Official certification from the Wireshark Foundation is available! Learn about becoming a Wireshark Certified Analyst.

Display Filter Reference: Executable and Linkable Format

Protocol field name: elf

Versions: 1.12.0 to 4.6.0

Back to Display Filter Reference

Field name Description Type Versions
elf.abi_versionABI VersionUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.blackhole_sizeBlackhole sizeUnsigned integer (32 bits)2.0.0 to 4.6.0
elf.blackholes_sizeTotal blackholes sizeUnsigned integer (32 bits)2.0.0 to 4.6.0
elf.cfi_extraneous_dataSegment size is larger than CFI records combinedLabel2.0.0 to 4.6.0
elf.data_encodingData EncodingUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.dwarf.formatDWARF Exception Header value formatUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.dwarf.omitDW_EH_PE_omitUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.dwarf.upperDWARF Exception Header applicationUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.dynamic.ignoredIgnoredUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.dynamic.ignored64IgnoredUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.dynamic.pointerPointerUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.dynamic.pointer64PointerUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.dynamic.tagTagUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.dynamic.tag64TagUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.dynamic.unspecifiedUnspecifiedUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.dynamic.unspecified64UnspecifiedUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.dynamic.valueValueUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.dynamic.value64ValueUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.eh_frame.augmentation_dataAugmentation DataByte sequence1.12.0 to 4.6.0
elf.eh_frame.augmentation_lengthAugmentation LengthUnsigned integer (64 bits)1.12.0 to 4.6.0
elf.eh_frame.augmentation_stringAugmentation StringCharacter string1.12.3 to 4.6.0
elf.eh_frame.cie_idCIE IDUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.eh_frame.code_alignment_factorCode Alignment FactorUnsigned integer (64 bits)1.12.0 to 4.6.0
elf.eh_frame.data_alignment_factorData Alignment FactorSigned integer (64 bits)1.12.0 to 4.6.0
elf.eh_frame.extended_lengthExtended LengthUnsigned integer (64 bits)2.0.0 to 4.6.0
elf.eh_frame.fde.augmentation_dataAugmentation DataByte sequence1.12.0 to 4.6.0
elf.eh_frame.fde.augmentation_lengthAugmentation LengthUnsigned integer (64 bits)1.12.0 to 4.6.0
elf.eh_frame.fde.call_frame_instructionsCall Frame InstructionsByte sequence1.12.0 to 4.6.0
elf.eh_frame.fde.cie_pointerCIE PointerUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.eh_frame.fde.extended_lengthExtended LengthUnsigned integer (64 bits)2.0.0 to 4.6.0
elf.eh_frame.fde.lengthLengthUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.eh_frame.fde.pc_beginPC BeginUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.eh_frame.fde.pc_rangePC RangeUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.eh_frame.initial_instructionsInitial InstructionsByte sequence1.12.0 to 4.6.0
elf.eh_frame.lengthLengthUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.eh_frame.return_address_registerReturn Address RegisterUnsigned integer (64 bits)1.12.0 to 4.6.0
elf.eh_frame.versionVersionUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.eh_frame_hdr.binary_search_table_encodingBinary Search Table EncodingUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.eh_frame_hdr.binary_search_table_entry.addressAddressByte sequence1.12.0 to 4.6.0
elf.eh_frame_hdr.binary_search_table_entry.initial_locationInitial locationByte sequence1.12.0 to 4.6.0
elf.eh_frame_hdr.eh_frame_ptrException Frame PointerByte sequence1.12.0 to 4.6.0
elf.eh_frame_hdr.eh_frame_ptr_encException Frame Pointer EncodingUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.eh_frame_hdr.fde_countNumber of FDE entriesUnsigned integer (64 bits)1.12.0 to 4.6.0
elf.eh_frame_hdr.fde_count_encFDE Count EncodingUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.eh_frame_hdr.versionVersionUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.ehsizeELF Header SizeUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.entryEntryUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.entry64EntryUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.entry_bytesEntryByte sequence2.0.0 to 4.6.0
elf.file_classFile ClassUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.file_paddingFile PaddingByte sequence1.12.0 to 4.6.0
elf.file_sizeFile sizeUnsigned integer (32 bits)2.0.0 to 4.6.0
elf.file_versionFile VersionUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.flagsFlagsUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.header_segment_sizeHeader size + all segment sizeUnsigned integer (32 bits)2.0.0 to 4.6.0
elf.invalid_cie_lengthCIE length is too small or larger than segment sizeLabel2.0.0 to 4.6.0
elf.invalid_entry_sizeEntry size is different then currently parsed bytesLabel1.12.0 to 4.6.0
elf.invalid_segment_sizeSegment size is different then currently parsed bytesLabel1.12.0 to 4.6.0
