Display Filter Reference: NetBIOS

Protocol field name: netbios

Versions: 1.0.0 to 2.6.1

Back to Display Filter Reference

Field name Description Type Versions
netbios.ack Acknowledge Boolean 1.0.0 to 1.8.15
netbios.ack_expected Acknowledge expected Boolean 1.0.0 to 1.8.15
netbios.ack_with_data Acknowledge with data Boolean 1.0.0 to 1.8.15
netbios.call_name_type Caller\'s Name Type Unsigned integer, 1 byte 1.0.0 to 2.6.1
netbios.command Command Unsigned integer, 1 byte 1.0.0 to 2.6.1
netbios.data1 DATA1 value Unsigned integer, 1 byte 1.0.0 to 1.8.15
netbios.data2 DATA2 value Unsigned integer, 2 bytes 1.0.0 to 2.6.1
netbios.data2.frame Data length exceeds maximum frame size Boolean 1.10.0 to 2.6.1
netbios.data2.status Status data length Unsigned integer, 2 bytes 1.10.0 to 2.6.1
netbios.data2.user Data length exceeds user\'s buffer Boolean 1.10.0 to 2.6.1
netbios.datagram_bcast_mac Sender\'s Node Address Ethernet or other MAC address 1.10.0 to 2.6.1
netbios.datagram_mac Sender\'s MAC Address Ethernet or other MAC address 1.10.0 to 2.6.1
netbios.delimiter Delimiter Unsigned integer, 2 bytes 2.0.0 to 2.6.1
netbios.flags Flags Unsigned integer, 1 byte 1.10.0 to 2.6.1
netbios.flags.ack Acknowledge Boolean 1.10.0 to 2.6.1
netbios.flags.ack_expected Acknowledge expected Boolean 1.10.0 to 2.6.1
netbios.flags.ack_with_data Acknowledge with data Boolean 1.10.0 to 2.6.1
netbios.flags.recv_cont_req RECEIVE_CONTINUE requested Boolean 1.10.0 to 2.6.1
netbios.flags.send_no_ack Handle SEND.NO.ACK Boolean 1.10.0 to 2.6.1
netbios.fragment NetBIOS Fragment Frame number 1.0.0 to 2.6.1
netbios.fragment.count Fragment count Unsigned integer, 4 bytes 1.6.0 to 2.6.1
netbios.fragment.error Defragmentation error Frame number 1.0.0 to 2.6.1
netbios.fragment.multipletails Multiple tail fragments found Boolean 1.0.0 to 2.6.1
netbios.fragment.overlap Fragment overlap Boolean 1.0.0 to 2.6.1
netbios.fragment.overlap.conflict Conflicting data in fragment overlap Boolean 1.0.0 to 2.6.1
netbios.fragment.toolongfragment Fragment too long Boolean 1.0.0 to 2.6.1
netbios.fragments NetBIOS Fragments Label 1.0.0 to 2.6.1
netbios.hdr_len Length Unsigned integer, 2 bytes 1.0.0 to 2.6.1
netbios.largest_frame Largest Frame Unsigned integer, 1 byte 1.0.0 to 2.6.1
netbios.local_session Local Session No. Unsigned integer, 1 byte 1.0.0 to 2.6.1
netbios.local_session_no Local Session No. Unsigned integer, 1 byte 2.0.0 to 2.6.1
netbios.max_data_recv_size Maximum data receive size Unsigned integer, 2 bytes 1.0.0 to 2.6.1
netbios.name_type Name type Unsigned integer, 2 bytes 1.0.0 to 2.6.1
netbios.nb_name NetBIOS Name Character string 1.0.0 to 2.6.1
netbios.nb_name_type NetBIOS Name Type Unsigned integer, 1 byte 1.0.0 to 2.6.1
netbios.no_receive_flags Flags Unsigned integer, 1 byte 1.10.0 to 2.6.1
netbios.no_receive_flags.send_no_ack SEND.NO.ACK data received Boolean 1.10.0 to 2.6.1
netbios.num_data_bytes_accepted Number of data bytes accepted Unsigned integer, 2 bytes 1.0.0 to 2.6.1
netbios.reassembled.length Reassembled NetBIOS length Unsigned integer, 4 bytes 1.4.0 to 2.6.1
netbios.recv_cont_req RECEIVE_CONTINUE requested Boolean 1.0.0 to 1.8.15
netbios.remote_session Remote Session No. Unsigned integer, 1 byte 1.0.0 to 2.6.1
netbios.resp_corrl Response Correlator Unsigned integer, 2 bytes 1.0.0 to 2.6.1
netbios.resync_indicator Re-sync indicator Unsigned integer, 2 bytes 2.0.0 to 2.6.1
netbios.send_no_ack Handle SEND.NO.ACK Boolean 1.0.0 to 1.8.15
netbios.state_of_name State of name Unsigned integer, 1 byte 2.0.0 to 2.6.1
netbios.status Status Unsigned integer, 1 byte 1.0.0 to 2.6.1
netbios.status_buffer_len Length of status buffer Unsigned integer, 2 bytes 1.0.0 to 2.6.1
netbios.status_request Status request Unsigned integer, 1 byte 2.0.0 to 2.6.1
netbios.status_response Status response Unsigned integer, 1 byte 2.0.0 to 2.6.1
netbios.termination_indicator Termination indicator Unsigned integer, 2 bytes 1.0.0 to 2.6.1
netbios.unknown_command_data Unknown NetBIOS command data Label 2.0.0 to 2.6.1
netbios.version NetBIOS Version Boolean 1.0.0 to 2.6.1
netbios.xmit_corrl Transmit Correlator Unsigned integer, 2 bytes 1.0.0 to 2.6.1
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ NetShark appliance
  • • Troubleshoot problems faster
  • • Quickly identify the applications running on your network
  • • Monitor your virtual machine traffic
Learn More