- •Table of Contents
 - •Foreword
 - •Acknowledgments
 - •Chapter 1. Introduction
 - •About this manual
 - •What is Ethereal?
 - •The status of Ethereal
 - •Development and maintenance of Ethereal
 - •A rose by any other name
 - •A brief history of Ethereal
 - •Platforms Ethereal runs on
 - •Where to get Ethereal
 - •Reporting problems and getting help
 - •Where to get the latest copy of this document
 - •Providing feedback
 - •Chapter 2. Building and Installing Ethereal
 - •Introduction
 - •Obtaining the source and binary distributions
 - •Before you build Ethereal
 - •Building from Source under UNIX
 - •Installing the binaries under UNIX
 - •Installing from RPMs under Linux
 - •Installing from debs under Debian
 - •Building from source under Windows
 - •Installing Ethereal under Windows
 - •Troubleshooting during the install
 - •Chapter 3. Using Ethereal
 - •Introduction
 - •Starting Ethereal
 - •The Ethereal menus
 - •The Ethereal File menu
 - •The Ethereal Edit menu
 - •The Ethereal Capture menu
 - •The Ethereal Display menu
 - •The Ethereal Tools menu
 - •The Ethereal Help menu
 - •Capturing packets with Ethereal
 - •The Capture Preferences dialog box
 - •Filtering while capturing
 - •Viewing packets you have captured
 - •Display Options
 - •Saving captured packets
 - •The Save Capture File As dialog box
 - •The File Open dialog box
 - •Filtering packets while viewing
 - •Comparing values
 - •Combining expressions
 - •Packet colorization
 - •Finding frames
 - •Following TCP streams
 - •The Add Expression Dialog
 - •Printing packets
 - •Ethereal preferences
 - •Files used by Ethereal
 - •Chapter 4. Troubleshooting with Ethereal
 - •An approach to troubleshooting with Ethereal
 - •Capturing in the presence of switches and routers
 - •Examples of troubleshooting
 - •Chapter 5. Related tools
 - •Capturing with tcpdump for viewing with Ethereal
 - •Using editcap
 - •Converting ASCII hexdumps to network captures with text2pcap
 - •What is it?
 - •Why do this?
 - •TODO
 - •Limitations
 - •Notes
 - •Appendix A. Ethereal Display Filter Fields
 - •802.1q Virtual LAN (vlan)
 - •802.1x Authentication (eapol)
 - •AOL Instant Messenger (aim)
 - •ATM LAN Emulation (lane)
 - •Address Resolution Protocol (arp)
 - •Aggregate Server Access Protocol (asap)
 - •Andrew File System (AFS) (afs)
 - •Apache JServ Protocol v1.3 (ajp13)
 - •AppleTalk Filing Protocol (afp)
 - •AppleTalk Session Protocol (asp)
 - •AppleTalk Transaction Protocol packet (atp)
 - •Appletalk Address Resolution Protocol (aarp)
 - •Async data over ISDN (V.120) (v120)
 - •Authentication Header (ah)
 - •BACnet Virtual Link Control (bvlc)
 - •Banyan Vines (vines)
 - •Blocks Extensible Exchange Protocol (beep)
 - •Boot Parameters (bootparams)
 - •Bootstrap Protocol (bootp)
 - •Border Gateway Protocol (bgp)
 - •Building Automation and Control Network APDU (bacapp)
 - •Building Automation and Control Network NPDU (bacnet)
 - •Cisco Discovery Protocol (cdp)
 - •Cisco Group Management Protocol (cgmp)
 - •Cisco HDLC (chdlc)
 - •Cisco Hot Standby Router Protocol (hsrp)
 - •Cisco ISL (isl)
 - •Cisco Interior Gateway Routing Protocol (igrp)
 - •Cisco SLARP (slarp)
 - •CoSine IPNOS L2 debug output (cosine)
 - •Common Open Policy Service (cops)
 - •Common Unix Printing System (CUPS) Browsing Protocol (cups)
 - •DCE RPC (dcerpc)
 - •DCE/RPC Conversation Manager (conv)
 - •DCE/RPC Endpoint Mapper (epm)
 - •DCE/RPC Remote Management (mgmt)
 - •DCOM OXID Resolver (oxid)
 - •DCOM Remote Activation (remact)
 - •DHCPv6 (dhcpv6)
 - •Data (data)
 - •Data Link SWitching (dlsw)
 - •Data Stream Interface (dsi)
 - •Datagram Delivery Protocol (ddp)
 - •Diameter Protocol (diameter)
 - •Distance Vector Multicast Routing Protocol (dvmrp)
 - •Distributed Checksum Clearinghouse Prototocl (dccp)
