STRATO(1) STRATO(1) ] . mso www.tmac (NAME) strato - (SYNOPSIS) strato [ -i |- ] [ -f ] [ -2 ] [ -r ] [ -w |- ] [ options ] [ ] strato -h|--help strato -v|--version (DESCRIPTION) strato . . strato scap Stratoshark Falco sysdig . strato sysdig . libscap libsinsp . -r strato sysdig . strato Stratoshark . gzip Zstandard LZ4 . DESCRIPTION wireshark(1) Wireshark strato . zlib ( ). zlib strato . LZ4 ZStandard . strato (preferences) ( Wireshark ) "frame number" . -V . -O . <> . -P -V -O . pcap . . -f . pcap . strato strato . strato . Wireshark -Y . . strato . -f -Y ( ) . ( -r ) ( -r ) . -w strato . -w . . strato -w ( -w ). -w -P -w -V -O . -P -V -O . strato pcapng . -F . -F . dumpcap(1) pcapng pcap. --compress --compress . --compress ( ) -w . strato . -q . -Q . -q -Q -P -V -O . -q -Q -z . -G strato (dump) ..SH " (OPTIONS)" -2 - (two-pass) . strato 'response in frame #' . (reassembly) . (pipe) FIFO . -a|--autostop strato . test:value test : duration:value value . ( 0.5) . files:value value . filesize:value value . -b strato . strato ( ). () . packets:value value . -c . -A : strato rpcap:// . libpcap . -b|--ring-buffer strato << >> (multiple files) . << >> strato . strato . -w outfile_00001_20260714120117.pcap outfile_00002_20260714120523.pcap ... files << >> . strato . files ( ) . key:value key : duration:value value . ( 0.5) . files:value value ( ). . : . files duration interval filesize . -b -b . filesize:value value . () . interval:value value . . packets:value value . printname:filename filename . filename stdout - stderr . nametimenum:value . value ( log_00001_20260714164426.pcap). value ( log_20210828164426_00001.pcap). . : strato -b filesize:1000 -b files:5 . -B|--buffer-size ( ). . (packet drop) . strato . Linux macOS \*BSD Solaris AIX libpcap 1.0.0 Windows . libpcap . . -i . -i -i . . -c . . -a packets: . -C (configuration profile) . --global-profile . -D|--list-interfaces strato . . -i . Windows GUID . -e -T ek|fields|json|pdml . . -T fields . <<_ws.col.>> . (@) . : strato -T fields -e frame.number -e ip.addr -e udp -e _ws.col.info . -E . ( ) . ( <>) (<>) . -E -T fields . : bom=y|n y (BOM) UTF-8 ( ef, bb, bf) . n . header=y|n y -e . n . separator=/t|/s| . /t ( ) /s . . occurrence=f|l|a . f l a (). aggregator=,|/s| . , () /s . . quote=d|s|n . d s n () . . escape=y|n y ( line feed carriage return form feed ) (backspace) C <<\n>> line feed. n . y . escape_formulas=y|n y CSV . = + - @ ( ) . . n . -f . . -i . -i -i . . Capture->Capture Filters <> . : strato -f "predef:MyPredefinedHostOnlyFilter" -F -w . -w -F . -F . pcapng ( ). . -g () (group-read) ( () ). -G -G strato . fields . -C . help . : column-formats strato . . . ( "%rD") ( "Dest port (resolved)") ( "_ws.col.res_dst_port") gui.column.format -o . currentprefs stdout . decodes <>/<> stdout . . . "tcp.port" <> "http" defaultprefs stdout . . dissectors stdout . . . dissector-tables stdout . . . "tcp.port" (GUI) ( ftenum "heuristic") ( ) <> ( ) elastic-mapping[,filter] ElasticSearch