Wireshark User's Guide

Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible.

You could think of a network packet analyzer as a measuring device used to examine what's going on inside a network cable, just like a voltmeter is used by an electrician to examine what's going on inside an electric cable (but at a higher level, of course).

In the past, such tools were either very expensive, proprietary, or both. However, with the advent of Wireshark, all that has changed.

Wireshark is perhaps one of the best open source packet analyzers available today.

1.1.2. Features

The following are some of the many features Wireshark provides:

• Available for UNIX and Windows.

• Capture live packet data from a network interface.

• Display packets with very detailed protocol information.

• Open and Save packet data captured.

• Import and Export packet data from and to a lot of other capture programs.

• Filter packets on many criteria.

• Search for packets on many criteria.

• Colorize packet display based on filters.

• Create various statistics.

• ... and a lot more!

However, to really appreciate its power, you have to start using it.

Figure 1.1, “ Wireshark captures packets and allows you to examine their content. ” shows Wireshark having captured some packets and waiting for you to examine them.

Figure 1.1.  Wireshark captures packets and allows you to examine their content.

What you'll need to get Wireshark up and running ...

You can get the latest copy of the program from the Wireshark website: http://www.wireshark.org/download.html. The website allows you to choose from among several mirrors for downloading.

A new Wireshark version will typically become available every 4-8 months.

If you want to be notified about new Wireshark releases, you should subscribe to the wireshark-announce mailing list. You will find more details in Section 1.6.4, “Mailing Lists”.

In late 1997, Gerald Combs needed a tool for tracking down networking problems and wanted to learn more about networking, so he started writing Ethereal (the former name of the Wireshark project) as a way to solve both problems.

Ethereal was initially released, after several pauses in development, in July 1998 as version 0.2.0. Within days, patches, bug reports, and words of encouragement started arriving, so Ethereal was on its way to success.

Not long after that, Gilbert Ramirez saw its potential and contributed a low-level dissector to it.

In October, 1998, Guy Harris of Network Appliance was looking for something better than tcpview, so he started applying patches and contributing dissectors to Ethereal.

In late 1998, Richard Sharpe, who was giving TCP/IP courses, saw its potential on such courses, and started looking at it to see if it supported the protocols he needed. While it didn't at that point, new protocols could be easily added. So he started contributing dissectors and contributing patches.

The list of people who have contributed to Ethereal has become very long since then, and almost all of them started with a protocol that they needed that Ethereal did not already handle. So they copied an existing dissector and contributed the code back to the team.

In 2006 the project moved house and re-emerged under a new name: Wireshark.

Wireshark was initially developed by Gerald Combs. Ongoing development and maintenance of Wireshark is handled by the Wireshark team, a loose group of individuals who fix bugs and provide new functionality.

There have also been a large number of people who have contributed protocol dissectors to Wireshark, and it is expected that this will continue. You can find a list of the people who have contributed code to Wireshark by checking the about dialog box of Wireshark, or at the authors page on the Wireshark web site.

Wireshark is an open source software project, and is released under the GNU General Public License (GPL). All source code is freely available under the GPL. You are welcome to modify Wireshark to suit your own needs, and it would be appreciated if you contribute your improvements back to the Wireshark team.

You gain three benefits by contributing your improvements back to the community:

The Wireshark source code and binary kits for some platforms are all available on the download page of the Wireshark website: http://www.wireshark.org/download.html.

If you have problems, or need help with Wireshark, there are several places that may be of interest to you (well, besides this guide of course).

1.6.3. FAQ

The "Frequently Asked Questions" will list often asked questions and the corresponding answers.

	Read the FAQ!
	Before sending any mail to the mailing lists below, be sure to read the FAQ, as it will often answer the question(s) you might have. This will save yourself and others a lot of time (keep in mind that a lot of people are subscribed to the mailing lists).

You will find the FAQ inside Wireshark by clicking the menu item Help/Contents and selecting the FAQ page in the dialog shown.

An online version is available at the Wireshark website: http://www.wireshark.org/faq.html. You might prefer this online version, as it's typically more up to date and the HTML format is easier to use.

1.6.4. Mailing Lists

There are several mailing lists of specific Wireshark topics available:

wireshark-announce

This mailing list will inform you about new program releases, which usually appear about every 4-8 weeks.

wireshark-users

This list is for users of Wireshark. People post questions about building and using Wireshark, others (hopefully) provide answers.

wireshark-dev

This list is for Wireshark developers. If you want to start developing a protocol dissector, join this list.

You can subscribe to each of these lists from the Wireshark web site: http://www.wireshark.org. Simply select the mailing lists link on the left hand side of the site. The lists are archived at the Wireshark web site as well.

	Tip!
	You can search in the list archives to see if someone asked the same question some time before and maybe already got an answer. That way you don't have to wait until someone answers your question.

1.6.5. Reporting Problems

	Note!
	Before reporting any problems, please make sure you have installed the latest version of Wireshark.

When reporting problems with Wireshark, it is helpful if you supply the following information:

1. The version number of Wireshark and the dependent libraries linked with it, e.g. GTK+, etc. You can obtain this with the command wireshark -v.

2. Information about the platform you run Wireshark on.

3. A detailed description of your problem.

4. If you get an error/warning message, copy the text of that message (and also a few lines before and after it, if there are some), so others may find the place where things go wrong. Please don't give something like: "I get a warning while doing x" as this won't give a good idea where to look at.

	Don't send large files!
	Do not send large files (>100KB) to the mailing lists, just place a note that further data is available on request. Large files will only annoy a lot of people on the list who are not interested in your specific problem. If required, you will be asked for further data by the persons who really can help you.

	Don't send confidential information!
	If you send captured data to the mailing lists, be sure they don't contain any sensitive or confidential information like passwords or such.

1.6.6. Reporting Crashes on UNIX/Linux platforms

When reporting crashes with Wireshark, it is helpful if you supply the traceback information (besides the information mentioned in "Reporting Problems").

You can obtain this traceback information with the following commands:

$ gdb `whereis wireshark | cut -f2 -d: | cut -d' ' -f2` core >& bt.txt
backtrace
^D
$

		

	Note
	Type the characters in the first line verbatim! Those are back-tics there!

	Note
	backtrace is a gdb command. You should enter it verbatim after the first line shown above, but it will not be echoed. The ^D (Control-D, that is, press the Control key and the D key together) will cause gdb to exit. This will leave you with a file called bt.txt in the current directory. Include the file with your bug report.

	Note
	If you do not have gdb available, you will have to check out your operating system's debugger.

You should mail the traceback to the wireshark-dev[AT]wireshark.org mailing list.

As with all things, there must be a beginning, and so it is with Wireshark. To use Wireshark, you must:

Currently, only two or three Linux distributions ship Wireshark, and they are commonly shipping an out-of-date version. No other versions of UNIX ship Wireshark so far, and Microsoft does not ship it with any version of Windows. For that reason, you will need to know where to get the latest version of Wireshark and how to install it.

This chapter shows you how to obtain source and binary packages, and how to build Wireshark from source, should you choose to do so.

The following are the general steps you would use:

You can obtain both source and binary distributions from the Wireshark web site: http://www.wireshark.org. Simply select the download link, and then select either the source package or binary package of your choice from the mirror site closest to you.

	Download all required files!
	In general, unless you have already downloaded Wireshark before, you will most likely need to download several source packages if you are building Wireshark from source. This is covered in more detail below.

Once you have downloaded the relevant files, you can go on to the next step.

Note!

While you will find a number of binary packages available on the Wireshark web site, you might not find one for your platform, and they often tend to be several versions behind the current released version, as they are contributed by people who have the platforms they are built for. For this reason, you might want to pull down the source distribution and build it, as the process is relatively simple.

Before you build Wireshark from sources, or install a binary package, you must ensure that you have the following other packages installed:

Depending on your system, you may be able to install these from binaries, e.g. RPMs, or you may need to obtain them in source code form and build them.

If you have downloaded the source for GTK+, the instructions shown in Example 2.1, “Building GTK+ from source” may provide some help in building it:

gzip -dc gtk+-1.2.10.tar.gz | tar xvf -
<much output removed>
cd gtk+-1.2.10
./configure
<much output removed>
make
<much output removed>
make install
<much output removed>
	  

	Note!
	You may need to change the version number of gtk+ in Example 2.1, “Building GTK+ from source” to match the version of GTK+ you have downloaded. The directory you change to will change if the version of GTK+ changes, and in all cases, tar xvf - will show you the name of the directory you should change to.

	Note!
	If you use Linux, or have GNU tar installed, you can use tar zxvf gtk+-1.2.10.tar.gz. It is also possible to use gunzip -c or gzcat rather than gzip -dc on many UNIX systems.

	Note!
	If you downloaded gtk+ or any other tar file using Windows, you may find your file called gtk+-1_2_8_tar.gz.

