RAWSHARK(1) RAWSHARK(1) (NAME) rawshark - pcap (SYNOPSIS) rawshark [ -d | ] [ -F ] [ -l ] [ -m ] [ -o ] ... [ -p ] [ -r |- ] [ -R ] [ -s ] [ -S ] [ options ] rawshark -h|--help rawshark -v|--version (DESCRIPTION) Rawshark . (INPUT) TShark Rawshark . -d -r . -F . Wireshark TShark . Rawshark . pcap . struct rawshark_rec_s { uint32_t ts_sec; /* Time stamp (seconds) */ uint32_t ts_usec; /* Time stamp (microseconds) */ uint32_t caplen; /* Length of the packet buffer */ uint32_t len; /* "On the wire" length of the packet */ uint8_t data[caplen]; /* Packet data */ }; -p rawshark . struct pcap_pkthdr libpcap Npcap . tv_sec struct timeval . rawshark (layout) rawshark . rawshark rawshark . struct rawshark_rec_s { struct timeval ts; /* Time stamp */ uint32_t caplen; /* Length of the packet buffer */ uint32_t len; /* "On the wire" length of the packet */ uint8_t data[caplen]; /* Packet data */ }; () rawshark . (OUTPUT) -F Rawshark << >> . "1" "0" . "-" . -F ip.src -F dns.qry.type : 0 FT_IPv4 BASE_NONE - 1 FT_UINT16 BASE_HEX - 1 1="1" 0="192.168.77.10" 1 - 2 1="1" 0="192.168.77.250" 1 - 3 0="192.168.77.10" 1 - 4 0="74.125.19.104" 1 - DNS . -R "not dns" : 0 FT_IPv4 BASE_NONE - 1 FT_UINT16 BASE_HEX - 1 1="1" 0="192.168.77.10" 0 - 2 1="1" 0="192.168.77.250" 0 - 3 0="192.168.77.10" 1 - 4 0="74.125.19.104" 1 - . (OPTIONS) -d . type:value type : encap:name name (DLT) libpcap/Npcap encap:EN10MB Ethernet. ()pcap_datalink_name_to_val . DLT : . encap:number number LINKTYPE_ libpcap/Npcap encap:105 IEEE 802.11 encap:101 IP . proto:protocol Wireshark proto:http HTTP. -F . . -F . -F . -R . -h|--help . -l (flush) . ( -V -V -l (pipe) . Microsoft Visual C++ C .) TShark pipe TShark . -m rawshark . POSIX ( ). -o : (preference) . prefname:value prefname ( ) value . -p pcap_pkthdr pcap.h . . . -r |- input source . FIFO ( ) ``-'' . rawshark rawshark C . -R|--read-filter ( / ) . rawshark . -s pcap pcap . -S . : %D "Type" dns.qry.type %N . %S . Wireshark ( "Type: A (1)") %D: %S (%N) . -v|--version . -Y|--display-filter ( / ) . rawshark . --disable-all-protocols . --disable-protocol [,,...] proto_name. ALL proto_name (profile) . --disable-heuristic (heuristic). --enable-protocol [,,...] proto_name. ALL proto_name . --disable-protocol --enable-protocol . . : --disable-protocol ALL --enable-protocol eth,ip --enable-heuristic (heuristic). -K (Kerberos) (keytab) . . : -K krb5.keytab -n ( TCP UDP) -N . -N . ( -n) . -n (preferences) -o . -N -n -N dmN . : d DNS g (geolocation) IP MaxMind m MAC n N ( DNS) n . s SNI (handshake) t (transport-layer) v VLAN --only-protocols . . -t (a|ad|adoy|d|dd|e|r|rc|u|ud|udoy)[.[N]]|.[N] . : a (absolute): ad : YYYY-MM-DD adoy : YYYY/DOY d (delta): dd (delta_displayed): delta_displayed e (epoch): (1 1970 00:00:00) r (relative): rc : u (UTC): UTC "Z" ud UTC : YYYY-MM-DD UTC "Z" udoy UTC : YYYY/DOY UTC "Z" .[N] : N ( ). "." N (trace) . . -u -t ( relative delta delta_displayed) . : s hms . (DIAGNOSTIC OPTIONS) --log-level . "noisy" "debug" "info" "message" "warning" "critical" "error". "warning" "warning" "critical" "error" "noisy" . . --log-fatal . "warning" "warning" "critical" "error" . --log-fatal-count (fatal) . --log-domains "GUI,Epan,sshdump". . "!" ( ). --log-debug "debug" . . "!" ( ). --log-noisy "noisy" . . "!" ( ). --log-fatal-domains . . --log-file stderr . (READ FILTER SYNTAX) Rawshark wireshark-filter(4) . (FILES) Wireshark . (Preferences) preferences . / . / . : -o ( ) / . prefname:value prefname value (white space) : value . . # : # Vertical scrollbars should be on right side? # TRUE or FALSE (case-insensitive). gui.scrollbar_on_right: TRUE wireshark share . macOS /Application/Wireshark.app/Contents/Resources/share UNIX Linux \*BSD Solaris AIX /usr/share/wireshark/preferences /usr/local/share/wireshark/preferences C:\Program Files\Wireshark\preferences . UNIX $XDG_CONFIG_HOME/wireshark/preferences ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/preferences) $HOME/.config/wireshark/preferences . %APPDATA%\Wireshark\preferences ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\preferences) . () disabled_protos . : http tcp # a comment disabled_protos . disabled_protos . disabled_protos . disabled_protos ( - postdissectors) . enabled_protos . (Heuristic Dissectors) heuristic_protos . 