11.coloritem.flags.do-green do-green
Boolean
x11.coloritem.flags.do-red do-red
Boolean
x11.coloritem.flags.unused unused
Boolean
x11.coloritem.green green
Unsigned 16-bit integer
x11.coloritem.pixel pixel
Unsigned 32-bit integer
x11.coloritem.red red
Unsigned 16-bit integer
x11.coloritem.unused unused
No value
x11.colormap colormap
Unsigned 32-bit integer
x11.colors colors
Unsigned 16-bit integer
x11.configure-window-mask configure-window-mask
Unsigned 16-bit integer
x11.configure-window-mask.border-width border-width
Boolean
x11.configure-window-mask.height height
Boolean
x11.configure-window-mask.sibling sibling
Boolean
Boolean
x11.configure-window-mask.width width
Boolean
x11.configure-window-mask.x x
Boolean
x11.configure-window-mask.y y
Boolean
x11.confine-to confine-to
Unsigned 32-bit integer
x11.contiguous contiguous
Boolean
x11.coordinate-mode coordinate-mode
Unsigned 8-bit integer
x11.count count
Unsigned 8-bit integer
x11.cursor cursor
Unsigned 32-bit integer
x11.dash-offset dash-offset
Unsigned 16-bit integer
x11.dashes dashes
Byte array
x11.dashes-length dashes-length
Unsigned 16-bit integer
x11.data data
Byte array
x11.data-length data-length
Unsigned 32-bit integer
x11.delete delete
Boolean
x11.delta delta
Signed 16-bit integer
x11.depth depth
Unsigned 8-bit integer
x11.direction direction
Unsigned 8-bit integer
Boolean
x11.do-not-propagate-mask do-not-propagate-mask
Unsigned 32-bit integer
x11.do-not-propagate-mask.Button1Motion Button1Motion
Boolean
x11.do-not-propagate-mask.Button2Motion Button2Motion
Boolean
x11.do-not-propagate-mask.Button3Motion Button3Motion
Boolean
x11.do-not-propagate-mask.Button4Motion Button4Motion
Boolean
x11.do-not-propagate-mask.Button5Motion Button5Motion
Boolean
x11.do-not-propagate-mask.ButtonMotion ButtonMotion
Boolean
x11.do-not-propagate-mask.ButtonPress ButtonPress
Boolean
x11.do-not-propagate-mask.ButtonRelease ButtonRelease
Boolean
x11.do-not-propagate-mask.KeyPress KeyPress
Boolean
x11.do-not-propagate-mask.KeyRelease KeyRelease
Boolean
x11.do-not-propagate-mask.PointerMotion PointerMotion
Boolean
x11.do-not-propagate-mask.erroneous-bits erroneous-bits
Boolean
x11.do-threshold do-threshold
Boolean
x11.drawable drawable
Unsigned 32-bit integer
x11.dst-drawable dst-drawable
Unsigned 32-bit integer
x11.dst-gc dst-gc
Unsigned 32-bit integer
Unsigned 32-bit integer
x11.dst-x dst-x
Signed 16-bit integer
x11.dst-y dst-y
Signed 16-bit integer
x11.event-mask event-mask
Unsigned 32-bit integer
x11.event-mask.Button1Motion Button1Motion
Boolean
x11.event-mask.Button2Motion Button2Motion
Boolean
x11.event-mask.Button3Motion Button3Motion
Boolean
x11.event-mask.Button4Motion Button4Motion
Boolean
x11.event-mask.Button5Motion Button5Motion
Boolean
x11.event-mask.ButtonMotion ButtonMotion
Boolean
x11.event-mask.ButtonPress ButtonPress
Boolean
x11.event-mask.ButtonRelease ButtonRelease
Boolean
x11.event-mask.ColormapChange ColormapChange
Boolean
x11.event-mask.EnterWindow EnterWindow
Boolean
x11.event-mask.Exposure Exposure
Boolean
x11.event-mask.FocusChange FocusChange
Boolean
x11.event-mask.KeyPress KeyPress
Boolean
x11.event-mask.KeyRelease KeyRelease
Boolean
Boolean
x11.event-mask.LeaveWindow LeaveWindow
Boolean
x11.event-mask.OwnerGrabButton OwnerGrabButton