You should consult the GTK+ web site if any errors occur in carrying out the instructions in Example 2.1, “Building GTK+ from source”.

If you have downloaded the source to libpcap, the general instructions shown in Example 2.2, “Building and installing libpcap” will assist in building it. Also, if your operating system does not support tcpdump, you might also want to download it from the tcpdump web site and install it.

gzip -dc libpcap-0.9.4.tar.Z | tar xvf -
<much output removed>
cd libpcap-0.9.4
./configure
<much output removed>
make
<much output removed>
make install
<much output removed>
	    

	Note!
	The directory you should change to will depend on the version of libpcap you have downloaded. In all cases, tar xvf - will show you the name of the directory that has been unpacked.

Under Red Hat 6.x and beyond (and distributions based on it, like Mandrake) you can simply install each of the packages you need from RPMs. Most Linux systems will install GTK+ and GLib in any case, however you will probably need to install the devel versions of each of these packages. The commands shown in Example 2.3, “ Installing required RPMs under Red Hat Linux 6.2 and beyond ” will install all the needed RPMs if they are not already installed.

cd /mnt/cdrom/RedHat/RPMS
rpm -ivh glib-1.2.6-3.i386.rpm
rpm -ivh glib-devel-1.2.6-3.i386.rpm
rpm -ivh gtk+-1.2.6-7.i386.rpm
rpm -ivh gtk+-devel-1.2.6-7.i386.rpm
rpm -ivh libpcap-0.4-19.i386.rpm
	  

	Note
	If you are using a version of Red Hat later than 6.2, the required RPMs have most likely changed. Simply use the correct RPMs from your distribution.

Under Debian you can install Wireshark using aptitude. aptitude will handle any dependency issues for you. Example 2.4, “Installing debs under Debian” shows how to do this.

aptitude install wireshark-dev
	  

Use the following general steps if you are building Wireshark from source under a UNIX operating system:

Once you have installed Wireshark with make install above, you should be able to run it by entering wireshark.

In general, installing the binary under your version of UNIX will be specific to the installation methods used with your version of UNIX. For example, under AIX, you would use smit to install the Wireshark binary package, while under Tru64 UNIX (formerly Digital UNIX) you would use setld.

rpm -ivh wireshark-1.0.0.i386.rpm
      

aptitude install wireshark
      

USE="adns gtk ipv6 portaudio snmp ssl kerberos threads selinux" emerge wireshark
      

pkg_add -r wireshark
      

A number of errors can occur during the installation process. Some hints on solving these are provided here.

If the configure stage fails, you will need to find out why. You can check the file config.log in the source directory to find out what failed. The last few lines of this file should help in determining the problem.

The standard problems are that you do not have GTK+ on your system, or you do not have a recent enough version of GTK+. The configure will also fail if you do not have libpcap (at least the required include files) on your system.

Another common problem is for the final compile and link stage to terminate with a complaint of: Output too long. This is likely to be caused by an antiquated sed (such as the one shipped with Solaris). Since sed is used by the libtool script to construct the final link command, this leads to mysterious problems. This can be resolved by downloading a recent version of sed from http://directory.fsf.org/GNU/sed.html.

If you cannot determine what the problems are, send mail to the wireshark-dev mailing list explaining your problem, and including the output from config.log and anything else you think is relevant, like a trace of the make stage.

It is recommended to use the binary installer for Windows, until you want to start developing Wireshark on the Windows platform.

For further information how to build Wireshark for Windows from the sources, have a look at the Development Wiki: http://wiki.wireshark.org/Development for the latest available development documentation.

In this section we explore installing Wireshark under Windows from the binary packages.

2.8.1. Install Wireshark

You may acquire a binary installer of Wireshark named something like: wireshark-setup-x.y.z.exe. The Wireshark installer includes WinPcap, so you don't need to download and install two separate packages.

Simply download the Wireshark installer from: http://www.wireshark.org/download.html and execute it. Beside the usual installer options like where to install the program, there are several optional components.

	Tip: Just keep the defaults!
	If you are unsure which settings to select, just keep the defaults.

2.8.1.1. "Choose Components" page

Wireshark

• Wireshark GTK - Wireshark is a GUI network protocol analyzer.

• GTK MS Windows Engine - GTK MS Windows Engine (native Win32 look and feel, recommended).

TShark - TShark is a command-line based network protocol analyzer.

Plugins / Extensions (for the Wireshark and TShark dissection engines):

• Dissector Plugins - Plugins with some extended dissections.

• Tree Statistics Plugins - Plugins with some extended statistics.

• Mate - Meta Analysis and Tracing Engine (experimental) - user configurable extension(s) of the display filter engine, see http://wiki.wireshark.org/Mate for details.

• SNMP MIBs - SNMP MIBs for a more detailed SNMP dissection.

Tools (additional command line tools to work with capture files):

• Editcap - Editcap is a program that reads a capture file and writes some or all of the packets into another capture file.

• Text2Pcap - Text2pcap is a program that reads in an ASCII hex dump and writes the data into a libpcap-style capture file.

• Mergecap - Mergecap is a program that combines multiple saved capture files into a single output file.

• Capinfos - Capinfos is a program that provides information on capture files.

User's Guide - Local installation of the User's Guide. The Help buttons on most dialogs will require an internet connection to show help pages if the User's Guide is not installed locally.

2.8.1.2. "Additional Tasks" page

• Start Menu Shortcuts - add some start menu shortcuts.

• Desktop Icon - add a Wireshark icon to the desktop.

• Quick Launch Icon - add a Wireshark icon to the Explorer quick launch toolbar.

• Associate file extensions to Wireshark - Associate standard network trace files to Wireshark.

2.8.1.3. "Install WinPcap?" page

The Wireshark installer contains the latest released WinPcap installer.

If you don't have WinPcap installed, you won't be able to capture live network traffic, but you will still be able to open saved capture files.

• Currently installed WinPcap version - the Wireshark installer detects the currently installed WinPcap version.

• Install WinPcap x.x - if the currently installed version is older than the one which comes with the Wireshark installer (or WinPcap is not installed at all), this will be selected by default.

• Start WinPcap service "NPF" at startup - so users without administrative privileges can capture.

More WinPcap info:

• Wireshark related: http://wiki.wireshark.org/WinPcap

• General WinPcap info: http://www.winpcap.org

2.8.1.4. Command line options

You can simply start the Wireshark installer without any command line parameters, it will show you the usual interactive installer.

For special cases, there are some command line parameters available:

• /NCRC disables the CRC check

• /S runs the installer or uninstaller silently with default values. Please note: The silent installer won't install WinPCap!

• /desktopicon installation of the desktop icon, =yes - force installation, =no - don't install, otherwise use defaults / user settings. This option can be useful for a silent installer.

• /quicklaunchicon installation of the quick launch icon, =yes - force installation, =no - don't install, otherwise use defaults / user settings.

• /D sets the default installation directory ($INSTDIR), overriding InstallDir and InstallDirRegKey. It must be the last parameter used in the command line and must not contain any quotes, even if the path contains spaces.

Example:

wireshark-setup-1.0.0.exe /NCRC /S /desktopicon=yes 
  /quicklaunchicon=no /D=C:\Program Files\Foo
	

2.8.2. Manual WinPcap Installation

	Note!
	As mentioned above, the Wireshark installer takes care of the installation of WinPcap, so usually you don't have to worry about WinPcap at all!

The following is only necessary if you want to try a different version than the one included in the Wireshark installer, e.g. because a new WinPcap (beta) version was released.

Additional WinPcap versions (including newer alpha or beta releases) can be downloaded from the following locations:

• The main WinPcap site: http://www.winpcap.org

• The Wiretapped.net mirror: http://www.mirrors.wiretapped.net/security/packet-capture/winpcap

At the download page you will find a single installer exe called something like "auto-installer", which can be installed under various Windows systems, including NT4.0/2000/XP/Vista.

2.8.4. Update WinPcap

New versions of WinPcap are less frequently available, maybe only once in a year. You will find WinPcap update instructions where you can download new WinPcap versions. Usually you have to reboot the machine after installing a new WinPcap version.

	Warning!
	If you have an older version of WinPcap installed, you must uninstall it before installing the current version. Recent versions of the WinPcap installer will take care of this.

2.8.6. Uninstall WinPcap

You can uninstall WinPcap independently of Wireshark, using the "WinPcap" entry in the "Add or Remove Programs" of the Control Panel.

	Note!
	After uninstallation of WinPcap you can't capture anything with Wireshark.

It might be a good idea to reboot Windows afterwards.

By now you have installed Wireshark and are most likely keen to get started capturing your first packets. In the next chapters we will explore:

You can start Wireshark from your shell or window manager.

	Tip!
	When starting Wireshark it's possible to specify optional settings using the command line. See Section 9.2, “Start Wireshark from the command line” for details.

