TETHEREAL(1)

NAME
Tethereal - Dump and analyze network traffic

SYNOPSYS
tethereal [ -c count ] [ -f capture filter expression ] [ -F file format ] [ -h ] [ -i interface ] [ -l ] [ -n ] [ -o preference setting ] ... [ -p ] [ -r infile ] [ -R display filter expression ] [ -s snaplen ] [ -t time stamp format ] [ -v ] [ -V ] [ -w savefile ] [ -x ] [ filter expression ]

DESCRIPTION
Tethereal is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. Tethereal knows how to read libpcap capture files, including those of tcpdump. In addition, Tethereal can read capture files from snoop (including Shomiti) and atmsnoop, LanAlyzer, Sniffer (compressed or uncompressed), Microsoft Network Monitor, AIX's iptrace, NetXray, Sniffer Pro, RADCOM's WAN/LAN analyzer, Lucent/Ascend router debug output, HP-UX's nettl, the dump output from Toshiba's ISDN routers, the output from i4btrace from the ISDN4BSD project, and output in IPLog format from the Cisco Secure Intrusion Detection System. There is no need to tell Tethereal what type of file you are reading; it will determine the file type by itself. Tethereal is also capable of reading any of these file formats if they are compressed using gzip. Tethereal recognizes this directly from the file; the '.gz' extension is not required for this purpose.

If the -w flag is not specified, Tethereal prints a decoded form of the packets it captures or reads; otherwise, it writes those packets to the file specified by that flag.

When printing a decoded form of packets, Tethereal prints, by default, a summary line containing the fields specified by the preferences file (which are also the fields displayed in the packet list pane in Ethereal), although if it's printing packets as it captures them, rather than printing packets from a saved capture file, it won't print the "frame number" field. If the -V flag is specified, it prints intead a protocol tree, showing all the fields of all protocols in the packet.

When writing packets to a file, Tethereal, by default, writes the file in libpcap format, and writes all of the packets it sees to the output file. The -F flag can be used to specify the format in which to write the file; it can write the file in libpcap format (standard libpcap format, a modified format used by some patched versions of libpcap, or the format used by Red Hat Linux 6.1), snoop format, uncompressed Sniffer format, Microsoft Network Monitor 1.x format, and the format used by Windows-based versions of the Sniffer software.

Read filters in Tethereal, which allow you to select which packets are to be decoded or written to a file, are very powerful; more fields are filterable in Tethereal than in other protocol analyzers, and the syntax you can use to create your filters is richer. As Tethereal progresses, expect more and more protocol fields to be allowed in read filters.

Packet capturing is performed with the pcap library. The capture filter syntax follows the rules of the pcap library. This syntax is different from the read filter syntax. A read filter can also be specified when capturing, and only packets that pass the read filter will be displayed or saved to the output file; note, however, that capture filers are much more efficient than read filters, and it may be more difficult for Tethereal to keep up with a busy network if a read filter is specified for a live capture.

Compressed file support uses (and therefore requires) the zlib library. If the zlib library is not present, Tethereal will compile, but will be unable to read compressed files.

A capture or read filter can either be specified with the -f or -R option, respectively, in which case the entire filter expression must be specified as a single argument (which means that if it contains spaces, it must be quoted), or can be specified with command-line arguments after the option arguments, in which case all the arguments after the filter arguments are treated as a filter expression. If the filter is specified with command-line arguments after the option arguments, it's a capture filter if a capture is being done (i.e., if no -r flag was specified) and a read filter if a capture file is being read (i.e., if a -r flag was specified).

OPTIONS

-c  Sets the default number of packets to read when capturing live data.

-f  Sets the capture filter expression.

-F  Sets the file format of the output capture file.

-h  Prints the version and options and exits.

-i  Sets the name of the network interface to use for live packet capture. It should match one of the names listed in "netstat -i" or "ifconfig -a". If no interface is specified, Tethereal searches the list of interfaces, choosing the first non-loopback interface if there are any non-loopback interfaces, and choosing the first loopback interface if there are no non-loopback interfaces; if there are no interfaces, Tethereal reports an error and doesn't start the capture.

-l  Flush the standard output after the information for each packet is printed. (This is not, strictly speaking, line-buffered if -V was specified; however, it is the same as line-buffered if -V wasn't specified, as only one line is printed for each packet, and, as -l is normally used when piping a live capture to a program or script, so that output for a packet shows up as soon as the packet is seen and dissected, it should work just as well as true line-buffering. We do this as a workaround for a deficiency in the Microsoft Visual C++ C library.)

    This may be useful when piping the output of Tethereal to another program, as it means that the program to which the output is piped will see the dissected data for a packet as soon as Tethereal sees the packet and generates that output, rather than seeing it only when the standard output buffer containing that data fills up.

-n  Disables network object name resolution (such as hostname, TCP and UDP port names).

-o  Sets a preference value, overriding the default value and any value read from a preference file. The argument to the flag is a string of the form prefname:value, where prefname is the name of the preference (which is the same name that would appear in the preference file), and value is the value to which it should be set.

-p  Don't put the interface into promiscuous mode. Note that the interface might be in promiscuous mode for some other reason; hence, -p cannot be used to ensure that the only traffic that is captured is traffic sent to or from the machine on which Tethereal is running, broadcast traffic, and multicast traffic to addresses received by that machine.

-r  Reads packet data from file.

-R  Causes the specified filter (which uses the syntax of read filters, rather than that of capture filters) to be applied before printing a decoded form of packets or writing packets to a file; packets not matching the filter are discarded rather than being printed or written.

-s  Sets the default snapshot length to use when capturing live data. No more than snaplen bytes of each network packet will be read into memory, or saved to disk.

-t  Sets the format of the packet timestamp printed in summary lines. The format can be one of 'r' (relative), 'a' (absolute), 'ad' (absolute with date), or 'd' (delta). The relative time is the time elapsed between the first packet and the current packet. The absolute time is the actual time the packet was captured, with no date displayed; the absolute date and time is the actual time and date the packet was captured. The delta time is the time since the previous packet was captured. The default is relative.

-v  Prints the version and exits.

-V  Causes Tethereal to print a protocol tree for each packet rather than a one-line summary of the packet.

-w  Writes packet data to savefile.

-x  Causes Tethereal to print a hex and ASCII dump of the packet data after printing the summary or protocol tree.

CAPTURE FILTER SYNTAX
See manual page of tcpdump(8).

READ FILTER SYNTAX
Read filters help you remove the noise from a packet trace and let you see only the packets that interest you. If a packet meets the requirements expressed in your read filter, then it is printed. Read filters let you compare the fields within a protocol against a specific value, compare fields against fields, and to check the existence of specified fields or protocols.

The simplest read filter allows you to check for the existence of a protocol or field. If you want to see all packets which contain the IPX protocol, the filter would be "ipx". (Without the quotation marks) To see all packets that contain a Token-Ring RIF field, use "tr.rif".

Fields can also be compared against values. The comparison operators can be expressed either through C-like symbols, or through English-like abbreviations:

    eq, ==    Equal
    ne, !=    Not equal
    gt, >     Greater than
    lt, <     Less Than
    ge, >=    Greater than or Equal to
    le, <=    Less than or Equal to
Furthermore, each protocol field is typed. The types are:

    Unsigned integer (either 8-bit, 16-bit, 24-bit, or 32-bit)
    Signed integer (either 8-bit, 16-bit, 24-bit, or 32-bit)
    Boolean
    Ethernet address (6 bytes)
    Byte string (n-number of bytes)
    IPv4 address
    IPv6 address
    IPX network number
    String (text)
    Double-precision floating point number
An integer may be expressed in decimal, octal, or hexadecimal notation. The following three read filters are equivalent:

    frame.pkt_len > 10
    frame.pkt_len > 012
    frame.pkt_len > 0xa
Boolean values are either true or false. In a read filter expression testing the value of a Boolean field, "true" is expressed as 1 or any other non-zero value, and "false" is expressed as zero. For example, a token-ring packet's source route field is boolean. To find any source-routed packets, a read filter would be:

    tr.sr == 1
Non source-routed packets can be found with:

    tr.sr == 0
Ethernet addresses, as well as a string of bytes, are represented in hex digits. The hex digits may be separated by colons, periods, or hyphens:

    fddi.dst eq ff:ff:ff:ff:ff:ff
    ipx.srcnode == 0.0.0.0.0.1
    eth.src == aa-aa-aa-aa-aa-aa
If a string of bytes contains only one byte, then it is represented as an unsigned integer. That is, if you are testing for hex value 'ff' in a one-byte byte-string, you must compare it agains '0xff' and not 'ff'.

IPv4 addresses can be represented in either dotted decimal notation, or by using the hostname:

    ip.dst eq www.mit.edu
    ip.src == 192.168.1.1
IPv4 address can be compared with the same logical relations as numbers: eq, ne, gt, ge, lt, and le. The IPv4 address is stored in host order, so you do not have to worry about how the endianness of an IPv4 address when using it in a read filter.

Classless InterDomain Routing (CIDR) notation can be used to test if an IPv4 address is in a certain subnet. For example, this read filter will find all packets in the 129.111 Class-B network:

    ip.addr == 129.111.0.0/16
Remember, the number after the slash represents the number of bits used to represent the network. CIDR notation can also be used with hostnames, in this example of finding IP addresses on the same Class C network as 'sneezy':

    ip.addr eq sneezy/24
The CIDR notation can only be used on IP addresses or hostnames, not in variable names. So, a read filter like "ip.src/24 == ip.dst/24" is not valid. (yet)

IPX networks are represented by unsigned 32-bit integers. Most likely you will be using hexadecimal when testing for IPX network values:

    ipx.srcnet == 0xc0a82c00
A substring operator also exists. You can check the substring (byte-string) of any protocol or field. For example, you can filter on the vendor portion of an ethernet address (the first three bytes) like this:

    eth.src[0:3] == 00:00:83
Or more simply, since the number of bytes is inherent in the byte-string you provide, you can provide just the offset. The previous example can be stated like this:

    eth.src[0] == 00:00:83
In fact, the only time you need to explicitly provide a length is when you don't provide a byte-string, and are comparing fields against fields:

    fddi.src[0:3] == fddi.dst[0:3]
If the length of your byte-string is only one byte, then it must be represented in the same way as an unsigned 8-bit integer:

    llc[3] == 0xaa
You can use the substring operator on a protocol name, too. And remember, the "frame" protocol encompasses the entire packet, allowing you to look at the nth byte of a packet regardless of its frame type (Ethernet, token-ring, etc.).

    token[0:5] ne 0.0.0.1.1
    ipx[0:2] == ff:ff
    llc[3:1] eq 0xaa
Offsets for byte-strings can also be negative, in which case the negative number indicates the number of bytes from the end of the field or protocol that you are testing. Here's how to check the last 4 bytes of a frame:

    frame[-4] == 0.1.2.3
or

    frame[-4:4] == 0.1.2.3
All the above tests can be combined together with logical expressions. These too are expressable in C-like syntax or with English-like abbreviations:

    and, &&   Logical AND
    or, ||    Logical OR
    xor, ^^   Logical XOR
    not, !    Logical NOT
Expressions can be grouped by parentheses as well. The following are all valid read filter expression:

    tcp.port == 80 and ip.src == 192.168.2.1
    not llc
    (ipx.srcnet == 0xbad && ipx.srnode == 0.0.0.0.0.1) || ip
    tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29
A special caveat must be given regarding fields that occur more than once per packet. "ip.addr" occurs twice per IP packet, once for the source address, and once for the destination address. Likewise, tr.rif.ring fields can occur more than once per packet. The following two expressions are not equivalent:

        ip.addr ne 192.168.4.1
    not ip.addr eq 192.168.4.1
The first filter says "show me all packets where an ip.addr exists that does not equal 192.168.4.1". That is, as long as one ip.addr in the packet does not equal 192.168.44.1, the packet passes the display filter. The second filter "don't show me any packets that have at least one ip.addr field equal to 192.168.4.1". If one ip.addr is 192.168.4.1, the packet does not pass. If neither ip.addr fields is 192.168.4.1, then the packet passes.

It is easy to think of the 'ne' and 'eq' operators as having an implict "exists" modifier when dealing with multiply-recurring fields. "ip.addr ne 192.168.4.1" can be thought of as "there exists an ip.addr that does not equal 192.168.4.1".

Be careful with multiply-recurring fields; they can be confusing.

The following is a table of protocol and protocol fields that are filterable in Tethereal. The abbreviation of the protocol or field is given. This abbreviation is what you use in the read filter. The type of the field is also given.

  802.1q Virtual LAN (vlan)

    vlan.cfi  CFI
        Unsigned 16-bit integer
    vlan.etype  Type
        Unsigned 16-bit integer
    vlan.id  ID
        Unsigned 16-bit integer
    vlan.len  Length
        Unsigned 16-bit integer
    vlan.priority  Priority
        Unsigned 16-bit integer
    vlan.trailer  Trailer
        Byte array

  AOL Instant Messenger (aim)

    aim.channel  Channel ID
        Unsigned 8-bit integer
    aim.cmd_start  Command Start
        Unsigned 8-bit integer
    aim.datalen  Data Field Length
        Unsigned 16-bit integer
    aim.fnac.family  FNAC Family ID
        Unsigned 16-bit integer
    aim.fnac.subtype  FNAC Subtype ID
        Unsigned 16-bit integer
    aim.seqno  Sequence Number
        Unsigned 16-bit integer

  ATM (atm)

    atm.vci  VCI
        Unsigned 16-bit integer
    atm.vpi  VPI
        Unsigned 8-bit integer

  ATM LAN Emulation (lane)

  Address Resolution Protocol (arp)

    arp.dst.atm_num_e164  Target ATM number (E.164)
        String
    arp.dst.atm_num_nsap  Target ATM number (NSAP)
        Byte array
    arp.dst.atm_subaddr  Target ATM subaddress
        Byte array
    arp.dst.hlen  Target ATM number length
        Unsigned 8-bit integer
    arp.dst.htype  Target ATM number type
        Boolean
    arp.dst.hw  Target hardware address
        Byte array
    arp.dst.pln  Target protocol size
        Unsigned 8-bit integer
    arp.dst.proto  Target protocol address
        Byte array
    arp.dst.slen  Target ATM subaddress length
        Unsigned 8-bit integer
    arp.dst.stype  Target ATM subaddress type
        Boolean
    arp.hw.size  Hardware size
        Unsigned 8-bit integer
    arp.hw.type  Hardware type
        Unsigned 16-bit integer
    arp.opcode  Opcode
        Unsigned 16-bit integer
    arp.proto.size  Protocol size
        Unsigned 8-bit integer
    arp.proto.type  Protocol type
        Unsigned 16-bit integer
    arp.src.atm_num_e164  Sender ATM number (E.164)
        String
    arp.src.atm_num_nsap  Sender ATM number (NSAP)
        Byte array
    arp.src.atm_subaddr  Sender ATM subaddress
        Byte array
    arp.src.hlen  Sender ATM number length
        Unsigned 8-bit integer
    arp.src.htype  Sender ATM number type
        Boolean
    arp.src.hw  Sender hardware address
        Byte array
    arp.src.pln  Sender protocol size
        Unsigned 8-bit integer
    arp.src.proto  Sender protocol address
        Byte array
    arp.src.slen  Sender ATM subaddress length
        Unsigned 8-bit integer
    arp.src.stype  Sender ATM subaddress type
        Boolean

  Andrew File System (AFS) (afs)

