Official certification from the Wireshark Foundation is available! Learn about becoming a Wireshark Certified Analyst.

Display Filter Reference: Session Announcement Protocol

Protocol field name: sap

Versions: 1.0.0 to 4.6.0

Back to Display Filter Reference

Field name Description Type Versions
sap.authAuthentication dataLabel1.0.0 to 4.6.0
sap.auth.data_paddingAuthentication data paddingByte sequence1.12.0 to 4.6.0
sap.auth.data_padding.lenAuthentication data pad count (bytes)Unsigned integer (8 bits)1.12.0 to 4.6.0
sap.auth.flagsAuthentication data flagsUnsigned integer (8 bits)1.0.0 to 4.6.0
sap.auth.flags.pPadding BitBoolean1.0.0 to 4.6.0
sap.auth.flags.tAuthentication TypeUnsigned integer (8 bits)1.0.0 to 4.6.0
sap.auth.flags.vVersion NumberUnsigned integer (8 bits)1.0.0 to 4.6.0
sap.auth.lenAuthentication LengthUnsigned integer (8 bits)1.12.0 to 4.6.0
sap.auth.subheaderAuthentication subheaderByte sequence1.12.0 to 4.6.0
sap.bogus_authentication_or_pad_lengthBogus authentication lengthLabel1.12.0 to 4.6.0
sap.compressedThe rest of the packet is compressedLabel1.12.0 to 4.6.0
sap.compressed_and_encryptedThe rest of the packet is compressed and encryptedLabel1.12.0 to 4.6.0
sap.encryptedThe rest of the packet is encryptedLabel1.12.0 to 4.6.0
sap.flagsFlagsUnsigned integer (8 bits)1.0.0 to 4.6.0
sap.flags.aAddress TypeBoolean1.0.0 to 4.6.0
sap.flags.cCompression BitBoolean1.0.0 to 4.6.0
sap.flags.eEncryption BitBoolean1.0.0 to 4.6.0
sap.flags.rReservedBoolean1.0.0 to 4.6.0
sap.flags.tMessage TypeBoolean1.0.0 to 4.6.0
sap.flags.vVersion NumberUnsigned integer (8 bits)1.0.0 to 4.6.0
sap.message_identifier_hashMessage Identifier HashUnsigned integer (16 bits)1.12.0 to 4.6.0
sap.originating_sourceOriginating SourceIPv4 address1.12.0 to 4.6.0
sap.originating_source.ipv6Originating SourceIPv6 address2.2.0 to 4.6.0
sap.payload_typePayload typeCharacter string1.12.0 to 4.6.0