	Note!
	In the following chapters, a lot of screenshots from Wireshark will be shown. As Wireshark runs on many different platforms and there are different versions of the underlying GUI toolkit (GTK 1.x / 2.x) used, your screen might look different from the provided screenshots. But as there are no real differences in functionality, these screenshots should still be well understandable.

Let's look at Wireshark's user interface. Figure 3.1, “The Main window” shows Wireshark as you would usually see it after some packets are captured or loaded (how to do this will be described later).

Figure 3.1. The Main window

Wireshark's main window consists of parts that are commonly known from many other GUI programs.

	Tip!
	The layout of the main window can be customized by changing preference settings. See Section 9.5, “Preferences” for details!

The Wireshark menu sits on top of the Wireshark window. An example is shown in Figure 3.2, “The Menu”.

	Note!
	Menu items will be greyed out if the corresponding feature isn't available. For example, you cannot save a capture file if you didn't capture or load any data before.

Figure 3.2. The Menu

It contains the following items:

Each of these menu items is described in more detail in the sections that follow.

	Tip!
	You can access menu items directly or by pressing the corresponding accelerator keys, which are shown at the right side of the menu. For example, you can press the Control (or Strg in German) and the K keys together to open the capture dialog.

The Wireshark file menu contains the fields shown in Table 3.2, “File menu items”.

Figure 3.3. The "File" Menu

Table 3.2. File menu items

Menu Item	Accelerator	Description
Open...	Ctrl+O	This menu item brings up the file open dialog box that allows you to load a capture file for viewing. It is discussed in more detail in Section 5.2.1, “The "Open Capture File" dialog box”.
Open Recent		This menu item shows a submenu containing the recently opened capture files. Clicking on one of the submenu items will open the corresponding capture file directly.
Merge...		This menu item brings up the merge file dialog box that allows you to merge a capture file into the currently loaded one. It is discussed in more detail in Section 5.4, “Merging capture files”.
Close	Ctrl+W	This menu item closes the current capture. If you haven't saved the capture, you will be asked to do so first (this can be disabled by a preference setting).
------
Save	Ctrl+S	This menu item saves the current capture. If you have not set a default capture file name (perhaps with the -w <capfile> option), Wireshark pops up the Save Capture File As dialog box (which is discussed further in Section 5.3.1, “The "Save Capture File As" dialog box”). Note! If you have already saved the current capture, this menu item will be greyed out. Note! You cannot save a live capture while it is in progress. You must stop the capture in order to save.
Save As...	Shift+Ctrl+S	This menu item allows you to save the current capture file to whatever file you would like. It pops up the Save Capture File As dialog box (which is discussed further in Section 5.3.1, “The "Save Capture File As" dialog box”).
------
File Set > List Files		This menu item allows you to show a list of files in a file set. It pops up the Wireshark List File Set dialog box (which is discussed further in Section 5.5, “File Sets”).
File Set > Next File		If the currently loaded file is part of a file set, jump to the next file in the set. If it isn't part of a file set or just the last file in that set, this item is greyed out.
File Set > Previous File		If the currently loaded file is part of a file set, jump to the previous file in the set. If it isn't part of a file set or just the first file in that set, this item is greyed out.
------
Export > as "Plain Text" file...		This menu item allows you to export all (or some) of the packets in the capture file to a plain ASCII text file. It pops up the Wireshark Export dialog box (which is discussed further in Section 5.6.1, “The "Export as Plain Text File" dialog box”).
Export > as "PostScript" file...		This menu item allows you to export all (or some) of the packets in the capture file to a PostScript file. It pops up the Wireshark Export dialog box (which is discussed further in Section 5.6.2, “The "Export as PostScript File" dialog box”).
Export > as "CSV" (Comma Separated Values packet summary) file...		This menu item allows you to export all (or some) of the packet summaries in the capture file to a .csv file (e.g. used by spreadsheet programs). It pops up the Wireshark Export dialog box (which is discussed further in Section 5.6.3, “The "Export as CSV (Comma Separated Values) File" dialog box”).
Export > as "C Arrays" (packet bytes) file...		This menu item allows you to export all (or some) of the packet bytes in the capture file to a .c file so you can import the stream data into your own C program. It pops up the Wireshark Export dialog box (which is discussed further in Section 5.6.4, “The "Export as C Arrays (packet bytes) file" dialog box”).
------
Export > as "PSML" file...		This menu item allows you to export all (or some) of the packets in the capture file to a PSML (packet summary markup language) XML file. It pops up the Wireshark Export dialog box (which is discussed further in Section 5.6.5, “The "Export as PSML File" dialog box”).
Export > as "PDML" file...		This menu item allows you to export all (or some) of the packets in the capture file to a PDML (packet details markup language) XML file. It pops up the Wireshark Export dialog box (which is discussed further in Section 5.6.6, “The "Export as PDML File" dialog box”).
------
Export > Selected Packet Bytes...	Ctrl+H	This menu item allows you to export the currently selected bytes in the packet bytes pane to a binary file. It pops up the Wireshark Export dialog box (which is discussed further in Section 5.6.7, “The "Export selected packet bytes" dialog box”)
Objects > HTTP		This menu item allows you to export all or some of the captured HTTP objects into local files. It pops up the Wireshark HTTP object list (which is discussed further in Section 5.6.8, “The "Export Objects" dialog box”)
------
Print...	Ctrl+P	This menu item allows you to print all (or some) of the packets in the capture file. It pops up the Wireshark Print dialog box (which is discussed further in Section 5.7, “Printing packets”).
------
Quit	Ctrl+Q	This menu item allows you to quit from Wireshark. Wireshark will ask to save your capture file if you haven't saved it before (this can be disabled by a preference setting).

The Wireshark Edit menu contains the fields shown in Table 3.3, “Edit menu items”.

Figure 3.4. The "Edit" Menu

The Wireshark View menu contains the fields shown in Table 3.4, “View menu items”.

Figure 3.5. The "View" Menu

Table 3.4. View menu items

Menu Item	Accelerator	Description
Main Toolbar		This menu item hides or shows the main toolbar, see Section 3.14, “The "Main" toolbar”.
Filter Toolbar		This menu item hides or shows the filter toolbar, see Section 3.15, “The "Filter" toolbar”.
Statusbar		This menu item hides or shows the statusbar, see Section 3.19, “The Statusbar”.
------
Packet List		This menu item hides or shows the packet list pane, see Section 3.16, “The "Packet List" pane”.
Packet Details		This menu item hides or shows the packet details pane, see Section 3.17, “The "Packet Details" pane”.
Packet Bytes		This menu item hides or shows the packet bytes pane, see Section 3.18, “The "Packet Bytes" pane”.
------
Time Display Format > Date and Time of Day: 1970-01-01 01:02:03.123456		Selecting this tells Wireshark to display the time stamps in date and time of day format, see Section 6.11, “Time display formats and time references”. Note! The fields "Time of Day", "Date and Time of Day", "Seconds Since Beginning of Capture", "Seconds Since Previous Captured Packet" and "Seconds Since Previous Displayed Packet" are mutually exclusive.
Time Display Format > Time of Day: 01:02:03.123456		Selecting this tells Wireshark to display time stamps in time of day format, see Section 6.11, “Time display formats and time references”.
Time Display Format > Seconds Since Beginning of Capture: 123.123456		Selecting this tells Wireshark to display time stamps in seconds since beginning of capture format, see Section 6.11, “Time display formats and time references”.
Time Display Format > Seconds Since Previous Captured Packet: 1.123456		Selecting this tells Wireshark to display time stamps in seconds since previous captured packet format, see Section 6.11, “Time display formats and time references”.
Time Display Format > Seconds Since Previous Displayed Packet: 1.123456		Selecting this tells Wireshark to display time stamps in seconds since previous displayed packet format, see Section 6.11, “Time display formats and time references”.
Time Display Format > Seconds Since Epoch (1970-01-01): 1234567890.123456		Selecting this tells Wireshark to display time stamps in seconds since 1970-01-01 00:00:00, see Section 6.11, “Time display formats and time references”.
Time Display Format > ------
Time Display Format > Automatic (File Format Precision)		Selecting this tells Wireshark to display time stamps with the precision given by the capture file format used, see Section 6.11, “Time display formats and time references”. Note! The fields "Automatic", "Seconds" and "...seconds" are mutually exclusive.
Time Display Format > Seconds: 0		Selecting this tells Wireshark to display time stamps with a precision of one second, see Section 6.11, “Time display formats and time references”.
Time Display Format > ...seconds: 0....		Selecting this tells Wireshark to display time stamps with a precision of one second, decisecond, centisecond, millisecond, microsecond or nanosecond, see Section 6.11, “Time display formats and time references”.
Name Resolution > Resolve Name		This item allows you to trigger a name resolve of the current packet only, see Section 7.7, “Name Resolution”.
Name Resolution > Enable for MAC Layer		This item allows you to control whether or not Wireshark translates MAC addresses into names, see Section 7.7, “Name Resolution”.
Name Resolution > Enable for Network Layer		This item allows you to control whether or not Wireshark translates network addresses into names, see Section 7.7, “Name Resolution”.
Name Resolution > Enable for Transport Layer		This item allows you to control whether or not Wireshark translates transport addresses into names, see Section 7.7, “Name Resolution”.
Colorize Packet List		This item allows you to control whether or not Wireshark should colorize the packet list. Note! Enabling colorization will slow down the display of new packets while capturing / loading capture files.
Auto Scroll in Live Capture		This item allows you to specify that Wireshark should scroll the packet list pane as new packets come in, so you are always looking at the last packet. If you do not specify this, Wireshark simply adds new packets onto the end of the list, but does not scroll the packet list pane.
------
Zoom In	Ctrl++	Zoom into the packet data (increase the font size).
Zoom Out	Ctrl+-	Zoom out of the packet data (decrease the font size).
Normal Size	Ctrl+=	Set zoom level back to 100% (set font size back to normal).
Resize All Columns		Resize all column widths so the content will fit into it. Note! Resizing may take a significant amount of time, especially if a large capture file is loaded.
------
Expand Subtrees		This menu item expands the currently selected subtree in the packet details tree.
Expand All		Wireshark keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item expands all subtrees in all packets in the capture.
Collapse All		This menu item collapses the tree view of all packets in the capture list.
------
Colorize Conversation		This menu item brings up a submenu that allows you to color packets in the packet list pane based on the addresses of the currently selected packet. This makes it easy to distinguish packets belonging to different conversations. Section 9.3, “Packet colorization”.
Colorize Conversation > Color 1-10		These menu items enable one of the ten temporary color filters based on the currently selected conversation.
Colorize Conversation > Reset coloring		This menu item clears all temporary coloring rules.
Colorize Conversation > New Coloring Rule...		This menu item opens a dialog window in which a new permanent coloring rule can be created based on the currently selected conversation.
Coloring Rules...		This menu item brings up a dialog box that allows you to color packets in the packet list pane according to filter expressions you choose. It can be very useful for spotting certain types of packets, see Section 9.3, “Packet colorization”.
------
Show Packet in New Window		This menu item brings up the selected packet in a separate window. The separate window shows only the tree view and byte view panes.
Reload	Ctrl-R	This menu item allows you to reload the current capture file.

