- •Table of Contents
 - •Foreword
 - •Acknowledgments
 - •Chapter 1. Introduction
 - •About this manual
 - •What is Ethereal?
 - •The status of Ethereal
 - •Development and maintenance of Ethereal
 - •A rose by any other name
 - •A brief history of Ethereal
 - •Platforms Ethereal runs on
 - •Where to get Ethereal
 - •Reporting problems and getting help
 - •Where to get the latest copy of this document
 - •Providing feedback
 - •Chapter 2. Building and Installing Ethereal
 - •Introduction
 - •Obtaining the source and binary distributions
 - •Before you build Ethereal
 - •Building from Source under UNIX
 - •Installing the binaries under UNIX
 - •Installing from RPMs under Linux
 - •Installing from debs under Debian
 - •Building from source under Windows
 - •Installing Ethereal under Windows
 - •Troubleshooting during the install
 - •Chapter 3. Using Ethereal
 - •Introduction
 - •Starting Ethereal
 - •The Ethereal menus
 - •The Ethereal File menu
 - •The Ethereal Edit menu
 - •The Ethereal Capture menu
 - •The Ethereal Display menu
 - •The Ethereal Tools menu
 - •The Ethereal Help menu
 - •Capturing packets with Ethereal
 - •The Capture Preferences dialog box
 - •Filtering while capturing
 - •Viewing packets you have captured
 - •Display Options
 - •Saving captured packets
 - •The Save Capture File As dialog box
 - •The File Open dialog box
 - •Filtering packets while viewing
 - •Comparing values
 - •Combining expressions
 - •Packet colorization
 - •Finding frames
 - •Following TCP streams
 - •The Add Expression Dialog
 - •Printing packets
 - •Ethereal preferences
 - •Files used by Ethereal
 - •Chapter 4. Troubleshooting with Ethereal
 - •An approach to troubleshooting with Ethereal
 - •Capturing in the presence of switches and routers
 - •Examples of troubleshooting
 - •Chapter 5. Related tools
 - •Capturing with tcpdump for viewing with Ethereal
 - •Using editcap
 - •Converting ASCII hexdumps to network captures with text2pcap
 - •What is it?
 - •Why do this?
 - •TODO
 - •Limitations
 - •Notes
 - •Appendix A. Ethereal Display Filter Fields
 - •802.1q Virtual LAN (vlan)
 - •802.1x Authentication (eapol)
 - •AOL Instant Messenger (aim)
 - •ATM LAN Emulation (lane)
 - •Address Resolution Protocol (arp)
 - •Aggregate Server Access Protocol (asap)
 - •Andrew File System (AFS) (afs)
 - •Apache JServ Protocol v1.3 (ajp13)
 - •AppleTalk Filing Protocol (afp)
 - •AppleTalk Session Protocol (asp)
 - •AppleTalk Transaction Protocol packet (atp)
 - •Appletalk Address Resolution Protocol (aarp)
 - •Async data over ISDN (V.120) (v120)
 - •Authentication Header (ah)
 - •BACnet Virtual Link Control (bvlc)
 - •Banyan Vines (vines)
 - •Blocks Extensible Exchange Protocol (beep)
 - •Boot Parameters (bootparams)
 - •Bootstrap Protocol (bootp)
 - •Border Gateway Protocol (bgp)
 - •Building Automation and Control Network APDU (bacapp)
 - •Building Automation and Control Network NPDU (bacnet)
 - •Cisco Discovery Protocol (cdp)
 - •Cisco Group Management Protocol (cgmp)
 - •Cisco HDLC (chdlc)
 - •Cisco Hot Standby Router Protocol (hsrp)
 - •Cisco ISL (isl)
 - •Cisco Interior Gateway Routing Protocol (igrp)
 - •Cisco SLARP (slarp)
 - •CoSine IPNOS L2 debug output (cosine)
 - •Common Open Policy Service (cops)
 - •Common Unix Printing System (CUPS) Browsing Protocol (cups)
 - •DCE RPC (dcerpc)
 - •DCE/RPC Conversation Manager (conv)
 - •DCE/RPC Endpoint Mapper (epm)
 - •DCE/RPC Remote Management (mgmt)
 - •DCOM OXID Resolver (oxid)
 - •DCOM Remote Activation (remact)
 - •DHCPv6 (dhcpv6)
 - •Data (data)
 - •Data Link SWitching (dlsw)
 - •Data Stream Interface (dsi)
 - •Datagram Delivery Protocol (ddp)
 - •Diameter Protocol (diameter)
 - •Distance Vector Multicast Routing Protocol (dvmrp)
 - •Distributed Checksum Clearinghouse Prototocl (dccp)