 - •Domain Name Service (dns)
 - •Dynamic DNS Tools Protocol (ddtp)
 - •Encapsulating Security Payload (esp)
 - •Enhanced Interior Gateway Routing Protocol (eigrp)
 - •Ethernet (eth)
 - •Extensible Authentication Protocol (eap)
 - •Fiber Distributed Data Interface (fddi)
 - •File Transfer Protocol (FTP) (ftp)
 - •Frame (frame)
 - •Frame Relay (fr)
 - •GARP Multicast Registration Protocol (gmrp)
 - •GARP VLAN Registration Protocol (gvrp)
 - •GPRS Tunneling Protocol (gtp)
 - •GPRS Tunnelling Protocol v0 (gtpv0)
 - •GPRS Tunnelling Protocol v1 (gtpv1)
 - •Generic Routing Encapsulation (gre)
 - •Gnutella Protocol (gnutella)
 - •Hummingbird NFS Daemon (hclnfsd)
 - •Hypertext Transfer Protocol (http)
 - •ICQ Protocol (icq)
 - •IEEE 802.11 wireless LAN (wlan)
 - •ILMI (ilmi)
 - •IP Payload Compression (ipcomp)
 - •IPX Message (ipxmsg)
 - •IPX Routing Information Protocol (ipxrip)
 - •ISDN User Part (isup)
 - •ISO 8473 CLNP ConnectionLess Network Protocol (clnp)
 - •ISO 8602 CLTP ConnectionLess Transport Protocol (cltp)
 - •ISO 9542 ESIS Routeing Information Exchange Protocol (esis)
 - •Internet Cache Protocol (icp)
 - •Internet Content Adaptation Protocol (icap)
 - •Internet Control Message Protocol (icmp)
 - •Internet Control Message Protocol v6 (icmpv6)
 - •Internet Group Management Protocol (igmp)
 - •Internet Message Access Protocol (imap)
 - •Internet Printing Protocol (ipp)
 - •Internet Protocol (ip)
 - •Internet Protocol Version 6 (ipv6)
 - •Internet Relay Chat (irc)
 - •Internet Security Association and Key Management Protocol (isakmp)
 - •Internetwork Packet eXchange (ipx)
 - •Java RMI (rmi)
 - •Java Serialization (serialization)
 - •Kerberos (kerberos)
 - •Kernel Lock Manager (klm)
 - •Label Distribution Protocol (ldp)
 - •Layer 2 Tunneling Protocol (l2tp)
 - •Lightweight Directory Access Protocol (ldap)
 - •Line Printer Daemon Protocol (lpd)
 - •Link Access Procedure Balanced (LAPB) (lapb)
 - •Link Access Procedure Balanced Ethernet (LAPBETHER) (lapbether)
 - •Link Access Procedure, Channel D (LAPD) (lapd)
 - •Link Aggregation Control Protocol (lacp)
 - •Link Management Protocol (LMP) (lmp)
 - •Local Management Interface (lmi)
 - •LocalTalk Link Access Protocol (llap)
 - •Lucent/Ascend debug output (ascend)
 - •MMS Message Encapsulation (mmse)
 - •MS Proxy Protocol (msproxy)
 - •MTP 2 Transparent Proxy (m2tp)
 - •MTP 2 User Adaptation Layer (m2ua)
 - •MTP 3 User Adaptation Layer (m3ua)
 - •MTP2 Peer Adaptation Layer (m2pa)
 - •Malformed Packet (malformed)
 - •Message Transfer Part Level 2 (mtp2)
 - •Message Transfer Part Level 3 (mtp3)
 - •Microsoft Distributed File System (dfs)
 - •Microsoft Exchange MAPI (mapi)
 - •Microsoft Local Security Architecture (lsa)
 - •Microsoft Registry (winreg)
 - •Microsoft Security Account Manager (samr)
 - •Microsoft Server Service (srvsvc)
 - •Microsoft Spool Subsystem (spoolss)
 - •Microsoft Telephony API Service (tapi)
 - •Microsoft Windows Browser Protocol (browser)
 - •Microsoft Windows Lanman Remote API Protocol (lanman)
 - •Microsoft Windows Logon Protocol (netlogon)
 - •Microsoft Workstation Service (wkssvc)
 - •Mobile IP (mip)
 - •Modbus/TCP (mbtcp)
 - •Mount Service (mount)
 - •MultiProtocol Label Switching Header (mpls)
 - •Multicast Router DISCovery protocol (mrdisc)
 - •Multicast Source Discovery Protocol (msdp)
 - •NFSACL (nfsacl)
 - •NFSAUTH (nfsauth)
 - •NIS+ (nisplus)
 - •NIS+ Callback (nispluscb)
 - •NSPI (nspi)
 - •NTLM Secure Service Provider (ntlmssp)
 - •Name Binding Protocol (nbp)
 - •Name Management Protocol over IPX (nmpi)
 - •NetBIOS (netbios)
 - •NetBIOS Datagram Service (nbdgm)
 - •NetBIOS Name Service (nbns)
 - •NetBIOS Session Service (nbss)
 - •NetBIOS over IPX (nbipx)
 - •NetWare Core Protocol (ncp)
 - •Network Data Management Protocol (ndmp)
