Wireshark User’s Guide
Next
Wireshark User’s Guide
Version 4.5.0
Richard
Sharpe,
Ed Warnicke, Ulf Lamping
Table of Contents
Preface
1. Foreword
2. Who should read this document?
3. Acknowledgements
4. About this document
5. Where to get the latest copy of this document?
6. Providing feedback about this document
7. Typographic Conventions
7.1. Admonitions
7.2. Shell Prompt and Source Code Examples
1. Introduction
1.1. What is Wireshark?
1.1.1. Some intended purposes
1.1.2. Features
1.1.3. Live capture from many different network media
1.1.4. Import files from many other capture programs
1.1.5. Export files for many other capture programs
1.1.6. Many protocol dissectors
1.1.7. Open Source Software
1.1.8. What Wireshark is not
1.2. System Requirements
1.2.1. Microsoft Windows
1.2.2. macOS
1.2.3. UNIX, Linux, and BSD
1.3. Where To Get Wireshark
1.4. A Brief History Of Wireshark
1.5. Development And Maintenance Of Wireshark
1.6. Reporting Problems And Getting Help
1.6.1. Website
1.6.2. Wiki
1.6.3. Q&A Site
1.6.4. FAQ
1.6.5. Mailing Lists
1.6.6. Reporting Problems
1.6.7. Reporting Crashes on UNIX/Linux platforms
1.6.8. Reporting Crashes on Windows platforms
2. Building and Installing Wireshark
2.1. Introduction
2.2. Obtaining the source and binary distributions
2.3. Installing Wireshark under Windows
2.3.1. Installation Components
2.3.2. Additional Tasks
2.3.3. Install Location
2.3.4. Installing Npcap
2.3.5. Windows installer command line options
2.3.6. Manual Npcap Installation
2.3.7. Update Npcap
2.3.8. Uninstall Wireshark
2.3.9. Uninstall Npcap
2.4. Building from source under Windows
2.5. Installing Wireshark under macOS
2.6. Installing the binaries under UNIX
2.6.1. Installing from RPMs under Red Hat and alike
2.6.2. Installing from debs under Debian, Ubuntu and other Debian derivatives
2.6.3. Installing from portage under Gentoo Linux
2.6.4. Installing from packages under FreeBSD
2.7. Building from source under UNIX or Linux
2.8. Updating Wireshark
3. User Interface
3.1. Introduction
3.2. Start Wireshark
3.3. The Main window
3.3.1. Main Window Navigation
3.4. The Menu
3.5. The “File” Menu
3.6. The “Edit” Menu
3.7. The “View” Menu
3.8. The “Go” Menu
3.9. The “Capture” Menu
3.10. The “Analyze” Menu
3.11. The “Statistics” Menu
3.12. The “Telephony” Menu
3.13. The “Wireless” Menu
3.14. The “Tools” Menu
3.15. The “Help” Menu
3.16. The “Main” Toolbar
3.17. The “Filter” Toolbar
3.18. The “Packet List” Pane
3.19. The “Packet Details” Pane
3.20. The “Packet Bytes” Pane
3.21. The “Packet Diagram” Pane
3.22. The Statusbar
4. Capturing Live Network Data
4.1. Introduction
4.2. Prerequisites
4.3. Start Capturing
4.4. The “Capture” Section Of The Welcome Screen
4.5. The “Capture Options” Dialog Box
4.6. The “Manage Interfaces” Dialog Box
4.7. The “Compiled Filter Output” Dialog Box
4.8. Capture files and file modes