    afs.backup  Backup
        Boolean
    afs.backup.errcode  Error Code
        Unsigned 32-bit integer
    afs.backup.opcode  Operation
        Unsigned 32-bit integer
    afs.bos  BOS
        Boolean
    afs.bos.baktime  Backup Time
        Date/Time stamp
    afs.bos.cell  Cell
        String
    afs.bos.cmd  Command
        String
    afs.bos.content  Content
        String
    afs.bos.data  Data
        Byte array
    afs.bos.date  Date
        Unsigned 32-bit integer
    afs.bos.errcode  Error Code
        Unsigned 32-bit integer
    afs.bos.error  Error
        String
    afs.bos.file  File
        String
    afs.bos.flags  Flags
        Unsigned 32-bit integer
    afs.bos.host  Host
        String
    afs.bos.instance  Instance
        String
    afs.bos.key  Key
        Byte array
    afs.bos.keychecksum  Key Checksum
        Unsigned 32-bit integer
    afs.bos.keymodtime  Key Modification Time
        Date/Time stamp
    afs.bos.keyspare2  Key Spare 2
        Unsigned 32-bit integer
    afs.bos.kvno  Key Version Number
        Unsigned 32-bit integer
    afs.bos.newtime  New Time
        Date/Time stamp
    afs.bos.number  Number
        Unsigned 32-bit integer
    afs.bos.oldtime  Old Time
        Date/Time stamp
    afs.bos.opcode  Operation
        Unsigned 32-bit integer
    afs.bos.parm  Parm
        String
    afs.bos.path  Path
        String
    afs.bos.size  Size
        Unsigned 32-bit integer
    afs.bos.spare1  Spare1
        String
    afs.bos.spare2  Spare2
        String
    afs.bos.spare3  Spare3
        String
    afs.bos.status  Status
        Signed 32-bit integer
    afs.bos.statusdesc  Status Description
        String
    afs.bos.type  Type
        String
    afs.bos.user  User
        String
    afs.cb  Callback
        Boolean
    afs.cb.callback.expires  Expires
        Date/Time stamp
    afs.cb.callback.type  Type
        Unsigned 32-bit integer
    afs.cb.callback.version  Version
        Unsigned 32-bit integer
    afs.cb.errcode  Error Code
        Unsigned 32-bit integer
    afs.cb.fid.uniq  FileID (Uniqifier)
        Unsigned 32-bit integer
    afs.cb.fid.vnode  FileID (VNode)
        Unsigned 32-bit integer
    afs.cb.fid.volume  FileID (Volume)
        Unsigned 32-bit integer
    afs.cb.opcode  Operation
        Unsigned 32-bit integer
    afs.error  Error
        Boolean
    afs.error.opcode  Operation
        Unsigned 32-bit integer
    afs.fs  File Server
        Boolean
    afs.fs.acl.a  _A_dminister
        Unsigned 8-bit integer
    afs.fs.acl.count.negative  ACL Count (Negative)
        Unsigned 32-bit integer
    afs.fs.acl.count.positive  ACL Count (Positive)
        Unsigned 32-bit integer
    afs.fs.acl.d  _D_elete
        Unsigned 8-bit integer
    afs.fs.acl.datasize  ACL Size
        Unsigned 32-bit integer
    afs.fs.acl.entity  Entity (User/Group)
        String
    afs.fs.acl.i  _I_nsert
        Unsigned 8-bit integer
    afs.fs.acl.k  _L_ock
        Unsigned 8-bit integer
    afs.fs.acl.l  _L_ookup
        Unsigned 8-bit integer
    afs.fs.acl.r  _R_ead
        Unsigned 8-bit integer
    afs.fs.acl.w  _W_rite
        Unsigned 8-bit integer
    afs.fs.callback.expires  Expires
        Date/Time stamp
    afs.fs.callback.type  Type
        Unsigned 32-bit integer
    afs.fs.callback.version  Version
        Unsigned 32-bit integer
    afs.fs.cps.spare1  CPS Spare1
        Unsigned 32-bit integer
    afs.fs.cps.spare2  CPS Spare2
        Unsigned 32-bit integer
    afs.fs.cps.spare3  CPS Spare3
        Unsigned 32-bit integer
    afs.fs.data  Data
        Byte array
    afs.fs.errcode  Error Code
        Unsigned 32-bit integer
    afs.fs.fid.uniq  FileID (Uniqifier)
        Unsigned 32-bit integer
    afs.fs.fid.vnode  FileID (VNode)
        Unsigned 32-bit integer
    afs.fs.fid.volume  FileID (Volume)
        Unsigned 32-bit integer
    afs.fs.flength  FLength
        Unsigned 32-bit integer
    afs.fs.ipaddr  IP Address
        IPv4 address
    afs.fs.length  Length
        Unsigned 32-bit integer
    afs.fs.motd  Message of the Day
        String
    afs.fs.name  Name
        String
    afs.fs.newname  New Name
        String
    afs.fs.offlinemsg  Offline Message
        String
    afs.fs.offset  Offset
        Unsigned 32-bit integer
    afs.fs.oldname  Old Name
        String
    afs.fs.opcode  Operation
        Unsigned 32-bit integer
    afs.fs.status.anonymousaccess  Anonymous Access
        Unsigned 32-bit integer
    afs.fs.status.author  Author
        Unsigned 32-bit integer
    afs.fs.status.calleraccess  Caller Access
        Unsigned 32-bit integer
    afs.fs.status.clientmodtime  Client Modification Time
        Date/Time stamp
    afs.fs.status.dataversion  Data Version
        Unsigned 32-bit integer
    afs.fs.status.dataversionhigh  Data Version (High)
        Unsigned 32-bit integer
    afs.fs.status.filetype  File Type
        Unsigned 32-bit integer
    afs.fs.status.group  Group
        Unsigned 32-bit integer
    afs.fs.status.interfaceversion  Interface Version
        Unsigned 32-bit integer
    afs.fs.status.length  Length
        Unsigned 32-bit integer
    afs.fs.status.linkcount  Link Count
        Unsigned 32-bit integer
    afs.fs.status.mask  Mask
        Unsigned 32-bit integer
    afs.fs.status.mask.fsync  FSync
        Unsigned 32-bit integer
    afs.fs.status.mask.setgroup  Set Group
        Unsigned 32-bit integer
    afs.fs.status.mask.setmode  Set Mode
        Unsigned 32-bit integer
    afs.fs.status.mask.setmodtime  Set Modification Time
        Unsigned 32-bit integer
    afs.fs.status.mask.setowner  Set Owner
        Unsigned 32-bit integer
    afs.fs.status.mask.setsegsize  Set Segment Size
        Unsigned 32-bit integer
    afs.fs.status.mode  Unix Mode
        Unsigned 32-bit integer
    afs.fs.status.owner  Owner
        Unsigned 32-bit integer
    afs.fs.status.parentunique  Parent Unique
        Unsigned 32-bit integer
    afs.fs.status.parentvnode  Parent VNode
        Unsigned 32-bit integer
    afs.fs.status.segsize  Segment Size
        Unsigned 32-bit integer
    afs.fs.status.servermodtime  Server Modification Time
        Date/Time stamp
    afs.fs.status.spare2  Spare 2
        Unsigned 32-bit integer
    afs.fs.status.spare3  Spare 3
        Unsigned 32-bit integer
    afs.fs.status.spare4  Spare 4
        Unsigned 32-bit integer
    afs.fs.status.synccounter  Sync Counter
        Unsigned 32-bit integer
    afs.fs.symlink.content  Symlink Content
        String
    afs.fs.symlink.name  Symlink Name
        String
    afs.fs.timestamp  Timestamp
        Date/Time stamp
    afs.fs.token  Token
        Byte array
    afs.fs.viceid  Vice ID
        Unsigned 32-bit integer
    afs.fs.vicelocktype  Vice Lock Type
        Unsigned 32-bit integer
    afs.fs.volid  Volume ID
        Unsigned 32-bit integer
    afs.fs.volname  Volume Name
        String
    afs.fs.volsync.spare1  Spare 1
        Unsigned 32-bit integer
    afs.fs.volsync.spare2  Spare 2
        Unsigned 32-bit integer
    afs.fs.volsync.spare3  Spare 3
        Unsigned 32-bit integer
    afs.fs.volsync.spare4  Spare 4
        Unsigned 32-bit integer
    afs.fs.volsync.spare5  Spare 5
        Unsigned 32-bit integer
    afs.fs.volsync.spare6  Spare 6
        Unsigned 32-bit integer
    afs.fs.xstats.clientversion  Client Version
        Unsigned 32-bit integer
    afs.fs.xstats.collnumber  Collection Number
        Unsigned 32-bit integer
    afs.fs.xstats.timestamp  XStats Timestamp
        Unsigned 32-bit integer
    afs.fs.xstats.version  XStats Version
        Unsigned 32-bit integer
    afs.kauth  KAuth
        Boolean
    afs.kauth.data  Data
        Byte array
    afs.kauth.domain  Domain
        String
    afs.kauth.errcode  Error Code
        Unsigned 32-bit integer
    afs.kauth.kvno  Key Version Number
        Unsigned 32-bit integer
    afs.kauth.name  Name
        String
    afs.kauth.opcode  Operation
        Unsigned 32-bit integer
    afs.kauth.princ  Principal
        String
    afs.kauth.realm  Realm
        String
    afs.prot  Protection
        Boolean
    afs.prot.count  Count
        Unsigned 32-bit integer
    afs.prot.errcode  Error Code
        Unsigned 32-bit integer
    afs.prot.flag  Flag
        Unsigned 32-bit integer
    afs.prot.gid  Group ID
        Unsigned 32-bit integer
    afs.prot.id  ID
        Unsigned 32-bit integer
    afs.prot.maxgid  Maximum Group ID
        Unsigned 32-bit integer
    afs.prot.maxuid  Maximum User ID
        Unsigned 32-bit integer
    afs.prot.name  Name
        String
    afs.prot.newid  New ID
        Unsigned 32-bit integer
    afs.prot.oldid  Old ID
        Unsigned 32-bit integer
    afs.prot.opcode  Operation
        Unsigned 32-bit integer
    afs.prot.pos  Position
        Unsigned 32-bit integer
    afs.prot.uid  User ID
        Unsigned 32-bit integer
    afs.rmtsys  Rmtsys
        Boolean
    afs.rmtsys.opcode  Operation
        Unsigned 32-bit integer
    afs.ubik  Ubik
        Boolean
    afs.ubik.errcode  Error Code
        Unsigned 32-bit integer
    afs.ubik.file  File
        Unsigned 32-bit integer
    afs.ubik.length  Length
        Unsigned 32-bit integer
    afs.ubik.locktype  Lock Type
        Unsigned 32-bit integer
    afs.ubik.opcode  Operation
        Unsigned 32-bit integer
    afs.ubik.position  Position
        Unsigned 32-bit integer
    afs.ubik.site  Site
        IPv4 address
    afs.ubik.syncsite  Syncsite
        Boolean
    afs.ubik.version.counter  Counter
        Unsigned 32-bit integer
    afs.ubik.version.epoch  Epoch
        Date/Time stamp
    afs.ubik.voteend  Vote Ends
        Date/Time stamp
    afs.ubik.votestart  Vote Started
        Date/Time stamp
    afs.ubik.votetype  Vote Type
        Boolean
    afs.update  Update
        Boolean
    afs.update.opcode  Operation
        Unsigned 32-bit integer
    afs.vldb  VLDB
        Boolean
    afs.vldb.bkvol  Backup Volume ID
        Unsigned 32-bit integer
    afs.vldb.bump  Bumped Volume ID
        Unsigned 32-bit integer
    afs.vldb.count  Volume Count
        Unsigned 32-bit integer
    afs.vldb.errcode  Error Code
        Unsigned 32-bit integer
    afs.vldb.id  Volume ID
        Unsigned 32-bit integer
    afs.vldb.index  Volume Index
        Unsigned 32-bit integer
    afs.vldb.name  Volume Name
        String
    afs.vldb.nextindex  Next Volume Index
        Unsigned 32-bit integer
    afs.vldb.numservers  Number of Servers
        Unsigned 32-bit integer
    afs.vldb.opcode  Operation
        Unsigned 32-bit integer
    afs.vldb.partition  Partition
        String
    afs.vldb.rovol  Read-Only Volume ID
        Unsigned 32-bit integer
    afs.vldb.rwvol  Read-Write Volume ID
        Unsigned 32-bit integer
    afs.vldb.server  Server
        IPv4 address
    afs.vldb.serveruuid  Server UUID
        Byte array
    afs.vldb.type  Volume Type
        Unsigned 32-bit integer
    afs.vol  Volume Server
        Boolean
    afs.vol.count  Volume Count
        Unsigned 32-bit integer
    afs.vol.errcode  Error Code
        Unsigned 32-bit integer
    afs.vol.id  Volume ID
        Unsigned 32-bit integer
    afs.vol.name  Volume Name
        String
    afs.vol.opcode  Operation
        Unsigned 32-bit integer

  Appletalk Address Resolution Protocol (aarp)

    aarp.dst.ether  Target ether
        Byte array
    aarp.dst.id  Target ID
        Byte array
    aarp.hard.size  Hardware size
        Unsigned 8-bit integer
    aarp.hard.type  Hardware type
        Unsigned 16-bit integer
    aarp.opcode  Opcode
        Unsigned 16-bit integer
    aarp.proto.size  Protocol size
        Unsigned 8-bit integer
    aarp.proto.type  Protocol type
        Unsigned 16-bit integer
    aarp.src.ether  Sender ether
        Byte array
    aarp.src.id  Sender ID
        Byte array

  Async data over ISDN (V.120) (v120)

    v120.address  Link Address
        Unsigned 16-bit integer
    v120.control  Control Field
        Unsigned 16-bit integer
    v120.header  Header Field
        String

  Authentication Header (ah)

    ah.sequence  Sequence
        Unsigned 32-bit integer
    ah.spi  SPI
        Unsigned 32-bit integer

  Banyan Vines (vines)

    vines.protocol  Protocol
        Unsigned 8-bit integer

  Banyan Vines Fragmentation Protocol (vines_frp)

  Banyan Vines SPP (vines_spp)

  Blocks eXtensible eXchange Protocol (bxxp)

    bxxp.channel  Channel
        Unsigned 32-bit integer
    bxxp.end  End
        Boolean
    bxxp.more.complete  Complete
        Boolean
    bxxp.more.intermediate  Intermediate
        Boolean
    bxxp.req  Request
        Boolean
    bxxp.req.channel  Request Channel Number
        Unsigned 32-bit integer
    bxxp.rsp  Response
        Boolean
    bxxp.rsp.channel  Response Channel Number
        Unsigned 32-bit integer
    bxxp.seq  Sequence
        Boolean
    bxxp.seq.ackno  Ackno
        Unsigned 32-bit integer
    bxxp.seq.channel  Sequence Channel Number
        Unsigned 32-bit integer
    bxxp.seq.window  Window
        Unsigned 32-bit integer
    bxxp.seqno  Seqno
        Unsigned 32-bit integer
    bxxp.serial  Serial
        Unsigned 32-bit integer
    bxxp.size  Size
        Unsigned 32-bit integer
    bxxp.status.negative  Negative
        Boolean
    bxxp.status.positive  Positive
        Boolean
    bxxp.violation  Protocol Violation
        Boolean

  Boot Parameters (bootparams)

    bootparams.domain  Client Domain
        String
    bootparams.fileid  File ID
        String
    bootparams.filepath  File Path
        String
    bootparams.host  Client Host
        String
    bootparams.hostaddr  Client Address
        IPv4 address
    bootparams.routeraddr  Router Address
        IPv4 address

  Bootstrap Protocol (bootp)

    bootp.cookie  Magic cookie
        IPv4 address
    bootp.dhcp  Frame is DHCP
        Boolean
    bootp.file  Boot file name
        String
    bootp.flag  Broadcast flag
        Unsigned 16-bit integer
    bootp.hops  Hops
        Unsigned 8-bit integer
    bootp.hw.addr  Client hardware address
        Byte array
    bootp.hw.len  Hardware address length
        Unsigned 8-bit integer
    bootp.hw.type  Hardware type
        Unsigned 8-bit integer
    bootp.id  Transaction ID
        Unsigned 32-bit integer
    bootp.ip.client  Client IP address
        IPv4 address
    bootp.ip.relay  Relay agent IP address
        IPv4 address
    bootp.ip.server  Next server IP address
        IPv4 address
    bootp.ip.your  Your (client) IP address
        IPv4 address
    bootp.secs  Seconds elapsed
        Unsigned 16-bit integer
    bootp.server  Server host name
        String
    bootp.type  Message type
        Unsigned 8-bit integer

  Border Gateway Protocol (bgp)

    bgp.type  BGP message type
        Unsigned 8-bit integer

  Cisco Auto-RP (auto_rp)

    auto_rp.group_prefix  Prefix
        IPv4 address
    auto_rp.holdtime  Holdtime
        Unsigned 16-bit integer
    auto_rp.mask_len  Mask length
        Unsigned 8-bit integer
    auto_rp.pim_ver  Version
        Unsigned 8-bit integer
    auto_rp.prefix_sign  Sign
        Unsigned 8-bit integer
    auto_rp.rp_addr  RP address
        IPv4 address
    auto_rp.rp_count  RP count
        Unsigned 8-bit integer
    auto_rp.type  Packet type
        Unsigned 8-bit integer
    auto_rp.version  Protocol version
        Unsigned 8-bit integer

  Cisco Discovery Protocol (cdp)

    cdp.checksum  Checksum
        Unsigned 16-bit integer
    cdp.tlv.len  Length
        Unsigned 16-bit integer
    cdp.tlv.type  Type
        Unsigned 16-bit integer
    cdp.ttl  TTL
        Unsigned 16-bit integer
    cdp.version  Version
        Unsigned 8-bit integer

  Cisco Group Management Protocol (cgmp)

    cgmp.count  Count
        Unsigned 8-bit integer
    cgmp.gda  Group Destination Address
        6-byte Hardware (MAC) Address
    cgmp.type  Type
        Unsigned 8-bit integer
    cgmp.usa  Unicast Source Address
        6-byte Hardware (MAC) Address
    cgmp.version  Version
        Unsigned 8-bit integer

  Cisco Hot Standby Router Protocol (hsrp)

    hsrp.auth_data  Authentication Data
        String
    hsrp.group  Group
        Unsigned 8-bit integer
    hsrp.hellotime  Hellotime
        Unsigned 8-bit integer
    hsrp.holdtime  Holdtime
        Unsigned 8-bit integer
    hsrp.opcode  Op Code
        Unsigned 8-bit integer
    hsrp.priority  Priority
        Unsigned 8-bit integer
    hsrp.reserved  Reserved
        Unsigned 8-bit integer
    hsrp.state  State
        Unsigned 8-bit integer
    hsrp.version  Version
        Unsigned 8-bit integer
    hsrp.virt_ip  Virtual IP Address
        IPv4 address

  Cisco ISL (isl)

    isl.addr  Source or Destination Address
        6-byte Hardware (MAC) Address
    isl.bpdu  BPDU
        Boolean
    isl.crc  CRC
        Unsigned 32-bit integer
    isl.dst  Destination
        6-byte Hardware (MAC) Address
    isl.dst_route_desc  Destination route descriptor
        Unsigned 16-bit integer
    isl.esize  Esize
        Unsigned 8-bit integer
    isl.explorer  Explorer
        Boolean
    isl.fcs_not_incl  FCS Not Included
        Boolean
    isl.hsa  HSA
        Unsigned 24-bit integer
    isl.index  Index
        Unsigned 16-bit integer
    isl.len  Length
        Unsigned 16-bit integer
    isl.src  Source
        6-byte Hardware (MAC) Address
    isl.src_route_desc  Source-route descriptor
        Unsigned 16-bit integer
    isl.src_vlan_id  Source VLAN ID
        Unsigned 16-bit integer
    isl.type  Type
        Unsigned 8-bit integer
    isl.user  User
        Unsigned 8-bit integer
    isl.user_eth  User
        Unsigned 8-bit integer
    isl.vlan_id  VLAN ID
        Unsigned 16-bit integer

  Cisco Interior Gateway Routing Protocol (igrp)

    igrp.as  Autonomous System
        Unsigned 16-bit integer
    igrp.update  Update Release
        Unsigned 8-bit integer

  Common Open Policy Service (cops)

    cops.accttimer.value  Contents: ACCT Timer Value
        Unsigned 16-bit integer
    cops.c_num  C-Num
        Unsigned 8-bit integer
    cops.c_type  C-Type
        Unsigned 8-bit integer
    cops.client_type  Client Type
        Unsigned 16-bit integer
    cops.context.m_type  M-Type
        Unsigned 16-bit integer
    cops.context.r_type  R-Type
        Unsigned 16-bit integer
    cops.decision.cmd  Command-Code
        Unsigned 16-bit integer
    cops.decision.flags  Flags
        Unsigned 16-bit integer
    cops.error  Error
        Unsigned 16-bit integer
    cops.error_sub  Error Sub-code
        Unsigned 16-bit integer
    cops.flags  Flags
        Unsigned 8-bit integer
    cops.in-int.ipv4  IPv4 address
        IPv4 address
    cops.in-int.ipv6  IPv6 address
        IPv6 address
    cops.in-out-int.ifindex  ifIndex
        Unsigned 32-bit integer
    cops.integrity.key_id  Contents: Key ID
        Unsigned 32-bit integer
    cops.integrity.seq_num  Contents: Sequence Number
        Unsigned 32-bit integer
    cops.katimer.value  Contents: KA Timer Value
        Unsigned 16-bit integer
    cops.lastpdpaddr.ipv4  IPv4 address
        IPv4 address
    cops.lastpdpaddr.ipv6  IPv6 address
        IPv6 address
    cops.msg_len  Message Length
        Unsigned 32-bit integer
    cops.obj.len  Object Length
        Unsigned 32-bit integer
    cops.op_code  Op Code
        Unsigned 8-bit integer
    cops.out-int.ipv4  IPv4 address
        IPv4 address
    cops.out-int.ipv6  IPv6 address
        IPv6 address
    cops.pdp.tcp_port  TCP Port Number
        Unsigned 32-bit integer
    cops.pdprediraddr.ipv4  IPv4 address
        IPv4 address
    cops.pdprediraddr.ipv6  IPv6 address
        IPv6 address
    cops.pepid.id  Contents: PEP Id
        String
    cops.reason  Reason
        Unsigned 16-bit integer
    cops.reason_sub  Reason Sub-code
        Unsigned 16-bit integer
    cops.report_type  Contents: Report-Type
        Unsigned 16-bit integer
    cops.ver_flags  Version and Flags
        Unsigned 8-bit integer
    cops.version  Version
        Unsigned 8-bit integer

  DEC Spanning Tree Protocol (dec_stp)

  Data (data)

  Datagram Delivery Protocol (ddp)

    ddp.checksum  Checksum
        Unsigned 16-bit integer
    ddp.dst.net  Destination Net
        Unsigned 16-bit integer
    ddp.dst.node  Destination Node
        Unsigned 8-bit integer
    ddp.dst.socket  Destination Socket
        Unsigned 8-bit integer
    ddp.hopcount  Hop count
        Unsigned 8-bit integer
    ddp.len  Datagram length
        Unsigned 16-bit integer
    ddp.src.net  Source Net
        Unsigned 16-bit integer
    ddp.src.node  Source Node
        Unsigned 8-bit integer
    ddp.src.socket  Source Socket
        Unsigned 8-bit integer
    ddp.type  Protocol type
        Unsigned 8-bit integer

  Diameter Protocol (diameter)

    diameter.avp.code  AVP Code
        Unsigned 32-bit integer
    diameter.avp.data.bytes  AVP Data
        Byte array
    diameter.avp.data.int32  AVP Data
        Signed 32-bit integer
    diameter.avp.data.string  AVP Data
        String
    diameter.avp.data.time  AVP Data
        Date/Time stamp
    diameter.avp.data.uint32  AVP Data
        Unsigned 32-bit integer
    diameter.avp.data.v4addr  AVP Data
        IPv4 address
    diameter.avp.data.v6addr  AVP Data
        IPv6 address
    diameter.avp.flags  AVP Flags
        Unsigned 8-bit integer
    diameter.avp.length  AVP length
        Unsigned 16-bit integer
    diameter.avp.reserved  AVP Reserved
        Unsigned 8-bit integer
    diameter.avp.vendorId  AVP Vendor Id
        Unsigned 32-bit integer
    diameter.code  Command Code
        Unsigned 32-bit integer
    diameter.flags  Flags
        Unsigned 8-bit integer
    diameter.id  Identifier
        Unsigned 32-bit integer
    diameter.length  Length
        Unsigned 16-bit integer
    diameter.reserved  Reserved
        Unsigned 8-bit integer
    diameter.vendorId  VendorId
        Unsigned 32-bit integer
    diameter.version  Version
        Unsigned 8-bit integer

  Domain Name Service (dns)

    dns.count.add_rr  Additional RRs
        Unsigned 16-bit integer
    dns.count.answers  Answer RRs
        Unsigned 16-bit integer
    dns.count.auth_rr  Authority RRs
        Unsigned 16-bit integer
    dns.count.queries  Questions
        Unsigned 16-bit integer
    dns.flags  Flags
        Unsigned 16-bit integer
    dns.id  Transaction ID
        Unsigned 16-bit integer
    dns.query  Query
        Boolean
    dns.response  Response
        Boolean

  Dynamic DNS Tools Protocol (ddtp)

    ddtp.encrypt  Encryption
        Unsigned 32-bit integer
    ddtp.hostid  Hostid
        Unsigned 32-bit integer
    ddtp.ipaddr  IP address
        IPv4 address
    ddtp.msgtype  Message type
        Unsigned 32-bit integer
    ddtp.opcode  Opcode
        Unsigned 32-bit integer
    ddtp.status  Status
        Unsigned 32-bit integer
    ddtp.version  Version
        Unsigned 32-bit integer

  Encapsulating Security Payload (esp)

    esp.sequence  Sequence
        Unsigned 32-bit integer
    esp.spi  SPI
        Unsigned 32-bit integer

  Enhanced Interior Gateway Routing Protocol (eigrp)

    eigrp.as  Autonomous System
        Unsigned 16-bit integer
    eigrp.opcode  Opcode
        Unsigned 8-bit integer
    eigrp.tlv  Entry
        Unsigned 16-bit integer

  Ethernet (eth)

    eth.addr  Source or Destination Address
        6-byte Hardware (MAC) Address
    eth.dst  Destination
        6-byte Hardware (MAC) Address
    eth.len  Length
        Unsigned 16-bit integer
    eth.src  Source
        6-byte Hardware (MAC) Address
    eth.trailer  Trailer
        Byte array
    eth.type  Type
        Unsigned 16-bit integer

  FTP Data (ftp-data)

  Fiber Distributed Data Interface (fddi)

    fddi.addr  Source or Destination Address
        6-byte Hardware (MAC) Address
    fddi.dst  Destination
        6-byte Hardware (MAC) Address
    fddi.fc  Frame Control
        Unsigned 8-bit integer
    fddi.src  Source
        6-byte Hardware (MAC) Address