 - •Domain Name Service (dns)
 - •Dynamic DNS Tools Protocol (ddtp)
 - •Encapsulating Security Payload (esp)
 - •Enhanced Interior Gateway Routing Protocol (eigrp)
 - •Ethernet (eth)
 - •Extensible Authentication Protocol (eap)
 - •Fiber Distributed Data Interface (fddi)
 - •File Transfer Protocol (FTP) (ftp)
 - •Frame (frame)
 - •Frame Relay (fr)
 - •GARP Multicast Registration Protocol (gmrp)
 - •GARP VLAN Registration Protocol (gvrp)
 - •GPRS Tunneling Protocol (gtp)
 - •GPRS Tunnelling Protocol v0 (gtpv0)
 - •GPRS Tunnelling Protocol v1 (gtpv1)
 - •Generic Routing Encapsulation (gre)
 - •Gnutella Protocol (gnutella)
 - •Hummingbird NFS Daemon (hclnfsd)
 - •Hypertext Transfer Protocol (http)
 - •ICQ Protocol (icq)
 - •IEEE 802.11 wireless LAN (wlan)
 - •ILMI (ilmi)
 - •IP Payload Compression (ipcomp)
 - •IPX Message (ipxmsg)
 - •IPX Routing Information Protocol (ipxrip)
 - •ISDN User Part (isup)
 - •ISO 8473 CLNP ConnectionLess Network Protocol (clnp)
 - •ISO 8602 CLTP ConnectionLess Transport Protocol (cltp)
 - •ISO 9542 ESIS Routeing Information Exchange Protocol (esis)
 - •Internet Cache Protocol (icp)
 - •Internet Content Adaptation Protocol (icap)
 - •Internet Control Message Protocol (icmp)
 - •Internet Control Message Protocol v6 (icmpv6)
 - •Internet Group Management Protocol (igmp)
 - •Internet Message Access Protocol (imap)
 - •Internet Printing Protocol (ipp)
 - •Internet Protocol (ip)
 - •Internet Protocol Version 6 (ipv6)
 - •Internet Relay Chat (irc)
 - •Internet Security Association and Key Management Protocol (isakmp)
 - •Internetwork Packet eXchange (ipx)
 - •Java RMI (rmi)
 - •Java Serialization (serialization)
 - •Kerberos (kerberos)
 - •Kernel Lock Manager (klm)
 - •Label Distribution Protocol (ldp)
 - •Layer 2 Tunneling Protocol (l2tp)
 - •Lightweight Directory Access Protocol (ldap)
 - •Line Printer Daemon Protocol (lpd)
 - •Link Access Procedure Balanced (LAPB) (lapb)
 - •Link Access Procedure Balanced Ethernet (LAPBETHER) (lapbether)
 - •Link Access Procedure, Channel D (LAPD) (lapd)
 - •Link Aggregation Control Protocol (lacp)
 - •Link Management Protocol (LMP) (lmp)
 - •Local Management Interface (lmi)
 - •LocalTalk Link Access Protocol (llap)
 - •Lucent/Ascend debug output (ascend)
 - •MMS Message Encapsulation (mmse)
 - •MS Proxy Protocol (msproxy)
 - •MTP 2 Transparent Proxy (m2tp)
 - •MTP 2 User Adaptation Layer (m2ua)
 - •MTP 3 User Adaptation Layer (m3ua)
 - •MTP2 Peer Adaptation Layer (m2pa)
 - •Malformed Packet (malformed)
 - •Message Transfer Part Level 2 (mtp2)
 - •Message Transfer Part Level 3 (mtp3)
 - •Microsoft Distributed File System (dfs)
 - •Microsoft Exchange MAPI (mapi)
 - •Microsoft Local Security Architecture (lsa)
 - •Microsoft Registry (winreg)
 - •Microsoft Security Account Manager (samr)
 - •Microsoft Server Service (srvsvc)
 - •Microsoft Spool Subsystem (spoolss)
 - •Microsoft Telephony API Service (tapi)
 - •Microsoft Windows Browser Protocol (browser)
 - •Microsoft Windows Lanman Remote API Protocol (lanman)
 - •Microsoft Windows Logon Protocol (netlogon)
 - •Microsoft Workstation Service (wkssvc)
 - •Mobile IP (mip)
 - •Modbus/TCP (mbtcp)
 - •Mount Service (mount)
 - •MultiProtocol Label Switching Header (mpls)
 - •Multicast Router DISCovery protocol (mrdisc)
 - •Multicast Source Discovery Protocol (msdp)
 - •NFSACL (nfsacl)
 - •NFSAUTH (nfsauth)
 - •NIS+ (nisplus)
 - •NIS+ Callback (nispluscb)
 - •NSPI (nspi)
 - •NTLM Secure Service Provider (ntlmssp)
 - •Name Binding Protocol (nbp)
 - •Name Management Protocol over IPX (nmpi)
 - •NetBIOS (netbios)
 - •NetBIOS Datagram Service (nbdgm)
 - •NetBIOS Name Service (nbns)
 - •NetBIOS Session Service (nbss)
 - •NetBIOS over IPX (nbipx)
 - •NetWare Core Protocol (ncp)
 - •Network Data Management Protocol (ndmp)