4.9. Link-layer header type
4.10. Filtering while capturing
4.10.1. Automatic Remote Traffic Filtering
4.11. While a Capture is running …
4.11.1. Stop the running capture
4.11.2. Restart a running capture
5. File Input, Output, And Printing
5.1. Introduction
5.2. Open Capture Files
5.2.1. The “Open Capture File” Dialog Box
5.2.2. Input File Formats
5.3. Saving Captured Packets
5.3.1. The “Save Capture File As” Dialog Box
5.3.2. Output File Formats
5.4. Merging Capture Files
5.4.1. The “Merge With Capture File” Dialog Box
5.5. Import Hex Dump
5.5.1. Standard ASCII Hexdumps
5.5.2. Regular Text Dumps
5.5.3. The “Import From Hex Dump” Dialog Box
5.5.4. File source
5.5.5. Input Format
5.5.6. Encapsulation
5.6. File Sets
5.6.1. The “List Files” Dialog Box
5.7. Exporting Data
5.7.1. The “Export Specified Packets” Dialog Box
5.7.2. The “Export Packet Dissections” Dialog Box
5.7.3. The “Export Selected Packet Bytes” Dialog Box
5.7.4. The “Export PDUs to File…” Dialog Box
5.7.5. The “Strip Headers…” Dialog Box
5.7.6. The “Export TLS Session Keys…” Dialog Box
5.7.7. The “Export Objects” Dialog Box
5.8. Printing Packets
5.8.1. The “Print” Dialog Box
5.9. The “Packet Range” Frame
5.10. The Packet Format Frame
6. Working With Captured Packets
6.1. Viewing Packets You Have Captured
6.2. Pop-up Menus
6.2.1. Pop-up Menu Of The “Packet List” Column Header
6.2.2. Pop-up Menu Of The “Packet List” Pane
6.2.3. Pop-up Menu Of The “Packet Details” Pane
6.2.4. Pop-up Menu Of The “Packet Bytes” Pane
6.2.5. Pop-up Menu Of The “Packet Diagram” Pane
6.3. Filtering Packets While Viewing
6.4. Building Display Filter Expressions
6.4.1. Display Filter Fields
6.4.2. Comparing Values
6.4.3. Combining Expressions
6.4.4. Slice Operator
6.4.5. The Layer Operator
6.4.6. The At Operator
6.4.7. Membership Operator
6.4.8. Arithmetic operators
6.4.9. Functions
6.4.10. Field References
6.4.11. Sometimes Fields Change Names
6.4.12. Some protocol names can be ambiguous
6.5. The “Display Filter Expression” Dialog Box
6.6. Defining And Saving Filters
6.7. Defining And Saving Filter Macros
6.7.1. Display Filter Macros syntax
6.8. Finding Packets
6.8.1. The “Find Packet” Toolbar
6.9. Go To A Specific Packet
6.9.1. The “Go Back” Command
6.9.2. The “Go Forward” Command
6.9.3. The “Go to Packet” Toolbar
6.9.4. The “Go to Corresponding Packet” Command
6.9.5. The “Go to First Packet” Command
6.9.6. The “Go to Last Packet” Command
6.10. Marking Packets
6.11. Ignoring Packets
6.12. Time Display Formats And Time References
6.12.1. Packet Time Referencing
6.13. Time Shifting Packets
7. Advanced Topics
7.1. Introduction
7.2. Following Protocol Streams
7.3. Show Packet Bytes
7.4. Expert Information
7.4.1. Expert Information Entries
7.4.2. The “Expert Information” Dialog
7.4.3. “Colorized” Protocol Details Tree
7.4.4. “Expert” Packet List Column (Optional)