  File Transfer Protocol (FTP) (ftp)

    ftp.reponse.data  Response data
        String
    ftp.request  Request
        Boolean
    ftp.request.command  Request command
        String
    ftp.request.data  Request data
        String
    ftp.response  Response
        Boolean
    ftp.response.code  Response code
        Unsigned 8-bit integer

  Frame (frame)

    frame.cap_len  Capture Frame Length
        Unsigned 32-bit integer
    frame.number  Frame Number
        Unsigned 32-bit integer
    frame.p2p_dir  Point-to-Point Direction
        Unsigned 8-bit integer
    frame.pkt_len  Total Frame Length
        Unsigned 32-bit integer
    frame.time  Arrival Time
        Date/Time stamp
    frame.time_delta  Time delta from previous packet
        Time duration
    frame.time_relative  Time relative to first packet
        Time duration

  Frame Relay (fr)

    fr.becn  BECN
        Boolean
    fr.cr  CR
        Boolean
    fr.de  DE
        Boolean
    fr.dlci  DLCI
        Unsigned 16-bit integer
    fr.fecn  FECN
        Boolean
    fr.nlpid  NLPID
        Unsigned 8-bit integer
    fr.snap.oui  Organization Code
        Unsigned 24-bit integer
    fr.snap.pid  Protocol ID
        Unsigned 16-bit integer
    fr.type  Type
        Unsigned 16-bit integer

  GARP VLAN Registration Protocol (gvrp)

    garp.attribute_event  Event
        Unsigned 8-bit integer
    garp.attribute_length  Length
        Unsigned 8-bit integer
    garp.attribute_type  Type
        Unsigned 8-bit integer
    garp.attribute_value  Value
        Unsigned 16-bit integer
    garp.protocol_id  Protocol ID
        Unsigned 16-bit integer

  General Inter-ORB Protocol (giop)

    giop.len  Message size
        Unsigned 32-bit integer
    giop.type  Message type
        Unsigned 8-bit integer

  Generic Routing Encapsulation (gre)

    gre.proto  Protocol Type
        Unsigned 16-bit integer

  Hummingbird NFS Daemon (hclnfsd)

    hclnfsd.device  Device
        String
    hclnfsd.filename  Filename
        String
    hclnfsd.group  Group
        String
    hclnfsd.hostname  Hostname
        String
    hclnfsd.lockname  Lockname
        String
    hclnfsd.lockowner  Lockowner
        String
    hclnfsd.logintext  Login Text
        String
    hclnfsd.printername  Printer Name
        String
    hclnfsd.printparameters  Print Parameters
        String
    hclnfsd.printqueuecomment  Comment
        String
    hclnfsd.printqueuename  Name
        String
    hclnfsd.request_type  Request Type
        Unsigned 32-bit integer
    hclnfsd.status  Status
        Unsigned 32-bit integer
    hclnfsd.unknown_data  Unknown
        String
    hclnfsd.username  Username
        String

  Hypertext Transfer Protocol (http)

    http.notification  Notification
        Boolean
    http.request  Request
        Boolean
    http.response  Response
        Boolean

  ICQ Protocol (icq)

    icq.checkcode  Checkcode
        Unsigned 32-bit integer
    icq.cmd  Command
        Unsigned 16-bit integer
    icq.decode  Decode
        String
    icq.sessionid  SessionID
        Unsigned 32-bit integer
    icq.type  Type
        Unsigned 16-bit integer
    icq.uin  UIN
        Unsigned 32-bit integer

  IEEE 802.11 wireless LAN (wlan)

    wlan.aid  Association ID
        Unsigned 16-bit integer
    wlan.bssid  BSS Id
        6-byte Hardware (MAC) Address
    wlan.da  Destination address
        6-byte Hardware (MAC) Address
    wlan.duration  Duration
        Unsigned 16-bit integer
    wlan.fc  Frame Control Field
        Unsigned 16-bit integer
    wlan.fc.ds  DS status
        Unsigned 8-bit integer
    wlan.fc.frag  Fragments
        Boolean
    wlan.fc.fromds  From DS
        Boolean
    wlan.fc.moredata  More Data
        Boolean
    wlan.fc.order  Order flag
        Boolean
    wlan.fc.pwrmgt  PWR MGT
        Boolean
    wlan.fc.retry  Retry
        Boolean
    wlan.fc.subtype  Subtype
        Unsigned 8-bit integer
    wlan.fc.tods  To DS
        Boolean
    wlan.fc.type  Type
        Unsigned 8-bit integer
    wlan.fc.version  Version
        Unsigned 8-bit integer
    wlan.fc.wep  WEP flag
        Boolean
    wlan.fcs  Frame Check Sequence (not verified)
        Unsigned 32-bit integer
    wlan.fixed.aid  Association ID
        Unsigned 16-bit integer
    wlan.fixed.all  Fixed parameters
        Unsigned 16-bit integer
    wlan.fixed.auth.alg  Authentication Algorithm
        Unsigned 16-bit integer
    wlan.fixed.auth_seq  Authentication SEQ
        Unsigned 16-bit integer
    wlan.fixed.beacon  Beacon Interval
        Unsigned 16-bit integer
    wlan.fixed.capabilities  Capabilities
        Unsigned 16-bit integer
    wlan.fixed.capabilities.cfpoll.ap  CFP participation capabilities
        Unsigned 16-bit integer
    wlan.fixed.capabilities.cfpoll.sta  CFP participation capabilities
        Unsigned 16-bit integer
    wlan.fixed.capabilities.ess  ESS capabilities
        Boolean
    wlan.fixed.capabilities.ibss  IBSS status
        Boolean
    wlan.fixed.capabilities.privacy  Privacy
        Boolean
    wlan.fixed.current_ap  Current AP
        6-byte Hardware (MAC) Address
    wlan.fixed.listen_ival  Listen Interval
        Unsigned 16-bit integer
    wlan.fixed.reason_code  Reason code
        Unsigned 16-bit integer
    wlan.fixed.status_code  Status code
        Unsigned 16-bit integer
    wlan.fixed.timestamp  Timestamp
        String
    wlan.flags  Protocol Flags
        Unsigned 8-bit integer
    wlan.frag  Fragment number
        Unsigned 16-bit integer
    wlan.ra  Receiver address
        6-byte Hardware (MAC) Address
    wlan.sa  Source address
        6-byte Hardware (MAC) Address
    wlan.seq  Sequence number
        Unsigned 16-bit integer
    wlan.ta  Transmitter address
        6-byte Hardware (MAC) Address
    wlan.tag.interpretation  Tag interpretation
        String
    wlan.tag.length  Tag length
        Unsigned 16-bit integer
    wlan.tag.number  Tag
        Unsigned 16-bit integer
    wlan.tagged.all  Tagged parameters
        Unsigned 16-bit integer

  ILMI (ilmi)

  IP Payload Compression (ipcomp)

    ipcomp.cpi  CPI
        Unsigned 16-bit integer
    ipcomp.flags  Flags
        Unsigned 8-bit integer

  IPX Message (ipxmsg)

    ipxmsg.conn  Connection Number
        Unsigned 8-bit integer
    ipxmsg.sigchar  Signature Char
        Unsigned 8-bit integer

  IPX Routing Information Protocol (ipxrip)

    ipxrip.request  Request
        Boolean
    ipxrip.response  Response
        Boolean

  ISDN Q.921-User Adaptation Layer (iua)

    hf.iua.one_bit  One bit
        Boolean
    hf.iua.sapi  SAPI
        Unsigned 8-bit integer
    hf.iua.spare_bit  Spare bit
        Boolean
    hf.iua.tei  TEI
        Unsigned 8-bit integer
    hf.iua.zero_bit  Zero bit
        Boolean
    iua.asp_reason  Reason
        Unsigned 32-bit integer
    iua.error_code  Error code
        Unsigned 32-bit integer
    iua.info_string  Info string
        String
    iua.int_interface_identifier  Integer interface identifier
        Unsigned 32-bit integer
    iua.interface_range_end  End
        Unsigned 32-bit integer
    iua.interface_range_start  Start
        Unsigned 32-bit integer
    iua.message_class  Message class
        Unsigned 8-bit integer
    iua.message_length  Message length
        Unsigned 32-bit integer
    iua.message_type  Message Type
        Unsigned 8-bit integer
    iua.parameter_length  Parameter length
        Unsigned 16-bit integer
    iua.parameter_tag  Parameter Tag
        Unsigned 16-bit integer
    iua.release_reason  Reason
        Unsigned 32-bit integer
    iua.reserved  Reserved
        Unsigned 8-bit integer
    iua.status_identification  Status identification
        Unsigned 16-bit integer
    iua.status_type  Status type
        Unsigned 16-bit integer
    iua.tei_status  TEI status
        Unsigned 32-bit integer
    iua.text_interface_identifier  Text interface identifier
        String
    iua.traffic_mode_type  Traffic mode type
        Unsigned 32-bit integer
    iua.version  Version
        Unsigned 8-bit integer

  ISIS HELLO (isis_hello)

    isis_hello.circuite_type  Circuit type
        Unsigned 8-bit integer
    isis_hello.clv_ipv4_int_addr  IPv4 interface address
        IPv4 address
    isis_hello.holding_timer  Holding timer
        Unsigned 16-bit integer
    isis_hello.lan_id  SystemID{ Designated IS }
        Byte array
    isis_hello.local_circuit_id  Local circuit ID
        Unsigned 8-bit integer
    isis_hello.pdu_length  PDU length
        Unsigned 16-bit integer
    isis_hello.priority  Priority
        Unsigned 8-bit integer
    isis_hello.source_id  SystemID{ Sender of PDU }
        Byte array

  ISO 10589 ISIS Complete Sequence Numbers Protocol Data Unit (isis_csnp)

    isis_csnp.pdu_length  PDU length
        Unsigned 16-bit integer

  ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol (isis)

    isis.irpd  Intra Domain Routing Protocol Discriminator
        Unsigned 8-bit integer
    isis.len  PDU Header Length
        Unsigned 8-bit integer
    isis.max_area_adr  Max.AREAs: (0==3)
        Unsigned 8-bit integer
    isis.reserved  Reserved (==0)
        Unsigned 8-bit integer
    isis.sysid_len  System ID Length
        Unsigned 8-bit integer
    isis.type  PDU Type          :
        Unsigned 8-bit integer
    isis.version  Version (==1)
        Unsigned 8-bit integer
    isis.version2  Version2 (==1)
        Unsigned 8-bit integer

  ISO 10589 ISIS Link State Protocol Data Unit (isis_lsp)

    isis_lsp.checksum  Checksum
        Unsigned 16-bit integer
    isis_lsp.clv_ipv4_int_addr  IPv4 interface address:
        IPv4 address
    isis_lsp.pdu_length  PDU length
        Unsigned 16-bit integer
    isis_lsp.remaining_life  Remaining life
        Unsigned 16-bit integer
    isis_lsp.sequence_number  Sequence number
        Unsigned 32-bit integer

  ISO 10589 ISIS Partial Sequence Numbers Protocol Data Unit (isis_psnp)

    isis_psnp.pdu_length  PDU length
        Unsigned 16-bit integer

  ISO 8073 COTP Connection-Oriented Transport Protocol (cotp)

  ISO 8473 CLNP ConnectionLess Network Protocol (clnp)

    clnp.checksum  Checksum
        Unsigned 16-bit integer
    clnp.dsap   DA
        Byte array
    clnp.dsap.len  DAL
        Unsigned 8-bit integer
    clnp.len  HDR Length
        Unsigned 8-bit integer
    clnp.nlpi  Network Layer Protocol Identifier
        Unsigned 8-bit integer
    clnp.pdu.len  PDU length
        Unsigned 16-bit integer
    clnp.ssap   SA
        Byte array
    clnp.ssap.len  SAL
        Unsigned 8-bit integer
    clnp.ttl  Holding Time
        Unsigned 8-bit integer
    clnp.type  PDU Type
        Unsigned 8-bit integer
    clnp.version  Version
        Unsigned 8-bit integer

  ISO 8602 CLTP ConnectionLess Transport Protocol (cltp)

  ISO 9542 ESIS Routeing Information Exchange Protocol (esis)

    esis.chksum  Checksum
        Unsigned 16-bit integer
    esis.htime  Holding Time
        Unsigned 16-bit integer
    esis.length  PDU Length
        Unsigned 8-bit integer
    esis.nlpi  Network Layer Protocol Identifier
        Unsigned 8-bit integer
    esis.res  Reserved(==0)
        Unsigned 8-bit integer
    esis.type  PDU Type
        Unsigned 8-bit integer
    esis.ver  Version (==1)
        Unsigned 8-bit integer

  ITU-T Recommendation H.261 (h261)

    h261.ebit  End bit position
        Unsigned 8-bit integer
    h261.gobn  GOB Number
        Unsigned 8-bit integer
    h261.hmvd  Horizontal motion vctor data
        Unsigned 8-bit integer
    h261.i  Intra frame encoded data flag
        Boolean
    h261.mbap  Macroblock address predictor
        Unsigned 8-bit integer
    h261.quant  Quantizer
        Unsigned 8-bit integer
    h261.sbit  Start bit position
        Unsigned 8-bit integer
    h261.stream  H.261 stream
        Byte array
    h261.v  Motion vector flag
        Boolean
    h261.vmvd  Vertical motion vector data
        Unsigned 8-bit integer

  Internet Cache Protocol (icp)

    icp.length  Length
        Unsigned 16-bit integer
    icp.nr  Request Number
        Unsigned 32-bit integer
    icp.opcode  Opcode
        Unsigned 8-bit integer
    icp.version  Version
        Unsigned 8-bit integer

  Internet Control Message Protocol (icmp)

    icmp.checksum  Checksum
        Unsigned 16-bit integer
    icmp.checksum_bad  Bad Checksum
        Boolean
    icmp.code  Code
        Unsigned 8-bit integer
    icmp.type  Type
        Unsigned 8-bit integer

  Internet Control Message Protocol v6 (icmpv6)

    icmpv6.checksum  Checksum
        Unsigned 16-bit integer
    icmpv6.checksum_bad  Bad Checksum
        Boolean
    icmpv6.code  Code
        Unsigned 8-bit integer
    icmpv6.type  Type
        Unsigned 8-bit integer

  Internet Group Management Protocol (igmp)

    igmp.checksum  Checksum
        Unsigned 16-bit integer
    igmp.group  Group address
        IPv4 address
    igmp.type  Type
        Unsigned 8-bit integer
    igmp.unused  Unused
        Unsigned 8-bit integer
    igmp.version  Version
        Unsigned 8-bit integer

  Internet Message Access Protocol (imap)

    imap.request  Request
        Boolean
    imap.response  Response
        Boolean

  Internet Printing Protocol (ipp)

  Internet Protocol (ip)

    ip.addr  Source or Destination Address
        IPv4 address
    ip.checksum  Header checksum
        Unsigned 16-bit integer
    ip.checksum_bad  Bad Header checksum
        Boolean
    ip.dsfield  Differentiated Services field
        Unsigned 8-bit integer
    ip.dsfield.ce  ECN-CE
        Unsigned 8-bit integer
    ip.dsfield.dscp  Differentiated Services Codepoint
        Unsigned 8-bit integer
    ip.dsfield.ect  ECN-Capable Transport (ECT)
        Unsigned 8-bit integer
    ip.dst  Destination
        IPv4 address
    ip.flags  Flags
        Unsigned 8-bit integer
    ip.flags.df  Don't fragment
        Boolean
    ip.flags.mf  More fragments
        Boolean
    ip.frag_offset  Fragment offset
        Unsigned 16-bit integer
    ip.hdr_len  Header Length
        Unsigned 8-bit integer
    ip.id  Identification
        Unsigned 16-bit integer
    ip.len  Total Length
        Unsigned 16-bit integer
    ip.proto  Protocol
        Unsigned 8-bit integer
    ip.src  Source
        IPv4 address
    ip.tos  Type of Service
        Unsigned 8-bit integer
    ip.tos.cost  Cost
        Boolean
    ip.tos.delay  Delay
        Boolean
    ip.tos.precedence  Precedence
        Unsigned 8-bit integer
    ip.tos.reliability  Reliability
        Boolean
    ip.tos.throughput  Throughput
        Boolean
    ip.ttl  Time to live
        Unsigned 8-bit integer
    ip.version  Version
        Unsigned 8-bit integer

  Internet Protocol Version 6 (ipv6)

    ipv6.addr  Address
        IPv6 address
    ipv6.class  Traffic class
        Unsigned 8-bit integer
    ipv6.dst  Destination
        IPv6 address
    ipv6.flow  Flowlabel
        Unsigned 32-bit integer
    ipv6.hlim  Hop limit
        Unsigned 8-bit integer
    ipv6.mipv6_a_flag  Acknowledge (A)
        Boolean
    ipv6.mipv6_b_flag  Bicasting all (B)
        Boolean
    ipv6.mipv6_d_flag  Duplicate Address Detection (D)
        Boolean
    ipv6.mipv6_h_flag  Home Registration (H)
        Boolean
    ipv6.mipv6_home_address  Home Address
        IPv6 address
    ipv6.mipv6_length  Option Length
        Unsigned 8-bit integer
    ipv6.mipv6_life_time  Life Time
        Unsigned 32-bit integer
    ipv6.mipv6_m_flag  MAP Registration (M)
        Boolean
    ipv6.mipv6_prefix_length  Prefix Length
        Unsigned 8-bit integer
    ipv6.mipv6_r_flag  Router (R)
        Boolean
    ipv6.mipv6_refresh  Refresh
        Unsigned 32-bit integer
    ipv6.mipv6_sequence_number  Sequence Number
        Unsigned 16-bit integer
    ipv6.mipv6_status  Status
        Unsigned 8-bit integer
    ipv6.mipv6_sub_alternative_COA  Alternative Care of Address
        IPv6 address
    ipv6.mipv6_sub_length  Sub-Option Length
        Unsigned 8-bit integer
    ipv6.mipv6_sub_type  Sub-Option Type
        Unsigned 8-bit integer
    ipv6.mipv6_sub_unique_ID  Unique Identifier
        Unsigned 16-bit integer
    ipv6.mipv6_type  Option Type
        Unsigned 8-bit integer
    ipv6.nxt  Next header
        Unsigned 8-bit integer
    ipv6.plen  Payload length
        Unsigned 16-bit integer
    ipv6.src  Source
        IPv6 address
    ipv6.version  Version
        Unsigned 8-bit integer

  Internet Relay Chat (irc)

    irc.command  Command
        String
    irc.request  Request
        Boolean
    irc.response  Response
        Boolean

  Internet Security Association and Key Management Protocol (isakmp)

  Internetwork Packet eXchange (ipx)

    ipx.checksum  Checksum
        Unsigned 16-bit integer
    ipx.dst.net  Destination Network
        IPX network or server name
    ipx.dst.node  Destination Node
        6-byte Hardware (MAC) Address
    ipx.dst.socket  Destination Socket
        Unsigned 16-bit integer
    ipx.hops  Transport Control (Hops)
        Unsigned 8-bit integer
    ipx.len  Length
        Unsigned 16-bit integer
    ipx.packet_type  Packet Type
        Unsigned 8-bit integer
    ipx.src.net  Source Network
        IPX network or server name
    ipx.src.node  Source Node
        6-byte Hardware (MAC) Address
    ipx.src.socket  Source Socket
        Unsigned 16-bit integer

  Kerberos (kerberos)

  Label Distribution Protocol (ldp)

    ldp,msg.tlv.hello.requested  Hello Requested
        Boolean
    ldp.hdr.ldpid.lsid  Label Space ID
        Unsigned 16-bit integer
    ldp.hdr.ldpid.lsr  LSR ID
        Unsigned 32-bit integer
    ldp.hdr.pdu_len  PDU Length
        Unsigned 16-bit integer
    ldp.hdr.version  Version
        Unsigned 16-bit integer
    ldp.msg.id  Message ID
        Unsigned 32-bit integer
    ldp.msg.len  Message Length
        Unsigned 16-bit integer
    ldp.msg.tlv.fec.af  FEC Element Address Type
        Unsigned 16-bit integer
    ldp.msg.tlv.fec.len  FEC Element Length
        Unsigned 8-bit integer
    ldp.msg.tlv.fec.pfval  FEC Element Prefix Value
        Unsigned 32-bit integer
    ldp.msg.tlv.fec.type  FEC Element Type
        Unsigned 8-bit integer
    ldp.msg.tlv.hello.cnf_seqno  Configuration Sequence Number
        Unsigned 32-bit integer
    ldp.msg.tlv.hello.hold  Hold Time
        Unsigned 16-bit integer
    ldp.msg.tlv.hello.res  Reserved
        Unsigned 16-bit integer
    ldp.msg.tlv.hello.targeted  Targeted Hello
        Boolean
    ldp.msg.tlv.label  Generic Label
        Unsigned 32-bit integer
    ldp.msg.tlv.len  TLV Length
        Unsigned 16-bit integer
    ldp.msg.tlv.type  TLV Type
        Unsigned 16-bit integer
    ldp.msg.tlv.value  TLV Value
        Byte array
    ldp.msg.type  Message Type
        Unsigned 16-bit integer
    ldp.req  Request
        Boolean
    ldp.rsp  Response
        Boolean

