WIRESHARK(1) WIRESHARK(1) (NAME) wireshark - (SYNOPSIS) wireshark [ -i < >|- ] [ -f < > ] [ -Y < > ] [ -w < > ] [ ] [ < > ] wireshark -h|--help wireshark -v|--version (DESCRIPTION) Wireshark . . Wireshark pcapng pcap . pcap tcpdump tcpdump libpcap pcapng macOS pcapng . Wireshark / : o snoop atmsnoop Oracle ( Sun) o Surveyor Finisar ( Shomiti) o Network Monitor Microsoft o LANalyzer Novell o iptrace AIX o NetXRay Cinco Networks o Sniffer Windows NETSCOUT ( Network Associates/Network General) o Sniffer DOS Network General/Network Associates ( ) o *Peek/EtherHelp/PacketGrabber LiveAction ( WildPackets/Savvius) o WAN/LAN RADCOM o Observer Viavi ( Network Instruments) o Lucent/Ascend o nettl HP-UX o ISDN Toshiba o i4btrace ISDN4BSD o EyeSDN USB S0 o IPLog Cisco Secure Intrusion Detection System o pppd logs ( pppdump) o TCPIPtrace/TCPtrace/UCX$TRACE VMS o VMS DBS Etherwatch o Visual UpTime Visual Networks o L2 CoSine o (LAN) 5View InfoVista ( Accellent) o ERF Endace Measurement Systems o hcidump -w Linux Bluez o .out Catapult DCT2000 o Gammu Nokia DCT3 Netmonitor o (Comm traces) IBM Series (OS/400) ( ASCII UNICODE) o snoop Juniper Netscreen o btsnoop Symbian OS o TamoSoft CommView o rf5. Tektronix K12xx o Tektronix K12 o Apple PacketLogger o PC108 Aethra Telecommunications o (Trace) Citrix NetScaler o Android Logcat o Colasoft Capsa PacketBuilder o mplog Micropross o AUX Unigraf DPA-400 DisplayPort o 802.15.4 Sensor Network Analyzer Daintree o MPEG-2 ISO/IEC 13818-1 o candump o BUSMASTER o Ixia IxVeriWave o Rabbit Labs CAM Inspector o systemd o 3GPP TS 32.423 Wireshark . Wireshark gzip LZ4 Zstandard . Wireshark '.gz' . Wireshark . . . (hex dump) ( ) . Wireshark . TCP ASCII ( EBCDIC ) . Wireshark Wireshark . Wireshark . pcap . pcap . . zlib ( ). zlib Wireshark . -r . (OPTIONS) Wireshark . . . -a|--autostop Wireshark . test:value test : duration:value value . ( 0.5) . files:value value . filesize:value value . -b Wireshark . 2 231 (2147483648) . packets:value value . -c . -b|--ring-buffer Wireshark << >> . << >> Wireshark . Wireshark . -w outfile_00001_20260714120117.pcap outfile_00002_20260714120523.pcap ... files << >> . Wireshark . files ( ) . key:value key : duration:value value . ( 0.5) . files:value value ( ). . : . files . -b -b . filesize:value value . 2 231 (2147483648) . interval:value value . packets:value value . : -b filesize:1000 -b files:5 . -B|--buffer-size ( ). . (packet drop) . Wireshark . UNIX Linux macOS \*BSD Solaris AIX libpcap 1.0.0 Windows . UNIX libpcap . . -i . -i -i . . -c . -a packets: . -C . --capture-comment -k . . Wireshark . -D|--list-interfaces Wireshark . . -i . Windows GUID . --display X . (otherhost:0.0) (:0.0) . macOS Windows . -f . . -i . -i -i . . Capture->Capture Filters "predef:" . : -f "predef:MyPredefinedHostOnlyFilter" -F -k -w . pcapng . -F . pcapng ( .) Wireshark . . --fullscreen Wireshark ( ). View Full Screen . F11 ( Ctrl + Cmd + F macOS) . -g -r packet number . -h|--help . -H . -i|--interface |- . <> ( ) <> . Wireshark loopback loopback loopback . Wireshark . FIFO ( ) <<->> . Windows <<\\.