The Wireshark Go menu contains the fields shown in Table 3.5, “Go menu items”.

Figure 3.6. The "Go" Menu

The Wireshark Capture menu contains the fields shown in Table 3.6, “Capture menu items”.

Figure 3.7. The "Capture" Menu

The Wireshark Analyze menu contains the fields shown in Table 3.7, “Analyze menu items”.

Figure 3.8. The "Analyze" Menu

The Wireshark Statistics menu contains the fields shown in Table 3.8, “Statistics menu items”.

Figure 3.9. The "Statistics" Menu

All menu items will bring up a new window showing specific statistical information.

The Wireshark Tools menu contains the fields shown in Table 3.9, “Tools menu items”.

The Wireshark Help menu contains the fields shown in Table 3.10, “Help menu items”.

Figure 3.10. The "Help" Menu

	Note!
	Calling a Web browser might be unsupported in your version of Wireshark. If this is the case, the corresponding menu items will be hidden.

	Note!
	If calling a Web browser fails on your machine, maybe because just nothing happens or the browser is started but no page is shown, have a look at the web browser setting in the preferences dialog.

The main toolbar provides quick access to frequently used items from the menu. This toolbar cannot be customized by the user, but it can be hidden using the View menu, if the space on the screen is needed to show even more packet data.

As in the menu, only the items useful in the current program state will be available. The others will be greyed out (e.g. you cannot save a capture file if you haven't loaded one).

Figure 3.11. The "Main" toolbar

Table 3.11. Main toolbar items

Toolbar Icon	Toolbar Item	Corresponding Menu Item	Description
	Interfaces...	Capture/Interfaces...	This item brings up the Capture Interfaces List dialog box (discussed further in Section 4.3, “Start Capturing”).
	Options...	Capture/Options...	This item brings up the Capture Options dialog box (discussed further in Section 4.3, “Start Capturing”) and allows you to start capturing packets.
	Start	Capture/Start	This item starts capturing packets with the options form the last time.
	Stop	Capture/Stop	This item stops the currently running live capture process Section 4.3, “Start Capturing”).
	Restart	Capture/Restart	This item stops the currently running live capture process and restarts it again, for convenience.
------
	Open...	File/Open...	This item brings up the file open dialog box that allows you to load a capture file for viewing. It is discussed in more detail in Section 5.2.1, “The "Open Capture File" dialog box”.
	Save As...	File/Save As...	This item allows you to save the current capture file to whatever file you would like. It pops up the Save Capture File As dialog box (which is discussed further in Section 5.3.1, “The "Save Capture File As" dialog box”). Note! If you currently have a temporary capture file, the Save icon will be shown instead.
	Close	File/Close	This item closes the current capture. If you have not saved the capture, you will be asked to save it first.
	Reload	View/Reload	This item allows you to reload the current capture file.
	Print...	File/Print...	This item allows you to print all (or some of) the packets in the capture file. It pops up the Wireshark Print dialog box (which is discussed further in Section 5.7, “Printing packets”).
------
	Find Packet...	Edit/Find Packet...	This item brings up a dialog box that allows you to find a packet. There is further information on finding packets in Section 6.8, “Finding packets”.
	Go Back	Go/Go Back	This item jumps back in the packet history.
	Go Forward	Go/Go Forward	This item jumps forward in the packet history.
	Go to Packet...	Go/Go to Packet...	This item brings up a dialog box that allows you to specify a packet number to go to that packet.
	Go To First Packet	Go/First Packet	This item jumps to the first packet of the capture file.
	Go To Last Packet	Go/Last Packet	This item jumps to the last packet of the capture file.
------
	Colorize	View/Colorize	Colorize the packet list (or not).
	Auto Scroll in Live Capture	View/Auto Scroll in Live Capture	Auto scroll packet list while doing a live capture (or not).
------
	Zoom In	View/Zoom In	Zoom into the packet data (increase the font size).
	Zoom Out	View/Zoom Out	Zoom out of the packet data (decrease the font size).
	Normal Size	View/Normal Size	Set zoom level back to 100%.
	Resize Columns	View/Resize Columns	Resize columns, so the content fits into them.
------
	Capture Filters...	Capture/Capture Filters...	This item brings up a dialog box that allows you to create and edit capture filters. You can name filters, and you can save them for future use. More detail on this subject is provided in Section 6.6, “Defining and saving filters”.
	Display Filters...	Analyze/Display Filters...	This item brings up a dialog box that allows you to create and edit display filters. You can name filters, and you can save them for future use. More detail on this subject is provided in Section 6.6, “Defining and saving filters”.
	Coloring Rules...	View/Coloring Rules...	This item brings up a dialog box that allows you color packets in the packet list pane according to filter expressions you choose. It can be very useful for spotting certain types of packets. More detail on this subject is provided in Section 9.3, “Packet colorization”.
	Preferences...	Edit/Preferences	This item brings up a dialog box that allows you to set preferences for many parameters that control Wireshark. You can also save your preferences so Wireshark will use them the next time you start it. More detail is provided in Section 9.5, “Preferences”
------
	Help	Help/Contents	This item brings up help dialog box.

The filter toolbar lets you quickly edit and apply display filters. More information on display filters is available in Section 6.3, “Filtering packets while viewing”.

Figure 3.12. The "Filter" toolbar

Table 3.12. Filter toolbar items

Toolbar Icon	Toolbar Item	Description
	Filter:	Brings up the filter construction dialog, described in Figure 6.7, “The "Capture Filters" and "Display Filters" dialog boxes”.
	Filter input	The area to enter or edit a display filter string, see Section 6.4, “Building display filter expressions” . A syntax check of your filter string is done while you are typing. The background will turn red if you enter an incomplete or invalid string, and will become green when you enter a valid string. You can click on the pull down arrow to select a previously-entered filter string from a list. The entries in the pull down list will remain available even after a program restart. Note! After you've changed something in this field, don't forget to press the Apply button (or the Enter/Return key), to apply this filter string to the display. Note! This field is also where the current filter in effect is displayed.
	Expression...	The middle button labeled "Add Expression..." opens a dialog box that lets you edit a display filter from a list of protocol fields, described in Section 6.5, “The "Filter Expression" dialog box”
	Clear	Reset the current display filter and clears the edit area.
	Apply	Apply the current value in the edit area as the new display filter. Note! Applying a display filter on large capture files might take quite a long time!

The packet list pane displays all the packets in the current capture file.