  Layer 2 Tunneling Protocol (l2tp)

    l2tp.Nr  Nr
        Unsigned 16-bit integer
    l2tp.Ns  Ns
        Unsigned 16-bit integer
    l2tp.length  Length
        Unsigned 16-bit integer
    l2tp.offset  Offset
        Unsigned 16-bit integer
    l2tp.session  Session ID
        Unsigned 16-bit integer
    l2tp.tunnel  Tunnel ID
        Unsigned 16-bit integer
    lt2p.code  code
        Unsigned 16-bit integer
    lt2p.length_bit  Length Bit
        Boolean
    lt2p.offset_bit  Offset bit
        Boolean
    lt2p.priority  Priority
        Boolean
    lt2p.seq_bit  Sequence Bit
        Boolean
    lt2p.type  Type
        Unsigned 16-bit integer
    lt2p.version  Version
        Unsigned 16-bit integer

  Lightweight Directory Access Protocol (ldap)

    ldap.abandon.msgid  Abandon Msg Id
        Unsigned 32-bit integer
    ldap.attribute  Attribute
        String
    ldap.bind.auth_type  Auth Type
        Unsigned 8-bit integer
    ldap.bind.dn  DN
        String
    ldap.bind.password  Password
        String
    ldap.bind.version  Version
        Unsigned 32-bit integer
    ldap.compare.test  Test
        String
    ldap.dn  Distinguished Name
        String
    ldap.length  Length
        Unsigned 32-bit integer
    ldap.message_id  Message Id
        Unsigned 32-bit integer
    ldap.message_length  Message Length
        Unsigned 32-bit integer
    ldap.message_type  Message Type
        Unsigned 8-bit integer
    ldap.modify.add  Add
        String
    ldap.modify.delete  Delete
        String
    ldap.modify.replace  Replace
        String
    ldap.modrdn.delete  Delete Values
        Boolean
    ldap.modrdn.name  New Name
        String
    ldap.modrdn.superior  New Location
        String
    ldap.result.code  Result Code
        Unsigned 8-bit integer
    ldap.result.errormsg  Error Message
        String
    ldap.result.matcheddn  Matched DN
        String
    ldap.result.referral  Referral
        String
    ldap.search.basedn  Base DN
        String
    ldap.search.dereference  Dereference
        Unsigned 8-bit integer
    ldap.search.filter  Filter
        String
    ldap.search.scope  Scope
        Unsigned 8-bit integer
    ldap.search.sizelimit  Size Limit
        Unsigned 32-bit integer
    ldap.search.timelimit  Time Limit
        Unsigned 32-bit integer
    ldap.search.typesonly  Attributes Only
        Boolean
    ldap.value  Value
        String

  Line Printer Daemon Protocol (lpd)

    lpd.request  Request
        Boolean
    lpd.response  Response
        Boolean

  Link Access Procedure Balanced (LAPB) (lapb)

    lapb.address  Address Field
        Unsigned 8-bit integer
    lapb.control  Control Field
        Unsigned 8-bit integer

  Link Access Procedure Balanced Ethernet (LAPBETHER) (lapbether)

    lapbether.length  Length Field
        Unsigned 16-bit integer

  Link Access Procedure, Channel D (LAPD) (lapd)

    lapd.address  Address Field
        Unsigned 16-bit integer
    lapd.control  Control Field
        Unsigned 16-bit integer
    lapd.cr  C/R
        Unsigned 16-bit integer
    lapd.ea1  EA1
        Unsigned 16-bit integer
    lapd.ea2  EA2
        Unsigned 16-bit integer
    lapd.sapi  SAPI
        Unsigned 16-bit integer
    lapd.tei  TEI
        Unsigned 16-bit integer

  Linux cooked-mode capture (sll)

    sll.etype  Protocol
        Unsigned 16-bit integer
    sll.halen  Link-layer address length
        Unsigned 16-bit integer
    sll.hatype  Link-layer address type
        Unsigned 16-bit integer
    sll.ltype  Protocol
        Unsigned 16-bit integer
    sll.pkttype  Packet type
        Unsigned 16-bit integer
    sll.src.eth  Source
        6-byte Hardware (MAC) Address
    sll.src.other  Source
        Byte array
    sll.trailer  Trailer
        Byte array

  Logical-Link Control (llc)

    llc.control  Control
        Unsigned 16-bit integer
    llc.dsap  DSAP
        Unsigned 8-bit integer
    llc.dsap.ig  IG Bit
        Boolean
    llc.oui  Organization Code
        Unsigned 24-bit integer
    llc.pid  Protocol ID
        Unsigned 16-bit integer
    llc.ssap  SSAP
        Unsigned 8-bit integer
    llc.ssap.cr  CR Bit
        Boolean
    llc.type  Type
        Unsigned 16-bit integer

  Lucent/Ascend debug output (ascend)

    ascend.chunk  WDD Chunk
        Unsigned 32-bit integer
    ascend.number  Called number
        String
    ascend.sess  Session ID
        Unsigned 32-bit integer
    ascend.task  Task
        Unsigned 32-bit integer
    ascend.type  Link type
        Unsigned 32-bit integer
    ascend.user  User name
        String

  MAPI (mapi)

    mapi.request  Request
        Boolean
    mapi.response  Response
        Boolean

  MS Proxy Protocol (msproxy)

    msproxy.bindaddr  Destination
        IPv4 address
    msproxy.bindid  Bound Port Id
        Unsigned 32-bit integer
    msproxy.bindport  Bind Port
        Unsigned 16-bit integer
    msproxy.boundport  Bound Port
        Unsigned 16-bit integer
    msproxy.clntport  Client Port
        Unsigned 16-bit integer
    msproxy.command  Command
        Unsigned 16-bit integer
    msproxy.dstaddr  Destination Address
        IPv4 address
    msproxy.dstport  Destination Port
        Unsigned 16-bit integer
    msproxy.resolvaddr  Address
        IPv4 address
    msproxy.server_ext_addr  Server External Address
        IPv4 address
    msproxy.server_ext_port  Server External Port
        Unsigned 16-bit integer
    msproxy.server_int_addr  Server Internal Address
        IPv4 address
    msproxy.server_int_port  Server Internal Port
        Unsigned 16-bit integer
    msproxy.serveraddr  Server Address
        IPv4 address
    msproxy.serverport  Server Port
        Unsigned 16-bit integer
    msproxy.srcport  Source Port
        Unsigned 16-bit integer

  MTP 3 User Adaptation Layer (m3ua)

    m3ua.affected_dpc  Affected DPC
        Unsigned 24-bit integer
    m3ua.congestion_level  Congestion level
        Unsigned 8-bit integer
    m3ua.error_code  Error code
        Unsigned 32-bit integer
    m3ua.info_string  Info string
        String
    m3ua.mask  Mask
        Unsigned 8-bit integer
    m3ua.message_class  Message class
        Unsigned 8-bit integer
    m3ua.message_length  Message length
        Unsigned 32-bit integer
    m3ua.message_type  Message Type
        Unsigned 8-bit integer
    m3ua.network_appearance  Network appearance
        Unsigned 32-bit integer
    m3ua.parameter_length  Parameter length
        Unsigned 16-bit integer
    m3ua.parameter_tag  Parameter Tag
        Unsigned 16-bit integer
    m3ua.reason  Reason
        Unsigned 32-bit integer
    m3ua.reserved  Reserved
        Unsigned 8-bit integer
    m3ua.routing_context  Routing context
        Unsigned 32-bit integer
    m3ua.status_info  Status info
        Unsigned 16-bit integer
    m3ua.status_type  Status type
        Unsigned 16-bit integer
    m3ua.traffic_mode_type  Traffic mode Type
        Unsigned 32-bit integer
    m3ua.unavailability_cause  Unavailability cause
        Unsigned 16-bit integer
    m3ua.user_identity  User Identity
        Unsigned 16-bit integer
    m3ua.version  Version
        Unsigned 8-bit integer

  Malformed Frame (malformed)

  Microsoft Windows Browser Protocol (browser)

  Microsoft Windows Lanman Protocol (lanman)

  Microsoft Windows Logon Protocol (netlogon)

  Mobile IP (mip)

    mip.auth.auth  Authenticator
        Byte array
    mip.auth.spi  SPI
        Signed 32-bit integer
    mip.b  Broadcast Datagrams
        Boolean
    mip.coa  Care of Address
        IPv4 address
    mip.code  Reply Code
        Unsigned 8-bit integer
    mip.d  Co-lcated Care-of Address
        Boolean
    mip.ext.len  Extension Length
        Signed 8-bit integer
    mip.ext.type  Extension Type
        Signed 8-bit integer
    mip.g  GRE
        Boolean
    mip.haaddr  Home Agent
        IPv4 address
    mip.homeaddr  Home Address
        IPv4 address
    mip.ident  Identification
        Date/Time stamp
    mip.life  Lifetime
        Unsigned 16-bit integer
    mip.m  Minimal Encapsulation
        Boolean
    mip.nai  NAI
        String
    mip.s  Simultaneous Bindings
        Boolean
    mip.t  Reverse Tunneling
        Boolean
    mip.type  Message Type
        Signed 8-bit integer
    mip.v  Van Jacobson
        Boolean

  Mount Service (mount)

    mount.dump.directory  Directory
        String
    mount.dump.entry  Mount List Entry
        No value
    mount.dump.hostname  Hostname
        String
    mount.export.directory  Directory
        String
    mount.export.entry  Export List Entry
        No value
    mount.export.group  Group
        String
    mount.export.groups  Groups
        No value
    mount.flavor  Flavor
        Unsigned 32-bit integer
    mount.flavors  Flavors
        Unsigned 32-bit integer
    mount.path  Path
        String
    mount.pathconf.link_max  Maximum number of links to a file
        Unsigned 32-bit integer
    mount.pathconf.mask  Reply error/status bits
        Unsigned 16-bit integer
    mount.pathconf.mask.chown_restricted  CHOWN_RESTRICTED
        Boolean
    mount.pathconf.mask.error_all  ERROR_ALL
        Boolean
    mount.pathconf.mask.error_link_max  ERROR_LINK_MAX
        Boolean
    mount.pathconf.mask.error_max_canon  ERROR_MAX_CANON
        Boolean
    mount.pathconf.mask.error_max_input  ERROR_MAX_INPUT
        Boolean
    mount.pathconf.mask.error_name_max  ERROR_NAME_MAX
        Boolean
    mount.pathconf.mask.error_path_max  ERROR_PATH_MAX
        Boolean
    mount.pathconf.mask.error_pipe_buf  ERROR_PIPE_BUF
        Boolean
    mount.pathconf.mask.error_vdisable  ERROR_VDISABLE
        Boolean
    mount.pathconf.mask.no_trunc  NO_TRUNC
        Boolean
    mount.pathconf.max_canon  Maximum terminal input line length
        Unsigned 16-bit integer
    mount.pathconf.max_input  Terminal input buffer size
        Unsigned 16-bit integer
    mount.pathconf.name_max  Maximum file name length
        Unsigned 16-bit integer
    mount.pathconf.path_max  Maximum path name length
        Unsigned 16-bit integer
    mount.pathconf.pipe_buf  Pipe buffer size
        Unsigned 16-bit integer
    mount.pathconf.vdisable_char  VDISABLE character
        Unsigned 8-bit integer
    mount.status  Status
        Unsigned 32-bit integer

  MultiProtocol Label Switching Header (mpls)

    mpls.bottom  MPLS Bottom Of Label Stack
        Unsigned 8-bit integer
    mpls.exp  MPLS Experimental Bits
        Unsigned 8-bit integer
    mpls.label  MPLS Label
        Unsigned 32-bit integer
    mpls.ttl  MPLS TTL
        Unsigned 8-bit integer

  Name Binding Protocol (nbp)

    nbp.count  Count
        Unsigned 8-bit integer
    nbp.enum  Enumerator
        Unsigned 8-bit integer
    nbp.info  Info
        Unsigned 8-bit integer
    nbp.net  Network
        Unsigned 16-bit integer
    nbp.node  Node
        Unsigned 8-bit integer
    nbp.object  Object
        String
    nbp.op  Operation
        Unsigned 8-bit integer
    nbp.port  Port
        Unsigned 8-bit integer
    nbp.tid  Transaction ID
        Unsigned 8-bit integer
    nbp.type  Type
        String
    nbp.zone  Zone
        String

  Name Management Protocol over IPX (nmpi)

  NetBIOS (netbios)

    netbios.ack  Acknowledge
        Boolean
    netbios.ack_expected  Acknowledge expected
        Boolean
    netbios.ack_with_data  Acknowledge with data
        Boolean
    netbios.call_name_type  Call Name Type
        Signed 16-bit integer
    netbios.command  Command
        Unsigned 16-bit integer
    netbios.data2  DATA2 value
        Unsigned 16-bit integer
    netbios.hdr_len  Header Length
        Unsigned 16-bit integer
    netbios.largest_frame  Largest Frame
        Unsigned 8-bit integer
    netbios.local_session  Local Session No.
        Unsigned 8-bit integer
    netbios.name  Netbios Name
        String
    netbios.name_type  Netbios Name Type
        Unsigned 16-bit integer
    netbios.recv_cont_req  RECEIVE_CONTINUE requested
        Boolean
    netbios.remote_session  Remote Session No.
        Unsigned 8-bit integer
    netbios.resp_corrl  Response Correlator
        Signed 16-bit integer
    netbios.send_no_ack  Handle SEND.NO.ACK
        Boolean
    netbios.version  NetBIOS Version
        Boolean
    netbios.xmit_corrl  Transmit Correlator
        Signed 16-bit integer

  NetBIOS Datagram Service (nbdgm)

    nbdgm.dgram_id  Datagram ID
        Unsigned 16-bit integer
    nbdgm.first  First fragment
        Boolean
    nbdgm.next  Fragmented
        Boolean
    nbdgm.node_type  Node Type
        Unsigned 8-bit integer
    nbdgm.src.ip  Source IP
        IPv4 address
    nbdgm.src.port  Source Port
        Unsigned 16-bit integer
    nbdgm.type  Message Type
        Unsigned 8-bit integer

  NetBIOS Name Service (nbns)

    nbns.count.add_rr  Additional RRs
        Unsigned 16-bit integer
    nbns.count.answers  Answer RRs
        Unsigned 16-bit integer
    nbns.count.auth_rr  Authority RRs
        Unsigned 16-bit integer
    nbns.count.queries  Questions
        Unsigned 16-bit integer
    nbns.id  Transaction ID
        Unsigned 16-bit integer
    nbns.query  Query
        Boolean
    nbns.response  Response
        Boolean

  NetBIOS Session Service (nbss)

    nbss.flags  Flags
        Unsigned 8-bit integer
    nbss.type  Message Type
        Unsigned 8-bit integer

  NetBIOS over IPX (nbipx)

  NetWare Core Protocol (ncp)

    ncp.buffer_size  Buffer Size
        Unsigned 16-bit integer
    ncp.completion_code  Completion Code
        Unsigned 8-bit integer
    ncp.connection  Connection Number
        Unsigned 16-bit integer
    ncp.connection_number  Connection Number
        Unsigned 32-bit integer
    ncp.connection_status  Connection Status
        Unsigned 8-bit integer
    ncp.file_handle  File Handle
        Byte array
    ncp.file_offset  File Offset
        Unsigned 32-bit integer
    ncp.file_size  File Size
        Unsigned 32-bit integer
    ncp.func  Function
        Unsigned 8-bit integer
    ncp.ip.length  NCP over IP length
        Unsigned 32-bit integer
    ncp.ip.replybufsize  NCP over IP Reply Buffer Size
        Unsigned 32-bit integer
    ncp.ip.signature  NCP over IP signature
        Unsigned 32-bit integer
    ncp.ip.version  NCP over IP Version
        Unsigned 32-bit integer
    ncp.job_type  Job Type
        Unsigned 16-bit integer
    ncp.length  Packet Length
        Unsigned 16-bit integer
    ncp.max_bytes  Maximum Number of Bytes
        Unsigned 16-bit integer
    ncp.num_bytes  Number of Bytes
        Unsigned 16-bit integer
    ncp.object_flags  Object Flags
        Unsigned 8-bit integer
    ncp.object_has_properites  Object Has Properties
        Unsigned 8-bit integer
    ncp.object_id  Object ID
        Unsigned 32-bit integer
    ncp.object_name  Object Name

    ncp.object_name1  Object Name
        String
    ncp.object_security  Object Security
        Unsigned 8-bit integer
    ncp.object_type  Object Type
        Unsigned 16-bit integer
    ncp.property_data  Property Data
        Byte array
    ncp.property_has_more_segments  Property Has More Segments
        Unsigned 8-bit integer
    ncp.property_name  Property Name

    ncp.property_segment  Property Segment
        Unsigned 8-bit integer
    ncp.property_type  Property Type
        Unsigned 8-bit integer
    ncp.seq  Sequence Number
        Unsigned 8-bit integer
    ncp.subfunc  SubFunction
        Unsigned 8-bit integer
    ncp.task  Task Number
        Unsigned 8-bit integer
    ncp.task_number  Task Number
        Unsigned 32-bit integer
    ncp.type  Type
        Unsigned 16-bit integer
    ncp.unknown_byte  Unknown Byte
        Unsigned 8-bit integer

  Network File System (nfs)

    nfs.ace  ace
        String
    nfs.attr  mand_attr
        Unsigned 32-bit integer
    nfs.call.operation  Opcode
        Unsigned 32-bit integer
    nfs.change_info.atomic  Atomic
        Boolean
    nfs.clientid  Client ID
        String
    nfs.createmode  Create Mode
        Unsigned 32-bit integer
    nfs.data  Data
        String
    nfs.data_follows  data_follows
        Boolean
    nfs.dirlist4.eof  eof
        Boolean
    nfs.fattr4.attr_vals  attr_vals
        String
    nfs.fattr4_archive  fattr4_archive
        Boolean
    nfs.fattr4_cansettime  fattr4_cansettime
        Boolean
    nfs.fattr4_case_insensitive  fattr4_case_insensitive
        Boolean
    nfs.fattr4_case_preserving  fattr4_case_preserving
        Boolean
    nfs.fattr4_chown_restricted  fattr4_chown_restricted
        Boolean
    nfs.fattr4_expire_type  fattr4_expire_type
        Unsigned 32-bit integer
    nfs.fattr4_hidden  fattr4_hidden
        Boolean
    nfs.fattr4_homogeneous  fattr4_homogeneous
        Boolean
    nfs.fattr4_link_support  fattr4_link_support
        Boolean
    nfs.fattr4_mimetype  fattr4_mimetype
        String
    nfs.fattr4_named_attr  fattr4_named_attr
        Boolean
    nfs.fattr4_no_trunc  fattr4_no_trunc
        Boolean
    nfs.fattr4_owner  fattr4_owner
        String
    nfs.fattr4_owner_group  fattr4_owner_group
        String
    nfs.fattr4_symlink_support  fattr4_symlink_support
        Boolean
    nfs.fattr4_system  fattr4_system
        Boolean
    nfs.fattr4_unique_handles  fattr4_unique_handles
        Boolean
    nfs.fh.dentry  dentry
        Unsigned 32-bit integer
    nfs.fh.dev  device
        Unsigned 32-bit integer
    nfs.fh.dirinode  directory inode
        Unsigned 32-bit integer
    nfs.fh.fn  file number
        Unsigned 32-bit integer
    nfs.fh.fn.generation  generation
        Unsigned 32-bit integer
    nfs.fh.fn.inode  inode
        Unsigned 32-bit integer
    nfs.fh.fn.len  length
        Unsigned 32-bit integer
    nfs.fh.fsid.major  major
        Unsigned 32-bit integer
    nfs.fh.fsid.minor  minor
        Unsigned 32-bit integer
    nfs.fh.fstype  file system type
        Unsigned 32-bit integer
    nfs.fh.hp.len  length
        Unsigned 32-bit integer
    nfs.fh.pinode  pseudo inode
        Unsigned 32-bit integer
    nfs.fh.xdev  exported device
        Unsigned 32-bit integer
    nfs.fh.xfn  exported file number
        Unsigned 32-bit integer
    nfs.fh.xfn.generation  generation
        Unsigned 32-bit integer
    nfs.fh.xfn.inode  exported inode
        Unsigned 32-bit integer
    nfs.fh.xfn.len  length
        Unsigned 32-bit integer
    nfs.fh.xfsid.major  exported major
        Unsigned 32-bit integer
    nfs.fh.xfsid.minor  exported minor
        Unsigned 32-bit integer
    nfs.fsinfo.dtpref  dtpref
        Unsigned 32-bit integer
    nfs.fsinfo.propeties  Properties
        Unsigned 32-bit integer
    nfs.fsinfo.rtmax  rtmax
        Unsigned 32-bit integer
    nfs.fsinfo.rtmult  rtmult
        Unsigned 32-bit integer
    nfs.fsinfo.rtpref  rtpref
        Unsigned 32-bit integer
    nfs.fsinfo.wtmax  wtmax
        Unsigned 32-bit integer
    nfs.fsinfo.wtmult  wtmult
        Unsigned 32-bit integer
    nfs.fsinfo.wtpref  wtpref
        Unsigned 32-bit integer
    nfs.fsstat.invarsec  invarsec
        Unsigned 32-bit integer
    nfs.name  Name
        String
    nfs.nfs_ftype4  nfs_ftype4
        Unsigned 32-bit integer
    nfs.open.claim_type  Claim Type
        Unsigned 32-bit integer
    nfs.open.delegation_type  Delegation Type
        Unsigned 32-bit integer
    nfs.open.limit_by  Space Limit
        Unsigned 32-bit integer
    nfs.open.opentype  Open Type
        Unsigned 32-bit integer
    nfs.open4.share_access  share_access
        Unsigned 32-bit integer
    nfs.open4.share_deny  share_deny
        Unsigned 32-bit integer
    nfs.pathconf.case_insensitive  case_insensitive
        Boolean
    nfs.pathconf.case_preserving  case_preserving
        Boolean
    nfs.pathconf.chown_restricted  chown_restricted
        Boolean
    nfs.pathconf.linkmax  linkmax
        Unsigned 32-bit integer
    nfs.pathconf.name_max  name_max
        Unsigned 32-bit integer
    nfs.pathconf.no_trunc  no_trunc
        Boolean
    nfs.pathname.component  Filename
        String
    nfs.read.count  Count
        Unsigned 32-bit integer
    nfs.read.eof  EOF
        Boolean
    nfs.read.offset  Offset
        Unsigned 32-bit integer
    nfs.read.totalcount  Total Count
        Unsigned 32-bit integer
    nfs.readdir.cookie  Cookie
        Unsigned 32-bit integer
    nfs.readdir.count  Count
        Unsigned 32-bit integer
    nfs.readdir.entry  Entry
        No value
    nfs.readdir.entry.cookie  Cookie
        Unsigned 32-bit integer
    nfs.readdir.entry.fileid  File ID
        Unsigned 32-bit integer
    nfs.readdir.entry.name  Name
        String
    nfs.readdir.eof  EOF
        Unsigned 32-bit integer
    nfs.readdirplus.entry.name  Name
        String
    nfs.readlink.data  Data
        String
    nfs.recall  EOF
        Boolean
    nfs.reply.operation  Opcode
        Unsigned 32-bit integer
    nfs.seqid  seqid
        Unsigned 32-bit integer
    nfs.server  server
        String
    nfs.set_it  set_it
        Unsigned 32-bit integer
    nfs.stable_how4  stable_how4
        Unsigned 32-bit integer
    nfs.statfs.bavail  Available Blocks
        Unsigned 32-bit integer
    nfs.statfs.bfree  Free Blocks
        Unsigned 32-bit integer
    nfs.statfs.blocks  Total Blocks
        Unsigned 32-bit integer
    nfs.statfs.bsize  Block Size
        Unsigned 32-bit integer
    nfs.statfs.tsize  Transfer Size
        Unsigned 32-bit integer
    nfs.status  Status
        Unsigned 32-bit integer
    nfs.status2  Status
        Unsigned 32-bit integer
    nfs.symlink.linktext  Name
        String
    nfs.symlink.to  To
        String
    nfs.tag  Tag
        String
    nfs.type  Type
        Unsigned 32-bit integer
    nfs.who  who
        String
    nfs.write.beginoffset  Begin Offset
        Unsigned 32-bit integer
    nfs.write.committed  Committed
        Unsigned 32-bit integer
    nfs.write.offset  Offset
        Unsigned 32-bit integer
    nfs.write.stable  Stable
        Unsigned 32-bit integer
    nfs.write.totalcount  Total Count
        Unsigned 32-bit integer