 - •Network File System (nfs)
 - •Network Lock Manager Protocol (nlm)
 - •Network News Transfer Protocol (nntp)
 - •Network Status Monitor CallBack Protocol (statnotify)
 - •Network Status Monitor Protocol (stat)
 - •Network Time Protocol (ntp)
 - •Null/Loopback (null)
 - •Open Shortest Path First (ospf)
 - •PC NFS (pcnfsd)
 - •PPP Bandwidth Allocation Control Protocol (bacp)
 - •PPP Bandwidth Allocation Protocol (bap)
 - •PPP Callback Control Protocol (cbcp)
 - •PPP Challenge Handshake Authentication Protocol (chap)
 - •PPP Compression Control Protocol (ccp)
 - •PPP IP Control Protocol (ipcp)
 - •PPP Link Control Protocol (lcp)
 - •PPP Multilink Protocol (mp)
 - •PPP Multiplexing (pppmux)
 - •PPP Password Authentication Protocol (pap)
 - •PPP VJ Compression (vj)
 - •PPPMux Control Protocol (pppmuxcp)
 - •Portmap (portmap)
 - •Pragmatic General Multicast (pgm)
 - •Prism (prism)
 - •Protocol Independent Multicast (pim)
 - •Quake II Network Protocol (quake2)
 - •Quake III Arena Network Protocol (quake3)
 - •Quake Network Protocol (quake)
 - •QuakeWorld Network Protocol (quakeworld)
 - •RFC 2250 MPEG1 (mpeg1)
 - •RIPng (ripng)
 - •RSTAT (rstat)
 - •RX Protocol (rx)
 - •Radio Access Network Application Part (ranap)
 - •Radius Protocol (radius)
 - •Raw packet data (raw)
 - •Real Time Streaming Protocol (rtsp)
 - •Remote Procedure Call (rpc)
 - •Remote Quota (rquota)
 - •Remote Shell (rsh)
 - •Remote Wall protocol (rwall)
 - •Resource ReserVation Protocol (RSVP) (rsvp)
 - •Rlogin Protocol (rlogin)
 - •Routing Information Protocol (rip)
 - •Routing Table Maintenance Protocol (rtmp)
 - •SADMIND (sadmind)
 - •SCSI (scsi)
 - •SMB (Server Message Block Protocol) (smb)
 - •SMB MailSlot Protocol (mailslot)
 - •SMB Pipe Protocol (pipe)
 - •SNMP Multiplex Protocol (smux)
 - •SPRAY (spray)
 - •SSCOP (sscop)
 - •Secure Socket Layer (ssl)
 - •Sequenced Packet eXchange (spx)
 - •Service Advertisement Protocol (ipxsap)
 - •Service Location Protocol (srvloc)
 - •Session Announcement Protocol (sap)
 - •Session Description Protocol (sdp)
 - •Session Initiation Protocol (sip)
 - •Short Frame (short)
 - •Short Message Peer to Peer (smpp)
 - •Signalling Connection Control Part (sccp)
 - •Simple Mail Transfer Protocol (smtp)
 - •Simple Network Management Protocol (snmp)
 - •Sinec H1 Protocol (h1)
 - •Skinny Client Control Protocol (skinny)
 - •SliMP3 Communication Protocol (slimp3)
 - •Socks Protocol (socks)
 - •Spanning Tree Protocol (stp)
 - •Stream Control Transmission Protocol (sctp)
 - •Syslog message (syslog)
 - •Systems Network Architecture (sna)
 - •TACACS (tacacs)
 - •TACACS+ (tacplus)
 - •TPKT (tpkt)
 - •Telnet (telnet)
 - •Time Protocol (time)
 - •Time Synchronization Protocol (tsp)
 - •Transmission Control Protocol (tcp)
 - •Transparent Network Substrate Protocol (tns)
 - •Trivial File Transfer Protocol (tftp)
 - •Universal Computer Protocol (ucp)
 - •Unreassembled Fragmented Packet (unreassembled)
 - •User Datagram Protocol (udp)
 - •Virtual Router Redundancy Protocol (vrrp)
 - •Virtual Trunking Protocol (vtp)
 - •Web Cache Coordination Protocol (wccp)
 - •X Display Manager Control Protocol (xdmcp)
 - •X.25 over TCP (xot)
 - •Xyplex (xyplex)
 - •Yahoo Messenger Protocol (yhoo)
 - •Yellow Pages Bind (ypbind)
 - •Yellow Pages Passwd (yppasswd)
 - •Yellow Pages Service (ypserv)
 - •Yellow Pages Transfer (ypxfr)
 - •Zebra Protocol (zebra)
 - •Zone Information Protocol (zip)
 - •iSCSI (iscsi)
 - •Appendix B. Ethereal Error Messages
 - •Appendix C. The GNU Free Document Public Licence
 - •Copyright
 - •Preamble
 - •Verbatim Copying
 - •Copying in Quantity
 - •Combining Documents
 - •Collections of Documents
 - •Aggregation with Independent Works
 - •Translation
 - •Termination
 - •Future Revisions of this License
 
