Official certification from the Wireshark Foundation is available! Learn about becoming a Wireshark Certified Analyst.

Display Filter Reference: SMB Witness Service

Protocol field name: witness

Versions: 2.2.0 to 4.6.0

Back to Display Filter Reference

Field name Description Type Versions
witness.opnumOperationUnsigned integer (16 bits)2.2.0 to 4.6.0
witness.werrorWindows ErrorUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_AsyncNotify.context_handleContext HandleByte sequence2.2.0 to 4.6.0
witness.witness_AsyncNotify.responseResponseLabel2.2.0 to 4.6.0
witness.witness_GetInterfaceList.interface_listInterface ListLabel2.2.0 to 4.6.0
witness.witness_interfaceInfo.flagsFlagsUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_interfaceInfo.group_nameGroup NameCharacter string2.2.0 to 4.6.0
witness.witness_interfaceInfo.ipv4Ipv4IPv4 address2.2.0 to 4.6.0
witness.witness_interfaceInfo.ipv6Ipv6IPv6 address2.2.0 to 4.6.0
witness.witness_interfaceInfo.stateStateUnsigned integer (16 bits)2.2.0 to 4.6.0
witness.witness_interfaceInfo.versionVersionUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv4_VALIDWITNESS INFO IPv4 VALIDBoolean2.2.0 to 4.6.0
witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv6_VALIDWITNESS INFO IPv6 VALIDBoolean2.2.0 to 4.6.0
witness.witness_interfaceInfo_flags.WITNESS_INFO_WITNESS_IFWITNESS INFO WITNESS IFBoolean2.2.0 to 4.6.0
witness.witness_interfaceList.interfacesInterfacesLabel2.2.0 to 4.6.0
witness.witness_interfaceList.num_interfacesNum InterfacesUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_IPaddrInfo.flagsFlagsUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_IPaddrInfo.ipv4Ipv4IPv4 address2.2.0 to 4.6.0
witness.witness_IPaddrInfo.ipv6Ipv6IPv6 address2.2.0 to 4.6.0
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_OFFLINEWITNESS IPADDR OFFLINEBoolean2.2.0 to 4.6.0
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_ONLINEWITNESS IPADDR ONLINEBoolean2.2.0 to 4.6.0
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V4WITNESS IPADDR V4Boolean2.2.0 to 4.6.0
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V6WITNESS IPADDR V6Boolean2.2.0 to 4.6.0
witness.witness_IPaddrInfoList.addrAddrLabel2.2.0 to 4.6.0
witness.witness_IPaddrInfoList.lengthLengthUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_IPaddrInfoList.numNumUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_IPaddrInfoList.reservedReservedUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_notifyResponse.lengthLengthUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_notifyResponse.messagesMessagesLabel2.2.0 to 4.6.0
witness.witness_notifyResponse.messages_MessagesLabel2.2.0 to 4.6.0
witness.witness_notifyResponse.numNumUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_notifyResponse.typeTypeUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_notifyResponse_message.client_moveClient MoveLabel2.2.0 to 4.6.0
witness.witness_notifyResponse_message.dataDataLabel2.2.0 to 4.6.0
witness.witness_notifyResponse_message.ip_changeIp ChangeLabel2.2.0 to 4.6.0
witness.witness_notifyResponse_message.resource_changeResource ChangeLabel2.2.0 to 4.6.0
witness.witness_notifyResponse_message.share_moveShare MoveLabel2.2.0 to 4.6.0
witness.witness_Register.client_computer_nameClient Computer NameCharacter string2.2.0 to 4.6.0
witness.witness_Register.context_handleContext HandleByte sequence2.2.0 to 4.6.0
witness.witness_Register.ip_addressIp AddressCharacter string2.2.0 to 4.6.0
witness.witness_Register.net_nameNet NameCharacter string2.2.0 to 4.6.0
witness.witness_Register.versionVersionUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_RegisterEx.client_computer_nameClient Computer NameCharacter string2.2.0 to 4.6.0
witness.witness_RegisterEx.context_handleContext HandleByte sequence2.2.0 to 4.6.0
witness.witness_RegisterEx.flagsFlagsUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_RegisterEx.ip_addressIp AddressCharacter string2.2.0 to 4.6.0
witness.witness_RegisterEx.net_nameNet NameCharacter string2.2.0 to 4.6.0
witness.witness_RegisterEx.share_nameShare NameCharacter string2.2.0 to 4.6.0
witness.witness_RegisterEx.timeoutTimeoutUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_RegisterEx.versionVersionUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_RegisterEx_flags.WITNESS_REGISTER_IP_NOTIFICATIONWITNESS REGISTER IP NOTIFICATIONBoolean2.2.0 to 4.6.0
witness.witness_RegisterEx_flags.WITNESS_REGISTER_NONEWitness Register NoneBoolean2.2.0 to 2.2.1
witness.witness_ResourceChange.lengthLengthUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_ResourceChange.nameNameCharacter string2.2.0 to 4.6.0
witness.witness_ResourceChange.typeTypeUnsigned integer (32 bits)2.2.0 to 4.6.0
witness.witness_UnRegister.context_handleContext HandleByte sequence2.2.0 to 4.6.0