 - •Network File System (nfs)
 - •Network Lock Manager Protocol (nlm)
 - •Network News Transfer Protocol (nntp)
 - •Network Status Monitor CallBack Protocol (statnotify)
 - •Network Status Monitor Protocol (stat)
 - •Network Time Protocol (ntp)
 - •Null/Loopback (null)
 - •Open Shortest Path First (ospf)
 - •PC NFS (pcnfsd)
 - •PPP Bandwidth Allocation Control Protocol (bacp)
 - •PPP Bandwidth Allocation Protocol (bap)
 - •PPP Callback Control Protocol (cbcp)
 - •PPP Challenge Handshake Authentication Protocol (chap)
 - •PPP Compression Control Protocol (ccp)
 - •PPP IP Control Protocol (ipcp)
 - •PPP Link Control Protocol (lcp)
 - •PPP Multilink Protocol (mp)
 - •PPP Multiplexing (pppmux)
 - •PPP Password Authentication Protocol (pap)
 - •PPP VJ Compression (vj)
 - •PPPMux Control Protocol (pppmuxcp)
 - •Portmap (portmap)
 - •Pragmatic General Multicast (pgm)
 - •Prism (prism)
 - •Protocol Independent Multicast (pim)
 - •Quake II Network Protocol (quake2)
 - •Quake III Arena Network Protocol (quake3)
 - •Quake Network Protocol (quake)
 - •QuakeWorld Network Protocol (quakeworld)
 - •RFC 2250 MPEG1 (mpeg1)
 - •RIPng (ripng)
 - •RSTAT (rstat)
 - •RX Protocol (rx)
 - •Radio Access Network Application Part (ranap)
 - •Radius Protocol (radius)
 - •Raw packet data (raw)
 - •Real Time Streaming Protocol (rtsp)
 - •Remote Procedure Call (rpc)
 - •Remote Quota (rquota)
 - •Remote Shell (rsh)
 - •Remote Wall protocol (rwall)
 - •Resource ReserVation Protocol (RSVP) (rsvp)
 - •Rlogin Protocol (rlogin)
 - •Routing Information Protocol (rip)
 - •Routing Table Maintenance Protocol (rtmp)
 - •SADMIND (sadmind)
 - •SCSI (scsi)
 - •SMB (Server Message Block Protocol) (smb)
 - •SMB MailSlot Protocol (mailslot)
 - •SMB Pipe Protocol (pipe)
 - •SNMP Multiplex Protocol (smux)
 - •SPRAY (spray)
 - •SSCOP (sscop)
 - •Secure Socket Layer (ssl)
 - •Sequenced Packet eXchange (spx)
 - •Service Advertisement Protocol (ipxsap)
 - •Service Location Protocol (srvloc)
 - •Session Announcement Protocol (sap)
 - •Session Description Protocol (sdp)
 - •Session Initiation Protocol (sip)
 - •Short Frame (short)
 - •Short Message Peer to Peer (smpp)
 - •Signalling Connection Control Part (sccp)
 - •Simple Mail Transfer Protocol (smtp)
 - •Simple Network Management Protocol (snmp)
 - •Sinec H1 Protocol (h1)
 - •Skinny Client Control Protocol (skinny)
 - •SliMP3 Communication Protocol (slimp3)
 - •Socks Protocol (socks)
 - •Spanning Tree Protocol (stp)
 - •Stream Control Transmission Protocol (sctp)
 - •Syslog message (syslog)
 - •Systems Network Architecture (sna)
 - •TACACS (tacacs)
 - •TACACS+ (tacplus)
 - •TPKT (tpkt)
 - •Telnet (telnet)
 - •Time Protocol (time)
 - •Time Synchronization Protocol (tsp)
 - •Transmission Control Protocol (tcp)
 - •Transparent Network Substrate Protocol (tns)
 - •Trivial File Transfer Protocol (tftp)
 - •Universal Computer Protocol (ucp)
 - •Unreassembled Fragmented Packet (unreassembled)
 - •User Datagram Protocol (udp)
 - •Virtual Router Redundancy Protocol (vrrp)
 - •Virtual Trunking Protocol (vtp)
 - •Web Cache Coordination Protocol (wccp)
 - •X Display Manager Control Protocol (xdmcp)
 - •X.25 over TCP (xot)
 - •Xyplex (xyplex)
 - •Yahoo Messenger Protocol (yhoo)
 - •Yellow Pages Bind (ypbind)
 - •Yellow Pages Passwd (yppasswd)
 - •Yellow Pages Service (ypserv)
 - •Yellow Pages Transfer (ypxfr)
 - •Zebra Protocol (zebra)
 - •Zone Information Protocol (zip)
 - •iSCSI (iscsi)
 - •Appendix B. Ethereal Error Messages
 - •Appendix C. The GNU Free Document Public Licence
 - •Copyright
 - •Preamble
 - •Verbatim Copying
 - •Copying in Quantity
 - •Combining Documents
 - •Collections of Documents
 - •Aggregation with Independent Works
 - •Translation
 - •Termination
 - •Future Revisions of this License
 