7.5. TCP Analysis
7.6. Time Stamps
7.6.1. Wireshark Internals
7.6.2. Capture File Formats
7.6.3. Accuracy
7.7. Time Zones
7.7.1. Wireshark and Time Zones
7.8. Packet Reassembly
7.8.1. What Is It?
7.8.2. How Wireshark Handles It
7.8.3. TCP Reassembly
7.9. Name Resolution
7.9.1. Name Resolution Drawbacks
7.9.2. Ethernet Name Resolution (MAC Layer)
7.9.3. IP Name Resolution (Network Layer)
7.9.4. TCP/UDP Port Name Resolution (Transport Layer)
7.9.5. VLAN ID Resolution
7.9.6. SS7 Point Code Resolution
7.10. Checksums
7.10.1. Wireshark Checksum Validation
7.10.2. Checksum Offloading
7.10.3. Partial Checksums
8. Statistics
8.1. Introduction
8.2. The “Capture File Properties” Dialog
8.3. Resolved Addresses
8.4. The “Protocol Hierarchy” Window
8.5. Conversations
8.5.1. The “Conversations” Window
8.6. Endpoints
8.6.1. The “Endpoints” Window
8.7. Packet Lengths
8.8. The “I/O Graphs” Window
8.9. Service Response Time
8.9.1. The “SMB2 Service Response Time Statistics” Window
8.10. DHCP (BOOTP) Statistics
8.11. NetPerfMeter Statistics
8.12. ONC-RPC Programs
8.13. 29West
8.14. ANCP
8.15. BACnet
8.16. Collectd
8.17. DNS
8.18. Flow Graph
8.19. HART-IP
8.20. HPFEEDS
8.21. HTTP Statistics
8.21.1. HTTP Packet Counter
8.21.2. HTTP Requests
8.21.3. HTTP Load Distribution
8.21.4. HTTP Request Sequences
8.22. HTTP2
8.23. Sametime
8.24. TCP Stream Graphs
8.25. UDP Multicast Streams
8.26. Reliable Server Pooling (RSerPool)
8.27. F5
8.28. IPv4 Statistics
8.29. IPv6 Statistics
9. Telephony
9.1. Introduction
9.2. Playing VoIP Calls
9.2.1. Supported codecs
9.2.2. Work with RTP streams - Playlist
9.2.3. Playing audio during live capture
9.2.4. RTP Decoding Settings
9.2.5. VoIP Processing Performance and Related Limits
9.3. VoIP Calls Window
9.4. ANSI
9.4.1. A-I/F BSMAP Statistics Window
9.4.2. A-I/F DTAP Statistics Window
9.5. GSM Windows
9.6. IAX2 Stream Analysis Window
9.7. ISUP Messages Window
9.8. LTE
9.8.1. LTE MAC Traffic Statistics Window
9.8.2. LTE RLC Graph Window
9.8.3. LTE RLC Traffic Statistics Window
9.9. MTP3 Windows
9.10. Osmux Windows
9.11. RTP
9.11.1. RTP Streams Window
9.11.2. RTP Stream Analysis Window
9.11.3. RTP Player Window
9.12. RTSP Window
9.13. SCTP Windows
9.14. SMPP Operations Window
9.15. UCP Messages Window
9.16. H.225 Window
9.17. SIP Flows Window
9.18. SIP Statistics Window
9.19. WAP-WSP Packet Counter Window
10. Wireless
10.1. Introduction
10.2. Bluetooth ATT Server Attributes
10.3. Bluetooth Devices
10.4. Bluetooth HCI Summary
10.5. WLAN Traffic
11. Customizing Wireshark
11.1. Introduction
11.2. Start Wireshark from the command line
11.3. Packet colorization
11.4. Control Protocol Dissection
11.4.1. The “Enabled Protocols” dialog box
11.4.2. User Specified Decodes
11.5. Preferences
11.5.1. Appearance
11.5.2. Columns
11.5.3. Font and Colors
11.5.4. Layout
11.5.5. Capture
11.5.6. Expert Items
11.5.7. Filter Buttons
11.5.8. Name Resolution
11.5.9. Protocols
11.5.10. RSA Keys
11.5.11. Statistics
11.5.12. Advanced
11.6. Configuration Profiles
11.6.1. Automatic Profile Switching
11.7. User Accessible Tables
11.8. ESS Category Attributes
11.9. MaxMind Database Paths
11.10. IEEE 802.11 WLAN Decryption Keys
11.10.1. Adding Keys