Boolean
x11.event-mask.PointerMotion PointerMotion
Boolean
x11.event-mask.PointerMotionHint PointerMotionHint
Boolean
x11.event-mask.PropertyChange PropertyChange
Boolean
x11.event-mask.ResizeRedirect ResizeRedirect
Boolean
x11.event-mask.StructureNotify StructureNotify
Boolean
x11.event-mask.SubstructureNotify SubstructureNotify
Boolean
x11.event-mask.SubstructureRedirect SubstructureRedirect
Boolean
x11.event-mask.VisibilityChange VisibilityChange
Boolean
x11.event-mask.erroneous-bits erroneous-bits
Boolean
x11.exposures exposures
Boolean
x11.family family
Unsigned 8-bit integer
x11.fid fid
Unsigned 32-bit integer
x11.fill-rule fill-rule
Unsigned 8-bit integer
x11.fill-style fill-style
Unsigned 8-bit integer
x11.first-keycode first-keycode
Unsigned 8-bit integer
Unsigned 8-bit integer
x11.font font
Unsigned 32-bit integer
x11.fore-blue fore-blue
Unsigned 16-bit integer
x11.fore-green fore-green
Unsigned 16-bit integer
x11.fore-red fore-red
Unsigned 16-bit integer
x11.foreground foreground
Unsigned 32-bit integer
x11.format format
Unsigned 8-bit integer
x11.function function
Unsigned 8-bit integer
x11.gc gc
Unsigned 32-bit integer
x11.gc-dashes gc-dashes
Unsigned 8-bit integer
x11.gc-value-mask gc-value-mask
Unsigned 32-bit integer
x11.gc-value-mask.arc-mode arc-mode
Boolean
x11.gc-value-mask.background background
Boolean
x11.gc-value-mask.cap-style cap-style
Boolean
x11.gc-value-mask.clip-mask clip-mask
Boolean
x11.gc-value-mask.clip-x-origin clip-x-origin
Boolean
x11.gc-value-mask.clip-y-origin clip-y-origin
Boolean
x11.gc-value-mask.dash-offset dash-offset
Boolean
Boolean
x11.gc-value-mask.fill-style fill-style
Boolean
x11.gc-value-mask.font font
Boolean
x11.gc-value-mask.foreground foreground
Boolean
x11.gc-value-mask.function function
Boolean
x11.gc-value-mask.gc-dashes gc-dashes
Boolean
x11.gc-value-mask.graphics-exposures graphics-exposures
Boolean
x11.gc-value-mask.join-style join-style
Boolean
x11.gc-value-mask.line-style line-style
Boolean
x11.gc-value-mask.line-width line-width
Boolean
x11.gc-value-mask.plane-mask plane-mask
Boolean
x11.gc-value-mask.stipple stipple
Boolean
x11.gc-value-mask.subwindow-mode subwindow-mode
Boolean
x11.gc-value-mask.tile tile
Boolean
x11.gc-value-mask.tile-stipple-x-origin tile-stipple-x-origin
Boolean
x11.gc-value-mask.tile-stipple-y-origin tile-stipple-y-origin
Boolean
x11.get-property-type get-property-type
Unsigned 32-bit integer
x11.grab_window grab_window
Unsigned 32-bit integer
Boolean
x11.green green
Unsigned 16-bit integer
x11.greens greens
Unsigned 16-bit integer
x11.height height
Unsigned 16-bit integer
x11.image-format image-format
Unsigned 8-bit integer
x11.image-pixmap-format image-pixmap-format
Unsigned 8-bit integer
x11.interval interval
Signed 16-bit integer
x11.items items
No value
x11.join-style join-style
Unsigned 8-bit integer
x11.key key
Unsigned 8-bit integer
x11.key-click-percent key-click-percent
Signed 8-bit integer
x11.keyboard-key keyboard-key
Unsigned 8-bit integer
x11.keyboard-mode keyboard-mode
Unsigned 8-bit integer
x11.keyboard-value-mask keyboard-value-mask
Unsigned 32-bit integer
x11.keyboard-value-mask.auto-repeat-mode auto-repeat-mode
Boolean
x11.keyboard-value-mask.bell-duration bell-duration
Boolean