Figure 3.13. The "Packet List" pane

Each line in the packet list corresponds to one packet in the capture file. If you select a line in this pane, more details will be displayed in the "Packet Details" and "Packet Bytes" panes.

While dissecting a packet, Wireshark will place information from the protocol dissectors into the columns. As higher level protocols might overwrite information from lower levels, you will typically see the information from the highest possible level only.

For example, let's look at a packet containing TCP inside IP inside an Ethernet packet. The Ethernet dissector will write its data (such as the Ethernet addresses), the IP dissector will overwrite this by its own (such as the IP addresses), the TCP dissector will overwrite the IP information, and so on.

There are a lot of different columns available. Which columns are displayed can be selected by preference settings, see Section 9.5, “Preferences”.

The default columns will show:

There is a context menu (right mouse click) available, see details in Figure 6.3, “Pop-up menu of the "Packet List" pane”.

The packet details pane shows the current packet (selected in the "Packet List" pane) in a more detailed form.

Figure 3.14. The "Packet Details" pane

This pane shows the protocols and protocol fields of the packet selected in the "Packet List" pane. The protocols and fields of the packet are displayed using a tree, which can be expanded and collapsed.

There is a context menu (right mouse click) available, see details in Figure 6.4, “Pop-up menu of the "Packet Details" pane”.

Some protocol fields are specially displayed.

The packet bytes pane shows the data of the current packet (selected in the "Packet List" pane) in a hexdump style.

Figure 3.15. The "Packet Bytes" pane

As usual for a hexdump, the left side shows the offset in the packet data, in the middle the packet data is shown in a hexadecimal representation and on the right the corresponding ASCII characters (or . if not appropriate) are displayed.

Depending on the packet data, sometimes more than one page is available, e.g. when Wireshark has reassembled some packets into a single chunk of data, see Section 7.6, “Packet Reassembling”. In this case there are some additional tabs shown at the bottom of the pane to let you select the page you want to see.

Figure 3.16. The "Packet Bytes" pane with tabs

	Note!
	The additional pages might contain data picked from multiple packets.

The context menu (right mouse click) of the tab labels will show a list of all available pages. This can be helpful if the size in the pane is too small for all the tab labels.

The statusbar displays informational messages.

In general, the left side will show context related information, the middle part will show the current number of packets, and the right side will show the selected configuration profile. Drag the handles between the text areas to change the size.

Figure 3.17. The initial Statusbar

This statusbar is shown while no capture file is loaded, e.g. when Wireshark is started.

Figure 3.18. The Statusbar with a loaded capture file

Figure 3.19. The Statusbar with a configuration profile menu

For a detailed description of configuration profiles, see Section 9.6, “Configuration Profiles”.

Figure 3.20. The Statusbar with a selected protocol field

This is displayed if you have selected a protocol field from the "Packet Details" pane.

	Tip!
	The value between the brackets (in this example arp.opcode) can be used as a display filter string, representing the selected protocol field.

Figure 3.21. The Statusbar with a display filter message

This is displayed if you are trying to use a display filter which may have unexpected results. For a detailed description, see Section 6.4.4, “A common mistake”.

Capturing live network data is one of the major features of Wireshark.

The Wireshark capture engine provides the following features:

The capture engine still lacks the following features:

Setting up Wireshark to capture packets for the first time can be tricky.

	Tip!
	A comprehensive guide "How To setup a Capture" is available at: http://wiki.wireshark.org/CaptureSetup.

Here are some common pitfalls:

If you have any problems setting up your capture environment, you should have a look at the guide mentioned above.

One of the following methods can be used to start capturing packets with Wireshark:

When you select "Interfaces..." from the Capture menu, Wireshark pops up the "Capture Interfaces" dialog box as shown in Figure 4.1, “The "Capture Interfaces" dialog box on Microsoft Windows” or Figure 4.2, “The "Capture Interfaces" dialog box on Unix/Linux”.

	This dialog consumes lot's of system resources!
	As the "Capture Interfaces" dialog is showing live captured data, it is consuming a lot of system resources. Close this dialog as soon as possible to prevent excessive system load.

	Not all available interfaces may be displayed!
	This dialog box will only show the local interfaces Wireshark knows of. It will not show interfaces marked as hidden in the "Interface Options" preferences dialog. As Wireshark might not be able to detect all local interfaces, and it cannot detect the remote interfaces available, there could be more capture interfaces available than listed.

Figure 4.1. The "Capture Interfaces" dialog box on Microsoft Windows

Figure 4.2. The "Capture Interfaces" dialog box on Unix/Linux

When you select Start... from the Capture menu (or use the corresponding item in the "Main" toolbar), Wireshark pops up the "Capture Options" dialog box as shown in Figure 4.3, “The "Capture Options" dialog box”.

Figure 4.3. The "Capture Options" dialog box

	Tip!
	If you are unsure which options to choose in this dialog box, just try keeping the defaults as this should work well in many cases.

You can set the following fields in this dialog box:

When you select Details from the Capture Interface menu, Wireshark pops up the "Interface Details" dialog box as shown in Figure 4.4, “The "Interface Details" dialog box”. This dialog shows various characteristics and statistics for the selected interface.

	Microsoft Windows only
	This dialog is only available on Microsoft Windows

Figure 4.4. The "Interface Details" dialog box

While capturing, the underlying libpcap capturing engine will grab the packets from the network card and keep the packet data in a (relatively) small kernel buffer. This data is read by Wireshark and saved into the capture file(s) the user specified.

Different modes of operation are available when saving this packet data to the capture file(s).

	Tip!
	Working with large files (several 100 MB's) can be quite slow. If you plan to do a long term capture or capturing from a high traffic network, think about using one of the "Multiple files" options. This will spread the captured packets over several smaller files which can be much more pleasant to work with.

Note!

Using Multiple files may cut context related information. Wireshark keeps context information of the loaded packet data, so it can report context related problems (like a stream error) and keeps information about context related protocols (e.g. where data is exchanged at the establishing phase and only referred to in later packets). As it keeps this information only for the loaded file, using one of the multiple file modes may cut these contexts. If the establishing phase is saved in one file and the things you would like to see is in another, you might not see some of the valuable context related information.

	Tip!
	Information about the folders used for the capture file(s), can be found in Appendix A, Files and Folders.

In the usual case, you won't have to choose this link-layer header type. The following paragraphs describe the exceptional cases, where selecting this type is possible, so you will have a guide of what to do:

If you are capturing on an 802.11 device on some versions of BSD, this might offer a choice of "Ethernet" or "802.11". "Ethernet" will cause the captured packets to have fake Ethernet headers; "802.11" will cause them to have IEEE 802.11 headers. Unless the capture needs to be read by an application that doesn't support 802.11 headers, you should select "802.11".

If you are capturing on an Endace DAG card connected to a synchronous serial line, this might offer a choice of "PPP over serial" or "Cisco HDLC"; if the protocol on the serial line is PPP, select "PPP over serial", and if the protocol on the serial line is Cisco HDLC, select "Cisco HDLC".

If you are capturing on an Endace DAG card connected to an ATM network, this might offer a choice of "RFC 1483 IP-over-ATM" or "Sun raw ATM". If the only traffic being captured is RFC 1483 LLC-encapsulated IP, or if the capture needs to be read by an application that doesn't support SunATM headers, select "RFC 1483 IP-over-ATM", otherwise select "Sun raw ATM".

If you are capturing on an Ethernet device, this might offer a choice of "Ethernet" or "DOCSIS". If you are capturing traffic from a Cisco Cable Modem Termination System that is putting DOCSIS traffic onto the Ethernet to be captured, select "DOCSIS", otherwise select "Ethernet".

Wireshark uses the libpcap filter language for capture filters. This is explained in the tcpdump man page, which can be hard to understand, so it's explained here to some extent.

	Tip!
	You will find a lot of Capture Filter examples at http://wiki.wireshark.org/CaptureFilters.

You enter the capture filter into the Filter field of the Wireshark Capture Options dialog box, as shown in Figure 4.3, “The "Capture Options" dialog box”. The following is an outline of the syntax of the tcpdump capture filter language. See the expression option at the tcpdump manual page for details: http://www.tcpdump.org/tcpdump_man.html.

A capture filter takes the form of a series of primitive expressions connected by conjunctions (and/or) and optionally preceded by not:

[not] primitive [and|or [not] primitive ...]
      

An example is shown in Example 4.1, “ A capture filter for telnet that captures traffic to and from a particular host ”.

tcp port 23 and host 10.0.0.5
	

This example captures telnet traffic to and from the host 10.0.0.5, and shows how to use two primitives and the and conjunction. Another example is shown in Example 4.2, “ Capturing all telnet traffic not from 10.0.0.5”, and shows how to capture all telnet traffic except that from 10.0.0.5.

tcp port 23 and not src host 10.0.0.5
	  

XXX - add examples to the following list.

