Display Filter Reference: Spotlight metadata search service

Protocol field name: mdssvc

Versions: 1.12.0 to 2.6.1

Back to Display Filter Reference

Field name Description Type Versions
mdssvc.mdssvc_blob.length Length Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_blob.size Size Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_blob.spotlight_blob Spotlight Blob Unsigned integer, 1 byte 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.device_id Device Id Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.flags Flags Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.max_fragment_size1 Max Fragment Size1 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.max_fragment_size2 Max Fragment Size2 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.request_blob Request Blob Label 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.response_blob Response Blob Label 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.share_handle Share Handle Sequence of bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.status Status Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.unkn1 Unkn1 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.unkn3 Unkn3 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.unkn4 Unkn4 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.unkn5 Unkn5 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.unkn6 Unkn6 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.unkn7 Unkn7 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.unkn8 Unkn8 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_cmd.unkn9 Unkn9 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_open.device_id Device Id Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_open.share_handle Share Handle Sequence of bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_open.share_mount_path Share Mount Path Character string 1.12.0 to 2.6.1
mdssvc.mdssvc_open.share_name Share Name Character string 1.12.0 to 2.6.1
mdssvc.mdssvc_open.share_path Share Path Character string 1.12.0 to 2.6.1
mdssvc.mdssvc_open.unkn2 Unkn2 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_open.unkn3 Unkn3 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.device_id Device Id Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.flags Flags Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.share_handle Share Handle Sequence of bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.status Status Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.unkn1 Unkn1 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.unkn3 Unkn3 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.unkn4 Unkn4 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.unkn5 Unkn5 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.unkn6 Unkn6 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.mdssvc_unknown1.unkn7 Unkn7 Unsigned integer, 4 bytes 1.12.0 to 2.6.1
mdssvc.opnum Operation Unsigned integer, 2 bytes 1.12.0 to 2.6.1
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ NetShark appliance
  • • Troubleshoot problems faster
  • • Quickly identify the applications running on your network
  • • Monitor your virtual machine traffic
Learn More