x11.keyboard-value-mask.bell-percent bell-percent
Boolean
x11.keyboard-value-mask.bell-pitch bell-pitch
Boolean
Boolean
x11.keyboard-value-mask.keyboard-key keyboard-key
Boolean
x11.keyboard-value-mask.led led
Boolean
x11.keyboard-value-mask.led-mode led-mode
Boolean
x11.keycode-count keycode-count
Unsigned 8-bit integer
x11.keycodes keycodes
No value
x11.keycodes-per-modifier keycodes-per-modifier
Unsigned 8-bit integer
x11.keycodes.item item
Byte array
x11.keysyms keysyms
No value
x11.keysyms-per-keycode keysyms-per-keycode
Unsigned 8-bit integer
x11.keysyms.item item
No value
x11.keysyms.item.keysym keysym
Unsigned 32-bit integer
x11.led led
Unsigned 8-bit integer
x11.led-mode led-mode
Unsigned 8-bit integer
x11.left-pad left-pad
Unsigned 8-bit integer
x11.line-style line-style
Unsigned 8-bit integer
x11.line-width line-width
Unsigned 16-bit integer
x11.long-length long-length
Unsigned 32-bit integer
Unsigned 32-bit integer
x11.map map
Byte array
x11.map-length map-length
Unsigned 8-bit integer
x11.mask mask
Unsigned 32-bit integer
x11.mask-char mask-char
Unsigned 16-bit integer
x11.mask-font mask-font
Unsigned 32-bit integer
x11.max-names max-names
Unsigned 16-bit integer
x11.mid mid
Unsigned 32-bit integer
x11.mode mode
Unsigned 8-bit integer
x11.modifiers-mask modifiers-mask
Unsigned 16-bit integer
x11.modifiers-mask.AnyModifier AnyModifier
Unsigned 16-bit integer
x11.modifiers-mask.Control Control
Boolean
x11.modifiers-mask.Lock Lock
Boolean
x11.modifiers-mask.Mod1 Mod1
Boolean
x11.modifiers-mask.Mod2 Mod2
Boolean
x11.modifiers-mask.Mod3 Mod3
Boolean
x11.modifiers-mask.Mod4 Mod4
Boolean
x11.modifiers-mask.Mod5 Mod5
Boolean
Boolean
x11.modifiers-mask.erroneous-bits erroneous-bits
Boolean
x11.name name
String
x11.name-length name-length
Unsigned 16-bit integer
x11.odd-length odd-length
Boolean
x11.only-if-exists only-if-exists
Boolean
x11.opcode opcode
Unsigned 8-bit integer
x11.ordering ordering
Unsigned 8-bit integer
x11.override-redirect override-redirect
Boolean
x11.owner owner
Unsigned 32-bit integer
x11.owner-events owner-events
Boolean
x11.parent parent
Unsigned 32-bit integer
x11.path path
No value
x11.path.string string
String
x11.pattern pattern
String
x11.pattern-length pattern-length
Unsigned 16-bit integer
x11.percent percent
Unsigned 8-bit integer
x11.pid pid
Unsigned 32-bit integer
Unsigned 32-bit integer
x11.pixels pixels
No value
x11.pixels_item pixels_item
Unsigned 32-bit integer
x11.pixmap pixmap
Unsigned 32-bit integer
x11.plane-mask plane-mask
Unsigned 32-bit integer
x11.planes planes
Unsigned 16-bit integer
x11.point point
No value
x11.point-x point-x
Signed 16-bit integer
x11.point-y point-y
Signed 16-bit integer
x11.pointer-event-mask pointer-event-mask
Unsigned 16-bit integer
x11.pointer-event-mask.Button1Motion Button1Motion
Boolean
x11.pointer-event-mask.Button2Motion Button2Motion
Boolean
x11.pointer-event-mask.Button3Motion Button3Motion
Boolean
x11.pointer-event-mask.Button4Motion Button4Motion
Boolean
x11.pointer-event-mask.Button5Motion Button5Motion
Boolean
x11.pointer-event-mask.ButtonMotion ButtonMotion
Boolean
x11.pointer-event-mask.ButtonPress ButtonPress
Boolean
x11.pointer-event-mask.ButtonRelease ButtonRelease
Boolean
Boolean
x11.pointer-event-mask.KeymapState KeymapState