stdout . () . filter ( Kibana) . strago -G elastic-mapping,ip,udp,dns enterprises (PEN) IANA . fieldcount stdout . fields[,prefix] stdout . HTML . . . . (Protocols) 'P' (Header Fields) 'F' ( ftenum) ( ) <> FT_BOOLEAN : : : 0x.... fields . (Search Output) folders strato . About | Folders Wireshark . . . ( "Personal configuration:") ( "/home/vagrant/.config/wireshark/") ftypes (<>) strato . . . FTYPE ( "FT_IPv6") ( "IPv6 address") heuristic-decodes . . . ( "tcp") ( "ucp") ( "T" "F") ( "T" "F") ( "ucp_tcp") ( "UCP over TCP") help . manuf MAC manuf . plugins . . . / Lua/ extcap ( "gryphon.so") ( 0.0.4) ("dissector" "tap" "file type" ) profiles[,filter] . "global" "personal" "all" . "all" . (personal global default) protocols stdout . HTML . . . ( "T" "F") ( "T" "F") ( "T" "F") services () TCP UDP SCTP . values value_strings range_strings true/false . . . : Value String Range String True/False String. 'V' 'R' 'T' . (Value Strings) 'V' (Range Strings) 'R' : : / (True/False Strings) 'T' / True False -h|--help . -H <> . -W n . . <> : . -i|--interface | - . <> ( ) <> . strato loopback loopback loopback . strato . FIFO ( ) <<->> . Windows <<\\.\pipe\pipename>> . pcapng pcap . pcapng (endianness) . . pcapng . -j ek|json|jsonraw|pdml. . . : strato -T json -j "ip ip.flags http" -J ek|json|jsonraw|pdml. . . : strato -T pdml -J "tcp http" -l (flush) . ( -V -V -l . ++ .) --update-interval 0 . strato strato . -L|--list-data-link-types . -y . -o : . prefname:value prefname ( ) value . strato . Wireshark . -O -V strato protocols . <> . -P|--print -w -Q . -q . SIGINFO BSD <<>> ( -T BSD "disabled" ) . -z . -Q . . -q stderr . -z . -r|--read-file infile ( ). stdin (-) ( : ). strato . -R|--read-filter ( / ) . . -2 . -Y . 'response in frame #' . -s|--snapshot-length . snaplen . 0 262144 . . -i . -i -i . . -S . -T ek|fields|json|jsonraw|pdml|ps|psml|tabs|text . : ek JSON Elasticsearch. -j -J -x . -P -P -V . -P -V . Elasticsearch: strato -T ek -j "http tcp ip" -P -V -x -r file.pcap > file.json curl -H "Content-Type: application/x-ndjson" -XPOST http://elasticsearch:9200/_bulk --data-binary "@file.json" Elastic Wireshark elastic *-packets . <> . --elastic-mapping-filter : strato -G elastic-mapping --elastic-mapping-filter ip,udp,dns -G elastic-mapping: strato -G elastic-mapping,ip,udp,dns fields -e -E . strato -T fields -E separator=, -E quote=d (CSV) . json JSON. -j -J -x . : strato -T json -r file.pcap strato -T json -j "http tcp ip" -x -r file.pcap jsonraw JSON . -j -J . : strato -T jsonraw -r file.pcap strato -T jsonraw -j "http tcp ip" -x -r file.pcap pdml (Packet Details Markup Language) XML . -V . --color pdml . . ps PostScript -V . psml (Packet Summary Markup Language) XML . . --color pdml . . tabs text ASCII (0x09) . text -V . . --temp-dir ( ) . Linux macOS \*BSD Solaris AIX $TMPDIR /tmp . Windows %TEMP% %USERPROFILE%\AppData\Local\Temp . -U PDU PDU tap infile outfile . -Y . tap "" tap ? . -v|--version . -V strato . -w | - outfile outfile '-' . -F --compress . ( ) gzip '.gz'. -w . stdout ( '>') -w . -W . strato -F pcapng -W n . strato pcapng . : n ( pcapng) -x strato / ( ) ASCII . --hexdump strato ASCII ASCII . ( -x) . . : all hexdump hexdump . --hexdump frames . -x . frames hexdump hexdump . hexdump 'Bitstring tvb' 'Reassembled TCP' 'De-chunked entity body' hexdump . ascii hexdump ASCII . --hexdump delimit --hexdump noascii . -x ASCII . delimit hexdump ASCII '|' . ASCII . noascii hexdump ASCII. time hexdump . -t . notime hexdump . help --hexdump . --hexdump pcap pcapng Microsoft NetMon 2.x strato Wireshark (<>) . : hexdump ASCII text2pcap : strato ... --hexdump frames --hexdump delimit --hexdump time -t ad \ | text2pcap -t 'ISO' - MYNEWPCAPNG hexdump ASCII UTC text2pcap -a : strato ... --hexdump frames --hexdump time -t ud \ | text2pcap -a -t 'ISO' - MYNEWPCAPNG hexdump ASCII (epoch) text2pcap : strato ... --hexdump frames --hexdump noascii --hexdump time -t e \ | text2pcap -t %s.%f - MYNEWPCAPNG -X strato. (eXtension) extension_key:value extension_key : lua_script:lua_script_filename strato Lua . lua_scriptnum:argument strato lua 'num' 'lua_script' . '-X lua_script:my.lua' '-X lua_script1:foo' 'foo' 'my.lua' . '-X lua_script:my.lua' '-X lua_script:other.lua' '-X lua_script2:bar' 'bar' lua 'other.lua' . read_format:file_format strato ( -r) . file_format . strato -r rtcp_broken.pcapng -X read_format:"MIME Files Format" -V file-pcapng . -Y|--display-filter ( / ) . ( ) . -R . (-2 ) ( ) . -M . strato -M 100000 . -2 . -z strato . -q . . filter ( ) . -z proto - . -q -V . : -z help -z. -z container_io,tree[,filter] I/O . -z expert[,error|,warn|,note|,chat|,comment][,filter] . : -z expert,sip sip . . : -z "expert,note,tcp" tcp note . --capture-comment . . Wireshark . --list-time-stamp-types . . --no-optimize libpcap . . . -i . -i -i . --time-stamp-type . --update-interval . . 100ms . --color Wireshark. Windows . "true color" . : --no-duplicate-keys json . ( -T json ) --elastic-mapping-filter ,,... ElasticSearch ( Kibana) . . : ip,udp,dns . --export-objects , destdir. protocol --export-objects help . . . . . --print-timers JSON strato . ( ) . --compress type. --compress . type outfile . -d ==, Decode As... Wireshark . ( tcp.port udp.port TCP UDP) (selector) . . Decode As -d tcp.port==8888,http TCP 8888 HTTP . . Decode As -d tcp.port==8888-8890,http TCP 8888 8889 8890 HTTP . . Decode As -d tcp.port==8888:3,http TCP 8888 8889 8890 HTTP . . . Decode As -d . . . Decode As -d ethertype==0x0800,. ethertype . --disable-all-protocols . --disable-protocol [,,...] proto_name. ALL proto_name (profile) . --disable-heuristic (heuristic protocol). --enable-protocol [,,...] proto_name. ALL proto_name . --disable-protocol --enable-protocol . . : --disable-protocol ALL --enable-protocol eth,ip --enable-heuristic (heuristic protocol). -K kerberos keytab . . : -K krb5.keytab -n ( TCP UDP) -N . -N . ( -n) . -n (preferences) -o . -N -n -N dmN . : d DNS g IP MaxMind m MAC n N ( DNS) n . s SNI (handshake) t v VLAN (single-pass mode) tshark (synchronous) . (dropped packets) . --only-protocols ( ) . . -t (a|ad|adoy|d|dd|e|r|rc|u|ud|udoy)[.