Display Filter Reference: Socks Protocol
Protocol field name: socks
Versions: 1.0.0 to 3.2.1
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| socks.address_type | Address Type | Unsigned integer, 1 byte | 1.10.0 to 3.2.1 |
| socks.auth_accepted_method | Accepted Auth Method | Unsigned integer, 1 byte | 1.10.0 to 3.2.1 |
| socks.auth_method | Method | Unsigned integer, 1 byte | 1.10.0 to 3.2.1 |
| socks.auth_method_count | Authentication Method Count | Unsigned integer, 1 byte | 1.10.0 to 3.2.1 |
| socks.auth_status | Status | Unsigned integer, 1 byte | 1.10.0 to 3.2.1 |
| socks.command | Command | Unsigned integer, 1 byte | 1.0.0 to 3.2.1 |
| socks.dst | Remote Address | IPv4 address | 1.0.0 to 3.2.1 |
| socks.dstport | Remote Port | Unsigned integer, 2 bytes | 1.0.0 to 3.2.1 |
| socks.dstV6 | Remote Address(ipv6) | IPv6 address | 1.0.0 to 3.2.1 |
| socks.fragment_number | Fragment Number | Unsigned integer, 1 byte | 1.10.0 to 3.2.1 |
| socks.gssapi.command | SOCKS/GSSAPI command | Unsigned integer, 1 byte | 1.2.0 to 3.2.1 |
| socks.gssapi.data | GSSAPI data | Sequence of bytes | 1.2.0 to 3.2.1 |
| socks.gssapi.length | SOCKS/GSSAPI data length | Unsigned integer, 2 bytes | 1.2.0 to 3.2.1 |
| socks.password | Password | Character string | 1.10.0 to 3.2.1 |
| socks.ping_end_command | Ping: End command | Label | 2.0.0 to 3.2.1 |
| socks.ping_results | Ping Results | Label | 2.0.0 to 3.2.1 |
| socks.port | Port | Unsigned integer, 2 bytes | 1.10.0 to 3.2.1 |
| socks.remote_host_port | Remote Host Port | Unsigned integer, 2 bytes | 1.10.0 to 3.2.1 |
| socks.remote_name | Remote name | Character string | 1.10.0 to 3.2.1 |
| socks.reserved | Reserved | Unsigned integer, 1 byte | 1.10.0 to 3.2.1 |
| socks.results | Results(V4) | Unsigned integer, 1 byte | 1.0.0 to 3.2.1 |
| socks.results_v4 | Results(V4) | Unsigned integer, 1 byte | 1.0.0 to 1.8.15 |
| socks.results_v5 | Results(V5) | Unsigned integer, 1 byte | 1.0.0 to 1.8.15 |
| socks.subnegotation_version | Subnegotiation Version | Unsigned integer, 1 byte | 2.6.0 to 3.2.1 |
| socks.traceroute_end_command | Traceroute: End command | Label | 2.0.0 to 3.2.1 |
| socks.traceroute_results | Traceroute Results | Label | 2.0.0 to 3.2.1 |
| socks.username | User name | Character string | 1.0.0 to 3.2.1 |
| socks.v4a_dns_name | SOCKS v4a Remote Domain Name | Character string | 1.0.0 to 3.2.1 |
| socks.version | Version | Unsigned integer, 1 byte | 1.0.0 to 3.2.1 |
Go Beyond with Riverbed Technology
I have a lot of traffic...
ANSWER: SteelCentral™ Packet Analyzer PE
- • Visually rich, powerful LAN analyzer
- • Quickly access very large pcap files
- • Professional, customizable reports
- • Advanced triggers and alerts
No, really, I have a LOT of traffic…
ANSWER: SteelCentral™ AppResponse 11
- • Full stack analysis – from packets to pages
- • Rich performance metrics & pre-defined insights for fast problem identification/resolution
- • Modular, flexible solution for deeply-analyzing network & application performance