Appendix A. Ethereal Display Filter Fields
Field  | 
	Field Name  | 
	Type  | 
smb.write.mode.message_  | 
	startMessage Start  | 
	Boolean  | 
  | 
	
  | 
	
  | 
smb.write.mode.raw  | 
	Write Raw  | 
	Boolean  | 
smb.write.mode.return_remainingReturn Remaining  | 
	Boolean  | 
|
  | 
	
  | 
|
smb.write.mode.write_throughWrite Through  | 
	Boolean  | 
|
  | 
	
  | 
	
  | 
SMB MailSlot Protocol (mailslot)
Table A-227. SMB MailSlot Protocol (mailslot)
Field  | 
	Field Name  | 
	Type  | 
mailslot.class  | 
	Class  | 
	Unsigned 16-bit integer  | 
mailslot.name  | 
	Mailslot Name  | 
	String  | 
mailslot.opcode  | 
	Opcode  | 
	Unsigned 16-bit integer  | 
mailslot.priority  | 
	Priority  | 
	Unsigned 16-bit integer  | 
mailslot.size  | 
	Size  | 
	Unsigned 16-bit integer  | 
SMB Pipe Protocol (pipe)
Table A-228. SMB Pipe Protocol (pipe)
Field  | 
	Field Name  | 
	Type  | 
pipe.fragment  | 
	Fragment  | 
	No value  | 
pipe.fragment.error  | 
	Defragmentation error  | 
	No value  | 
pipe.fragment.multipletails  | 
	Multiple tail fragments  | 
	Boolean  | 
  | 
	found  | 
	
  | 
pipe.fragment.overlap  | 
	Fragment overlap  | 
	Boolean  | 
pipe.fragment.overlap.conflictConflicting data in  | 
	Boolean  | 
|
  | 
	fragment overlap  | 
	