Appendix A. Ethereal Display Filter Fields
Field  | 
	Field Name  | 
	Type  | 
ldp.msg.tlv.unknown  | 
	TLV Unknown bits  | 
	Unsigned 8-bit integer  | 
ldp.msg.tlv.value  | 
	TLV Value  | 
	Byte array  | 
ldp.msg.tlv.vendor_id  | 
	Vendor ID  | 
	Unsigned 32-bit integer  | 
ldp.msg.tlv.weight  | 
	Weight  | 
	Unsigned 8-bit integer  | 
ldp.msg.type  | 
	Message Type  | 
	Unsigned 16-bit integer  | 
ldp.msg.ubit  | 
	U bit  | 
	Boolean  | 
ldp.msg.vendor.id  | 
	Vendor ID  | 
	Unsigned 32-bit integer  | 
ldp.req  | 
	Request  | 
	Boolean  | 
ldp.rsp  | 
	Response  | 
	Boolean  | 
ldp.tlv.lbl_req_msg_id  | 
	Label Request Message ID  | 
	Unsigned 32-bit integer  | 
Layer 2 Tunneling Protocol (l2tp)
Table A-109. Layer 2 Tunneling Protocol (l2tp)
Field  | 
	Field Name  | 
	Type  | 
l2tp.Nr  | 
	Nr  | 
	Unsigned 16-bit integer  | 
l2tp.Ns  | 
	Ns  | 
	Unsigned 16-bit integer  | 
l2tp.avp.hidden  | 
	Hidden  | 
	Boolean  | 
l2tp.avp.length  | 
	Length  | 
	Unsigned 16-bit integer  | 
l2tp.avp.mandatory  | 
	Mandatory  | 
	Boolean  | 
l2tp.avp.type  | 
	Type  | 
	Unsigned 16-bit integer  | 
l2tp.avp.vendor_id  | 
	Vendor ID  | 
	Unsigned 16-bit integer  | 
l2tp.length  | 
	Length  | 
	Unsigned 16-bit integer  | 
l2tp.length_bit  | 
	Length Bit  | 
	Boolean  | 
l2tp.offset  | 
	Offset  | 
	Unsigned 16-bit integer  | 
l2tp.offset_bit  | 
	Offset bit  | 
	Boolean  | 
l2tp.priority  | 
	Priority  | 
	Boolean  | 
l2tp.seq_bit  | 
	Sequence Bit  | 
	Boolean  | 
l2tp.session  | 
	Session ID  | 
	Unsigned 16-bit integer  | 
l2tp.tie_breaker  | 
	Tie Breaker  | 
	