Boolean
x11.pointer-event-mask.LeaveWindow LeaveWindow
Boolean
x11.pointer-event-mask.PointerMotion PointerMotion
Boolean
x11.pointer-event-mask.PointerMotionHint PointerMotionHint
Boolean
x11.pointer-event-mask.erroneous-bits erroneous-bits
Boolean
x11.pointer-mode pointer-mode
Unsigned 8-bit integer
x11.points points
No value
x11.prefer-blanking prefer-blanking
Unsigned 8-bit integer
x11.properties properties
No value
x11.properties.item item
Unsigned 32-bit integer
x11.property property
Unsigned 32-bit integer
x11.property-number property-number
Unsigned 16-bit integer
x11.rectangle rectangle
No value
x11.rectangle-height rectangle-height
Unsigned 16-bit integer
x11.rectangle-width rectangle-width
Unsigned 16-bit integer
x11.rectangle-x rectangle-x
Signed 16-bit integer
x11.rectangle-y rectangle-y
Signed 16-bit integer
No value
x11.red red
Unsigned 16-bit integer
x11.reds reds
Unsigned 16-bit integer
x11.request request
Unsigned 8-bit integer
x11.request-length request-length
Unsigned 16-bit integer
x11.requestor requestor
Unsigned 32-bit integer
x11.resource resource
Unsigned 32-bit integer
x11.revert-to revert-to
Unsigned 8-bit integer
x11.save-set-mode save-set-mode
Unsigned 8-bit integer
x11.save-under save-under
Boolean
x11.screen-saver-mode screen-saver-mode
Unsigned 8-bit integer
x11.segment segment
No value
x11.segment_x1 segment_x1
Signed 16-bit integer
x11.segment_x2 segment_x2
Signed 16-bit integer
x11.segment_y1 segment_y1
Signed 16-bit integer
x11.segment_y2 segment_y2
Signed 16-bit integer
x11.segments segments
No value
x11.selection selection
Unsigned 32-bit integer
Unsigned 8-bit integer
x11.sibling sibling
Unsigned 32-bit integer
x11.source-char source-char
Unsigned 16-bit integer
x11.source-font source-font
Unsigned 32-bit integer
x11.source-pixmap source-pixmap
Unsigned 32-bit integer
x11.src-cmap src-cmap
Unsigned 32-bit integer
x11.src-drawable src-drawable
Unsigned 32-bit integer
x11.src-gc src-gc
Unsigned 32-bit integer
x11.src-height src-height
Unsigned 16-bit integer
x11.src-width src-width
Unsigned 16-bit integer
x11.src-window src-window
Unsigned 32-bit integer
x11.src-x src-x
Signed 16-bit integer
x11.src-y src-y
Signed 16-bit integer
x11.stack-mode stack-mode
Unsigned 8-bit integer
x11.start start
Unsigned 32-bit integer
x11.stipple stipple
Unsigned 32-bit integer
x11.stop stop
Unsigned 32-bit integer
x11.str-number-in-path str-number-in-path
Unsigned 16-bit integer
String
x11.string-length string-length
Unsigned 32-bit integer
x11.string16 string16
String
x11.string16.bytes bytes
Byte array
x11.subwindow-mode subwindow-mode
Unsigned 8-bit integer
x11.target target
Unsigned 32-bit integer
x11.textitem textitem
No value
x11.textitem.font font
Unsigned 32-bit integer
x11.textitem.string string
No value
x11.textitem.string.delta delta
Signed 8-bit integer
x11.textitem.string.string16 string16
String
x11.textitem.string.string16.bytes bytes
Byte array
x11.textitem.string.string8 string8
String
x11.threshold threshold
Signed 16-bit integer
x11.tile tile
Unsigned 32-bit integer
x11.tile-stipple-x-origin tile-stipple-x-origin
Signed 16-bit integer
x11.tile-stipple-y-origin tile-stipple-y-origin
Signed 16-bit integer
x11.time time
Unsigned 32-bit integer