\pipe\pipename>> . pcapng pcap . pcapng (endianness) . . pcapng . -I|--monitor-mode << >> (monitor mode) Wi-Fi IEEE 802.11 . . . . -i . -i -i . -j -J . . -J -r ( ). . -k . -i . Wireshark loopback loopback loopback Wireshark . -l ( -S ) . -L|--list-data-link-types . --list-time-stamp-types . . --no-optimize libpcap . . . -i . -i -i . -o (preference) (recent) preference/recent . prefname:value prefname preference/recent ( preference/recent ) value . Ethereal 0.10.12 recent -B -P -T (GUI) . prefname "uat" "uat:uat filename:uat record" (UAT) . uat filename UAT user_dlts. uat_record . DLT : -o "uat:user_dlts:\"User 0 (DLT=147)\",\"cops\",\"0\",\"\",\"0\",\"\"" -p|--no-promiscuous-mode (promiscuous mode) . promiscuous -p Wireshark (broadcast) (multicast) . . -i promiscuous . -i -i promiscuous . -P . Wireshark USB. key:path key : persconf:path (preferences). persdata:path . recent . -r|--read-file infile ( ). TShark (named pipes) stdin ! pipe stdin -i - . -R|--read-filter -r ( ) . -s|--snapshot-length (snapshot length) . snaplen . 0 262144 . . -i . -i -i . . -S . --temp-dir ( ) . Linux macOS \*BSD Solaris AIX $TMPDIR /tmp . Windows %TEMP% %USERPROFILE%\AppData\Local\Temp . --time-stamp-type (timestamp) . --list-time-stamp-types . --update-interval . . 100 (100ms) . -v|--version . -w '-' . -X Wireshark . (eXtension) extension_key:value extension_key : lua_script:lua_script_filename Wireshark Lua . lua_scriptnum:argument Wireshark lua 'num' 'lua_script' . '-X lua_script:my.lua' '-X lua_script1:foo' 'foo' 'my.lua' . '-X lua_script:my.lua' '-X lua_script:other.lua' '-X lua_script2:bar' 'bar' lua 'other.lua' . read_format:file_format Wireshark ( -r) . stdin_descr:description Wireshark (-i -) . -y|--linktype -k (data link type) . -L . . -i . -i -i . . -Y|--display-filter . -z Wireshark . : -z help -z. -z afp,srt[,filter] (SRT) Apple Filing Protocol. -z conv,type[,filter] . type : "eth" Ethernet "fc" Fibre Channel "fddi" FDDI "ip" IPv4 "ipv6" IPv6 "ipx" IPX "tcp" TCP/IP IPv4 IPv6 "tr" Token Ring "udp" UDP/IP IPv4 IPv6 filter . / / . . <> . -z dcerpc,srt,name-or-uuid,major.minor[,filter] SRT ( ) / DCERPC name uuid major.minor. MinSRT MaxSRT AvgSRT . (name) uuid . : -z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0 CIFS SAMR . . filter . : -z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4 SRT SAMR . -z dhcp,stat[,filter] DHCP (BOOTP). -z expert (expert information). -z fc,srt[,filter] SRT ( ) / FC. Fibre Channel MinSRT MaxSRT AvgSRT . : -z fc,srt . FC . . filter . : -z "fc,srt,fc.id==01.02.03" FC FC 01.02.03 . -z h225,counter[,filter] ITU-T H.225 . H.225 H.225 . . : -z h225,counter . filter . : -z "h225,counter,ip.addr==1.2.3.4" H.225 IP 1.2.3.4 . -z h225,srt[,filter] SRT ( ) / ITU-T H.225 RAS. ITU-T H.225 RAS (Minimum SRT) (Maximum SRT) (Average SRT) (Minimum in Packet) (Maximum in Packet) . ( ) ( ) . : -z h225,srt . filter . : -z "h225,srt,ip.addr==1.2.3.4" ITU-T H.225 RAS IP 