elf.machineMachineUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.magic_bytesMagic BytesByte sequence1.12.0 to 4.6.0
elf.os_abiOS ABIUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.overlapping_sizeOverlapping sizeUnsigned integer (32 bits)2.0.0 to 4.6.0
elf.p_alignAlignUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.p_align64AlignUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.p_fileszFile Image SizeUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.p_filesz64File Image SizeUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.p_flags.executeExecute FlagBoolean1.12.0 to 4.6.0
elf.p_flags.maskosOperating System Specific FlagsBoolean1.12.0 to 4.6.0
elf.p_flags.maskprocProcessor Specific FlagsBoolean1.12.0 to 4.6.0
elf.p_flags.readRead FlagBoolean1.12.0 to 4.6.0
elf.p_flags.reservedReserved FlagsBoolean1.12.0 to 4.6.0
elf.p_flags.writeWrite FlagBoolean1.12.0 to 4.6.0
elf.p_memszMemory Image SizeUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.p_memsz64Memory Image SizeUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.p_offsetFile OffsetUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.p_offset64File OffsetUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.p_paddrPhysical AddressUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.p_paddr64Physical AddressUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.p_typeElement TypeUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.p_vaddrVirtual AddressUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.p_vaddr64Virtual AddressUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.phentsizeEntry Size in Program Header TableUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.phnumNumber of Entries in the Program Header TableUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.phoffProgram Header Table File OffsetUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.phoff64Program Header Table File OffsetUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.segmentSegmentByte sequence2.0.0 to 4.6.0
elf.sh_addrAddressUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.sh_addr64AddressUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.sh_addralignAddress AlignmentUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.sh_addralign64Address AlignmentUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.sh_entsizeEntry SizeUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.sh_entsize64Entry SizeUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.sh_flags.allocAlloc FlagBoolean1.12.0 to 4.6.0
elf.sh_flags.exec_instrExec Instr FlagBoolean1.12.0 to 4.6.0
elf.sh_flags.groupGroup FlagBoolean1.12.0 to 4.6.0
elf.sh_flags.maskosOperating System Specific FlagsBoolean1.12.0 to 4.6.0
elf.sh_flags.maskprocProcessor Specific FlagsBoolean1.12.0 to 4.6.0
elf.sh_flags.mergeMerge FlagBoolean1.12.0 to 4.6.0
elf.sh_flags.os_nonconformingOS NonConforming FlagBoolean1.12.0 to 4.6.0
elf.sh_flags.reservedReservedBoolean1.12.0 to 4.6.0
elf.sh_flags.reserved.8ReservedBoolean1.12.0 to 4.6.0
elf.sh_flags.stringsStrings FlagBoolean1.12.0 to 4.6.0
elf.sh_flags.tlsTLS FlagBoolean1.12.0 to 4.6.0
elf.sh_flags.writeWrite FlagBoolean1.12.0 to 4.6.0
elf.sh_infoInfoUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.sh_nameName IndexUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.sh_offsetFile OffsetUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.sh_offset64File OffsetUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.sh_sizeSizeUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.sh_size64SizeUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.sh_typeTypeUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.shentsizeEntry Size in Section Header TableUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.shnumNumber of Entries in the Section Header TableUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.shoffSection Header Table File OffsetUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.shoff64Section Header Table File OffsetUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.shstrndxSection Header Table String IndexUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.stringStringCharacter string1.12.0 to 4.6.0
elf.symbol_table.infoInfoUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.symbol_table.info.bindBindUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.symbol_table.info.typeTypeUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.symbol_table.name_indexName IndexUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.symbol_table.otherOtherUnsigned integer (8 bits)1.12.0 to 4.6.0
elf.symbol_table.shndxRelated Section Header IndexUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.symbol_table.sizeSizeUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.symbol_table.size64SizeUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.symbol_table.valueValueUnsigned integer (32 bits)1.12.0 to 4.6.0
elf.symbol_table.value64ValueUnsigned integer (64 bits)2.2.0 to 4.6.0
elf.typeTypeUnsigned integer (16 bits)1.12.0 to 4.6.0
elf.versionVersionUnsigned integer (32 bits)1.12.0 to 4.6.0