STRATOSHARK(1) STRATOSHARK(1) (NAME) stratoshark - (SYNOPSIS) stratoshark [ -i |- ] [ -f ] [ -Y ] [ -w ] [ options ] [ ] stratoshark -h|--help stratoshark -v|--version (DESCRIPTION) Stratoshark (GUI) (system calls) . . Stratoshark scap sysdig Falco . Stratoshark (event) . . . (hex dump) . Stratoshark . (file descriptor) ASCII ( EBCDIC ) . Stratoshark Stratoshark . Stratoshark . libscap libsinsp . libscap . . zlib ( ). zlib Stratoshark . -r . (OPTIONS) Stratoshark . . . -a|--autostop Stratoshark . test:value test : duration:value value . ( 0.5) . files:value value . filesize:value value (kB). -b Stratoshark . 2 2^31 (2147483648) . events:value value . -c . -b|--ring-buffer Stratoshark << >> (multiple files) . Stratoshark . Stratoshark . -w outfile_00001_20260714120117.pcap outfile_00002_20260714120523.pcap ... files << >> (ring buffer) . Stratoshark . files ( ) . key:value key : duration:value value . ( 0.5) . files:value value ( ). . : . files . -b -b . filesize:value value . 2^31 (2147483648) . interval:value value . events:value value . : -b filesize:1000 -b files:5 . -c . -a events: . -C (configuration profile) . --capture-comment -k (comment) . . Stratoshark . -D|--list-sources Stratoshark . . -i . --display X ( X) . (otherhost:0.0) (:0.0) . macOS Windows . -f . . -i . -i -i . . Capture->Capture Filters "predef:" . : -f "predef:MyPredefinedHostOnlyFilter" --fullscreen Stratoshark ( ). View Full Screen . F11 ( Ctrl + Cmd + F macOS) . -g -r event number . -h|--help . -H . -i|--source |- . "stratoshark -D" ( ) . Stratoshark . Stratoshark . FIFO ( ) "-" . Windows "\\.\pipe\pipename" . scap . scap (endianness) . . -j -J . . -J -r ( ). . -k . -i . Stratoshark . Stratoshark . -l ( -S ) . -L|--list-data-link-types (data link types) . --list-time-stamp-types (time stamp types) . . -o preference/recent . prefname:value prefname preference/recent ( preference/recent ) value . prefname "uat" "uat:uat filename:uat record" . uat filename UAT user_dlts. uat_record . DLT : -o "uat:user_dlts:\"User 0 (DLT=147)\",\"cops\",\"0\",\"\",\"0\",\"\"" -P . Stratoshark USB. key:path key : persconf:path (preferences). persdata:path . recent . -r|--read-file infile ( ) . TShark stdin ! stdin -i - . -R|--read-filter -r ( ) . -S . --temp-dir ( ) . UNIX Linux macOS \*BSD Solaris AIX $TMPDIR /tmp . Windows %TEMP% %USERPROFILE%\AppData\Local\Temp . --time-stamp-type . --list-time-stamp-types . --update-interval . . 100ms . -v|--version . -w '-' . -X Stratoshark. (eXtension) extension_key:value extension_key : lua_script:lua_script_filename Stratoshark Lua . lua_scriptnum:argument Stratoshark Lua 'num' 'lua_script' . '-X lua_script:my.lua' '-X lua_script1:foo' 'foo' 'my.lua' . '-X lua_script:my.lua' '-X lua_script:other.lua' '-X lua_script2:bar' 'bar' Lua 'other.lua' . stdin_descr:description Stratoshark (-i -) . -Y|--display-filter (display filter) . -z Stratoshark (semi-real time) . : -z help -z. (DISSECTION OPTIONS) -d ==, Decode As... Wireshark . ( tcp.port udp.port TCP UDP) (selector) . . (Decode As Port) -d tcp.port==8888,http TCP 8888 HTTP . tshark(1) . --disable-all-protocols . --disable-protocol [,,...] proto_name. ALL proto_name . --disable-heuristic (heuristic). --enable-protocol [,,...] proto_name. ALL proto_name . --disable-protocol --enable-protocol . . : --disable-protocol ALL --enable-protocol eth,ip --enable-heuristic (heuristic). -K kerberos keytab . . : -K krb5.keytab -n ( TCP UDP) -N . -N . ( -n) . -n (preferences) -o . -N -n -N dmN . : d DNS g IP MaxMind m MAC n N ( DNS) n . s SNI (handshake) t v VLAN --only-protocols . . -t (a|ad|adoy|d|dd|e|r|rc|u|ud|udoy)[.