1.2.3.4 . -z io,stat / . . . Analyze:Statistics:Traffic:IO-Stat . -z ldap,srt[,filter] SRT ( ) / LDAP. LDAP MinSRT MaxSRT AvgSRT . : -z ldap,srt . LDAP . . filter . : -z "ldap,srt,ip.addr==10.1.1.1" LDAP IP 10.1.1.1 ..sp LDAP : BIND SEARCH MODIFY ADD DELETE MODRDN COMPARE EXTENDED -z megaco,srt[,filter] SRT ( Service Response Time) / MEGACO. ( -z smb,srt ). MEGACO SRT SRT SRT. : -z megaco,srt . filter . : -z "megaco,srt,ip.addr==1.2.3.4" MEGACO IP 1.2.3.4 . -z mgcp,srt[,filter] SRT ( Service Response Time) / MGCP. ( -z smb,srt ). MGCP SRT SRT SRT. : -z mgcp,srt . filter . : -z "mgcp,srt,ip.addr==1.2.3.4" MGCP IP 1.2.3.4 . -z mtp3,msus[,] MSU MTP3. -z multicast,stat[,] (multicast) UDP. -z rpc,programs SRT / / ONC-RPC. / MinSRT MaxSRT AvgSRT. -z rpc,srt,name-or-number,version[,] SRT ( Service Response Time) / name/version number/version. MinSRT MaxSRT AvgSRT. (name) . : -z rpc,srt,100003,3 NFS v3 . . filter . : -z rpc,srt,nfs,3,nfs.fh.hash==0x12345678 SRT NFS v3 . -z scsi,srt,cmdset[,] SRT ( Service Response Time) / SCSI . 0:SBC 1:SSC 5:MMC MinSRT MaxSRT AvgSRT. : -z scsi,srt,0 (SCSI BLOCK COMMANDS SBC) . . filter . : -z scsi,srt,0,ip.addr==1.2.3.4 SRT SCSI SBC iscsi/ifcp/fcip . -z sip,stat[,filter] SIP . SIP SIP . SIP ( SIP UDP) . : -z sip,stat . filter . : -z "sip,stat,ip.addr==1.2.3.4" SIP IP 1.2.3.4 . -z smb,srt[,filter] SRT ( Service Response Time) / SMB. SMB MinSRT MaxSRT AvgSRT. : -z smb,srt SMB Transaction2 NT Transaction . . xAndX . SessionSetupAndX + TreeConnectAndX SessionSetupAndX . . . filter . : -z "smb,srt,ip.addr==1.2.3.4" SMB IP 1.2.3.4 . -z voip,calls VoIP . Statistics VoIP Calls . : -z voip,calls -z wlan,stat[,] IEEE 802.11. -z wsp,stat[,] WSP. -d ==, Decode As... Wireshark . ( tcp.port udp.port TCP UDP) . . Decode As Port -d tcp.port==8888,http TCP 8888 HTTP . tshark(1) . --disable-all-protocols . --disable-protocol [,,...] proto_name. ALL proto_name . --disable-heuristic (heuristic). --enable-protocol [,,...] proto_name. ALL proto_name . --disable-protocol --enable-protocol . . : --disable-protocol ALL --enable-protocol eth,ip --enable-heuristic (heuristic). -K Kerberos keytab . . : -K krb5.keytab -n ( TCP UDP) -N . -N . ( -n) . -n (preferences) -o . -N -n -N dmN . : d DNS g IP MaxMind m MAC n N ( DNS) n . s SNI (handshake) t v VLAN --only-protocols . . -t (a|ad|adoy|d|dd|e|r|rc|u|ud|udoy)[.[N]]|.[N] (timestamp) . : a : ad : YYYY-MM-DD adoy : YYYY/DOY d : dd (delta_displayed): e (epoch): (Jan 1, 1970 00:00:00) r : rc : u UTC: UTC "Z" ud UTC : YYYY-MM-DD UTC "Z" udoy UTC : YYYY/DOY UTC "Z" .[N] : N ( ). "." N (trace) . . -u -t ( relative delta delta_displayed) . : s hms . --log-level (log level). <> <> <> <> <> <> <>. <> <> <> <> <> . . --log-fatal . <> <> <> <> (abort) . --log-fatal-count (fatal) . --log-domains (log domains) "GUI,Epan,sshdump". . <> ( ). --log-debug <>. . <> ( ). --log-noisy <>. . <> ( ). --log-fatal-domains . . --log-file stderr . (INTERFACE) Wireshark (Wireshark User's Guide) . Wireshark . F1 . (CAPTURE FILTER