  Network Lock Manager Protocol (nlm)

    nlm.block  block
        Boolean
    nlm.cookie  cookie
        String
    nlm.exclusive  exclusive
        Boolean
    nlm.holder  holder
        No value
    nlm.lock  lock
        No value
    nlm.lock.caller_name  caller_name
        String
    nlm.lock.l_len  l_len
        Unsigned 32-bit integer
    nlm.lock.l_offset  l_offset
        Unsigned 32-bit integer
    nlm.lock.owner  owner
        String
    nlm.lock.svid  svid
        Unsigned 32-bit integer
    nlm.reclaim  reclaim
        Boolean
    nlm.sequence  sequence
        Signed 32-bit integer
    nlm.share  share
        No value
    nlm.share.access  access
        Unsigned 32-bit integer
    nlm.share.mode  mode
        Unsigned 32-bit integer
    nlm.share.name  name
        String
    nlm.state  state
        Unsigned 32-bit integer
    nlm.test_stat  test_stat
        No value
    nlm.test_stat.stat  stat
        Unsigned 32-bit integer

  Network News Transfer Protocol (nntp)

    nntp.request  Request
        Boolean
    nntp.response  Response
        Boolean

  Network Time Protocol (ntp)

    ntp.flags  Flags
        Unsigned 8-bit integer
    ntp.flags.li  Leap Indicator
        Unsigned 8-bit integer
    ntp.flags.mode  Mode
        Unsigned 8-bit integer
    ntp.flags.vn  Version number
        Unsigned 8-bit integer
    ntp.keyid  Key ID
        Byte array
    ntp.mac  Message Authentication Code
        Byte array
    ntp.org  Originate Time Stamp
        Byte array
    ntp.ppoll  Peer Polling Interval
        Unsigned 8-bit integer
    ntp.precision  Peer Clock Precision
        Unsigned 8-bit integer
    ntp.rec  Receive Time Stamp
        Byte array
    ntp.refid  Reference Clock ID
        Byte array
    ntp.reftime  Reference Clock Update Time
        Byte array
    ntp.rootdelay  Root Delay
        Double-precision floating point
    ntp.rootdispersion  Clock Dispersion
        Double-precision floating point
    ntp.stratum  Peer Clock Stratum
        Unsigned 8-bit integer
    ntp.xmt  Transmit Time Stamp
        Byte array

  Null/Loopback (null)

    null.family  Family
        Unsigned 32-bit integer
    null.type  Type
        Unsigned 16-bit integer

  Open Shortest Path First (ospf)

  PPP IP Control Protocol (ipcp)

  PPP Link Control Protocol (lcp)

  PPP Multilink Protocol (mp)

    mp.first  First fragment
        Boolean
    mp.last  Last fragment
        Boolean
    mp.seq  Sequence number
        Unsigned 24-bit integer

  PPP-over-Ethernet Discovery (pppoed)

  PPP-over-Ethernet Session (pppoes)

  Point-to-Point Protocol (ppp)

  Point-to-Point Tunnelling Protocol (pptp)

    pptp.type  Message type
        Unsigned 16-bit integer

  Portmap (portmap)

    portmap.answer  Answer
        Boolean
    portmap.args  Arguments
        Byte array
    portmap.port  Port
        Unsigned 32-bit integer
    portmap.proc  Procedure
        Unsigned 32-bit integer
    portmap.prog  Program
        Unsigned 32-bit integer
    portmap.proto  Protocol
        Unsigned 32-bit integer
    portmap.result  Result
        Byte array
    portmap.rpcb  RPCB
        No value
    portmap.rpcb.addr  Universal Address
        String
    portmap.rpcb.netid  Network Id
        String
    portmap.rpcb.owner  Owner of this Service
        String
    portmap.rpcb.prog  Program
        Unsigned 32-bit integer
    portmap.rpcb.version  Version
        Unsigned 32-bit integer
    portmap.uaddr  Universal Address
        String
    portmap.version  Version
        Unsigned 32-bit integer

  Post Office Protocol (pop)

    pop.request  Request
        Boolean
    pop.response  Response
        Boolean

  Protocol Independent Multicast (pim)

    pim.cksum  Checksum
        Unsigned 16-bit integer
    pim.type  Type
        Unsigned 8-bit integer
    pim.version  Version
        Unsigned 8-bit integer

  Q.2931 (q2931)

    q2931.call_ref  Call reference value
        Byte array
    q2931.call_ref_len  Call reference value length
        Unsigned 8-bit integer
    q2931.disc  Protocol discriminator
        Unsigned 8-bit integer
    q2931.message_action_indicator  Action indicator
        Unsigned 8-bit integer
    q2931.message_flag  Flag
        Boolean
    q2931.message_len  Message length
        Unsigned 16-bit integer
    q2931.message_type  Message type
        Unsigned 8-bit integer
    q2931.message_type_ext  Message type extension
        Unsigned 8-bit integer

  Q.931 (q931)

    q931.call_ref  Call reference value
        Byte array
    q931.call_ref_len  Call reference value length
        Unsigned 8-bit integer
    q931.disc  Protocol discriminator
        Unsigned 8-bit integer
    q931.message_type  Message type
        Unsigned 8-bit integer

  Quake Network Protocol (quake)

    quake.control.accept.port  Port
        Unsigned 32-bit integer
    quake.control.command  Command
        Unsigned 8-bit integer
    quake.control.connect.game  Game
        String
    quake.control.connect.version  Version
        Unsigned 8-bit integer
    quake.control.player_info.address  Address
        String
    quake.control.player_info.colors  Colors
        Unsigned 32-bit integer
    quake.control.player_info.colors.pants  Pants
        Unsigned 8-bit integer
    quake.control.player_info.colors.shirt  Shirt
        Unsigned 8-bit integer
    quake.control.player_info.connect_time  Connect Time
        Unsigned 32-bit integer
    quake.control.player_info.frags  Frags
        Unsigned 32-bit integer
    quake.control.player_info.name  Name
        String
    quake.control.player_info.player  Player
        Unsigned 8-bit integer
    quake.control.reject.reason  Reason
        String
    quake.control.rule_info.lastrule  Last Rule
        String
    quake.control.rule_info.rule  Rule
        String
    quake.control.rule_info.value  Value
        String
    quake.control.server_info.address  Address
        String
    quake.control.server_info.game  Game
        String
    quake.control.server_info.map  Map
        String
    quake.control.server_info.max_player  Maximal Number of Players
        Unsigned 8-bit integer
    quake.control.server_info.num_player  Number of Players
        Unsigned 8-bit integer
    quake.control.server_info.server  Server
        String
    quake.control.server_info.version  Version
        Unsigned 8-bit integer
    quake.header.flags  Flags
        Unsigned 16-bit integer
    quake.header.length  Length
        Unsigned 16-bit integer
    quake.header.sequence  Sequence
        Unsigned 32-bit integer

  RIPng (ripng)

    ripng.cmd  Command
        Unsigned 8-bit integer
    ripng.version  Version
        Unsigned 8-bit integer

  RX Protocol (rx)

    rx.callnumber  Call Number
        Unsigned 32-bit integer
    rx.cid  CID
        Unsigned 32-bit integer
    rx.epoch  Epoch
        Unsigned 32-bit integer
    rx.flags  Flags
        Unsigned 8-bit integer
    rx.flags.client_init  Client Initiated
        Unsigned 8-bit integer
    rx.flags.free_packet  Free Packet
        Unsigned 8-bit integer
    rx.flags.last_packet  Last Packet
        Unsigned 8-bit integer
    rx.flags.more_packets  More Packets
        Unsigned 8-bit integer
    rx.flags.request_ack  Request Ack
        Unsigned 8-bit integer
    rx.securityindex  Security Index
        Unsigned 32-bit integer
    rx.seq  Sequence Number
        Unsigned 32-bit integer
    rx.serial  Serial
        Unsigned 32-bit integer
    rx.serviceid  Service ID
        Unsigned 16-bit integer
    rx.spare  Spare/Checksum
        Unsigned 16-bit integer
    rx.type  Type
        Unsigned 8-bit integer
    rx.userstatus  User Status
        Unsigned 32-bit integer

  Radius Protocol (radius)

    radius.code  Code
        Unsigned 8-bit integer
    radius.id  Identifier
        Unsigned 8-bit integer
    radius.length  Length
        Unsigned 16-bit integer

  Real Time Streaming Protocol (rtsp)

    rtsp.method  Method
        String
    rtsp.status  Status
        Unsigned 32-bit integer
    rtsp.url  URL
        String

  Real-Time Transport Protocol (rtp)

    rtp.cc  Contributing source identifiers count
        Unsigned 8-bit integer
    rtp.csrc.item  CSRC item
        Unsigned 32-bit integer
    rtp.ext  Extension
        Boolean
    rtp.ext.len  Extension length
        Unsigned 16-bit integer
    rtp.ext.profile  Defined by profile
        Unsigned 16-bit integer
    rtp.hdr_ext  Header extension
        Unsigned 32-bit integer
    rtp.marker  Marker
        Boolean
    rtp.p_type  Payload type
        Unsigned 8-bit integer
    rtp.padding  Padding
        Boolean
    rtp.padding.count  Padding count
        Unsigned 8-bit integer
    rtp.padding.data  Padding data
        Byte array
    rtp.payload  Payload
        Byte array
    rtp.seq  Sequence number
        Unsigned 16-bit integer
    rtp.ssrc  Synchronization Source identifier
        Unsigned 32-bit integer
    rtp.timestamp  Timestamp
        Unsigned 32-bit integer
    rtp.version  Version
        Unsigned 8-bit integer

  Real-time Transport Control Protocol (rtcp)

    rtcp.app.data  Application specific data
        Byte array
    rtcp.app.name  Name (ASCII)
        String
    rtcp.app.subtype  Subtype
        Unsigned 8-bit integer
    rtcp.length  Length
        Unsigned 16-bit integer
    rtcp.nack.blp  Bitmask of following lost packets
        Unsigned 16-bit integer
    rtcp.nack.fsn  First sequence number
        Unsigned 16-bit integer
    rtcp.padding  Padding
        Boolean
    rtcp.padding.count  Padding count
        Unsigned 8-bit integer
    rtcp.padding.data  Padding data
        Byte array
    rtcp.pt  Packet type
        Unsigned 8-bit integer
    rtcp.rc  Reception report count
        Unsigned 8-bit integer
    rtcp.sc  Source count
        Unsigned 8-bit integer
    rtcp.sdes.length  Length
        Unsigned 32-bit integer
    rtcp.sdes.prefix.length  Prefix length
        Unsigned 8-bit integer
    rtcp.sdes.prefix.string  Prefix string
        String
    rtcp.sdes.ssrc_csrc  SSRC / CSRC identifier
        Unsigned 32-bit integer
    rtcp.sdes.text  Text
        String
    rtcp.sdes.type  Type
        Unsigned 8-bit integer
    rtcp.sender.octetcount  Sender's octet count
        Unsigned 32-bit integer
    rtcp.sender.packetcount  Sender's packet count
        Unsigned 32-bit integer
    rtcp.senderssrc  Sender SSRC
        Unsigned 32-bit integer
    rtcp.ssrc.cum_nr  Cumulative number of packets lost
        Unsigned 32-bit integer
    rtcp.ssrc.dlsr  Delay since last SR timestamp
        Unsigned 32-bit integer
    rtcp.ssrc.ext_high  Extended highest sequence number received
        Unsigned 32-bit integer
    rtcp.ssrc.fraction  Fraction lost
        Unsigned 8-bit integer
    rtcp.ssrc.high_cycles  Sequence number cycles count
        Unsigned 16-bit integer
    rtcp.ssrc.high_seq  Highest sequence number received
        Unsigned 16-bit integer
    rtcp.ssrc.identifier  Identifier
        Unsigned 32-bit integer
    rtcp.ssrc.jitter  Interarrival jitter
        Unsigned 32-bit integer
    rtcp.ssrc.lsr  Last SR timestamp
        Unsigned 32-bit integer
    rtcp.timestamp.ntp  NTP timestamp
        String
    rtcp.timestamp.rtp  RTP timestamp
        Unsigned 32-bit integer
    rtcp.version  Version
        Unsigned 8-bit integer

  Remote Procedure Call (rpc)

    rpc.auth.flavor  Flavor
        Unsigned 32-bit integer
    rpc.auth.gid  GID
        Unsigned 32-bit integer
    rpc.auth.length  Length
        Unsigned 32-bit integer
    rpc.auth.machinename  Machine Name
        String
    rpc.auth.stamp  Stamp
        Unsigned 32-bit integer
    rpc.auth.uid  UID
        Unsigned 32-bit integer
    rpc.authgss.checksum  GSS Checksum
        Byte array
    rpc.authgss.context  GSS Context
        Byte array
    rpc.authgss.data  GSS Data
        Byte array
    rpc.authgss.data.length  Length
        Unsigned 32-bit integer
    rpc.authgss.major  GSS Major Status
        Unsigned 32-bit integer
    rpc.authgss.minor  GSS Minor Status
        Unsigned 32-bit integer
    rpc.authgss.procedure  GSS Procedure
        Unsigned 32-bit integer
    rpc.authgss.seqnum  GSS Sequence Number
        Unsigned 32-bit integer
    rpc.authgss.service  GSS Service
        Unsigned 32-bit integer
    rpc.authgss.token  GSS Token
        Byte array
    rpc.authgss.version  GSS Version
        Unsigned 32-bit integer
    rpc.authgss.window  GSS Sequence Window
        Unsigned 32-bit integer
    rpc.call.dup  Duplicate Call
        Unsigned 32-bit integer
    rpc.dup  Duplicate Transaction
        Unsigned 32-bit integer
    rpc.fraglen  Fragment Length
        Unsigned 32-bit integer
    rpc.lastfrag  Last Fragment
        Boolean
    rpc.msgtyp  Message Type
        Unsigned 32-bit integer
    rpc.procedure  Procedure
        Unsigned 32-bit integer
    rpc.program  Program
        Unsigned 32-bit integer
    rpc.programversion  Program Version
        Unsigned 32-bit integer
    rpc.programversion.max  Program Version (Maximum)
        Unsigned 32-bit integer
    rpc.programversion.min  Program Version (Minimum)
        Unsigned 32-bit integer
    rpc.reply.dup  Duplicate Reply
        Unsigned 32-bit integer
    rpc.replystat  Reply State
        Unsigned 32-bit integer
    rpc.state_accept  Accept State
        Unsigned 32-bit integer
    rpc.state_auth  Auth State
        Unsigned 32-bit integer
    rpc.state_reject  Reject State
        Unsigned 32-bit integer
    rpc.value_follows  Value Follows
        Boolean
    rpc.version  RPC Version
        Unsigned 32-bit integer
    rpc.version.max  RPC Version (Maximum)
        Unsigned 32-bit integer
    rpc.version.min  RPC Version (Minimum)
        Unsigned 32-bit integer
    rpc.xid  XID
        Unsigned 32-bit integer

  Remote Quota (rquota)

  Remote Shell (rsh)

    rsh.request  Request
        Boolean
    rsh.response  Response
        Boolean

  Resource ReserVation Protocol (RSVP) (rsvp)

    rsvp.adspec  ADSPEC
        Unsigned 8-bit integer
    rsvp.confirm  CONFIRM
        Unsigned 8-bit integer
    rsvp.error  ERROR
        Unsigned 8-bit integer
    rsvp.explicit_route  EXPLICIT ROUTE
        Unsigned 8-bit integer
    rsvp.filter  FILTERSPEC
        Unsigned 8-bit integer
    rsvp.flowspec  FLOWSPEC
        Unsigned 8-bit integer
    rsvp.hop  HOP
        Unsigned 8-bit integer
    rsvp.integrity  INTEGRITY
        Unsigned 8-bit integer
    rsvp.label  LABEL
        Unsigned 8-bit integer
    rsvp.label_request  LABEL REQUEST
        Unsigned 8-bit integer
    rsvp.msg  Message Type
        Unsigned 8-bit integer
    rsvp.obj_unknown  Unknown object
        Unsigned 8-bit integer
    rsvp.path  Path Message
        Boolean
    rsvp.perr  Path Error Message
        Boolean
    rsvp.policy  POLICY
        Unsigned 8-bit integer
    rsvp.ptear  Path Tear Message
        Boolean
    rsvp.record_route  RECORD ROUTE
        Unsigned 8-bit integer
    rsvp.rerr  Resv Error Message
        Boolean
    rsvp.resv  Resv Message
        Boolean
    rsvp.resvconf  Resv Confirm Message
        Boolean
    rsvp.rtear  Resv Tear Message
        Boolean
    rsvp.rtearconf  Resv Tear Confirm Message
        Boolean
    rsvp.scope  SCOPE
        Unsigned 8-bit integer
    rsvp.sender  SENDER TEMPLATE
        Unsigned 8-bit integer
    rsvp.sender.ip  Sender IPv4 address
        IPv4 address
    rsvp.sender.lsp_id  Sender LSP ID
        Unsigned 16-bit integer
    rsvp.sender.port  Sender port number
        Unsigned 16-bit integer
    rsvp.session  SESSION
        Unsigned 8-bit integer
    rsvp.session.ext_tunnel_id  Extended tunnel ID
        Unsigned 32-bit integer
    rsvp.session.ip  Destination address
        IPv4 address
    rsvp.session.port  Port number
        Unsigned 16-bit integer
    rsvp.session.proto  Protocol
        Unsigned 8-bit integer
    rsvp.session.tunnel_id  Tunnel ID
        Unsigned 16-bit integer
    rsvp.session_attribute  SESSION ATTRIBUTE
        Unsigned 8-bit integer
    rsvp.style  STYLE
        Unsigned 8-bit integer
    rsvp.time  TIME VALUES
        Unsigned 8-bit integer
    rsvp.tspec  SENDER TSPEC
        Unsigned 8-bit integer

  Rlogin Protocol (rlogin)

    rlogin.user_info  User Info
        No value
    rlogin.window_size  Window Info
        No value
    rlogin.window_size.cols  Columns
        Unsigned 16-bit integer
    rlogin.window_size.rows  Rows
        Unsigned 16-bit integer
    rlogin.window_size.x_pixels  X Pixels
        Unsigned 16-bit integer
    rlogin.window_size.y_pixels  Y Pixels
        Unsigned 16-bit integer

  Routing Information Protocol (rip)