[N]]|.[N] (timestamp) . : a (absolute): ad (absolute with date): YYYY-MM-DD adoy (absolute with date using day of year): YYYY/DOY d (delta): dd (delta_displayed): delta_displayed .sp e epoch: epoch (Jan 1, 1970 00:00:00) r relative: rc relative to capture start: u UTC: UTC "Z" ud UTC with date: YYYY-MM-DD UTC "Z" udoy UTC with date using day of year: YYYY/DOY UTC "Z" .[N] : N ( ) . "." N (trace) . . -u -t ( relative delta delta_displayed) . : s hms . (DIAGNOSTIC OPTIONS) --log-level . : "noisy" "debug" "info" "message" "warning" "critical" "error". "warning" "warning" "critical" "error" "noisy" . . --log-fatal (abort) . "warning" "warning" "critical" "error" . --log-fatal-count (fatal) . --log-domains "GUI,Epan,sshdump". . "!" ( ). --log-debug "debug" . . "!" ( ). --log-noisy "noisy" . . "!" ( ). --log-fatal-domains . . --log-file stderr . Wireshark . (Preferences) preferences ( ) . . . : -o ( ) . prefname:value prefname value (white space) : value . . # () : # Vertical scrollbars should be on right side? # TRUE or FALSE (case-insensitive). gui.scrollbar_on_right: TRUE wireshark share . macOS /Application/Wireshark.app/Contents/Resources/share UNIX Linux \*BSD Solaris AIX /usr/share/wireshark/preferences /usr/local/share/wireshark/preferences Windows C:\Program Files\Wireshark\preferences . UNIX $XDG_CONFIG_HOME/wireshark/preferences ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/preferences) $HOME/.config/wireshark/preferences . Windows %APPDATA%\Wireshark\preferences ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\preferences). : Save Edit:Preferences / . (Recent) recent ( ) Wireshark . . : -o . preferences . : Wireshark recent / . () (Disabled (Enabled) Protocols) disabled_protos (dissectors) . (display filter) : http tcp # a comment disabled_protos . Analyze::Enabled Protocols . disabled_protos . disabled_protos . disabled_protos ( postdissector) . enabled_protos . : Save Analyze:Enabled Protocols . (Heuristic Dissectors) heuristic_protos (heuristic dissectors) . 0 1 : quic,1 rtcp_stun,1 rtcp_udp,1 rtp_stun,0 rtp_udp,0 tls_tcp,1 heuristic_protos . heuristic_protos . (hosts) hosts IPv4 IPv6 . (syntax) hosts IP . hosts . libpcap UNIX Linux macOS \*BSD Solaris AIX Npcap Windows . hosts Wireshark . (subnets) IPv4 ( ) subnets . subnets subnets . IPv4 / . IPv4 . : # Comments must be prepended by the # sign! 192.168.0.0/24 ws_test_network "subnet-name.remaining-address" . "192.168.0.1" "ws_test_network.1" 24 16 "ws_test_network.0.1" . (ethers) ethers - EUI-48 - EUI-64 . ethers ethers . ethers(5) . ( ) . (:) (-) (.) . . # . - MAC - EUI-64 . ethers : ff:ff:ff:ff:ff:ff Broadcast c0-00-ff-ff-ff-ff TR_broadcast 00.00.00.00.00.00 Zero_broadcast 00:00:00:00:00:00:00:00 EUI64_zero_broadcast ethers(5) UN*X . ethers /etc Linux macOS \*BSD Solaris AIX ( C:\Program Files\Wireshark) Windows . ethers (preferences) . libpcap Npcap Windows . ethers Wireshark . (manuf) manuf - - MAC netmask . ethers : 00:00:0C Cisco Cisco Systems, Inc OUI : 00-00-0C-07-AC/40 All-HSRP-routers MAC . ( ) 00-00-0C-07-AC-00 00-00-0C-07-AC-FF . . manuf manuf . Wireshark IEEE manuf . tshark -G manuf . manuf wka . Wireshark MAC IEEE . (services) services . services services . services () . ( tcp udp sctp) / . : mydns 5045/udp # My own Domain Name Server mydns 5045/tcp # My own Domain Name Server Wireshark IANA services . tshark -G services . (ipxnets) ipxnets - IPX . ipxnets . ethers . IPX . ipxnets : C0.A8.2C.00 HR c0-a8-1c-00 CEO 00:00:BE:EF IT_Server1 110f FileServer3 ipxnets /etc Linux macOS \*BSD Solaris AIX ( C:\Program Files\Wireshark) Windows . ipxnets . (ss7pcs) ss7pcs point code SS7 . . point code . : 2-1234 MyPointCode1 (vlans) vlans VLAN ( VLAN tag ID) . . VLAN . : 123 Server-Lan 2049 HR-Client-LAN cfilters . : "HTTP" port 80 "DCERPC" port 135 cfilters . cfilters . Capture:Capture Filters . cfilters cfilters . dfilters . : "HTTP" http "DCERPC" dcerpc dfilters . dfilters . Analyze:Display Filters . dfilters dfilters . dmacros . : "private_ipv6" ipv6 && $1 == fc00::/7 "private_ethernet" $1[0] & 0x0F == 2 "private_ipv4" $1 == 192.168.0.0/16 or $1 == 172.16.0.0/12 or $1 == 10.0.0.0/8 dmacros . dmacros . Analyze:Display Filter Macros . dmacros dmacros . Wireshark 4.4 dfilter_macros . dmacros . ( ) colorfilters . . : # a comment @tcp@tcp@[59345,58980,65534][0,0,0] @udp@udp@[28834,57427,65533][0,0,0] colorfilters . colorfilters . View:Coloring Rules . colorfilters colorfilters . Wireshark . UNIX Linux macOS \*BSD Solaris AIX lib/wireshark/plugins/ ( lib64 lib ) ( /usr/local/lib/wireshark/plugins/). $HOME/.local/lib/wireshark/plugins . macOS Wireshark %APPDIR%/Contents/PlugIns/wireshark . Windows plugins/ ( C:\Program Files\Wireshark\plugins\). %APPDATA%\Wireshark\plugins ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\plugins). Lua Wireshark (X.Y) . Wireshark (libwireshark libwiretap codecs). libwireshark foo.so (foo.dll Windows) PLUGINDIR/X.Y/epan (libwireshark libepan codecs wiretap ). UNIX Lua ( ) $XDG_CONFIG_HOME/wireshark/plugins ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/plugins.) dissector dissector . dissector Wireshark . WIRESHARK_CONFIG_DIR . UNIX Linux macOS \*BSD Solaris AIX $XDG_CONFIG_HOME/wireshark ( $HOME/.wireshark $HOME/.wireshark) $HOME/.config/wireshark . Windows %APPDATA%\Wireshark ( %APPDATA% %USERPROFILE%\Application Data\Wireshark). Wireshark 3.0 . WIRESHARK_DEBUG_WMEM_OVERRIDE wmem (backend) backend all . . README.wmem . WIRESHARK_RUN_FROM_BUILD_DIRECTORY ( ) . root ( setuid) UNIX Linux macOS \*BSD Solaris AIX . WIRESHARK_DATA_DIR . root ( setuid) UNIX . WIRESHARK_EXTCAP_DIR extcap . root ( setuid) UNIX . WIRESHARK_PLUGIN_DIR . root ( setuid) UNIX . WIRESHARK_ABORT_ON_DISSECTOR_BUG Stratoshark dissector abort(3) . abort(3) Stratoshark (debugger) ( ) core dump . dissector . WIRESHARK_ABORT_ON_TOO_MANY_ITEMS dissector ( dissector ) Stratoshark abort(3) . abort(3) Stratoshark ( ) core dump . dissector . WIRESHARK_QUIT_AFTER_CAPTURE Stratoshark (capture) . -k . -c -a duration:.... . WIRESHARK_LOG_LEVEL (verbosity) . critical warning message info debug noisy . . critical error . WIRESHARK_LOG_FATAL (fatal) . (abort) . Error critical warning . Error . WIRESHARK_LOG_DOMAINS . . . . '!' . WIRESHARK_LOG_DEBUG debug. . '!' debug . WIRESHARK_LOG_NOISY noisy. Stratoshark . AUTHORS Wireshark . (SEE ALSO) wireshark-filter(4), strato(1), editcap(1), dumpcap(1), mergecap(1) (NOTES) Stratoshark 0.10.3 . Stratoshark : . HTML Wireshark : . 2026-09-03 STRATOSHARK(1)