  | 
pipe.fragment.toolongfragmentFragment too long  | 
	Boolean  | 
|
  | 
	
  | 
	
  | 
pipe.fragments  | 
	Fragments  | 
	No value  | 
pipe.function  | 
	Function  | 
	Unsigned 16-bit integer  | 
pipe.getinfo.current_instancesCurrent Instances  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
	
  | 
368
Appendix A. Ethereal Display Filter Fields
Field  | 
	Field Name  | 
	Type  | 
pipe.getinfo.info_level  | 
	Information Level  | 
	Unsigned 16-bit integer  | 
pipe.getinfo.input_buffer_  | 
	sizeInput Buffer Size  | 
	Unsigned 16-bit integer  | 
  | 
	
  | 
	
  | 
pipe.getinfo.maximum_instancesMaximum Instances  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
|
pipe.getinfo.output_buffer_sizeOutput Buffer Size  | 
	Unsigned 16-bit integer  | 
|
  | 
	
  | 
	
  | 
pipe.getinfo.pipe_name  | 
	Pipe Name  | 
	String  | 
pipe.getinfo.pipe_name_lengthPipe Name Length  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
	
  | 
pipe.peek.available_bytes  | 
	Available Bytes  | 
	Unsigned 16-bit integer  | 
pipe.peek.remaining_bytes  | 
	Bytes Remaining  | 
	Unsigned 16-bit integer  | 
  | 
	
  | 
	
  | 
pipe.peek.status  | 
	Pipe Status  | 
	Unsigned 16-bit integer  | 
pipe.priority  | 
	Priority  | 
	Unsigned 16-bit integer  | 
pipe.write_raw.bytes_writtenBytes Written  | 
	Unsigned 16-bit integer  | 
|
  | 
	
  | 
	
  | 
SNA-over-Ethernet (snaeth)
Table A-229. SNA-over-Ethernet (snaeth)
Field  | 
	Field Name  | 
	Type  | 
snaeth_len  | 
	Length  | 
	Unsigned 16-bit integer  | 
SNMP Multiplex Protocol (smux)
Table A-230. SNMP Multiplex Protocol (smux)
Field  | 
	Field Name  | 
	Type  | 
  | 
	
  | 
	
  | 
SPRAY (spray)
Table A-231. SPRAY (spray)
Field  | 
	Field Name  | 
	Type  | 
369
Appendix A. Ethereal Display Filter Fields
Field  | 
	Field Name  | 
	Type  | 
spray.clock  | 
	clock  | 
	No value  | 
spray.counter  | 
	counter  | 
	Unsigned 32-bit integer  | 
spray.sec  | 
	sec  | 
	Unsigned 32-bit integer  | 
spray.sprayarr  | 
	Data  | 
	Byte array  | 
spray.usec  | 
	usec  | 
	Unsigned 32-bit integer  | 
SS7 SCCP-User Adaptation Layer (sua)
Table A-232. SS7 SCCP-User Adaptation Layer (sua)
Field  | 
	Field Name  | 
	Type  | 
|
sua.affected_point_code.maskMask  | 
	
  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
||
sua.affected_pointcode.dpc Affected DPC  | 
	Unsigned 24-bit integer  | 
||
  | 
	
  | 
	
  | 
|
sua.asp_capabilities.a_bit  | 
	Protocol Class 3  | 
	Boolean  | 
|
sua.asp_capabilities.b_bit  | 
	Protocol Class 2  | 
	Boolean  | 
|
sua.asp_capabilities.c_bit  | 
	Protocol Class 1  | 
	Boolean  | 
|
sua.asp_capabilities.d_bit  | 
	Protocol Class 0  | 
	Boolean  | 
|
sua.asp_capabilities.interworkingInterworking  | 
	Unsigned 8-bit integer  | 
||
  | 
	
  | 
	
  | 
|
sua.asp_capabilities.reservedReserved  | 
	
  | 
	Byte array  | 
|
  | 
	
  | 
	
  | 
|
sua.asp_capabilities.reservedReservedbits  | 
	Bits  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
	
  | 
|
sua.asp_identifier.id  | 
	ASP Identifier  | 
	Unsigned 32-bit integer  | 
|
sua.cause_user.cause  | 
	Cause  | 
	