0 1 : quic,1 rtcp_stun,1 rtcp_udp,1 rtp_stun,0 rtp_udp,0 tls_tcp,1 heuristic_protos . heuristic_protos . ( - hosts) hosts IPv4 IPv6 . hosts IP (whitespace) . hosts / . UNIX Linux macOS \*BSD Solaris AIX libpcap Npcap . hosts Wireshark . ( - subnets) IPv4 ( ) subnets . subnets subnets . IPv4 / . IPv4 . : # Comments must be prepended by the # sign! 192.168.0.0/24 ws_test_network "subnet-name.remaining-address" . "192.168.0.1" "ws_test_network.1" 24 16 "ws_test_network.0.1" . (ethers) ethers - EUI-48 - EUI-64 . ethers ethers . ethers(5) - . ( ) . (:) (-) (.) . . # . - MAC - EUI-64 . ethers : ff:ff:ff:ff:ff:ff Broadcast c0-00-ff-ff-ff-ff TR_broadcast 00.00.00.00.00.00 Zero_broadcast 00:00:00:00:00:00:00:00 EUI64_zero_broadcast ethers(5) UN*X . ethers macOS \*BSD AIX /etc ( C:\Program Files\Wireshark) . ethers . libpcap Npcap . ethers Wireshark . (manuf) manuf - - MAC . ethers : 00:00:0C Cisco Cisco Systems, Inc OUI - : 00-00-0C-07-AC/40 All-HSRP-routers MAC . 00-00-0C-07-AC-00 00-00-0C-07-AC-FF . . manuf manuf . Wireshark IEEE manuf . tshark -G manuf . manuf wka . Wireshark MAC IEEE . ( - services) services . services services . services () . ( tcp udp sctp) / . : mydns 5045/udp # My own Domain Name Server mydns 5045/tcp # My own Domain Name Server Wireshark IANA services . tshark -G services . (ipxnets) ipxnets IPX - . ipxnets . ethers . IPX . ipxnets : C0.A8.2C.00 HR c0-a8-1c-00 CEO 00:00:BE:EF IT_Server1 110f FileServer3 ipxnets /etc Linux macOS \*BSD Solaris AIX ( C:\Program Files\Wireshark) Windows . ipxnets . (ss7pcs) ss7pcs (point codes) (SS7) . . (whitespace) . : 2-1234 MyPointCode1 (vlans) vlans VLAN . . VLAN . : 123 Server-Lan 2049 HR-Client-LAN ( ) colorfilters . . : # a comment @tcp@tcp@[59345,58980,65534][0,0,0] @udp@udp@[28834,57427,65533][0,0,0] colorfilters (preferences) . colorfilters . View:Coloring Rules (: ) . colorfilters colorfilters . (Plugins) Wireshark . (UNIX) (macOS) \*BSD AIX lib/wireshark/plugins/ ( lib64 lib ) ( /usr/local/lib/wireshark/plugins/). $HOME/.local/lib/wireshark/plugins . macOS Wireshark (application bundle) %APPDIR%/Contents/PlugIns/wireshark . plugins/ ( C:\Program Files\Wireshark\plugins\). %APPDATA%\Wireshark\plugins ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\plugins) . Lua Wireshark ( X.Y) . Wireshark ( libwireshark libwiretap codecs). libwireshark foo.so ( foo.dll ) PLUGINDIR/X.Y/epan (libwireshark libepan codecs wiretap ). UNIX Lua ( ) $XDG_CONFIG_HOME/wireshark/plugins ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/plugins.) (dissector plugin) . Wireshark . (ENVIRONMENT VARIABLES) WIRESHARK_CONFIG_DIR . UNIX Linux macOS \*BSD Solaris AIX $XDG_CONFIG_HOME/wireshark ( $HOME/.wireshark $HOME/.wireshark) $HOME/.config/wireshark . Windows %APPDATA%\Wireshark ( %APPDATA% %USERPROFILE%\Application Data\Wireshark). Wireshark 3.0 . WIRESHARK_DEBUG_WMEM_OVERRIDE wmem all . . README.wmem . WIRESHARK_RUN_FROM_BUILD_DIRECTORY ( ) . root ( setuid) UNIX Linux macOS \*BSD Solaris AIX . WIRESHARK_DATA_DIR . root ( setuid) UNIX . ERF_RECORDS_TO_CHECK ERF ERF . (20) . IPFIX_RECORDS_TO_CHECK IPFIX IPFIX . (20) . WIRESHARK_ABORT_ON_DISSECTOR_BUG Rawshark abort(3) . abort(3) Rawshark ( ) core dump . . WIRESHARK_ABORT_ON_TOO_MANY_ITEMS Rawshark abort(3) ( ). abort(3) Rawshark ( ) core dump . . (SEE ALSO) wireshark-filter(4), wireshark(1), tshark(1), editcap(1), pcap(3), dumpcap(1), text2pcap(1), pcap-filter(7) tcpdump(8) (NOTES) Rawshark 4.7.3 . Rawshark Wireshark . Wireshark : . HTML Wireshark : . (AUTHORS) Rawshark Wireshark Wireshark Wireshark . 2026-09-03 RAWSHARK(1)