  Routing Table Maintenance Protocol (rtmp)

    nbp.nodeid  Node
        Unsigned 8-bit integer
    nbp.nodeid.length  Node Length
        Unsigned 8-bit integer
    rtmp.function  Function
        Unsigned 8-bit integer
    rtmp.net  Net
        Unsigned 16-bit integer
    rtmp.tuple.dist  Distance
        Unsigned 16-bit integer
    rtmp.tuple.net  Net
        Unsigned 16-bit integer
    rtmp.tuple.range_end  Range End
        Unsigned 16-bit integer
    rtmp.tuple.range_start  Range Start
        Unsigned 16-bit integer

  SCCP user adaptation layer light (sual)

    sual.message_length  Message length
        Unsigned 32-bit integer
    sual.message_type  Message Type
        Unsigned 16-bit integer
    sual.spare_1  Spare
        Unsigned 8-bit integer
    sual.spare_2  Spare
        Unsigned 16-bit integer
    sual.subsystem_number  Subsystem number
        Unsigned 16-bit integer
    sual.version  Version
        Unsigned 8-bit integer

  SMB (Server Message Block Protocol) (smb)

    smb.cmd  SMB Command
        Unsigned 8-bit integer

  SMB MailSlot Protocol (mailslot)

  SNMP Multiplex Protocol (smux)

  SSCOP (sscop)

  Sequenced Packet eXchange (spx)

    spx.ack  Acknowledgment Number
        Unsigned 16-bit integer
    spx.alloc  Allocation Number
        Unsigned 16-bit integer
    spx.ctl  Connection Control
        Unsigned 8-bit integer
    spx.dst  Destination Connection ID
        Unsigned 16-bit integer
    spx.seq  Sequence Number
        Unsigned 16-bit integer
    spx.src  Source Connection ID
        Unsigned 16-bit integer
    spx.type  Datastream type
        Unsigned 8-bit integer

  Service Advertisement Protocol (ipxsap)

    ipxsap.request  Request
        Boolean
    ipxsap.response  Response
        Boolean

  Service Location Protocol (srvloc)

    srvloc.err  Error Code
        Unsigned 16-bit integer
    srvloc.flags  Flags
        Unsigned 8-bit integer
    srvloc.function  Function
        Unsigned 8-bit integer
    srvloc.version  Version
        Unsigned 8-bit integer

  Session Announcement Protocol (sap)

    sap.auth  Authentication data
        No value
    sap.auth.flags  Authentication data flags
        Unsigned 8-bit integer
    sap.auth.flags.p  Padding Bit
        Boolean
    sap.auth.flags.t  Authentication Type
        Unsigned 8-bit integer
    sap.auth.flags.v  Version Number
        Unsigned 8-bit integer
    sap.flags  Flags
        Unsigned 8-bit integer
    sap.flags.a  Address Type
        Boolean
    sap.flags.c  Compression Bit
        Boolean
    sap.flags.e  Encryption Bit
        Boolean
    sap.flags.r  Reserved
        Boolean
    sap.flags.t  Message Type
        Boolean
    sap.flags.v  Version Number
        Unsigned 8-bit integer

  Session Description Protocol (sdp)

  Session Initiation Protocol (sip)

    sip.msg_hdr  Message Header
        No value

  Short Frame (short)

  Simple Mail Transfer Protocol (smtp)

    smtp.req  Request
        Boolean
    smtp.rsp  Response
        Boolean

  Simple Network Management Protocol (snmp)

    snmpv3.flags  SNMPv3 Flags
        Unsigned 8-bit integer
    snmpv3.flags.auth  Authenticated
        Boolean
    snmpv3.flags.crypt  Encrypted
        Boolean
    snmpv3.flags.report  Reportable
        Boolean

  Sinec H1 Protocol (h1)

    h1.dbnr  Memory block number
        Unsigned 8-bit integer
    h1.dlen  Length in words
        Signed 16-bit integer
    h1.dwnr  Address within memory block
        Unsigned 16-bit integer
    h1.empty  Empty field
        Unsigned 8-bit integer
    h1.empty_len  Empty field length
        Unsigned 8-bit integer
    h1.header  H1-Header
        Unsigned 16-bit integer
    h1.len  Length indicator
        Unsigned 16-bit integer
    h1.opcode  Opcode
        Unsigned 8-bit integer
    h1.opfield  Operation identifier
        Unsigned 8-bit integer
    h1.oplen  Operation length
        Unsigned 8-bit integer
    h1.org  Memory type
        Unsigned 8-bit integer
    h1.reqlen  Request length
        Unsigned 8-bit integer
    h1.request  Request identifier
        Unsigned 8-bit integer
    h1.reslen  Response length
        Unsigned 8-bit integer
    h1.response  Response identifier
        Unsigned 8-bit integer
    h1.resvalue  Response value
        Unsigned 8-bit integer

  Socks Protocol (socks)

    socks.command  Command
        Unsigned 16-bit integer
    socks.dst  Remote Address
        IPv4 address
    socks.dstV6  Remote Address
        IPv6 address
    socks.dstport  Remote Port
        Unsigned 16-bit integer
    socks.username  User Name
        String
    socks.ver  Version
        Unsigned 8-bit integer

  Spanning Tree Protocol (stp)

    stp.bridge.hw  Bridge Identifier
        6-byte Hardware (MAC) Address
    stp.flags  BPDU flags
        Unsigned 8-bit integer
    stp.forward  Forward Delay
        Double-precision floating point
    stp.hello  Hello Time
        Double-precision floating point
    stp.max_age  Max Age
        Double-precision floating point
    stp.msg_age  Message Age
        Double-precision floating point
    stp.port  Port identifier
        Unsigned 16-bit integer
    stp.protocol  Protocol Identifier
        Unsigned 16-bit integer
    stp.root.cost  Root Path Cost
        Unsigned 32-bit integer
    stp.root.hw  Root Identifier
        6-byte Hardware (MAC) Address
    stp.type  BPDU type
        Unsigned 8-bit integer
    stp.version  Protocol Version Identifier
        Unsigned 8-bit integer

  Status Service (stat)

  Stream Control Transmission Protcol (sctp)

    sctp.cause.code  Cause code
        Unsigned 16-bit integer
    sctp.cause.length  Cause length
        Unsigned 16-bit integer
    sctp.cause.measure_of_staleness  Measure of staleness in usec
        Unsigned 32-bit integer
    sctp.cause.missing_parameter_type  Missing parameters type
        Unsigned 16-bit integer
    sctp.cause.nr_of_missing_parameters  Number of missing parameters
        Unsigned 32-bit integer
    sctp.cause.stream_identifier  Stream identifier
        Unsigned 16-bit integer
    sctp.cause.tsn  TSN
        Unsigned 32-bit integer
    sctp.checksum  Adler-32 checksum
        Unsigned 32-bit integer
    sctp.chunk_flags  Flags
        Unsigned 8-bit integer
    sctp.chunk_length  Length
        Unsigned 16-bit integer
    sctp.chunk_type  Identifier
        Unsigned 8-bit integer
    sctp.cumulative.tsn.ack  Cumulative TSN Ack
        Unsigned 32-bit integer
    sctp.cwr.lowest_tsn  Lowest TSN
        Unsigned 32-bit integer
    sctp.data.b_bit  B-Bit
        Boolean
    sctp.data.e_bit  E-Bit
        Boolean
    sctp.data.u.bit  U-Bit
        Boolean
    sctp.dstport  Destination port
        Unsigned 16-bit integer
    sctp.ecne.lowest_tsn  Lowest TSN
        Unsigned 32-bit integer
    sctp.init.chunk.credit  Advertised reciever window credit (a_rwnd)
        Unsigned 32-bit integer
    sctp.init.chunk.initial.tsn  Initial TSN
        Unsigned 32-bit integer
    sctp.init.chunk.initiate.tag  Initiate tag
        Unsigned 32-bit integer
    sctp.init.chunk.nr.in.streams  Number of inbound streams
        Unsigned 16-bit integer
    sctp.init.chunk.nr.out.streams  Number of outbound streams
        Unsigned 16-bit integer
    sctp.parameter.cookie_preservative_incr  Suggested Cookie life-span increment (msec)
        Unsigned 32-bit integer
    sctp.parameter.hostname.hostname  Hostname
        String
    sctp.parameter.ipv4_address  IP Version 4 address
        IPv4 address
    sctp.parameter.ipv6_address  IP Version 6 address
        IPv6 address
    sctp.parameter.length  Parameter length
        Unsigned 16-bit integer
    sctp.parameter.supported_addres_type  Supported address type
        Unsigned 16-bit integer
    sctp.parameter.type  Parameter type
        Unsigned 16-bit integer
    sctp.payload_proto_id  Payload Protocol identifier
        Unsigned 32-bit integer
    sctp.sack.a_rwnd  Advertised receiver window credit (a_rwnd)
        Unsigned 32-bit integer
    sctp.sack.cumulative_tsn_ack  Cumulative TSN ACK
        Unsigned 32-bit integer
    sctp.sack.duplicate.tsn  Duplicate TSN
        Unsigned 16-bit integer
    sctp.sack.gap_block_end  End
        Unsigned 16-bit integer
    sctp.sack.gap_block_start  Start
        Unsigned 16-bit integer
    sctp.sack.number_of_duplicated_tsns  Number of duplicated TSNs
        Unsigned 16-bit integer
    sctp.sack.number_of_gap_blocks  Number of gap acknowldgement blocks
        Unsigned 16-bit integer
    sctp.shutdown.cumulative_tsn_ack  Cumulative TSN Ack
        Unsigned 32-bit integer
    sctp.shutdown_complete.t_bit  E-Bit
        Boolean
    sctp.srcport  Source port
        Unsigned 16-bit integer
    sctp.stream_id  Stream Identifier
        Unsigned 16-bit integer
    sctp.stream_seq_number  Stream sequence number
        Unsigned 16-bit integer
    sctp.tsn  TSN
        Unsigned 32-bit integer
    sctp.verfication_tag  Verification tag
        Unsigned 32-bit integer

  Syslog message (syslog)

    syslog.facility  Facility
        Unsigned 8-bit integer
    syslog.level  Level
        Unsigned 8-bit integer
    syslog.msg_len  Message length
        Unsigned 32-bit integer

  Systems Network Architecture (sna)

    sna.rh  Request/Response Header
        No value
    sna.rh.0  Request/Response Header Byte 0
        Unsigned 8-bit integer
    sna.rh.1  Request/Response Header Byte 1
        Unsigned 8-bit integer
    sna.rh.2  Request/Response Header Byte 2
        Unsigned 8-bit integer
    sna.rh.bbi  Begin Bracket Indicator
        Boolean
    sna.rh.bci  Begin Chain Indicator
        Boolean
    sna.rh.cdi  Change Direction Indicator
        Boolean
    sna.rh.cebi  Conditional End Bracket Indicator
        Boolean
    sna.rh.csi  Code Selection Indicator
        Unsigned 8-bit integer
    sna.rh.dr1  Definite Response 1 Indicator
        Boolean
    sna.rh.dr2  Definite Response 2 Indicator
        Boolean
    sna.rh.ebi  End Bracket Indicator
        Boolean
    sna.rh.eci  End Chain Indicator
        Boolean
    sna.rh.edi  Enciphered Data Indicator
        Boolean
    sna.rh.eri  Exception Response Indicator
        Boolean
    sna.rh.fi  Format Indicator
        Boolean
    sna.rh.lcci  Length-Checked Compression Indicator
        Boolean
    sna.rh.pdi  Padded Data Indicator
        Boolean
    sna.rh.pi  Pacing Indicator
        Boolean
    sna.rh.qri  Queued Response Indicator
        Boolean
    sna.rh.rlwi  Request Larger Window Indicator
        Boolean
    sna.rh.rri  Request/Response Indicator
        Unsigned 8-bit integer
    sna.rh.rti  Response Type Indicator
        Boolean
    sna.rh.ru_category  Request/Response Unit Category
        Unsigned 8-bit integer
    sna.rh.sdi  Sense Data Included
        Boolean
    sna.th  Transmission Header
        No value
    sna.th.0  Transmission Header Byte 0
        Unsigned 8-bit integer
    sna.th.cmd_fmt  Command Format
        Unsigned 8-bit integer
    sna.th.cmd_sn  Command Sequence Number
        Unsigned 16-bit integer
    sna.th.cmd_type  Command Type
        Unsigned 8-bit integer
    sna.th.daf  Destination Address Field
        Unsigned 16-bit integer
    sna.th.dcf  Data Count Field
        Unsigned 16-bit integer
    sna.th.def  Destination Element Field
        Unsigned 16-bit integer
    sna.th.dsaf  Destination Subarea Address Field
        Unsigned 32-bit integer
    sna.th.efi  Expedited Flow Indicator
        Unsigned 8-bit integer
    sna.th.er_vr_supp_ind  ER and VR Support Indicator
        Unsigned 8-bit integer
    sna.th.ern  Explicit Route Number
        Unsigned 8-bit integer
    sna.th.fid  Format Identifer
        Unsigned 8-bit integer
    sna.th.iern  Initial Explicit Route Number
        Unsigned 8-bit integer
    sna.th.lsid  Local Session Identification
        Unsigned 8-bit integer
    sna.th.mft  MPR FID4 Type
        Boolean
    sna.th.mpf  Mapping Field
        Unsigned 8-bit integer
    sna.th.nlp_cp  NLP Count or Padding
        Unsigned 8-bit integer
    sna.th.nlpoi  NLP Offset Indicator
        Unsigned 8-bit integer
    sna.th.ntwk_prty  Network Priority
        Unsigned 8-bit integer
    sna.th.oaf  Origin Address Field
        Unsigned 16-bit integer
    sna.th.odai  ODAI Assignment Indicator
        Unsigned 8-bit integer
    sna.th.oef  Origin Element Field
        Unsigned 16-bit integer
    sna.th.osaf  Origin Subarea Address Field
        Unsigned 32-bit integer
    sna.th.piubf  PIU Blocking Field
        Unsigned 8-bit integer
    sna.th.sa  Session Address
        Byte array
    sna.th.snai  SNA Indicator
        Boolean
    sna.th.snf  Sequence Number Field
        Unsigned 16-bit integer
    sna.th.tg_nonfifo_ind  Transmission Group Non-FIFO Indicator
        Boolean
    sna.th.tg_snf  Transmission Group Sequence Number Field
        Unsigned 16-bit integer
    sna.th.tg_sweep  Transmission Group Sweep
        Unsigned 8-bit integer
    sna.th.tgsf  Transmission Group Segmenting Field
        Unsigned 8-bit integer
    sna.th.tpf  Transmission Priority Field
        Unsigned 8-bit integer
    sna.th.vr_cwi  Virtual Route Change Window Indicator
        Unsigned 16-bit integer
    sna.th.vr_cwri  Virtual Route Change Window Reply Indicator
        Unsigned 16-bit integer
    sna.th.vr_pac_cnt_ind  Virtual Route Pacing Count Indicator
        Unsigned 8-bit integer
    sna.th.vr_rwi  Virtual Route Reset Window Indicator
        Boolean
    sna.th.vr_snf_send  Virtual Route Send Sequence Number Field
        Unsigned 16-bit integer
    sna.th.vr_sqti  Virtual Route Sequence and Type Indicator
        Unsigned 16-bit integer
    sna.th.vrn  Virtual Route Number
        Unsigned 8-bit integer
    sna.th.vrprq  Virtual Route Pacing Request
        Boolean
    sna.th.vrprs  Virtual Route Pacing Response
        Boolean

  TACACS (tacacs)

    tacacs.request  Request
        Boolean
    tacacs.response  Response
        Boolean
    tacacs.version  Tacacs Version
        String

  TPKT (tpkt)

    tpkt.length  Length
        Unsigned 16-bit integer
    tpkt.reserved  Reserved
        Unsigned 8-bit integer
    tpkt.version  Version
        Unsigned 8-bit integer

  Telnet (telnet)

  Time Protocol (time)

    time.time  Time
        Unsigned 32-bit integer

  Token-Ring (tr)

    tr.ac  Access Control
        Unsigned 8-bit integer
    tr.addr  Source or Destination Address
        6-byte Hardware (MAC) Address
    tr.broadcast  Broadcast Type
        Unsigned 8-bit integer
    tr.direction  Direction
        Unsigned 8-bit integer
    tr.dst  Destination
        6-byte Hardware (MAC) Address
    tr.fc  Frame Control
        Unsigned 8-bit integer
    tr.frame  Frame
        Boolean
    tr.frame_pcf  Frame PCF
        Unsigned 8-bit integer
    tr.frame_type  Frame Type
        Unsigned 8-bit integer
    tr.max_frame_size  Maximum Frame Size
        Unsigned 8-bit integer
    tr.monitor_cnt  Monitor Count
        Unsigned 8-bit integer
    tr.priority  Priority
        Unsigned 8-bit integer
    tr.priority_reservation  Priority Reservation
        Unsigned 8-bit integer
    tr.rif  Ring-Bridge Pairs
        String
    tr.rif.bridge  RIF Bridge
        Unsigned 8-bit integer
    tr.rif.ring  RIF Ring
        Unsigned 16-bit integer
    tr.rif_bytes  RIF Bytes
        Unsigned 8-bit integer
    tr.sr  Source Routed
        Boolean
    tr.src  Source
        6-byte Hardware (MAC) Address

  Token-Ring Media Access Control (trmac)

    trmac.dstclass  Destination Class
        Unsigned 8-bit integer
    trmac.errors.abort  Abort Delimiter Transmitted Errors
        Unsigned 8-bit integer
    trmac.errors.ac  A/C Errors
        Unsigned 8-bit integer
    trmac.errors.burst  Burst Errors
        Unsigned 8-bit integer
    trmac.errors.congestion  Receiver Congestion Errors
        Unsigned 8-bit integer
    trmac.errors.fc  Frame-Copied Errors
        Unsigned 8-bit integer
    trmac.errors.freq  Frequency Errors
        Unsigned 8-bit integer
    trmac.errors.internal  Internal Errors
        Unsigned 8-bit integer
    trmac.errors.iso  Isolating Errors
        Unsigned 16-bit integer
    trmac.errors.line  Line Errors
        Unsigned 8-bit integer
    trmac.errors.lost  Lost Frame Errors
        Unsigned 8-bit integer
    trmac.errors.noniso  Non-Isolating Errors
        Unsigned 16-bit integer
    trmac.errors.token  Token Errors
        Unsigned 8-bit integer
    trmac.length  Total Length
        Unsigned 8-bit integer
    trmac.mvec  Major Vector
        Unsigned 8-bit integer
    trmac.naun  NAUN
        6-byte Hardware (MAC) Address
    trmac.srcclass  Source Class
        Unsigned 8-bit integer
    trmac.svec  Sub-Vector
        Unsigned 8-bit integer

  Transmission Control Protocol (tcp)

    tcp.ack  Acknowledgement number
        Unsigned 32-bit integer
    tcp.checksum  Checksum
        Unsigned 16-bit integer
    tcp.checksum_bad  Bad Checksum
        Boolean
    tcp.dstport  Destination Port
        Unsigned 16-bit integer
    tcp.flags  Flags
        Unsigned 8-bit integer
    tcp.flags.ack  Acknowledgment
        Boolean
    tcp.flags.cwr  Congestion Window Reduced (CWR)
        Boolean
    tcp.flags.ecn  ECN-Echo
        Boolean
    tcp.flags.fin  Fin
        Boolean
    tcp.flags.push  Push
        Boolean
    tcp.flags.reset  Reset
        Boolean
    tcp.flags.syn  Syn
        Boolean
    tcp.flags.urg  Urgent
        Boolean
    tcp.hdr_len  Header Length
        Unsigned 8-bit integer
    tcp.nxtseq  Next sequence number
        Unsigned 32-bit integer
    tcp.port  Source or Destination Port
        Unsigned 16-bit integer
    tcp.seq  Sequence number
        Unsigned 32-bit integer
    tcp.srcport  Source Port
        Unsigned 16-bit integer
    tcp.urgent_pointer  Urgent pointer
        Unsigned 16-bit integer
    tcp.window_size  Window size
        Unsigned 16-bit integer

  Transparent Network Substrate Protocol (tns)

    tns.compat_version  Version (Compatible)
        Unsigned 16-bit integer
    tns.connect  Connect
        Boolean
    tns.data_flag  Data Flag
        Unsigned 16-bit integer
    tns.header_checksum  Header Checksum
        Unsigned 16-bit integer
    tns.length  Packet Length
        Unsigned 32-bit integer
    tns.packet_checksum  Packet Checksum
        Unsigned 16-bit integer
    tns.request  Request
        Boolean
    tns.reserved_byte  Reserved Byte
        Byte array
    tns.response  Response
        Boolean
    tns.service_options  Service Options
        Unsigned 16-bit integer
    tns.sns  Secure Network Services
        Boolean
    tns.type  Packet Type
        Unsigned 8-bit integer
    tns.version  Version
        Unsigned 16-bit integer