Signed 16-bit integer
x11.type type
Unsigned 32-bit integer
x11.undecoded undecoded
No value
x11.unused unused
No value
x11.visual visual
Unsigned 32-bit integer
x11.visualid visualid
Unsigned 32-bit integer
x11.warp-pointer-dst-window warp-pointer-dst-window
Unsigned 32-bit integer
x11.warp-pointer-src-window warp-pointer-src-window
Unsigned 32-bit integer
x11.wid wid
Unsigned 32-bit integer
x11.width width
Unsigned 16-bit integer
x11.win-gravity win-gravity
Unsigned 8-bit integer
x11.window window
Unsigned 32-bit integer
x11.window-class window-class
Unsigned 16-bit integer
x11.window-value-mask window-value-mask
Unsigned 32-bit integer
x11.window-value-mask.background-pixel background-pixel
Boolean
x11.window-value-mask.background-pixmap background-pixmap
Boolean
x11.window-value-mask.backing-pixel backing-pixel
Boolean
x11.window-value-mask.backing-planes backing-planes
Boolean
Boolean
x11.window-value-mask.bit-gravity bit-gravity
Boolean
x11.window-value-mask.border-pixel border-pixel
Boolean
x11.window-value-mask.border-pixmap border-pixmap
Boolean
x11.window-value-mask.colormap colormap
Boolean
x11.window-value-mask.cursor cursor
Boolean
x11.window-value-mask.do-not-propagate-mask do-not-propagate-mask
Boolean
x11.window-value-mask.event-mask event-mask
Boolean
x11.window-value-mask.override-redirect override-redirect
Boolean
x11.window-value-mask.save-under save-under
Boolean
x11.window-value-mask.win-gravity win-gravity
Boolean
x11.x x
Signed 16-bit integer
x11.y y
Signed 16-bit integer
Yahoo Messenger Protocol (yhoo)
yhoo.connection_id Connection ID
Unsigned 32-bit integer
yhoo.content Content
String
yhoo.len Packet Length
Unsigned 32-bit integer
yhoo.magic_id Magic ID
Unsigned 32-bit integer
Unsigned 32-bit integer
yhoo.nick1 Real Nick (nick1)
String
yhoo.nick2 Active Nick (nick2)
String
yhoo.service Service Type
Unsigned 32-bit integer
yhoo.unknown1 Unknown 1
Unsigned 32-bit integer
yhoo.version Version
String
Yellow Pages Bind (ypbind)
Yellow Pages Passwd (yppasswd)
yppasswd.newpw newpw
No value
yppasswd.newpw.dir dir
String
yppasswd.newpw.gecos gecos
String
yppasswd.newpw.gid gid
Unsigned 32-bit integer
yppasswd.newpw.name name
String
yppasswd.newpw.passwd passwd
String
yppasswd.newpw.shell shell
String
yppasswd.newpw.uid uid
Unsigned 32-bit integer
yppasswd.oldpass oldpass
String
yppasswd.status status
Unsigned 32-bit integer
ypserv.domain Domain
String
ypserv.key Key
String
ypserv.map Map Name
String
ypserv.map_parms YP Map Parameters
No value
ypserv.more More
Boolean
ypserv.ordernum Order Number
Unsigned 32-bit integer
ypserv.peer Peer Name
String
ypserv.port Port
Unsigned 32-bit integer
ypserv.prog Program Number
Unsigned 32-bit integer
ypserv.servesdomain Serves Domain
Boolean
ypserv.status Status
Signed 32-bit integer
ypserv.transid Host Transport ID
IPv4 address
ypserv.value Value
String
ypserv.xfrstat Xfrstat
Signed 32-bit integer
Yellow Pages Transfer (ypxfr)
Zebra Protocol (zebra)
zebra.bandwidth Bandwidth
Unsigned 32-bit integer
Unsigned 8-bit integer
zebra.dest4 Destination
IPv4 address
zebra.dest6 Destination
IPv6 address
zebra.distance Distance
Unsigned 8-bit integer
zebra.family Family
Unsigned 32-bit integer
zebra.index Index
Unsigned 32-bit integer