A primitive is simply one of the following:

While a capture is running, the following dialog box is shown:

Figure 4.5. The "Capture Info" dialog box

This dialog box will inform you about the number of captured packets and the time since the capture was started. The selection of which protocols are counted cannot be changed.

	Tip!
	This Capture Info dialog box can be hidden, using the "Hide capture info dialog" option in the Capture Options dialog box.

This chapter will describe input and output of capture data.

Wireshark can read in previously saved capture files. To read them, simply select the menu or toolbar item: "File/ Open". Wireshark will then pop up the File Open dialog box, which is discussed in more detail in Section 5.2.1, “The "Open Capture File" dialog box”.

	It's convenient to use drag-and-drop!
	... to open a file, by simply dragging the desired file from your file manager and dropping it onto Wireshark's main window. However, drag-and-drop is not available/won't work in all desktop environments.

If you didn't save the current capture file before, you will be asked to do so, to prevent data loss (this behaviour can be disabled in the preferences).

In addition to its native file format (libpcap format, also used by tcpdump/WinDump and other libpcap/WinPcap-based programs), Wireshark can read capture files from a large number of other packet capture programs as well. See Section 5.2.2, “Input File Formats” for the list of capture formats Wireshark understands.

5.2.1. The "Open Capture File" dialog box

The "Open Capture File" dialog box allows you to search for a capture file containing previously captured packets for display in Wireshark. Table 5.1, “The system specific "Open Capture File" dialog box” shows some examples of the Wireshark Open File Dialog box.

	The dialog appearance depends on your system!
	The appearance of this dialog depends on the system and/or GTK+ toolkit version used. However, the functionality remains basically the same on any particular system.

Common dialog behaviour on all systems:

• Select files and directories.

• Click the Open/Ok button to accept your selected file and open it.

• Click the Cancel button to go back to Wireshark and not load a capture file.

Wireshark extensions to the standard behaviour of these dialogs:

• View file preview information (like the filesize, the number of packets, ...), if you've selected a capture file.

• Specify a display filter with the "Filter:" button and filter field. This filter will be used when opening the new file. The text field background becomes green for a valid filter string and red for an invalid one. Clicking on the Filter button causes Wireshark to pop up the Filters dialog box (which is discussed further in Section 6.3, “Filtering packets while viewing”).

  XXX - we need a better description of these read filters

• Specify which name resolution is to be performed for all packets by clicking on one of the "... name resolution" check buttons. Details about name resolution can be found in Section 7.7, “Name Resolution”.

	Save a lot of time loading huge capture files!
	You can change the display filter and name resolution settings later while viewing the packets. However, loading huge capture files can take a significant amount of extra time if these settings are changed later, so in such situations it can be a good idea to set at least the filter in advance here.

Table 5.1. The system specific "Open Capture File" dialog box

Figure 5.1. "Open" on native Windows	Microsoft Windows This is the common Windows file open dialog - plus some Wireshark extensions. Specific for this dialog: If available, the "Help" button will lead you to this section of this "User's Guide". XXX - the "Filter:" button currently doesn't work on Windows! XXX - missing feature: If Wireshark doesn't recognize the selected file as a capture file, it should grey out the "Open" button.
Figure 5.2. "Open" - new GTK version	Unix/Linux: GTK version >= 2.4 This is the common Gimp/GNOME file open dialog - plus some Wireshark extensions. Specific for this dialog: The "+ Add" button allows you to add a directory, selected in the right-hand pane, to the favorites list on the left. Those changes are persistent. The "- Remove" button allows you to remove a selected directory from that list again (the items like: "Home", "Desktop", and "Filesystem" cannot be removed). If Wireshark doesn't recognize the selected file as a capture file, it will grey out the "Open" button.
Figure 5.3. "Open" - old GTK version	Unix/Linux: GTK version < 2.4 This is the file open dialog of former Gimp/GNOME versions - plus some Wireshark extensions. Specific for this dialog: If Wireshark doesn't recognize the selected file as a capture file, it will grey out the "Ok" button.

5.2.2. Input File Formats

The following file formats from other capture tools can be opened by Wireshark:

• libpcap, tcpdump and various other tools using tcpdump's capture format

• Sun snoop and atmsnoop

• Shomiti/Finisar Surveyor captures

• Novell LANalyzer captures

• Microsoft Network Monitor captures

• AIX's iptrace captures

• Cinco Networks NetXray captures

• Network Associates Windows-based Sniffer and Sniffer Pro captures

• Network General/Network Associates DOS-based Sniffer (compressed or uncompressed) captures

• AG Group/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures

• RADCOM's WAN/LAN Analyzer captures

• Network Instruments Observer version 9 captures

• Lucent/Ascend router debug output

• HP-UX's nettl

• Toshiba's ISDN routers dump output

• ISDN4BSD i4btrace utility

• traces from the EyeSDN USB S0

• IPLog format from the Cisco Secure Intrusion Detection System

• pppd logs (pppdump format)

• the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities

• the text output from the DBS Etherwatch VMS utility

• Visual Networks' Visual UpTime traffic capture

• the output from CoSine L2 debug

• the output from Accellent's 5Views LAN agents

• Endace Measurement Systems' ERF format captures

• Linux Bluez Bluetooth stack hcidump -w traces

• Catapult DCT2000 .out files

• ... new file formats are added from time to time

	Opening a file may fail due to invalid packet types!
	It may not be possible to read some formats dependent on the packet types captured. Ethernet captures are usually supported for most file formats, but other packet types (e.g. token ring packets) may not be possible to read from all file formats.

You can save captured packets simply by using the Save As... menu item from the File menu under Wireshark. You can choose which packets to save and which file format to be used.

	Saving may reduce the available information!
	Saving the captured packets will slightly reduce the amount of information, e.g. the number of dropped packets will be lost, see Section A.1, “Capture Files” for details.

5.3.1. The "Save Capture File As" dialog box

The "Save Capture File As" dialog box allows you to save the current capture to a file. Table 5.2, “The system specific "Save Capture File As" dialog box” shows some examples of this dialog box.

	The dialog appearance depends on your system!
	The appearance of this dialog depends on the system and GTK+ toolkit version used. However, the functionality remains basically the same on any particular system.

Table 5.2. The system specific "Save Capture File As" dialog box

Figure 5.4. "Save" on native Windows	Microsoft Windows This is the common Windows file save dialog - plus some Wireshark extensions. Specific for this dialog: If available, the "Help" button will lead you to this section of this "User's Guide". If you don't provide a file extension to the filename - e.g. .pcap, Wireshark will append the standard file extension for that file format.
Figure 5.5. "Save" - new GTK version	Unix/Linux: GTK version >= 2.4 This is the common Gimp/GNOME file save dialog - plus some Wireshark extensions. Specific for this dialog: Clicking on the + at "Browse for other folders" will allow you to browse files and folders in your file system.
Figure 5.6. "Save" - old GTK version	Unix/Linux: GTK version < 2.4 This is the file save dialog of former Gimp/GNOME versions - plus some Wireshark extensions.

With this dialog box, you can perform the following actions:

1. Type in the name of the file you wish to save the captured packets in, as a standard file name in your file system.

2. Select the directory to save the file into.

3. Select the range of the packets to be saved, see Section 5.8, “The Packet Range frame”

4. Specify the format of the saved capture file by clicking on the File type drop down box. You can choose from the types, described in Section 5.3.2, “Output File Formats”.

   	The selection of capture formats may be reduced!
   	Some capture formats may not be available, depending on the packet types captured.

   	File formats can be converted!
   	You can convert capture files from one format to another by reading in a capture file and writing it out using a different format.

5. Click on the Save/Ok button to accept your selected file and save to it. If Wireshark has a problem saving the captured packets to the file you specified, it will display an error dialog box. After clicking OK on that error dialog box, you can try again.

6. Click on the Cancel button to go back to Wireshark and not save the captured packets.

5.3.2. Output File Formats

Wireshark can save the packet data in its "native" file format (libpcap) and in the file formats of some other protocol analyzers, so other tools can read the capture data.

	File formats have different time stamp accuracies!
	Saving from the currently used file format to a different format may reduce the time stamp accuracy, see the Section 7.4, “Time Stamps” for details.