  Trivial File Transfer Protocol (tftp)

    tftp.block  Block
        Unsigned 16-bit integer
    tftp.destination_file  DESTINATION File

    tftp.error.code  Error code
        Unsigned 16-bit integer
    tftp.error.message  Error message

    tftp.opcode  Opcode
        Unsigned 16-bit integer
    tftp.source_file  Source File

    tftp.type  Type

  User Datagram Protocol (udp)

    udp.checksum  Checksum
        Unsigned 16-bit integer
    udp.checksum_bad  Bad Checksum
        Boolean
    udp.dstport  Destination Port
        Unsigned 16-bit integer
    udp.length  Length
        Unsigned 16-bit integer
    udp.port  Source or Destination Port
        Unsigned 16-bit integer
    udp.srcport  Source Port
        Unsigned 16-bit integer

  Virtual Router Redundancy Protocol (vrrp)

    vrrp.type  VRRP packet type
        Unsigned 8-bit integer
    vrrp.typever  VRRP message version and type
        Unsigned 8-bit integer
    vrrp.version  VRRP protocol version
        Unsigned 8-bit integer

  Virtual Trunking Protocol (vtp)

    vtp.code  Code
        Unsigned 8-bit integer
    vtp.conf_rev_num  Configuration Revision Number
        Unsigned 32-bit integer
    vtp.followers  Followers
        Unsigned 8-bit integer
    vtp.md  Management Domain
        String
    vtp.md5_digest  MD5 Digest
        Byte array
    vtp.md_len  Management Domain Length
        Unsigned 8-bit integer
    vtp.seq_num  Sequence Number
        Unsigned 8-bit integer
    vtp.start_value  Start Value
        Unsigned 16-bit integer
    vtp.upd_id  Updater Identity
        IPv4 address
    vtp.upd_ts  Update Timestamp
        String
    vtp.version  Version
        Unsigned 8-bit integer
    vtp.vlan_info.802_10_index  802.10 Index
        Unsigned 32-bit integer
    vtp.vlan_info.isl_vlan_id  ISL VLAN ID
        Unsigned 16-bit integer
    vtp.vlan_info.len  VLAN Information Length
        Unsigned 8-bit integer
    vtp.vlan_info.mtu_size  MTU Size
        Unsigned 16-bit integer
    vtp.vlan_info.status.vlan_susp  VLAN suspended
        Boolean
    vtp.vlan_info.tlv_len  Length
        Unsigned 8-bit integer
    vtp.vlan_info.tlv_type  Type
        Unsigned 8-bit integer
    vtp.vlan_info.vlan_name  VLAN Name
        String
    vtp.vlan_info.vlan_name_len  VLAN Name Length
        Unsigned 8-bit integer
    vtp.vlan_info.vlan_type  VLAN Type
        Unsigned 8-bit integer

  Web Cache Coordination Protocol (wccp)

    wccp.cache_ip  Web Cache IP address
        IPv4 address
    wccp.change_num  Change Number
        Unsigned 32-bit integer
    wccp.hash_revision  Hash Revision
        Unsigned 32-bit integer
    wccp.message  WCCP Message Type
        Unsigned 32-bit integer
    wccp.recvd_id  Received ID
        Unsigned 32-bit integer
    wccp.version  WCCP Version
        Unsigned 32-bit integer

  Who (who)

    who.boottime  Boot Time
        Date/Time stamp
    who.hostname  Hostname
        String
    who.idle  Time Idle
        Unsigned 32-bit integer
    who.loadav_10  Load Average Over Past 10 Minutes
        Double-precision floating point
    who.loadav_15  Load Average Over Past 15 Minutes
        Double-precision floating point
    who.loadav_5  Load Average Over Past  5 Minutes
        Double-precision floating point
    who.recvtime  Receive Time
        Date/Time stamp
    who.sendtime  Send Time
        Date/Time stamp
    who.timeon  Time On
        Date/Time stamp
    who.tty  TTY Name
        String
    who.type  Type
        Unsigned 8-bit integer
    who.uid  User ID
        String
    who.vers  Version
        Unsigned 8-bit integer
    who.whoent  Who utmp Entry
        No value

  Wireless Session Protocol (wap-wsp)

    wsp.TID  Transmission ID
        Unsigned 8-bit integer
    wsp.capabilities  Capabilities
        No value
    wsp.capability.length  Capability Length
        Unsigned 32-bit integer
    wsp.content_type.parameter.charset  Charset
        Unsigned 16-bit integer
    wsp.content_type.type  Content Type
        Unsigned 8-bit integer
    wsp.header.accept  Accept
        Unsigned 8-bit integer
    wsp.header.accept.string  Accept
        String
    wsp.header.accept_charset  Accept-Charset
        Unsigned 16-bit integer
    wsp.header.accept_charset.string  Accept-Charset
        String
    wsp.header.accept_language  Accept-Language
        Unsigned 8-bit integer
    wsp.header.accept_language.string  Accept-Language
        String
    wsp.header.accept_ranges  Accept-Ranges
        Unsigned 8-bit integer
    wsp.header.age  Age
        Unsigned 32-bit integer
    wsp.header.application_header  Application Header
        String
    wsp.header.application_header.value  Application Header Value
        String
    wsp.header.cache_control  Cache-Control
        Unsigned 8-bit integer
    wsp.header.content_length  Content-Length
        Unsigned 32-bit integer
    wsp.header.date  Date
        Date/Time stamp
    wsp.header.etag  Etag
        String
    wsp.header.expires  Expires
        Date/Time stamp
    wsp.header.if_modified_since  If-Modified-Since
        Date/Time stamp
    wsp.header.last_modified  Last-Modified
        Date/Time stamp
    wsp.header.location  Location
        String
    wsp.header.server  Server
        String
    wsp.header.transfer_enc  Transfer Encoding
        Unsigned 8-bit integer
    wsp.header.transfer_enc_str  Transfer Encoding
        String
    wsp.header.user_agent  User-Agent
        String
    wsp.header.via  Via
        String
    wsp.header.x_wap_tod  X-WAP.TOD
        Date/Time stamp
    wsp.headers  Headers
        No value
    wsp.headers.header  Header
        No value
    wsp.headers_length  Headers Length
        Unsigned 32-bit integer
    wsp.pdu_type  PDU Type
        Unsigned 8-bit integer
    wsp.post.data  Post Data
        No value
    wsp.reply.data  Data
        No value
    wsp.reply.status  Status
        Unsigned 8-bit integer
    wsp.server.session_id  Server Session ID
        Unsigned 32-bit integer
    wsp.uri  URI
        String
    wsp.uri_length  URI Length
        Unsigned 32-bit integer
    wsp.version.major  Version (Major)
        Unsigned 8-bit integer
    wsp.version.minor  Version (Minor)
        Unsigned 8-bit integer

  Wireless Transaction Protocol (wap-wsp-wtp)

    wtp.RID  Re-transmission Indicator
        Boolean
    wtp.TID  Transmission ID
        Unsigned 16-bit integer
    wtp.TID.response  TID Response
        Boolean
    wtp.abort.reason.provider  Abort Reason
        Unsigned 8-bit integer
    wtp.abort.reason.user  Abort Reason
        Unsigned 8-bit integer
    wtp.abort.type  Abort Type
        Unsigned 8-bit integer
    wtp.ack.tvetok  Tve/Tok flag
        Boolean
    wtp.continue_flag  Continue Flag
        Boolean
    wtp.header.TIDNew  TIDNew
        Boolean
    wtp.header.UP  U/P flag
        Boolean
    wtp.header.missing_packets  Missing Packets
        Unsigned 8-bit integer
    wtp.header.sequence  Packet Sequence Number
        Unsigned 8-bit integer
    wtp.header.version  Version
        Unsigned 8-bit integer
    wtp.header_data  Data
        Byte array
    wtp.header_fixed_part  Header
        Byte array
    wtp.header_variable_part  Header: Variable part
        Byte array
    wtp.inv.reserved  Reserved
        Unsigned 8-bit integer
    wtp.inv.transaction_class  Transaction Class
        Unsigned 8-bit integer
    wtp.pdu_type  PDU Type
        Unsigned 8-bit integer
    wtp.trailer_flags  Trailer Flags
        Unsigned 8-bit integer

  Wireless Transport Layer Security (wap-wtls)

    wsp.wtls.alert  Alert
        No value
    wsp.wtls.alert.description  Description
        Unsigned 8-bit integer
    wsp.wtls.alert.level  Level
        Unsigned 8-bit integer
    wsp.wtls.handshake  Handshake
        Unsigned 8-bit integer
    wsp.wtls.handshake.certificate  Certificate
        No value
    wsp.wtls.handshake.certificate.after  Valid not after
        Date/Time stamp
    wsp.wtls.handshake.certificate.before  Valid not before
        Date/Time stamp
    wsp.wtls.handshake.certificate.issuer.charset  Charset
        Unsigned 16-bit integer
    wsp.wtls.handshake.certificate.issuer.name  Name
        String
    wsp.wtls.handshake.certificate.issuer.type  Issuer
        Unsigned 8-bit integer
    wsp.wtls.handshake.certificate.parameter  Parameter Set
        String
    wsp.wtls.handshake.certificate.parameter_index  Parameter Index
        Unsigned 8-bit integer
    wsp.wtls.handshake.certificate.public.type  Public Key Type
        Unsigned 8-bit integer
    wsp.wtls.handshake.certificate.rsa.exponent  RSA Exponent Size
        Unsigned 32-bit integer
    wsp.wtls.handshake.certificate.rsa.modulus  RSA Modulus Size
        Unsigned 32-bit integer
    wsp.wtls.handshake.certificate.signature.signature  Signature Size
        Unsigned 32-bit integer
    wsp.wtls.handshake.certificate.signature.type  Signature Type
        Unsigned 8-bit integer
    wsp.wtls.handshake.certificate.subject.charset  Charset
        Unsigned 16-bit integer
    wsp.wtls.handshake.certificate.subject.name  Name
        String
    wsp.wtls.handshake.certificate.subject.type  Subject
        Unsigned 8-bit integer
    wsp.wtls.handshake.certificate.type  Type
        Unsigned 8-bit integer
    wsp.wtls.handshake.certificate.version  Version
        Unsigned 8-bit integer
    wsp.wtls.handshake.certificates  Certificates
        No value
    wsp.wtls.handshake.client_hello  Client Hello
        No value
    wsp.wtls.handshake.client_hello.cipher  Cipher
        No value
    wsp.wtls.handshake.client_hello.cipher.bulk  Cipher Bulk
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.cipher.mac  Cipher MAC
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.ciphers  Cipher Suites
        No value
    wsp.wtls.handshake.client_hello.client_keys_id  Client Keys
        No value
    wsp.wtls.handshake.client_hello.comp_methods  Compression Methods
        No value
    wsp.wtls.handshake.client_hello.compression  Compression
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.gmt  Time GMT
        Date/Time stamp
    wsp.wtls.handshake.client_hello.ident_type  Identifier Type
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.key.key_exchange  Key Exchange
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.key.key_exchange.suite  Suite
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.parameter  Parameter Set
        String
    wsp.wtls.handshake.client_hello.parameter_index  Parameter Index
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.random  Random
        No value
    wsp.wtls.handshake.client_hello.refresh  Refresh
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.sequence_mode  Sequence Mode
        Unsigned 8-bit integer
    wsp.wtls.handshake.client_hello.sessionid  Session ID
        No value
    wsp.wtls.handshake.client_hello.trusted_keys_id  Trusted Keys
        No value
    wsp.wtls.handshake.client_hello.version  Version
        Unsigned 8-bit integer
    wsp.wtls.handshake.length  Length
        Unsigned 16-bit integer
    wsp.wtls.handshake.server_hello  Server Hello
        No value
    wsp.wtls.handshake.server_hello.cipher  Cipher
        No value
    wsp.wtls.handshake.server_hello.cipher.bulk  Cipher Bulk
        Unsigned 8-bit integer
    wsp.wtls.handshake.server_hello.cipher.mac  Cipher MAC
        Unsigned 8-bit integer
    wsp.wtls.handshake.server_hello.compression  Compression
        Unsigned 8-bit integer
    wsp.wtls.handshake.server_hello.gmt  Time GMT
        Date/Time stamp
    wsp.wtls.handshake.server_hello.key  Client Key ID
        Unsigned 8-bit integer
    wsp.wtls.handshake.server_hello.random  Random
        No value
    wsp.wtls.handshake.server_hello.refresh  Refresh
        Unsigned 8-bit integer
    wsp.wtls.handshake.server_hello.sequence_mode  Sequence Mode
        Unsigned 8-bit integer
    wsp.wtls.handshake.server_hello.sessionid  Session ID
        No value
    wsp.wtls.handshake.server_hello.version  Version
        Unsigned 8-bit integer
    wsp.wtls.handshake.type  Type
        Unsigned 8-bit integer
    wsp.wtls.rec_cipher  Record Ciphered
        No value
    wsp.wtls.rec_length  Record Length
        Unsigned 16-bit integer
    wsp.wtls.rec_seq  Record Sequence
        Unsigned 16-bit integer
    wsp.wtls.rec_type  Record Type
        Unsigned 8-bit integer
    wsp.wtls.record  Record
        Unsigned 8-bit integer

  X.25 (x.25)

    x.25.a  A Bit
        Boolean
    x.25.d  D Bit
        Boolean
    x.25.gfi  GFI
        Unsigned 16-bit integer
    x.25.lcn  Logical Channel
        Unsigned 16-bit integer
    x.25.m  M Bit
        Boolean
    x.25.mod  Modulo
        Unsigned 16-bit integer
    x.25.p_r  P(R)
        Unsigned 8-bit integer
    x.25.p_s  P(S)
        Unsigned 8-bit integer
    x.25.q  Q Bit
        Boolean
    x.25.type  Packet Type
        Unsigned 8-bit integer

  X.25 over TCP (xot)

  X11 (x11)