zebra.indexnum Index Number
Unsigned 8-bit integer
zebra.interface Interface
String
zebra.intflags Flags
Unsigned 32-bit integer
zebra.len Length
Unsigned 16-bit integer
zebra.message Message
Unsigned 8-bit integer
zebra.message.distance Message Distance
Boolean
zebra.message.index Message Index
Boolean
zebra.message.metric Message Metric
Boolean
zebra.message.nexthop Message Nexthop
Boolean
zebra.metric Metric
Unsigned 32-bit integer
zebra.mtu MTU
Unsigned 32-bit integer
zebra.nexthop4 Nexthop
IPv4 address
IPv6 address
zebra.nexthopnum Nexthop Number
Unsigned 8-bit integer
zebra.prefix4 Prefix
IPv4 address
zebra.prefix6 Prefix
IPv6 address
zebra.prefixlen Prefix length
Unsigned 32-bit integer
zebra.request Request
Boolean
zebra.rtflags Flags
Unsigned 8-bit integer
zebra.type Type
Unsigned 8-bit integer
FILES
/usr/local/etc/ethereal.conf and $HOME/.ethereal/prefer
ences contain system-wide and personal preference set
tings, respectively. The file contains preference set
tings of the form prefname:value, one per line, where
prefname is the name of the preference (which is the same
name that would appear in the preference file), and value
is the value to which it should be set; white space is
allowed between : and value. A preference setting can be
continued on subsequent lines by indenting the continua
tion lines with white space. A # character starts a com
ment that runs to the end of the line.
The system-wide preference file is read first, if it
exists, overriding Tethereal's default values; the per
sonal preferences file is then read, if it exists, over
riding default values and values read from the system-wide
preference file.
/etc/ethers is consulted to correlate 6-byte hardware
addresses to names. If an address is not found in
/etc/ethers, the $HOME/.ethereal/ethers file is consulted
next. Each line contains one hardware address and name,
separated by whitespace. The digits of the hardware
address are separated by either a colon (:), a dash (-),
or a period (.). The following three lines are valid
lines of an ethers file:
c0-00-ff-ff-ff-ff TR_broadcast
00.00.00.00.00.00 Zero_broadcast
/usr/local/etc/manuf matches the 3-byte vendor portion of
a 6-byte hardware address with the manufacturer's name.
The format of the file is the same as the /etc/ethers
file, except that each address is three bytes instead of
six.
/etc/ipxnets and $HOME/.ethereal/ipxnets correlate 4-byte
IPX network numbers to names. The format is the same as
the /etc/ethers file, except that each address if four
bytes instead of six. Additionally, the address can be
represented a single hexadecimal number, as is more common
in the IPX world, rather than four hex octets. For exam
ple, these four lines are valid lines of an ipxnets file.
C0.A8.2C.00 HR
c0-a8-1c-00 CEO
00:00:BE:EF IT_Server1
110f FileServer3
SEE ALSO
ethereal(1), editcap(1), tcpdump(8), pcap(3)
NOTES
Tethereal is part of the Ethereal distribution. The lat
est version of Ethereal can be found at http://www.ethe
real.com.
AUTHORS
Tethereal uses the same packet dissection code that Ethe
real does, as well as using many other modules from Ethe
real; see the list of authors in the Ethereal man page for
a list of authors of that code.
Man(1) output converted with
man2html