  | 
l2tp.tunnel  | 
	Tunnel ID  | 
	Unsigned 16-bit integer  | 
l2tp.type  | 
	Type  | 
	Unsigned 16-bit integer  | 
l2tp.version  | 
	Version  | 
	Unsigned 16-bit integer  | 
185
Appendix A. Ethereal Display Filter Fields
Lightweight Directory Access Protocol (ldap)
Table A-110. Lightweight Directory Access Protocol (ldap)
Field  | 
	Field Name  | 
	Type  | 
ldap.abandon.msgid  | 
	Abandon Msg Id  | 
	Unsigned 32-bit integer  | 
ldap.attribute  | 
	Attribute  | 
	String  | 
ldap.bind.auth_type  | 
	Auth Type  | 
	Unsigned 8-bit integer  | 
ldap.bind.dn  | 
	DN  | 
	String  | 
ldap.bind.password  | 
	Password  | 
	String  | 
ldap.bind.version  | 
	Version  | 
	Unsigned 32-bit integer  | 
ldap.compare.test  | 
	Test  | 
	String  | 
ldap.dn  | 
	Distinguished Name  | 
	String  | 
ldap.length  | 
	Length  | 
	Unsigned 32-bit integer  | 
ldap.message_id  | 
	Message Id  | 
	Unsigned 32-bit integer  | 
ldap.message_length  | 
	Message Length  | 
	Unsigned 32-bit integer  | 
ldap.message_type  | 
	Message Type  | 
	Unsigned 8-bit integer  | 
ldap.modify.add  | 
	Add  | 
	String  | 
ldap.modify.delete  | 
	Delete  | 
	String  | 
ldap.modify.replace  | 
	Replace  | 
	String  | 
ldap.modrdn.delete  | 
	Delete Values  | 
	Boolean  | 
ldap.modrdn.name  | 
	New Name  | 
	String  | 
ldap.modrdn.superior  | 
	New Location  | 
	String  | 
ldap.result.code  | 
	Result Code  | 
	Unsigned 8-bit integer  | 
ldap.result.errormsg  | 
	Error Message  | 
	String  | 
ldap.result.matcheddn  | 
	Matched DN  | 
	String  | 
ldap.result.referral  | 
	Referral  | 
	String  | 
ldap.search.basedn  | 
	Base DN  | 
	String  | 
ldap.search.dereference  | 
	Dereference  | 
	Unsigned 8-bit integer  | 
ldap.search.filter  | 
	Filter  | 
	String  | 
ldap.search.scope  | 
	Scope  | 
	Unsigned 8-bit integer  | 
ldap.search.sizelimit  | 
	Size Limit  | 
	Unsigned 32-bit integer  | 
ldap.search.timelimit  | 
	Time Limit  | 
	Unsigned 32-bit integer  | 
ldap.search.typesonly  | 
	Attributes Only  | 
	Boolean  | 
ldap.value  | 
	Value  | 
	String  | 
186
Appendix A. Ethereal Display Filter Fields
Line Printer Daemon Protocol (lpd)
Table A-111. Line Printer Daemon Protocol (lpd)
Field  | 
	Field Name  | 
	Type  | 
lpd.request  | 
	Request  | 
	Boolean  | 
lpd.response  | 
	Response  | 
	Boolean  | 
Link Access Procedure Balanced (LAPB) (lapb)
Table A-112. Link Access Procedure Balanced (LAPB) (lapb)
Field  | 
	Field Name  | 
	Type  | 
lapb.address  | 
	Address Field  | 
	Unsigned 8-bit integer  | 
lapb.control  | 
	Control Field  | 
	Unsigned 8-bit integer  | 
Link Access Procedure Balanced Ethernet (LAPBETHER) (lapbether)
Table A-113. Link Access Procedure Balanced Ethernet (LAPBETHER) (lapbether)
Field  | 
	Field Name  | 
	Type  | 
lapbether.length  | 
	Length Field  | 
	Unsigned 16-bit integer  | 
Link Access Procedure, Channel D (LAPD) (lapd)
Table A-114. Link Access Procedure, Channel D (LAPD) (lapd)
Field  | 
	Field Name  | 
	Type  | 
lapd.address  | 
	Address Field  | 
	Unsigned 16-bit integer  | 
lapd.control  | 
	Control Field  | 
	Unsigned 16-bit integer  | 
lapd.cr  | 
	C/R  | 
	Unsigned 16-bit integer  | 
lapd.ea1  | 
	EA1  | 
	Unsigned 16-bit integer  | 
lapd.ea2  | 
	EA2  | 
	Unsigned 16-bit integer  | 
lapd.sapi  | 
	SAPI  | 
	Unsigned 16-bit integer  | 
lapd.tei  | 
	TEI  | 
	Unsigned 16-bit integer  | 
187
Appendix A. Ethereal Display Filter Fields
Link Aggregation Control Protocol (lacp)
Table A-115. Link Aggregation Control Protocol (lacp)
Field  | 
	Field Name  | 
	Type  | 
lacp.actorInfo  | 
	Actor Information  | 
	Unsigned 8-bit integer  | 
lacp.actorInfoLen  | 
	Actor Information Length  | 
	Unsigned 8-bit integer  | 
lacp.actorKey  | 
	Actor Key  | 
	Unsigned 16-bit integer  | 
lacp.actorPort  | 
	Actor Port  | 
	Unsigned 16-bit integer  | 
lacp.actorPortPriority  | 
	Actor Port Priority  | 
	Unsigned 16-bit integer  | 
lacp.actorState  | 
	Actor State  | 
	Unsigned 8-bit integer  | 
lacp.actorState.activity  | 
	LACP Activity  | 
	Boolean  | 
lacp.actorState.aggregation  | 
	Aggregation  | 
	Boolean  | 
  | 
	