SYNTAX) pcap-filter(7) tcpdump(8) . (DISPLAY FILTER SYNTAX) Wireshark wireshark-filter(4) . (FILES) Wireshark . (Preferences) preferences ( ) . . . : -o ( ) . prefname:value prefname value (white space) : value . . # : # Vertical scrollbars should be on right side? # TRUE or FALSE (case-insensitive). gui.scrollbar_on_right: TRUE wireshark share . macOS /Application/Wireshark.app/Contents/Resources/share UNIX Linux \*BSD Solaris AIX /usr/share/wireshark/preferences /usr/local/share/wireshark/preferences Windows C:\Program Files\Wireshark\preferences . UNIX $XDG_CONFIG_HOME/wireshark/preferences ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/preferences) $HOME/.config/wireshark/preferences . Windows %APPDATA%\Wireshark\preferences ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\preferences) . : Save Edit:Preferences / . (Recent) recent ( - GUI) Wireshark . . : -o . preferences . : Wireshark recent / . () (Disabled (Enabled) Protocols) disabled_protos (dissectors) . : http tcp # a comment disabled_protos . Analyze::Enabled Protocols . disabled_protos . disabled_protos . disabled_protos ( postdissector) . enabled_protos . : Save Analyze:Enabled Protocols . (Heuristic Dissectors) heuristic_protos (heuristic dissectors) . 0 1 :.sp quic,1 rtcp_stun,1 rtcp_udp,1 rtp_stun,0 rtp_udp,0 tls_tcp,1 heuristic_protos . heuristic_protos . (hosts) hosts IPv4 IPv6 . hosts IP (whitespace) . hosts . (capture filter) libpcap UNIX Linux macOS \*BSD Solaris AIX Npcap Windows . hosts Wireshark . (subnets) IPv4 ( ) subnets . subnets subnets . IPv4 / . IPv4 . : # Comments must be prepended by the # sign! 192.168.0.0/24 ws_test_network "subnet-name.remaining-address" . "192.168.0.1" "ws_test_network.1" 24 16 "ws_test_network.0.1" . (ethers) ethers EUI-48 EUI-64 . ethers ethers . ethers(5) . ( ) . (:) (-) (.) . . # . MAC EUI-64 . ethers : ff:ff:ff:ff:ff:ff Broadcast c0-00-ff-ff-ff-ff TR_broadcast 00.00.00.00.00.00 Zero_broadcast 00:00:00:00:00:00:00:00 EUI64_zero_broadcast ethers(5) UN*X . ethers UNIX Linux macOS \*BSD Solaris AIX /etc Windows ( C:\Program Files\Wireshark) . ethers . libpcap UNIX Npcap Windows . ethers Wireshark . (manuf) manuf (vendor) MAC (netmask) . ethers : 00:00:0C Cisco Cisco Systems, Inc OUI : 00-00-0C-07-AC/40 All-HSRP-routers MAC . 00-00-0C-07-AC-00 00-00-0C-07-AC-FF . . manuf manuf . Wireshark IEEE Registration Authority manuf . tshark -G manuf . manuf wka . Wireshark MAC IEEE . (services) services . services services . services () . ( tcp udp sctp) / . : mydns 5045/udp # My own Domain Name Server mydns 5045/tcp # My own Domain Name Server Wireshark IANA Registry services . tshark -G services . (ipxnets) ipxnets IPX . ipxnets ..sp ethers . IPX . ipxnets : C0.A8.2C.00 HR c0-a8-1c-00 CEO 00:00:BE:EF IT_Server1 110f FileServer3 ipxnets UNIX Linux macOS \*BSD Solaris AIX /etc Windows ( C:\Program Files\Wireshark) . ipxnets . (ss7pcs) ss7pcs point code SS7 . . point code . : 2-1234 MyPointCode1 (vlans) vlans VLAN . . VLAN . : 123 Server-Lan 2049 HR-Client-LAN (Capture Filters) cfilters . : "HTTP" port 80 "DCERPC" port 135 cfilters . cfilters . Capture:Capture Filters . cfilters cfilters . (Display Filters) dfilters . : "HTTP" http "DCERPC" dcerpc dfilters . dfilters . Analyze:Display Filters . dfilters dfilters . (Display Filter Macros) dmacros . : "private_ipv6" ipv6 && $1 == fc00::/7 "private_ethernet" $1[0] & 0x0F == 2 "private_ipv4" $1 == 192.168.0.0/16 or $1 == 172.16.0.0/12 or $1 == 10.0.0.0/8 dmacros . dmacros . Analyze:Display Filter Macros . dmacros dmacros . Wireshark 4.4 dfilter_macros . dmacros . (Color Filters (Coloring Rules)) colorfilters . . : # a comment @tcp@tcp@[59345,58980,65534][0,0,0] @udp@udp@[28834,57427,65533][0,0,0] colorfilters . colorfilters . View:Coloring Rules . colorfilters colorfilters . Wireshark . UNIX Linux macOS \*BSD Solaris AIX lib/wireshark/plugins/ ( lib64 lib ) ( /usr/local/lib/wireshark/plugins/). $HOME/.local/lib/wireshark/plugins . macOS Wireshark (application bundle) %APPDIR%/Contents/PlugIns/wireshark . Windows plugins/ ( C:\Program Files\Wireshark\plugins\). %APPDATA%\Wireshark\plugins ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\plugins). Lua (minor version) Wireshark (X.Y) . Wireshark (libwireshark libwiretap codecs). libwireshark foo.so ( foo.dll) PLUGINDIR/X.Y/epan (libwireshark libepan codecs wiretap ). UNIX Lua ( ) $XDG_CONFIG_HOME/wireshark/plugins ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/plugins). (dissector) dissector . dissector Wireshark . (ENVIRONMENT VARIABLES) WIRESHARK_CONFIG_DIR . UNIX Linux macOS \*BSD Solaris AIX $XDG_CONFIG_HOME/wireshark ( $HOME/.wireshark $HOME/.wireshark) $HOME/.config/wireshark . Windows %APPDATA%\Wireshark ( %APPDATA% %USERPROFILE%\Application Data\Wireshark). Wireshark 3.0 . WIRESHARK_DEBUG_WMEM_OVERRIDE wmem backend backend all . . README.wmem . WIRESHARK_RUN_FROM_BUILD_DIRECTORY ( ) . root ( setuid) UNIX Linux macOS \*BSD Solaris AIX . WIRESHARK_DATA_DIR . root ( setuid) UNIX . WIRESHARK_EXTCAP_DIR extcap . root ( setuid) UNIX . WIRESHARK_PLUGIN_DIR . root ( setuid) UNIX . ERF_RECORDS_TO_CHECK ERF ERF . (20) . IPFIX_RECORDS_TO_CHECK IPFIX IPFIX . (20) . WIRESHARK_ABORT_ON_DISSECTOR_BUG Wireshark dissector abort(3) . abort(3) Wireshark (debugger) ( ) core dump . dissector . WIRESHARK_ABORT_ON_TOO_MANY_ITEMS dissector ( dissector ) Wireshark abort(3) . abort(3) Wireshark ( ) core dump . dissector . WIRESHARK_QUIT_AFTER_CAPTURE Wireshark (capture) . -k . -c -a duration:... . . WIRESHARK_LOG_LEVEL . : critical warning message info debug noisy. . critical error . WIRESHARK_LOG_FATAL (fatal) . (abort) . Error critical warning . Error . WIRESHARK_LOG_DOMAINS . . . . '!' . WIRESHARK_LOG_DEBUG debug. . '!' debug . WIRESHARK_LOG_NOISY noisy. (AUTHORS) Wireshark . AUTHORS Wireshark . (SEE ALSO) wireshark-filter(4), tshark(1), editcap(1), pcap(3), dumpcap(1), mergecap(1), text2pcap(1), pcap-filter(7) tcpdump(8) (NOTES) Wireshark 4.7.3 . Wireshark : . HTML Wireshark : . Wireshark : . 2026-09-03 WIRESHARK(1)