  | 
	Unsigned 16-bit integer  | 
sua.cause_user.user  | 
	User  | 
	
  | 
	Unsigned 16-bit integer  | 
sua.congestion_level.level  | 
	Congestion Level  | 
	Unsigned 32-bit integer  | 
|
sua.correlation_id.identifier Correlation ID  | 
	Unsigned 32-bit integer  | 
||
  | 
	
  | 
	
  | 
	
  | 
sua.credit.credit  | 
	Credit  | 
	
  | 
	Unsigned 32-bit integer  | 
sua.data.padding  | 
	Padding  | 
	
  | 
	Byte array  | 
sua.deregistration_result.deregistrationDeregistrationstatusStatus  | 
	Unsigned 32-bit integer  | 
||
  | 
	
  | 
||
sua.deregistration_result.routingRoutingcontextContext  | 
	Unsigned 32-bit integer  | 
||
  | 
	
  | 
	
  | 
	
  | 
370
Appendix A. Ethereal Display Filter Fields
Field  | 
	Field Name  | 
	Type  | 
sua.destination_address.gt_  | 
	bitInclude GT  | 
	Boolean  | 
  | 
	
  | 
	
  | 
sua.destination_address.pc_  | 
	Includebit PC  | 
	Boolean  | 
  | 
	
  | 
	
  | 
sua.destination_address.reservedReservedbitsBits  | 
	Unsigned 16-bit integer  | 
|
  | 
	
  | 
|
sua.destination_address.routingRoutiingIndicator  | 
	Unsigned 16-bit integer  | 
|
  | 
	
  | 
|
sua.destination_address.ssnIncludebit SSN  | 
	Boolean  | 
|
  | 
	
  | 
|
sua.destination_reference_numberDestination Reference  | 
	Unsigned 32-bit integer  | 
|
  | 
	Number  | 
	
  | 
sua.diagnostic_information.infoDiagnostic Information  | 
	Byte array  | 
|
  | 
	
  | 
|
sua.diagnostic_information.pPadding  | 
	Byte array  | 
|
  | 
	
  | 
	
  | 
sua.drn_label.end  | 
	End  | 
	Unsigned 8-bit integer  | 
sua.drn_label.start  | 
	Start  | 
	Unsigned 8-bit integer  | 
sua.drn_label.value  | 
	Label Value  | 
	Unsigned 16-bit integer  | 
sua.error_code.code  | 
	Error code  | 
	Unsigned 32-bit integer  | 
sua.global_title.nature_of_addressNature of Address  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
|
sua.global_title.number_of_digitsNumber of Digits  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
|
sua.global_title.numbering_planNumbering Plan  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
	
  | 
sua.global_title.padding  | 
	Padding  | 
	Byte array  | 
sua.global_title.signals  | 
	Global Title  | 
	Byte array  | 
sua.global_title.translation_typeTranslation Type  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
	
  | 
sua.heartbeat.data  | 
	Heratbeat Data  | 
	Byte array  | 
sua.heartbeat.padding  | 
	Padding  | 
	Byte array  | 
sua.hostname.name  | 
	Hostname  | 
	String  | 
sua.hostname.padding  | 
	Padding  | 
	Byte array  | 
sua.importance.inportance  | 
	Importance  | 
	Unsigned 8-bit integer  | 
sua.importance.reserved  | 
	Reserved  | 
	Byte array  | 
sua.info_string.padding  | 
	Padding  | 
	Byte array  | 
sua.info_string.string  | 
	Info string  | 
	String  | 
sua.ipv4.address  | 
	IP Version 4 address  | 
	IPv4 address  | 
371
Appendix A. Ethereal Display Filter Fields
Field  | 
	Field Name  | 
	Type  | 
sua.ipv6.address  | 
	IP Version 6 address  | 
	IPv6 address  | 
sua.light.error_code  | 
	Error Code  | 
	Unsigned 16-bit integer  | 
sua.light.message_length  | 
	Message length  | 
	Unsigned 32-bit integer  | 
sua.light.message_type  | 
	Message Type  | 
	Unsigned 16-bit integer  | 
sua.light.spare_1  | 
	Spare  | 
	Unsigned 8-bit integer  | 
sua.light.spare_2  | 
	Spare  | 
	Unsigned 16-bit integer  | 
sua.light.subsystem_numberSubsystem number  | 
	Unsigned 16-bit integer  | 
|
  | 
	