11.10.2. Gotchas
11.11. IKEv2 decryption table
11.12. Object Identifiers
11.13. PRES Users Context List
11.14. SCCP users Table
11.15. SMI (MIB and PIB) Modules
11.16. SMI (MIB and PIB) Paths
11.17. SNMP Enterprise Specific Trap Types
11.18. SNMP users Table
11.19. Tektronix K12xx/15 RF5 protocols Table
11.20. User DLTs dissector table
11.21. Protobuf Search Paths
11.22. Protobuf UDP Message Types
12. MATE
12.1. Introduction
12.2. Getting Started
12.3. MATE Overview
12.3.1. Introduction
12.3.2. Attribute Value Pairs (AVP)
12.3.3. AVP lists (AVPL)
12.4. MATE Frame Analysis
12.4.1. Create PDUs (Phase 1)
12.4.2. Grouping PDUs together (GOP) (Phase 2)
12.4.3. Grouping GOPs together (GOG) (Phase 3)
12.4.4. Adjust data (AVPL Transforms)
12.5. MATE’s configuration tutorial
12.5.1. A GOP for DNS requests
12.5.2. A GOP for HTTP requests
12.5.3. Getting DNS and HTTP together into a GOG
12.5.4. Separating requests from multiple users
12.6. MATE configuration examples
12.6.1. TCP session (tcp.mate)
12.6.2. a GOG for a complete FTP session
12.6.3. using RADIUS to filter SMTP traffic of a specific user
12.6.4. H323 Calls
12.6.5. MMS
12.7. MATE’s configuration library
12.7.1. General use protocols
12.7.2. VoIP/Telephony
12.8. MATE’s reference manual
12.8.1. Attribute Value Pairs (AVP)
12.8.2. AVP Operators (=,!,{},^,$,~,<,>,?)
12.8.3. Attribute Value Pair List (AVPL)
12.8.4. Operations between AVPLs (Match)
12.8.5. AVPL Merge
12.9. Configuration Reference (mate.config)
12.9.1. PDU declaration block
12.9.2. GOP declaration block
12.9.3. GOG declaration block
12.9.4. Transform declaration block
12.9.5. Settings configuration AVPL
12.9.6. Debugging Stuff
12.9.7. Action=Include
A. Wireshark Messages
A.1. Packet List Messages
A.1.1. [Malformed Packet]
A.1.2. [Packet size limited during capture]
A.2. Packet Details Messages
A.2.1. [Response in frame: 123]
A.2.2. [Request in frame: 123]
A.2.3. [Time from request: 0.123 seconds]
A.2.4. [Stream setup by PROTOCOL (frame 123)]
B. Files and Folders
B.1. Capture Files
B.1.1. Libpcap File Contents
B.1.2. Not Saved in the Capture File
B.2. Configuration File and Plugin Folders
B.2.1. Folders on Windows
B.2.2. Folders on Unix-like systems
B.3. Configuration Files
B.4. Plugin folders
B.5. Windows folders
B.5.1. Windows profiles
B.5.2. Windows roaming profiles
B.5.3. Windows temporary folder
C. Protocols and Protocol Fields
D. Related command line tools
D.1. Introduction
D.2.
tshark
: Terminal-based Wireshark
D.3.
tcpdump
: Capturing with “tcpdump” for viewing with Wireshark
D.4.
dumpcap
: Capturing with “dumpcap” for viewing with Wireshark
D.5.
capinfos
: Print information about capture files
D.6.
rawshark
: Dump and analyze network traffic.
D.7.
editcap
: Edit capture files
D.8.
mergecap
: Merging multiple capture files into one
D.9.
text2pcap
: Converting ASCII hexdumps to network captures
D.10.
reordercap
: Reorder a capture file
13. This Document’s License (GPL)
List of Figures
1.1.
Wireshark captures packets and lets you examine their contents.
3.1.
The Main window
3.2.
The Menu
3.3.
The “File” Menu
3.4.
The “Edit” Menu
3.5.
The “View” Menu
3.6.
The “Go” Menu
3.7.
The “Capture” Menu
3.8.
The “Analyze” Menu
3.9.