[N]]|.[N] (timestamp) . : a (absolute): ad (absolute with date): YYYY-MM-DD adoy (absolute with date using day of year): YYYY/DOY d (delta): dd delta_displayed: delta_displayed e (epoch): (Jan 1, 1970 00:00:00) r (relative): rc (relative to capture start): u (UTC): UTC "Z" ud (UTC with date): YYYY-MM-DD UTC "Z" udoy (UTC with date using day of year): YYYY/DOY UTC "Z" .[N] : N ( ). "." N (trace) . (relative) . -u -t ( relative delta delta_displayed) . : s hms . --log-level . "noisy" "debug" "info" "message" "warning" "critical" "error". "warning" "warning" "critical" "error" "noisy" . . --log-fatal . "warning" "warning" "critical" "error" . --log-fatal-count (fatal) . --log-domains "GUI,Epan,sshdump". . "!" ( ). --log-debug "debug". . "!" ( ). --log-noisy "noisy". . "!" ( ). --log-fatal-domains . . --log-file stderr . (FILES) Wireshark . (Preferences) preferences ( ) . . . : -o ( ) . prefname:value prefname value (white space) : value . . # : # Vertical scrollbars should be on right side? # TRUE or FALSE (case-insensitive). gui.scrollbar_on_right: TRUE wireshark share . macOS /Application/Wireshark.app/Contents/Resources/share UNIX Linux \*BSD Solaris AIX /usr/share/wireshark/preferences /usr/local/share/wireshark/preferences Windows C:\Program Files\Wireshark\preferences . UNIX $XDG_CONFIG_HOME/wireshark/preferences ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/preferences) $HOME/.config/wireshark/preferences . Windows %APPDATA%\Wireshark\preferences ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\preferences) . () (Disabled (Enabled) Protocols) disabled_protos (dissectors) . : http tcp # a comment disabled_protos . disabled_protos . disabled_protos . disabled_protos ( ) . enabled_protos . (Heuristic Dissectors) heuristic_protos . 0 1 : quic,1 rtcp_stun,1 rtcp_udp,1 rtp_stun,0 rtp_udp,0 tls_tcp,1 heuristic_protos . heuristic_protos . (hosts) hosts IPv4 IPv6 . hosts IP . hosts . libpcap UNIX Linux macOS \*BSD Solaris AIX Npcap Windows . hosts . (subnets) IPv4 ( ) subnets . subnets subnets . IPv4 / . IPv4 . : # Comments must be prepended by the # sign! 192.168.0.0/24 ws_test_network "subnet-name.remaining-address" . "192.168.0.1" "ws_test_network.1" 24 16 "ws_test_network.0.1" . (ethers) ethers EUI-48 EUI-64 . ethers ethers . ethers(5) . ( ) . (:) (-) (.) . . # . MAC EUI-64 . ethers : ff:ff:ff:ff:ff:ff Broadcast c0-00-ff-ff-ff-ff TR_broadcast 00.00.00.00.00.00 Zero_broadcast 00:00:00:00:00:00:00:00 EUI64_zero_broadcast ethers(5) UN*X . ethers /etc UNIX Linux macOS \*BSD Solaris AIX ( C:\Program Files\Wireshark) Windows . ethers . libpcap UNIX Npcap Windows . ethers . (manuf) manuf MAC . ethers : 00:00:0C Cisco Cisco Systems, Inc OUI : 00-00-0C-07-AC/40 All-HSRP-routers MAC . 