The following file formats can be saved by Wireshark (with the known file extensions):

• libpcap, tcpdump and various other tools using tcpdump's capture format (*.pcap,*.cap,*.dmp)

• Accellent 5Views (*.5vw)

• HP-UX's nettl (*.TRC0,*.TRC1)

• Microsoft Network Monitor - NetMon (*.cap)

• Network Associates Sniffer - DOS (*.cap,*.enc,*.trc,*fdc,*.syc)

• Network Associates Sniffer - Windows (*.cap)

• Network Instruments Observer version 9 (*.bfr)

• Novell LANalyzer (*.tr1)

• Sun snoop (*.snoop,*.cap)

• Visual Networks Visual UpTime traffic (*.*)

• ... new file formats are added from time to time

If the above tools will be more helpful than Wireshark is a different question ;-)

	Third party protocol analyzers may require specific file extensions!
	Other protocol analyzers than Wireshark may require that the file has a certain file extension in order to read the files you generate with Wireshark, e.g.: ".cap" for Network Associates Sniffer - Windows

Sometimes you need to merge several capture files into one. For example this can be useful, if you have captured simultaneously from multiple interfaces at once (e.g. using multiple instances of Wireshark).

Merging capture files can be done in three ways:

5.4.1. The "Merge with Capture File" dialog box

This dialog box let you select a file to be merged into the currently loaded file.

	You will be prompted for an unsaved file first!
	If your current data wasn't saved before, you will be asked to save it first, before this dialog box is shown.

Most controls of this dialog will work the same way as described in the "Open Capture File" dialog box, see Section 5.2.1, “The "Open Capture File" dialog box”.

Specific controls of this merge dialog are:

Prepend packets to existing file

Prepend the packets from the selected file before the currently loaded packets.

Merge packets chronologically

Merge both the packets from the selected and currently loaded file in chronological order.

Append packets to existing file

Append the packets from the selected file after the currently loaded packets.

Table 5.3. The system specific "Merge Capture File As" dialog box

Figure 5.7. "Merge" on native Windows	Microsoft Windows This is the common Windows file open dialog - plus some Wireshark extensions.
Figure 5.8. "Merge" - new GTK version	Unix/Linux: GTK version >= 2.4 This is the common Gimp/GNOME file open dialog - plus some Wireshark extensions.
Figure 5.9. "Merge" - old GTK version	Unix/Linux: GTK version < 2.4 This is the file open dialog of former Gimp/GNOME versions - plus some Wireshark extensions.

When using the "Multiple Files" option while doing a capture (see: Section 4.7, “Capture files and file modes”), the capture data is spread over several capture files, called a file set.

As it can become tedious to work with a file set by hand, Wireshark provides some features to handle these file sets in a convenient way.

The following features in the "File Set" submenu of the "File" menu are available to work with file sets in a convenient way:

5.5.1. The "List Files" dialog box

Figure 5.10. The "List Files" dialog box

Each line contains information about a file of the file set:

• Filename the name of the file. If you click on the filename (or the radio button left to it), the current file will be closed and the corresponding capture file will be opened.

• Created the creation time of the file

• Last Modified the last time the file was modified

• Size the size of the file

The last line will contain info about the currently used directory where all of the files in the file set can be found.

The content of this dialog box is updated each time a capture file is opened/closed.

The Close button will, well, close the dialog box.

Wireshark provides several ways and formats to export packet data. This section describes general ways to export data from Wireshark.

	Note!
	There are more specialized functions to export specific data, which will be described at the appropriate places.

XXX - add detailed descriptions of the output formats and some sample output, too.

5.6.1. The "Export as Plain Text File" dialog box

Export packet data into a plain ASCII text file, much like the format used to print packets.

Figure 5.11. The "Export as Plain Text File" dialog box

• Export to file: frame chooses the file to export the packet data to.

• The Packet Range frame is described in Section 5.8, “The Packet Range frame”.

• The Packet Details frame is described in Section 5.9, “The Packet Format frame”.

5.6.2. The "Export as PostScript File" dialog box

Export packet data into PostScript, much like the format used to print packets.

	Tip!
	You can easily convert PostScript files to PDF files using ghostscript. For example: export to a file named foo.ps and then call: ps2pdf foo.ps

Figure 5.12. The "Export as PostScript File" dialog box

• Export to file: frame chooses the file to export the packet data to.

• The Packet Range frame is described in Section 5.8, “The Packet Range frame”.

• The Packet Details frame is described in Section 5.9, “The Packet Format frame”.

5.6.5. The "Export as PSML File" dialog box

Export packet data into PSML. This is an XML based format including only the packet summary. The PSML file specification is available at: http://www.nbee.org/Docs/NetPDL/PSML.htm.

Figure 5.13. The "Export as PSML File" dialog box

• Export to file: frame chooses the file to export the packet data to.

• The Packet Range frame is described in Section 5.8, “The Packet Range frame”.

There's no such thing as a packet details frame for PSML export, as the packet format is defined by the PSML specification.

5.6.6. The "Export as PDML File" dialog box

Export packet data into PDML. This is an XML based format including the packet details. The PDML file specification is available at: http://www.nbee.org/Docs/NetPDL/PDML.htm.

	The PDML specification is not officially released and Wireshark's implementation of it is still in an early beta state, so please expect changes in future Wireshark versions.

Figure 5.14. The "Export as PDML File" dialog box

• Export to file: frame chooses the file to export the packet data to.

• The Packet Range frame is described in Section 5.8, “The Packet Range frame”.

There's no such thing as a packet details frame for PDML export, as the packet format is defined by the PDML specification.

5.6.7. The "Export selected packet bytes" dialog box

Export the bytes selected in the "Packet Bytes" pane into a raw binary file.

Figure 5.15. The "Export Selected Packet Bytes" dialog box

• Name: the filename to export the packet data to.

• The Save in folder: field lets you select the folder to save to (from some predefined folders).

• Browse for other folders provides a flexible way to choose a folder.

5.6.8. The "Export Objects" dialog box

This feature scans through HTTP streams in the currently open capture file or running capture and takes reassembled objects such as HTML documents, image files, executables and anything else that can be transferred over HTTP and lets you save them to disk. If you have a capture running, this list is automatically updated every few seconds with any new objects seen. The saved objects can then be opened with the proper viewer or executed in the case of executables (if it is for the same platform you are running Wireshark on) without any further work on your part. This feature is not available when using GTK2 versions below 2.4.

Figure 5.16. The "Export Objects" dialog box

Columns:

• Packet num: The packet number in which this object was found. In some cases, there can be multiple objects in the same packet.

• Hostname: The hostname of the server that sent the object as a response to an HTTP request.

• Content Type: The HTTP content type of this object.

• Bytes: The size of this object in bytes.

• Filename: The final part of the URI (after the last slash). This is typically a filename, but may be a long complex looking string, which typically indicates that the file was received in response to a HTTP POST request.

Buttons:

• Help: Opens this section in the user's guide.

• Close: Closes this dialog.

• Save As: Saves the currently selected object as a filename you specify. The default filename to save as is taken from the filename column of the objects list.

• Save All: Saves all objects in the list using the filename from the filename column. You will be asked what directory / folder to save them in. If the filename is invalid for the operating system / file system you are running Wireshark on, then an error will appear and that object will not be saved (but all of the others will be).

To print packets, select the "Print..." menu item from the File menu. When you do this, Wireshark pops up the Print dialog box as shown in Figure 5.17, “The "Print" dialog box”.

5.7.1. The "Print" dialog box

Figure 5.17. The "Print" dialog box

The following fields are available in the Print dialog box:

Printer

This field contains a pair of mutually exclusive radio buttons:

• Plain Text specifies that the packet print should be in plain text.

• PostScript specifies that the packet print process should use PostScript to generate a better print output on PostScript aware printers.

• Output to file: specifies that printing be done to a file, using the filename entered in the field or selected with the browse button.

  This field is where you enter the file to print to if you have selected Print to a file, or you can click the button to browse the filesystem. It is greyed out if Print to a file is not selected.

• Print command specifies that a command be used for printing.

  	Note!
  	These Print command fields are not available on windows platforms.

  This field specifies the command to use for printing. It is typically lpr. You would change it to specify a particular queue if you need to print to a queue other than the default. An example might be:

  lpr -Pmypostscript
  	      

  This field is greyed out if Output to file: is checked above.

Packet Range

Select the packets to be printed, see Section 5.8, “The Packet Range frame”

Packet Format

Select the output format of the packets to be printed. You can choose, how each packet is printed, see Figure 5.19, “The "Packet Format" frame”

The packet range frame is a part of various output related dialog boxes. It provides options to select which packets should be processed by the output function.

Figure 5.18. The "Packet Range" frame

If the Captured button is set (default), all packets from the selected rule will be processed. If the Displayed button is set, only the currently displayed packets are taken into account to the selected rule.

The packet format frame is a part of various output related dialog boxes. It provides options to select which parts of a packet should be used for the output function.

Figure 5.19. The "Packet Format" frame

Once you have captured some packets, or you have opened a previously saved capture file, you can view the packets that are displayed in the packet list pane by simply clicking on a packet in the packet list pane, which will bring up the selected packet in the tree view and byte view panes.