    x11.acceleration-denominator  acceleration-denominator
        Signed 16-bit integer
    x11.acceleration-numerator  acceleration-numerator
        Signed 16-bit integer
    x11.access-mode  access-mode
        Unsigned 8-bit integer
    x11.address  address
        Byte array
    x11.address-length  address-length
        Unsigned 16-bit integer
    x11.alloc  alloc
        Unsigned 8-bit integer
    x11.allow-events-mode  allow-events-mode
        Unsigned 8-bit integer
    x11.allow-exposures  allow-exposures
        Unsigned 8-bit integer
    x11.arc  arc
        No value
    x11.arc.angle1  angle1
        Signed 16-bit integer
    x11.arc.angle2  angle2
        Signed 16-bit integer
    x11.arc.height  height
        Unsigned 16-bit integer
    x11.arc.mode  mode
        Unsigned 8-bit integer
    x11.arc.width  width
        Unsigned 16-bit integer
    x11.arc.x  x
        Signed 16-bit integer
    x11.arc.y  y
        Signed 16-bit integer
    x11.arcs  arcs
        No value
    x11.atom  atom
        Unsigned 32-bit integer
    x11.auto-repeat-mode  auto-repeat-mode
        Unsigned 8-bit integer
    x11.back-blue  back-blue
        Unsigned 16-bit integer
    x11.back-green  back-green
        Unsigned 16-bit integer
    x11.back-red  back-red
        Unsigned 16-bit integer
    x11.background  background
        Unsigned 32-bit integer
    x11.background-pixel  background-pixel
        Unsigned 32-bit integer
    x11.background-pixmap  background-pixmap
        Unsigned 32-bit integer
    x11.backing-pixel  backing-pixel
        Unsigned 32-bit integer
    x11.backing-planes  backing-planes
        Unsigned 32-bit integer
    x11.backing-store  backing-store
        Unsigned 8-bit integer
    x11.bell-duration  bell-duration
        Signed 16-bit integer
    x11.bell-percent  bell-percent
        Signed 8-bit integer
    x11.bell-pitch  bell-pitch
        Signed 16-bit integer
    x11.bit-gravity  bit-gravity
        Unsigned 8-bit integer
    x11.bit-plane  bit-plane
        Unsigned 32-bit integer
    x11.blue  blue
        Unsigned 16-bit integer
    x11.blues  blues
        Unsigned 16-bit integer
    x11.border-pixel  border-pixel
        Unsigned 32-bit integer
    x11.border-pixmap  border-pixmap
        Unsigned 32-bit integer
    x11.border-width  border-width
        Unsigned 16-bit integer
    x11.button  button
        Unsigned 8-bit integer
    x11.cap-style  cap-style
        Unsigned 8-bit integer
    x11.change-host-mode  change-host-mode
        Unsigned 8-bit integer
    x11.cid  cid
        Unsigned 32-bit integer
    x11.class  class
        Unsigned 8-bit integer
    x11.clip-mask  clip-mask
        Unsigned 32-bit integer
    x11.clip-x-origin  clip-x-origin
        Signed 16-bit integer
    x11.clip-y-origin  clip-y-origin
        Signed 16-bit integer
    x11.close-down-mode  close-down-mode
        Unsigned 8-bit integer
    x11.cmap  cmap
        Unsigned 32-bit integer
    x11.color-items  color-items
        No value
    x11.coloritem  coloritem
        No value
    x11.coloritem.blue  blue
        Unsigned 16-bit integer
    x11.coloritem.flags  flags
        Unsigned 8-bit integer
    x11.coloritem.flags.do-blue  do-blue
        Boolean
    x11.coloritem.flags.do-green  do-green
        Boolean
    x11.coloritem.flags.do-red  do-red
        Boolean
    x11.coloritem.flags.unused  unused
        Boolean
    x11.coloritem.green  green
        Unsigned 16-bit integer
    x11.coloritem.pixel  pixel
        Unsigned 32-bit integer
    x11.coloritem.red  red
        Unsigned 16-bit integer
    x11.coloritem.unused  unused
        No value
    x11.colormap  colormap
        Unsigned 32-bit integer
    x11.colors  colors
        Unsigned 16-bit integer
    x11.configure-window-mask  configure-window-mask
        Unsigned 16-bit integer
    x11.configure-window-mask.border-width  border-width
        Boolean
    x11.configure-window-mask.height  height
        Boolean
    x11.configure-window-mask.sibling  sibling
        Boolean
    x11.configure-window-mask.stack-mode  stack-mode
        Boolean
    x11.configure-window-mask.width  width
        Boolean
    x11.configure-window-mask.x  x
        Boolean
    x11.configure-window-mask.y  y
        Boolean
    x11.confine-to  confine-to
        Unsigned 32-bit integer
    x11.contiguous  contiguous
        Boolean
    x11.coordinate-mode  coordinate-mode
        Unsigned 8-bit integer
    x11.count  count
        Unsigned 8-bit integer
    x11.cursor  cursor
        Unsigned 32-bit integer
    x11.dash-offset  dash-offset
        Unsigned 16-bit integer
    x11.dashes  dashes
        Byte array
    x11.dashes-length  dashes-length
        Unsigned 16-bit integer
    x11.data  data
        Byte array
    x11.data-length  data-length
        Unsigned 32-bit integer
    x11.delete  delete
        Boolean
    x11.delta  delta
        Signed 16-bit integer
    x11.depth  depth
        Unsigned 8-bit integer
    x11.direction  direction
        Unsigned 8-bit integer
    x11.do-acceleration  do-acceleration
        Boolean
    x11.do-not-propagate-mask  do-not-propagate-mask
        Unsigned 32-bit integer
    x11.do-not-propagate-mask.Button1Motion  Button1Motion
        Boolean
    x11.do-not-propagate-mask.Button2Motion  Button2Motion
        Boolean
    x11.do-not-propagate-mask.Button3Motion  Button3Motion
        Boolean
    x11.do-not-propagate-mask.Button4Motion  Button4Motion
        Boolean
    x11.do-not-propagate-mask.Button5Motion  Button5Motion
        Boolean
    x11.do-not-propagate-mask.ButtonMotion  ButtonMotion
        Boolean
    x11.do-not-propagate-mask.ButtonPress  ButtonPress
        Boolean
    x11.do-not-propagate-mask.ButtonRelease  ButtonRelease
        Boolean
    x11.do-not-propagate-mask.KeyPress  KeyPress
        Boolean
    x11.do-not-propagate-mask.KeyRelease  KeyRelease
        Boolean
    x11.do-not-propagate-mask.PointerMotion  PointerMotion
        Boolean
    x11.do-not-propagate-mask.erroneous-bits  erroneous-bits
        Boolean
    x11.do-threshold  do-threshold
        Boolean
    x11.drawable  drawable
        Unsigned 32-bit integer
    x11.dst-drawable  dst-drawable
        Unsigned 32-bit integer
    x11.dst-gc  dst-gc
        Unsigned 32-bit integer
    x11.dst-window  dst-window
        Unsigned 32-bit integer
    x11.dst-x  dst-x
        Signed 16-bit integer
    x11.dst-y  dst-y
        Signed 16-bit integer
    x11.event-mask  event-mask
        Unsigned 32-bit integer
    x11.event-mask.Button1Motion  Button1Motion
        Boolean
    x11.event-mask.Button2Motion  Button2Motion
        Boolean
    x11.event-mask.Button3Motion  Button3Motion
        Boolean
    x11.event-mask.Button4Motion  Button4Motion
        Boolean
    x11.event-mask.Button5Motion  Button5Motion
        Boolean
    x11.event-mask.ButtonMotion  ButtonMotion
        Boolean
    x11.event-mask.ButtonPress  ButtonPress
        Boolean
    x11.event-mask.ButtonRelease  ButtonRelease
        Boolean
    x11.event-mask.ColormapChange  ColormapChange
        Boolean
    x11.event-mask.EnterWindow  EnterWindow
        Boolean
    x11.event-mask.Exposure  Exposure
        Boolean
    x11.event-mask.FocusChange  FocusChange
        Boolean
    x11.event-mask.KeyPress  KeyPress
        Boolean
    x11.event-mask.KeyRelease  KeyRelease
        Boolean
    x11.event-mask.KeymapState  KeymapState
        Boolean
    x11.event-mask.LeaveWindow  LeaveWindow
        Boolean
    x11.event-mask.OwnerGrabButton  OwnerGrabButton
        Boolean
    x11.event-mask.PointerMotion  PointerMotion
        Boolean
    x11.event-mask.PointerMotionHint  PointerMotionHint
        Boolean
    x11.event-mask.PropertyChange  PropertyChange
        Boolean
    x11.event-mask.ResizeRedirect  ResizeRedirect
        Boolean
    x11.event-mask.StructureNotify  StructureNotify
        Boolean
    x11.event-mask.SubstructureNotify  SubstructureNotify
        Boolean
    x11.event-mask.SubstructureRedirect  SubstructureRedirect
        Boolean
    x11.event-mask.VisibilityChange  VisibilityChange
        Boolean
    x11.event-mask.erroneous-bits  erroneous-bits
        Boolean
    x11.exposures  exposures
        Boolean
    x11.family  family
        Unsigned 8-bit integer
    x11.fid  fid
        Unsigned 32-bit integer
    x11.fill-rule  fill-rule
        Unsigned 8-bit integer
    x11.fill-style  fill-style
        Unsigned 8-bit integer
    x11.first-keycode  first-keycode
        Unsigned 8-bit integer
    x11.focus  focus
        Unsigned 8-bit integer
    x11.font  font
        Unsigned 32-bit integer
    x11.fore-blue  fore-blue
        Unsigned 16-bit integer
    x11.fore-green  fore-green
        Unsigned 16-bit integer
    x11.fore-red  fore-red
        Unsigned 16-bit integer
    x11.foreground  foreground
        Unsigned 32-bit integer
    x11.format  format
        Unsigned 8-bit integer
    x11.function  function
        Unsigned 8-bit integer
    x11.gc  gc
        Unsigned 32-bit integer
    x11.gc-dashes  gc-dashes
        Unsigned 8-bit integer
    x11.gc-value-mask  gc-value-mask
        Unsigned 32-bit integer
    x11.gc-value-mask.arc-mode  arc-mode
        Boolean
    x11.gc-value-mask.background  background
        Boolean
    x11.gc-value-mask.cap-style  cap-style
        Boolean
    x11.gc-value-mask.clip-mask  clip-mask
        Boolean
    x11.gc-value-mask.clip-x-origin  clip-x-origin
        Boolean
    x11.gc-value-mask.clip-y-origin  clip-y-origin
        Boolean
    x11.gc-value-mask.dash-offset  dash-offset
        Boolean
    x11.gc-value-mask.fill-rule  fill-rule
        Boolean
    x11.gc-value-mask.fill-style  fill-style
        Boolean
    x11.gc-value-mask.font  font
        Boolean
    x11.gc-value-mask.foreground  foreground
        Boolean
    x11.gc-value-mask.function  function
        Boolean
    x11.gc-value-mask.gc-dashes  gc-dashes
        Boolean
    x11.gc-value-mask.graphics-exposures  graphics-exposures
        Boolean
    x11.gc-value-mask.join-style  join-style
        Boolean
    x11.gc-value-mask.line-style  line-style
        Boolean
    x11.gc-value-mask.line-width  line-width
        Boolean
    x11.gc-value-mask.plane-mask  plane-mask
        Boolean
    x11.gc-value-mask.stipple  stipple
        Boolean
    x11.gc-value-mask.subwindow-mode  subwindow-mode
        Boolean
    x11.gc-value-mask.tile  tile
        Boolean
    x11.gc-value-mask.tile-stipple-x-origin  tile-stipple-x-origin
        Boolean
    x11.gc-value-mask.tile-stipple-y-origin  tile-stipple-y-origin
        Boolean
    x11.get-property-type  get-property-type
        Unsigned 32-bit integer
    x11.grab_window  grab_window
        Unsigned 32-bit integer
    x11.graphics-exposures  graphics-exposures
        Boolean
    x11.green  green
        Unsigned 16-bit integer
    x11.greens  greens
        Unsigned 16-bit integer
    x11.height  height
        Unsigned 16-bit integer
    x11.image-format  image-format
        Unsigned 8-bit integer
    x11.image-pixmap-format  image-pixmap-format
        Unsigned 8-bit integer
    x11.interval  interval
        Signed 16-bit integer
    x11.items  items
        No value
    x11.join-style  join-style
        Unsigned 8-bit integer
    x11.key  key
        Unsigned 8-bit integer
    x11.key-click-percent  key-click-percent
        Signed 8-bit integer
    x11.keyboard-key  keyboard-key
        Unsigned 8-bit integer
    x11.keyboard-mode  keyboard-mode
        Unsigned 8-bit integer
    x11.keyboard-value-mask  keyboard-value-mask
        Unsigned 32-bit integer
    x11.keyboard-value-mask.auto-repeat-mode  auto-repeat-mode
        Boolean
    x11.keyboard-value-mask.bell-duration  bell-duration
        Boolean
    x11.keyboard-value-mask.bell-percent  bell-percent
        Boolean
    x11.keyboard-value-mask.bell-pitch  bell-pitch
        Boolean
    x11.keyboard-value-mask.key-click-percent  key-click-percent
        Boolean
    x11.keyboard-value-mask.keyboard-key  keyboard-key
        Boolean
    x11.keyboard-value-mask.led  led
        Boolean
    x11.keyboard-value-mask.led-mode  led-mode
        Boolean
    x11.keycode-count  keycode-count
        Unsigned 8-bit integer
    x11.keycodes  keycodes
        No value
    x11.keycodes-per-modifier  keycodes-per-modifier
        Unsigned 8-bit integer
    x11.keycodes.item  item
        Byte array
    x11.keysyms  keysyms
        No value
    x11.keysyms-per-keycode  keysyms-per-keycode
        Unsigned 8-bit integer
    x11.keysyms.item  item
        No value
    x11.keysyms.item.keysym  keysym
        Unsigned 32-bit integer
    x11.led  led
        Unsigned 8-bit integer
    x11.led-mode  led-mode
        Unsigned 8-bit integer
    x11.left-pad  left-pad
        Unsigned 8-bit integer
    x11.line-style  line-style
        Unsigned 8-bit integer
    x11.line-width  line-width
        Unsigned 16-bit integer
    x11.long-length  long-length
        Unsigned 32-bit integer
    x11.long-offset  long-offset
        Unsigned 32-bit integer
    x11.map  map
        Byte array
    x11.map-length  map-length
        Unsigned 8-bit integer
    x11.mask  mask
        Unsigned 32-bit integer
    x11.mask-char  mask-char
        Unsigned 16-bit integer
    x11.mask-font  mask-font
        Unsigned 32-bit integer
    x11.max-names  max-names
        Unsigned 16-bit integer
    x11.mid  mid
        Unsigned 32-bit integer
    x11.mode  mode
        Unsigned 8-bit integer
    x11.modifiers-mask  modifiers-mask
        Unsigned 16-bit integer
    x11.modifiers-mask.AnyModifier  AnyModifier
        Unsigned 16-bit integer
    x11.modifiers-mask.Control  Control
        Boolean
    x11.modifiers-mask.Lock  Lock
        Boolean
    x11.modifiers-mask.Mod1  Mod1
        Boolean
    x11.modifiers-mask.Mod2  Mod2
        Boolean
    x11.modifiers-mask.Mod3  Mod3
        Boolean
    x11.modifiers-mask.Mod4  Mod4
        Boolean
    x11.modifiers-mask.Mod5  Mod5
        Boolean
    x11.modifiers-mask.Shift  Shift
        Boolean
    x11.modifiers-mask.erroneous-bits  erroneous-bits
        Boolean
    x11.name  name
        String
    x11.name-length  name-length
        Unsigned 16-bit integer
    x11.odd-length  odd-length
        Boolean
    x11.only-if-exists  only-if-exists
        Boolean
    x11.opcode  opcode
        Unsigned 8-bit integer
    x11.ordering  ordering
        Unsigned 8-bit integer
    x11.override-redirect  override-redirect
        Boolean
    x11.owner  owner
        Unsigned 32-bit integer
    x11.owner-events  owner-events
        Boolean
    x11.parent  parent
        Unsigned 32-bit integer
    x11.path  path
        No value
    x11.path.string  string
        String
    x11.pattern  pattern
        String
    x11.pattern-length  pattern-length
        Unsigned 16-bit integer
    x11.percent  percent
        Unsigned 8-bit integer
    x11.pid  pid
        Unsigned 32-bit integer
    x11.pixel  pixel
        Unsigned 32-bit integer
    x11.pixels  pixels
        No value
    x11.pixels_item  pixels_item
        Unsigned 32-bit integer
    x11.pixmap  pixmap
        Unsigned 32-bit integer
    x11.plane-mask  plane-mask
        Unsigned 32-bit integer
    x11.planes  planes
        Unsigned 16-bit integer
    x11.point  point
        No value
    x11.point-x  point-x
        Signed 16-bit integer
    x11.point-y  point-y
        Signed 16-bit integer
    x11.pointer-event-mask  pointer-event-mask
        Unsigned 16-bit integer
    x11.pointer-event-mask.Button1Motion  Button1Motion
        Boolean
    x11.pointer-event-mask.Button2Motion  Button2Motion
        Boolean
    x11.pointer-event-mask.Button3Motion  Button3Motion
        Boolean
    x11.pointer-event-mask.Button4Motion  Button4Motion
        Boolean
    x11.pointer-event-mask.Button5Motion  Button5Motion
        Boolean
    x11.pointer-event-mask.ButtonMotion  ButtonMotion
        Boolean
    x11.pointer-event-mask.ButtonPress  ButtonPress
        Boolean
    x11.pointer-event-mask.ButtonRelease  ButtonRelease
        Boolean
    x11.pointer-event-mask.EnterWindow  EnterWindow
        Boolean
    x11.pointer-event-mask.KeymapState  KeymapState
        Boolean
    x11.pointer-event-mask.LeaveWindow  LeaveWindow
        Boolean
    x11.pointer-event-mask.PointerMotion  PointerMotion
        Boolean
    x11.pointer-event-mask.PointerMotionHint  PointerMotionHint
        Boolean
    x11.pointer-event-mask.erroneous-bits  erroneous-bits
        Boolean
    x11.pointer-mode  pointer-mode
        Unsigned 8-bit integer
    x11.points  points
        No value
    x11.prefer-blanking  prefer-blanking
        Unsigned 8-bit integer
    x11.properties  properties
        No value
    x11.properties.item  item
        Unsigned 32-bit integer
    x11.property  property
        Unsigned 32-bit integer
    x11.property-number  property-number
        Unsigned 16-bit integer
    x11.rectangle  rectangle
        No value
    x11.rectangle-height  rectangle-height
        Unsigned 16-bit integer
    x11.rectangle-width  rectangle-width
        Unsigned 16-bit integer
    x11.rectangle-x  rectangle-x
        Signed 16-bit integer
    x11.rectangle-y  rectangle-y
        Signed 16-bit integer
    x11.rectangles  rectangles
        No value
    x11.red  red
        Unsigned 16-bit integer
    x11.reds  reds
        Unsigned 16-bit integer
    x11.request  request
        Unsigned 8-bit integer
    x11.request-length  request-length
        Unsigned 16-bit integer
    x11.requestor  requestor
        Unsigned 32-bit integer
    x11.resource  resource
        Unsigned 32-bit integer
    x11.revert-to  revert-to
        Unsigned 8-bit integer
    x11.save-set-mode  save-set-mode
        Unsigned 8-bit integer
    x11.save-under  save-under
        Boolean
    x11.screen-saver-mode  screen-saver-mode
        Unsigned 8-bit integer
    x11.segment  segment
        No value
    x11.segment_x1  segment_x1
        Signed 16-bit integer
    x11.segment_x2  segment_x2
        Signed 16-bit integer
    x11.segment_y1  segment_y1
        Signed 16-bit integer
    x11.segment_y2  segment_y2
        Signed 16-bit integer
    x11.segments  segments
        No value
    x11.selection  selection
        Unsigned 32-bit integer
    x11.shape  shape
        Unsigned 8-bit integer
    x11.sibling  sibling
        Unsigned 32-bit integer
    x11.source-char  source-char
        Unsigned 16-bit integer
    x11.source-font  source-font
        Unsigned 32-bit integer
    x11.source-pixmap  source-pixmap
        Unsigned 32-bit integer
    x11.src-cmap  src-cmap
        Unsigned 32-bit integer
    x11.src-drawable  src-drawable
        Unsigned 32-bit integer
    x11.src-gc  src-gc
        Unsigned 32-bit integer
    x11.src-height  src-height
        Unsigned 16-bit integer
    x11.src-width  src-width
        Unsigned 16-bit integer
    x11.src-window  src-window
        Unsigned 32-bit integer
    x11.src-x  src-x
        Signed 16-bit integer
    x11.src-y  src-y
        Signed 16-bit integer
    x11.stack-mode  stack-mode
        Unsigned 8-bit integer
    x11.start  start
        Unsigned 32-bit integer
    x11.stipple  stipple
        Unsigned 32-bit integer
    x11.stop  stop
        Unsigned 32-bit integer
    x11.str-number-in-path  str-number-in-path
        Unsigned 16-bit integer
    x11.string  string
        String
    x11.string-length  string-length
        Unsigned 32-bit integer
    x11.string16  string16
        String
    x11.string16.bytes  bytes
        Byte array
    x11.subwindow-mode  subwindow-mode
        Unsigned 8-bit integer
    x11.target  target
        Unsigned 32-bit integer
    x11.textitem  textitem
        No value
    x11.textitem.font  font
        Unsigned 32-bit integer
    x11.textitem.string  string
        No value
    x11.textitem.string.delta  delta
        Signed 8-bit integer
    x11.textitem.string.string16  string16
        String
    x11.textitem.string.string16.bytes  bytes
        Byte array
    x11.textitem.string.string8  string8
        String
    x11.threshold  threshold
        Signed 16-bit integer
    x11.tile  tile
        Unsigned 32-bit integer
    x11.tile-stipple-x-origin  tile-stipple-x-origin
        Signed 16-bit integer
    x11.tile-stipple-y-origin  tile-stipple-y-origin
        Signed 16-bit integer
    x11.time  time
        Unsigned 32-bit integer
    x11.timeout  timeout
        Signed 16-bit integer
    x11.type  type
        Unsigned 32-bit integer
    x11.undecoded  undecoded
        No value
    x11.unused  unused
        No value
    x11.visual  visual
        Unsigned 32-bit integer
    x11.visualid  visualid
        Unsigned 32-bit integer
    x11.warp-pointer-dst-window  warp-pointer-dst-window
        Unsigned 32-bit integer
    x11.warp-pointer-src-window  warp-pointer-src-window
        Unsigned 32-bit integer
    x11.wid  wid
        Unsigned 32-bit integer
    x11.width  width
        Unsigned 16-bit integer
    x11.win-gravity  win-gravity
        Unsigned 8-bit integer
    x11.window  window
        Unsigned 32-bit integer
    x11.window-class  window-class
        Unsigned 16-bit integer
    x11.window-value-mask  window-value-mask
        Unsigned 32-bit integer
    x11.window-value-mask.background-pixel  background-pixel
        Boolean
    x11.window-value-mask.background-pixmap  background-pixmap
        Boolean
    x11.window-value-mask.backing-pixel  backing-pixel
        Boolean
    x11.window-value-mask.backing-planes  backing-planes
        Boolean
    x11.window-value-mask.backing-store  backing-store
        Boolean
    x11.window-value-mask.bit-gravity  bit-gravity
        Boolean
    x11.window-value-mask.border-pixel  border-pixel
        Boolean
    x11.window-value-mask.border-pixmap  border-pixmap
        Boolean
    x11.window-value-mask.colormap  colormap
        Boolean
    x11.window-value-mask.cursor  cursor
        Boolean
    x11.window-value-mask.do-not-propagate-mask  do-not-propagate-mask
        Boolean
    x11.window-value-mask.event-mask  event-mask
        Boolean
    x11.window-value-mask.override-redirect  override-redirect
        Boolean
    x11.window-value-mask.save-under  save-under
        Boolean
    x11.window-value-mask.win-gravity  win-gravity
        Boolean
    x11.x  x
        Signed 16-bit integer
    x11.y  y
        Signed 16-bit integer

  Yahoo Messenger Protocol (yhoo)

    yhoo.connection_id  Connection ID
        Unsigned 32-bit integer
    yhoo.content  Content
        String
    yhoo.len  Packet Length
        Unsigned 32-bit integer
    yhoo.magic_id  Magic ID
        Unsigned 32-bit integer
    yhoo.msgtype  Message Type
        Unsigned 32-bit integer
    yhoo.nick1  Real Nick (nick1)
        String
    yhoo.nick2  Active Nick (nick2)
        String
    yhoo.service  Service Type
        Unsigned 32-bit integer
    yhoo.unknown1  Unknown 1
        Unsigned 32-bit integer
    yhoo.version  Version
        String

  Yellow Pages Bind (ypbind)

  Yellow Pages Service (ypserv)

    ypserv.domain  Domain
        String
    ypserv.key  Key
        String
    ypserv.map  Map Name
        String
    ypserv.servesdomain  Serves Domain
        Boolean
    ypserv.status  Status
        Boolean
    ypserv.value  Value
        String

  Yellow Pages Transfer (ypxfr)

  Zebra Protocol (zebra)

    zebra.bandwidth  Bandwidth
        Unsigned 32-bit integer
    zebra.command  Command
        Unsigned 8-bit integer
    zebra.dest4  Destination
        IPv4 address
    zebra.dest6  Destination
        IPv6 address
    zebra.distance  Distance
        Unsigned 8-bit integer
    zebra.family  Family
        Unsigned 32-bit integer
    zebra.index  Index
        Unsigned 32-bit integer
    zebra.indexnum  Index Number
        Unsigned 8-bit integer
    zebra.interface  Interface
        String
    zebra.intflags  Flags
        Unsigned 32-bit integer
    zebra.len  Length
        Unsigned 16-bit integer
    zebra.message  Message
        Unsigned 8-bit integer
    zebra.message.distance  Message Distance
        Boolean
    zebra.message.index  Message Index
        Boolean
    zebra.message.metric  Message Metric
        Boolean
    zebra.message.nexthop  Message Nexthop
        Boolean
    zebra.metric  Metric
        Unsigned 32-bit integer
    zebra.mtu  MTU
        Unsigned 32-bit integer
    zebra.nexthop4  Nexthop
        IPv4 address
    zebra.nexthop6  Nexthop
        IPv6 address
    zebra.nexthopnum  Nexthop Number
        Unsigned 8-bit integer
    zebra.prefix4  Prefix
        IPv4 address
    zebra.prefix6  Prefix
        IPv6 address
    zebra.prefixlen  Prefix length
        Unsigned 32-bit integer
    zebra.request  Request
        Boolean
    zebra.rtflags  Flags
        Unsigned 8-bit integer
    zebra.type  Type
        Unsigned 8-bit integer

FILES
/usr/local/etc/ethereal.conf and $HOME/.ethereal/preferences contain system-wide and personal preference settings, respectively. The file contains preference settings of the form prefname:value, one per line, where prefname is the name of the preference (which is the same name that would appear in the preference file), and value is the value to which it should be set; white space is allowed between : and value. A preference setting can be continued on subsequent lines by indenting the continuation lines with white space. A # character starts a comment that runs to the end of the line.

The system-wide preference file is read first, if it exists, overriding Tethereal's default values; the personal preferences file is then read, if it exists, overriding default values and values read from the system-wide preference file.

/etc/ethers is consulted to correlate 6-byte hardware addresses to names. If an address is not found in /etc/ethers, the $HOME/.ethereal/ethers file is consulted next. Each line contains one hardware address and name, separated by whitespace. The digits of the hardware address are separated by either a colon (:), a dash (-), or a period (.). The following three lines are valid lines of an ethers file:

  ff:ff:ff:ff:ff:ff          Broadcast
  c0-00-ff-ff-ff-ff          TR_broadcast
  00.00.00.00.00.00          Zero_broadcast
/usr/local/etc/manuf matches the 3-byte vendor portion of a 6-byte hardware address with the manufacturer's name. The format of the file is the same as the /etc/ethers file, except that each address is three bytes instead of six.

/etc/ipxnets and $HOME/.ethereal/ipxnets correlate 4-byte IPX network numbers to names. The format is the same as the /etc/ethers file, except that each address if four bytes instead of six. Additionally, the address can be represented a single hexadecimal number, as is more common in the IPX world, rather than four hex octets. For example, these four lines are valid lines of an ipxnets file.

  C0.A8.2C.00              HR
  c0-a8-1c-00              CEO
  00:00:BE:EF              IT_Server1
  110f                     FileServer3

SEE ALSO
the ethereal(1) manpage, the editcap(1) manpage, the tcpdump(8) manpage, the pcap(3) manpage

NOTES
Tethereal is part of the Ethereal distribution. The latest version of Ethereal can be found at http://www.ethereal.com.

AUTHORS
Tethereal uses the same packet dissection code that Ethereal does, as well as using many other modules from Ethereal; see the list of authors in the Ethereal man page for a list of authors of that code.