00-00-0C-07-AC-00 00-00-0C-07-AC-FF . . manuf manuf . Wireshark IEEE manuf . tshark -G manuf . manuf wka . Wireshark MAC IEEE . (services) services . services services . services () . ( tcp udp sctp) / . : mydns 5045/udp # My own Domain Name Server mydns 5045/tcp # My own Domain Name Server Wireshark IANA services . tshark -G services . (ipxnets) ipxnets IPX . ipxnets . ethers . ( IPX ) . ipxnets : C0.A8.2C.00 HR c0-a8-1c-00 CEO 00:00:BE:EF IT_Server1 110f FileServer3 ipxnets /etc UNIX Linux macOS \*BSD Solaris AIX ( C:\Program Files\Wireshark) Windows . ipxnets . (ss7pcs) ss7pcs SS7 . . . : 2-1234 MyPointCode1 (vlans) vlans VLAN . . VLAN . : 123 Server-Lan 2049 HR-Client-LAN ( ) (Color Filters (Coloring Rules)) colorfilters . . : # a comment @tcp@tcp@[59345,58980,65534][0,0,0] @udp@udp@[28834,57427,65533][0,0,0] colorfilters . colorfilters . View:Coloring Rules . colorfilters colorfilters . (Plugins) Wireshark . UNIX Linux macOS \*BSD Solaris AIX lib/wireshark/plugins/ ( lib64 lib) ( /usr/local/lib/wireshark/plugins/). $HOME/.local/lib/wireshark/plugins . macOS Wireshark %APPDIR%/Contents/PlugIns/wireshark . Windows plugins/ ( C:\Program Files\Wireshark\plugins\). %APPDATA%\Wireshark\plugins ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\plugins). Lua (X.Y) . Wireshark (libwireshark libwiretap codecs). libwireshark foo.so ( Windows foo.dll) PLUGINDIR/X.Y/epan (libwireshark libepan codecs wiretap ). UNIX Lua ( ) $XDG_CONFIG_HOME/wireshark/plugins ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/plugins.) . Wireshark . strato UTF-8 . dissector UTF-8 . strato UTF-8 . strato TTY UNIX ( Linux macOS \*BSD Solaris AIX) (locale) UTF-8 . strato (dissection) UTF-16LE . UTF-8 . UTF-8 (chcp 65001) . (ENVIRONMENT VARIABLES) WIRESHARK_CONFIG_DIR . UNIX Linux macOS \*BSD Solaris AIX $XDG_CONFIG_HOME/wireshark ( $HOME/.wireshark $HOME/.wireshark) $HOME/.config/wireshark . %APPDATA%\Wireshark ( %APPDATA% %USERPROFILE%\Application Data\Wireshark). Wireshark 3.0 . WIRESHARK_DEBUG_WMEM_OVERRIDE wmem . . README.wmem . WIRESHARK_RUN_FROM_BUILD_DIRECTORY ( ) . (root setuid) UNIX Linux macOS \*BSD Solaris AIX . WIRESHARK_DATA_DIR . (root setuid) UNIX . WIRESHARK_EXTCAP_DIR extcap . (root setuid) UNIX . WIRESHARK_PLUGIN_DIR . (root setuid) UNIX . ERF_RECORDS_TO_CHECK ERF ERF . (20) . IPFIX_RECORDS_TO_CHECK IPFIX IPFIX . (20) . WIRESHARK_ABORT_ON_DISSECTOR_BUG strato dissector abort(3) . abort(3) strato ( ) core dump . dissector . WIRESHARK_ABORT_ON_TOO_MANY_ITEMS dissector ( dissector ) strato abort(3) . abort(3) strato ( ) core dump . dissector . WIRESHARK_LOG_LEVEL . critical warning message info debug noisy . . critical error . WIRESHARK_LOG_FATAL (log) . (abort) . Error critical warning . Error . WIRESHARK_LOG_DOMAINS . . . . '!' . WIRESHARK_LOG_DEBUG debug. . '!' debug . WIRESHARK_LOG_NOISY noisy . wireshark-filter(4), stratoshark(1), editcap(1), dumpcap(1) (NOTES) strato 0.10.3 . strato Stratoshark . Stratoshark : . HTML Wireshark : . (AUTHORS) strato (dissection) Stratoshark Wireshark Stratoshark Wireshark Wireshark . 2026-09-03 STRATO(1)