The “Statistics” Menu
3.10.
The “Telephony” Menu
3.11.
The “Wireless” Menu
3.12.
The “Tools” Menu
3.13.
The “Help” Menu
3.14.
The “Main” toolbar
3.15.
The “Filter” toolbar
3.16.
The “Packet List” pane
3.17.
The “Packet Details” pane
3.18.
The “Packet Bytes” pane
3.19.
The “Packet Bytes” pane with tabs
3.20.
The “Packet Diagram” pane
3.21.
The initial Statusbar
3.22.
The Statusbar with a loaded capture file
3.23.
The Statusbar with a configuration profile menu
3.24.
The Statusbar with a selected protocol field
3.25.
The Statusbar with a display filter message
4.1.
Capture interfaces on Microsoft Windows
4.2.
Capture interfaces on macOS
4.3.
The “Capture Options” input tab
4.4.
The “Capture Options” output tab
4.5.
The “Capture Options” options tab
4.6.
The “Manage Interfaces” dialog box
4.7.
The “Compiled Filter Output” dialog box
4.8.
Capture output options
4.9.
The “Capture Information” dialog box
5.1.
“Open” on Microsoft Windows
5.2.
“Open” - Linux and UNIX
5.3.
“Save” on Microsoft Windows
5.4.
“Save” on Linux and UNIX
5.5.
“Merge” on Microsoft Windows
5.6.
“Merge” on Linux and UNIX
5.7.
The “Import from Hex Dump” dialog in Hex Dump mode
5.8.
The "Regular Expression" tab inside the "Import from Hex Dump” dialog.
5.9.
The “List Files” dialog box
5.10.
The “Export Specified Packets” dialog box
5.11.
The “Export Packet Dissections” dialog box
5.12.
The “Export Selected Packet Bytes” dialog box
5.13.
Export PDUs to File window
5.14.
Export TLS Session Keys window
5.15.
The “Export Objects” dialog box
5.16.
The “Print” dialog box
5.17.
The “Packet Range” frame
5.18.
The “Packet Format” frame
6.1.
Wireshark with a TCP packet selected for viewing
6.2.
Viewing a packet in a separate window
6.3.
Pop-up menu of the “Packet List” column header
6.4.
Pop-up menu of the “Packet List” pane
6.5.
Pop-up menu of the “Packet Details” pane
6.6.
Pop-up menu of the “Packet Bytes” pane
6.7.
Pop-up menu of the “Packet Diagram” pane
6.8.
Filtering on the TCP protocol
6.9.
The “Display Filter Expression” dialog box
6.10.
The “Capture Filters” and “Display Filters” dialog boxes
6.11.
Display Filter Macros window
6.12.
The “Find Packet” toolbar
6.13.
The “Go To Packet” toolbar
6.14.
Wireshark showing a time referenced packet
6.15.
The “Time Shift” dialog
6.16.
A Time Shifted Packet
7.1.
The “Follow TCP Stream” dialog box
7.2.
The “Follow HTTP/2 Stream” dialog box
7.3.
The “Follow SIP Call” dialog box
7.4.
The “Expert Information” dialog box
7.5.
The “Colorized” protocol details tree
7.6.
The “Expert” packet list column
7.7.
“TCP Analysis” packet detail items
7.8.
The “Packet Bytes” pane with a reassembled tab
8.1.
The “Capture File Properties” dialog
8.2.
Resolved Addresses window
8.3.
The “Protocol Hierarchy” Window
8.4.
The “Conversations” window
8.5.
The “Endpoints” window
8.6.
The “Packet Lengths” window
8.7.
The “I/O Graphs” window
8.8.
The “SMB2 Service Response Time Statistics” window
8.9.
NetPerfMeter Statistics window
8.10.
DNS statistics window
8.11.
Flow Graph window
8.12.
Flow Graph window showing VoIP call sequences
8.13.
The “HTTP Request Sequences” window
8.14.
UDP Multicast Streams window
8.15.
