Display Filter Reference: SMB Witness Service

Protocol field name: witness

Versions: 2.2.0 to 2.6.3

Back to Display Filter Reference

Field name Description Type Versions
witness.opnum Operation Unsigned integer, 2 bytes 2.2.0 to 2.6.3
witness.werror Windows Error Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_AsyncNotify.context_handle Context Handle Sequence of bytes 2.2.0 to 2.6.3
witness.witness_AsyncNotify.response Response Label 2.2.0 to 2.6.3
witness.witness_GetInterfaceList.interface_list Interface List Label 2.2.0 to 2.6.3
witness.witness_interfaceInfo.flags Flags Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_interfaceInfo.group_name Group Name Character string 2.2.0 to 2.6.3
witness.witness_interfaceInfo.ipv4 Ipv4 IPv4 address 2.2.0 to 2.6.3
witness.witness_interfaceInfo.ipv6 Ipv6 IPv6 address 2.2.0 to 2.6.3
witness.witness_interfaceInfo.state State Unsigned integer, 2 bytes 2.2.0 to 2.6.3
witness.witness_interfaceInfo.version Version Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv4_VALID WITNESS INFO IPv4 VALID Boolean 2.2.0 to 2.6.3
witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv6_VALID WITNESS INFO IPv6 VALID Boolean 2.2.0 to 2.6.3
witness.witness_interfaceInfo_flags.WITNESS_INFO_WITNESS_IF WITNESS INFO WITNESS IF Boolean 2.2.0 to 2.6.3
witness.witness_interfaceList.interfaces Interfaces Label 2.2.0 to 2.6.3
witness.witness_interfaceList.num_interfaces Num Interfaces Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_IPaddrInfo.flags Flags Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_IPaddrInfo.ipv4 Ipv4 IPv4 address 2.2.0 to 2.6.3
witness.witness_IPaddrInfo.ipv6 Ipv6 IPv6 address 2.2.0 to 2.6.3
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_OFFLINE WITNESS IPADDR OFFLINE Boolean 2.2.0 to 2.6.3
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_ONLINE WITNESS IPADDR ONLINE Boolean 2.2.0 to 2.6.3
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V4 WITNESS IPADDR V4 Boolean 2.2.0 to 2.6.3
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V6 WITNESS IPADDR V6 Boolean 2.2.0 to 2.6.3
witness.witness_IPaddrInfoList.addr Addr Label 2.2.0 to 2.6.3
witness.witness_IPaddrInfoList.length Length Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_IPaddrInfoList.num Num Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_IPaddrInfoList.reserved Reserved Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_notifyResponse.length Length Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_notifyResponse.messages Messages Label 2.2.0 to 2.6.3
witness.witness_notifyResponse.messages_ Messages Label 2.2.0 to 2.6.3
witness.witness_notifyResponse.num Num Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_notifyResponse.type Type Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_notifyResponse_message.client_move Client Move Label 2.2.0 to 2.6.3
witness.witness_notifyResponse_message.data Data Label 2.2.0 to 2.6.3
witness.witness_notifyResponse_message.ip_change Ip Change Label 2.2.0 to 2.6.3
witness.witness_notifyResponse_message.resource_change Resource Change Label 2.2.0 to 2.6.3
witness.witness_notifyResponse_message.share_move Share Move Label 2.2.0 to 2.6.3
witness.witness_Register.client_computer_name Client Computer Name Character string 2.2.0 to 2.6.3
witness.witness_Register.context_handle Context Handle Sequence of bytes 2.2.0 to 2.6.3
witness.witness_Register.ip_address Ip Address Character string 2.2.0 to 2.6.3
witness.witness_Register.net_name Net Name Character string 2.2.0 to 2.6.3
witness.witness_Register.version Version Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_RegisterEx.client_computer_name Client Computer Name Character string 2.2.0 to 2.6.3
witness.witness_RegisterEx.context_handle Context Handle Sequence of bytes 2.2.0 to 2.6.3
witness.witness_RegisterEx.flags Flags Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_RegisterEx.ip_address Ip Address Character string 2.2.0 to 2.6.3
witness.witness_RegisterEx.net_name Net Name Character string 2.2.0 to 2.6.3
witness.witness_RegisterEx.share_name Share Name Character string 2.2.0 to 2.6.3
witness.witness_RegisterEx.timeout Timeout Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_RegisterEx.version Version Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_RegisterEx_flags.WITNESS_REGISTER_IP_NOTIFICATION WITNESS REGISTER IP NOTIFICATION Boolean 2.2.0 to 2.6.3
witness.witness_RegisterEx_flags.WITNESS_REGISTER_NONE Witness Register None Boolean 2.2.0 to 2.2.1
witness.witness_ResourceChange.length Length Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_ResourceChange.name Name Character string 2.2.0 to 2.6.3
witness.witness_ResourceChange.type Type Unsigned integer, 4 bytes 2.2.0 to 2.6.3
witness.witness_UnRegister.context_handle Context Handle Sequence of bytes 2.2.0 to 2.6.3
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ AppResponse 11
  • • Full stack analysis – from packets to pages
  • • Rich performance metrics & pre-defined insights for fast problem identification/resolution
  • • Modular, flexible solution for deeply-analyzing network & application performance
Learn More