You can then expand any part of the tree view by clicking on the plus sign (the symbol itself may vary) to the left of that part of the payload, and you can select individual fields by clicking on them in the tree view pane. An example with a TCP packet selected is shown in Figure 6.1, “Wireshark with a TCP packet selected for viewing”. It also has the Acknowledgment number in the TCP header selected, which shows up in the byte view as the selected bytes.

Figure 6.1. Wireshark with a TCP packet selected for viewing

You can also select and view packets the same way, while Wireshark is capturing, if you selected "Update list of packets in real time" in the Wireshark Capture Preferences dialog box.

In addition, you can view individual packets in a separate window as shown in Figure 6.2, “Viewing a packet in a separate window”. Do this by selecting the packet in which you are interested in the packet list pane, and then select "Show Packet in New Windows" from the Display menu. This allows you to easily compare two or even more packets.

Figure 6.2. Viewing a packet in a separate window

You can bring up a pop-up menu over either the "Packet List", "Packet Details" or "Packet Bytes" pane by clicking your right mouse button at the corresponding pane.

6.2.1. Pop-up menu of the "Packet List" pane

Figure 6.3. Pop-up menu of the "Packet List" pane

The following table gives an overview of which functions are available in this pane, where to find the corresponding function in the main menu, and a short description of each item.

Table 6.1. The menu items of the "Packet List" pop-up menu

Item	Identical to main menu's item:	Description
Mark Packet (toggle)	Edit	Mark/unmark a packet.
Set Time Reference (toggle)	Edit	Set/reset a time reference.
-----
Apply as Filter	Analyze	Prepare and apply a display filter based on the currently selected item.
Prepare a Filter	Analyze	Prepare a display filter based on the currently selected item.
Conversation Filter	-	This menu item applies a display filter with the address information from the selected packet. E.g. the IP menu entry will set a filter to show the traffic between the two IP addresses of the current packet. XXX - add a new section describing this better.
Colorize Conversation	-	This menu item uses a display filter with the address information from the selected packet to build a new colorizing rule.
SCTP	-	XXX - add an explanation of this.
Follow TCP Stream	Analyze	Allows you to view all the data on a TCP stream between a pair of nodes.
Follow SSL Stream	Analyze	Same as "Follow TCP Stream" but for SSL. XXX - add a new section describing this better.
-----
Copy/ Summary (Text)	-	Copy the summary fields as displayed to the clipboard, as tab-separated text.
Copy/ Summary (CSV)	-	Copy the summary fields as displayed to the clipboard, as comma-separated text.
Copy/ As Filter		Prepare a display filter based on the currently selected item and copy that filter to the clipboard.
Copy/ Bytes (Offset Hex Text)	-	Copy the packet bytes to the clipboard in hexdump-like format.
Copy/ Bytes (Offset Hex)	-	Copy the packet bytes to the clipboard in hexdump-like format, but without the text portion.
Copy/ Bytes (Printable Text Only)	-	Copy the packet bytes to the clipboard as ASCII text, excluding non-printable characters.
Copy/ Bytes (Hex Stream)	-	Copy the packet bytes to the clipboard as an unpunctuated list of hex digits.
Copy/ Bytes (Binary Stream)	-	Copy the packet bytes to the clipboard as raw binary. The data is stored in the clipboard as MIME-type "application/octet-stream". This option is not available in versions of Wireshark built using GTK+ 1.x.
Export Selected Packet Bytes...	File	This menu item is the same as the File menu item of the same name. It allows you to export raw packet bytes to a binary file.
-----
Decode As...	Analyze	Change or apply a new relation between two dissectors.
Print...	File	Print packets.
Show Packet in New Window	View	Display the selected packet in a new window.

6.2.2. Pop-up menu of the "Packet Details" pane

Figure 6.4. Pop-up menu of the "Packet Details" pane

The following table gives an overview of which functions are available in this pane, where to find the corresponding function in the main menu, and a short description of each item.

Table 6.2. The menu items of the "Packet Details" pop-up menu

Item	Identical to main menu's item:	Description
Expand Subtrees	View	Expand the currently selected subtree.
Expand All	View	Expand all subtrees in all packets in the capture.
Collapse All	View	Wireshark keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item collapses the tree view of all packets in the capture list.
-----
Copy/ Description	-	Copy the displayed text of the selected field to the system clipboard.
Copy/ As Filter	Edit	Prepare a display filter based on the currently selected item and copy it to the clipboard.
Copy/ Bytes (Offset Hex Text)	-	Copy the packet bytes to the clipboard in hexdump-like format; similar to the Packet List Pane command, but copies only the bytes relevant to the selected part of the tree (the bytes selected in the Packet Bytes Pane).
Copy/ Bytes (Offset Hex)	-	Copy the packet bytes to the clipboard in hexdump-like format, but without the text portion; similar to the Packet List Pane command, but copies only the bytes relevant to the selected part of the tree (the bytes selected in the Packet Bytes Pane).
Copy/ Bytes (Printable Text Only)	-	Copy the packet bytes to the clipboard as ASCII text, excluding non-printable characters; similar to the Packet List Pane command, but copies only the bytes relevant to the selected part of the tree (the bytes selected in the Packet Bytes Pane).
Copy/ Bytes (Hex Stream)	-	Copy the packet bytes to the clipboard as an unpunctuated list of hex digits; similar to the Packet List Pane command, but copies only the bytes relevant to the selected part of the tree (the bytes selected in the Packet Bytes Pane).
Copy/ Bytes (Binary Stream)	-	Copy the packet bytes to the clipboard as raw binary; similar to the Packet List Pane command, but copies only the bytes relevant to the selected part of the tree (the bytes selected in the Packet Bytes Pane). The data is stored in the clipboard as MIME-type "application/octet-stream". This option is not available in versions of Wireshark built using GTK+ 1.x.
Export Selected Packet Bytes...	File	This menu item is the same as the File menu item of the same name. It allows you to export raw packet bytes to a binary file.
-----
Apply as Filter	Analyze	Prepare and apply a display filter based on the currently selected item.
Prepare a Filter	Analyze	Prepare a display filter based on the currently selected item.
Colorize with Filter	-	Prepare a display filter based on the currently selected item and use it to prepare a new colorize rule.
Follow TCP Stream	Analyze	Allows you to view all the data on a TCP stream between a pair of nodes.
Follow SSL Stream	Analyze	Same as "Follow TCP Stream" but for SSL. XXX - add a new section describing this better.
-----
Wiki Protocol Page	-	Show the wiki page corresponding to the currently selected protocol in your web browser.
Filter Field Reference	-	Show the filter field reference web page corresponding to the currently selected protocol in your web browser.
Protocol Preferences...	-	The menu item takes you to the properties dialog and selects the page corresponding to the protocol if there are properties associated with the highlighted field. More information on preferences can be found in Figure 9.8, “The preferences dialog box”.
-----
Decode As...	Analyze	Change or apply a new relation between two dissectors.
Resolve Name	View	Causes a name resolution to be performed for the selected packet, but NOT every packet in the capture.
Go to Corresponding Packet	Go	If the selected field has a corresponding packet, go to it. Corresponding packets will usually be a request/response packet pair or such.

Wireshark has two filtering languages: One used when capturing packets, and one used when displaying packets. In this section we explore that second type of filter: Display filters. The first one has already been dealt with in Section 4.9, “Filtering while capturing”.

Display filters allow you to concentrate on the packets you are interested in while hiding the currently uninteresting ones. They allow you to select packets by:

To select packets based on protocol type, simply type the protocol in which you are interested in the Filter: field in the filter toolbar of the Wireshark window and press enter to initiate the filter. Figure 6.5, “Filtering on the TCP protocol” shows an example of what happens when you type tcp in the filter field.

	Note!
	All protocol and field names are entered in lowercase. Also, don't forget to press enter after entering the filter expression.

Figure 6.5. Filtering on the TCP protocol

As you might have noticed, only packets of the TCP protocol are displayed now (e.g. packets 1-10 are hidden). The packet numbering will remain as before, so the first packet shown is now packet number 11.

	Note!
	When using a display filter, all packets remain in the capture file. The display filter only changes the display of the capture file but not its content!

You can filter on any protocol that Wireshark understands. You can also filter on any field that a dissector adds to the tree view, but only if the dissector has added an abbreviation for the field. A list of such fields is available in Wireshark in the Add Expression... dialog box. You can find more information on the Add Expression... dialog box in Section 6.5, “The "Filter Expression" dialog box”.

For example, to narrow the packet list pane down to only those packets to or from the IP address 192.168.0.1, use ip.addr==192.168.0.1.

	Note!
	To remove the filter, click on the Clear button to the right of the filter field.

Wireshark provides a simple but powerful display filter language that allows you to build quite complex filter expressions. You can compare values in packets as well as combine expressions into more specific expressions. The following sections provide more information on doing this.

	Tip!
	You will find a lot of Display Filter examples at the Wireshark Wiki Display Filter page at http://wiki.wireshark.org/DisplayFilters.