ASAP Statistics window
8.16.
ENRP Statistics window
8.17.
Component Status Protocol Statistics window
8.18.
CalcApp Protocol Statistics window
8.19.
Fractal Generator Protocol Statistics window
8.20.
Ping Pong Protocol Statistics window
8.21.
Scripting Service Protocol Statistics window
9.1.
List of supported codecs
9.2.
Play Streams
button with opened action menu
9.3.
Tools for modifying playlist in RTP Player window
9.4.
VoIP Calls window
9.5.
The “LTE MAC Traffic Statistics” window
9.6.
The RLC Graph window
9.7.
The “LTE RLC Traffic Statistics” window
9.8.
The “RTP Streams” window
9.9.
The “RTP Stream Analysis” window
9.10.
Error indicated in “RTP Stream Analysis” window
9.11.
Graph in “RTP Stream Analysis” window
9.12.
RTP Player window
9.13.
Waveform with error marks
9.14.
RTP stream state indication
9.15.
SCTP Analyze Association window
9.16.
SCTP Associations window
10.1.
Bluetooth Devices window
10.2.
Bluetooth HCI Summary window
10.3.
The “WLAN Traffic Statistics” window
11.1.
The “Coloring Rules” dialog box
11.2.
A color chooser
11.3.
Using color filters with Wireshark
11.4.
The “Enabled Protocols” dialog box
11.5.
The “Decode As” dialog box
11.6.
The preferences dialog box
11.7.
Column preferences
11.8.
Font and colors preferences
11.9.
Layout preferences
11.10.
Capture preferences
11.11.
Expert item preferences
11.12.
Filter buttons
11.13.
Name resolution preferences
11.14.
Protocol preferences
11.15.
RSA keys
11.16.
Statistics preferences
11.17.
Advanced preferences
11.18.
The configuration profiles dialog box
11.19.
"IEEE 802.11 wireless LAN" preferences
11.20.
802.11 Decryption Key Types
11.21.
802.11 Decryption Key Examples
12.1.
Packet Details - MATE TCP Session (tcp.mate)
12.2.
MATE Analysis (PDU→GOP→GOG) flowchart
12.3.
Wireshark window - fields for PDU extraction
12.4.
Frame fields mapped to PDU attributes
12.5.
Frame containing multiple PDUs
12.6.
Frame with encapsulated (tunneled) fields
12.7.
Extract from Payload fields
12.8.
Grouping PDUs (GOP) flowchart
12.9.
Grouping GOPs (GOG) flowchart
12.10.
Applying Transform flowchart
List of Tables
1.
Typographic Conventions
3.1.
Keyboard Navigation
3.2.
File menu items
3.3.
Edit menu items
3.4.
View menu items
3.5.
Internals menu items
3.6.
Go menu items
3.7.
Capture menu items
3.8.
Analyze menu items
3.9.
Statistics menu items
3.10.
Telephony menu items
3.11.
Wireless menu items
3.12.
Tools menu items
3.13.
Help menu items
3.14.
Main toolbar items
3.15.
Filter toolbar items
3.16.
Related packet symbols
4.1.
Capture file mode selected by capture options
6.1.
The menu items of the “Packet List” column header pop-up menu
6.2.
The menu items of the “Packet List” pop-up menu
6.3.
The menu items of the “Packet Details” pop-up menu
6.4.
The menu items of the “Packet Bytes” pop-up menu
6.5.
The menu items of the “Packet Diagram” pop-up menu
6.6.
Display Filter comparison operators
6.7.
Display Filter Logical Operations
6.8.
Display Filter Arithmetic Operations
6.9.
Display Filter Functions
7.1.
Example expert information items
7.2.
Time zone examples for UTC arrival times (without DST)
B.1.
Configuration files overview
List of Examples
4.1.
A capture filter for telnet that captures traffic to and from a particular host
4.2.
Capturing all telnet traffic not from 10.0.0.5
7.1.
Follow Stream YAML output