  | 
	
  | 
lacp.actorState.collecting  | 
	Collecting  | 
	Boolean  | 
lacp.actorState.defaulted  | 
	Defaulted  | 
	Boolean  | 
lacp.actorState.distributing  | 
	Distributing  | 
	Boolean  | 
  | 
	
  | 
	
  | 
lacp.actorState.expired  | 
	Expired  | 
	Boolean  | 
lacp.actorState.synchronizationSynchronization  | 
	Boolean  | 
|
  | 
	
  | 
	
  | 
lacp.actorState.timeout  | 
	LACP Timeout  | 
	Boolean  | 
lacp.actorSysPriority  | 
	Actor System Priority  | 
	Unsigned 16-bit integer  | 
lacp.actorSystem  | 
	Actor System  | 
	6-byte Hardware (MAC)  | 
  | 
	
  | 
	Address  | 
lacp.collectorInfo  | 
	Collector Information  | 
	Unsigned 8-bit integer  | 
lacp.collectorInfoLen  | 
	Collector Information  | 
	Unsigned 8-bit integer  | 
  | 
	Length  | 
	
  | 
lacp.collectorMaxDelay  | 
	Collector Max Delay  | 
	Unsigned 16-bit integer  | 
lacp.partnerInfo  | 
	Partner Information  | 
	Unsigned 8-bit integer  | 
lacp.partnerInfoLen  | 
	Partner Information  | 
	Unsigned 8-bit integer  | 
  | 
	Length  | 
	
  | 
lacp.partnerKey  | 
	Partner Key  | 
	Unsigned 16-bit integer  | 
lacp.partnerPort  | 
	Partner Port  | 
	Unsigned 16-bit integer  | 
lacp.partnerPortPriority  | 
	Partner Port Priority  | 
	Unsigned 16-bit integer  | 
lacp.partnerState  | 
	Partner State  | 
	Unsigned 8-bit integer  | 
lacp.partnerState.activity  | 
	LACP Activity  | 
	Boolean  | 
lacp.partnerState.aggregationAggregation  | 
	Boolean  | 
|
  | 
	
  | 
	
  | 
188