  | 
	
  | 
sua.light.version  | 
	Version  | 
	Unsigned 8-bit integer  | 
sua.message_class  | 
	Message Class  | 
	Unsigned 8-bit integer  | 
sua.message_length  | 
	Message Length  | 
	Unsigned 32-bit integer  | 
sua.message_priority.priorityMessage Priority  | 
	Unsigned 8-bit integer  | 
|
  | 
	
  | 
|
sua.message_priority.reservedReserved  | 
	Byte array  | 
|
  | 
	
  | 
	
  | 
sua.message_type  | 
	Message Type  | 
	Unsigned 8-bit integer  | 
sua.network_appearance.appearanceNetwork Appearance  | 
	Unsigned 32-bit integer  | 
|
  | 
	
  | 
	
  | 
sua.parameter_length  | 
	Parameter Length  | 
	Unsigned 16-bit integer  | 
sua.parameter_padding  | 
	Padding  | 
	Byte array  | 
sua.parameter_tag  | 
	Parameter Tag  | 
	Unsigned 16-bit integer  | 
sua.parameter_value  | 
	Parameter Value  | 
	Byte array  | 
sua.point_code.mask  | 
	Mask  | 
	Unsigned 8-bit integer  | 
sua.point_code.pc  | 
	Point Code  | 
	Unsigned 24-bit integer  | 
sua.protcol_class.reserved  | 
	Reserved  | 
	Byte array  | 
sua.protocol_class.class  | 
	Protocol Class  | 
	Unsigned 8-bit integer  | 
sua.protocol_class.return_onReturnrror_Onbit Error Bit  | 
	Boolean  | 
|
  | 
	
  | 
|
sua.receive_sequence_numberReceive.numberSequence Number  | 
	Unsigned 8-bit integer  | 
|
  | 
	P(R)  | 
	
  | 
sua.receive_sequence_numberRes.reserved  | 
	Byte array  | 
|
  | 
	
  | 
|
sua.receive_sequence_numberSpare.spareBitbit  | 
	Boolean  | 
|
  | 
	
  | 
|
sua.registration_result.local_LrocalutingRoutingkey identifierKey  | 
	Unsigned 32-bit integer  | 
|
  | 
	Identifier  | 
	
  | 
sua.registration_result.registrationRegistrationatusStatus  | 
	Unsigned 32-bit integer  | 
|
  | 
	
  | 
	
  | 
372
Appendix A. Ethereal Display Filter Fields
Field  | 
	Field Name  | 
	Type  | 
|
sua.registration_result.routingRouticongtextContext  | 
	Unsigned 32-bit integer  | 
||
  | 
	
  | 
	
  | 
	
  | 
sua.reserved  | 
	Reserved  | 
	
  | 
	Byte array  | 
sua.routing_context.context Routing context  | 
	Unsigned 32-bit integer  | 
||
  | 
	
  | 
	
  | 
|
sua.routing_key.identifier  | 
	Local Routing Key  | 
	Unsigned 32-bit integer  | 
|
  | 
	Identifier  | 
	
  | 
	
  | 
sua.sccp_cause.reserved  | 
	Reserved  | 
	
  | 
	Byte array  | 
sua.sccp_cause.type  | 
	Cause Type  | 
	Unsigned 8-bit integer  | 
|
sua.sccp_cause.value  | 
	Cause Value  | 
	Unsigned 8-bit integer  | 
|
sua.segmentation.first_bit  | 
	First Segment Bit  | 
	Boolean  | 
|
sua.segmentation.number_ofNumberremainingof Remainisegmentsg  | 
	Unsigned 8-bit integer  | 
||
  | 
	Segments  | 
	
  | 
	
  | 
sua.segmentation.reference Segmentation Reference  | 
	Unsigned 24-bit integer  | 
||
  | 
	
  | 
||
sua.sequence_control.sequenceSequeconcetrolControl  | 
	Unsigned 32-bit integer  | 
||
  | 
	
  | 
||
sua.sequence_number.more_Moredata_Databit Bit  | 
	Boolean  | 
||
  | 
	
  | 
||
sua.sequence_number.receiveRecseivequenceSequencenumberNumber  | 
	Unsigned 8-bit integer  | 
||
  | 
	P(R)  | 
	
  | 
	
  | 
sua.sequence_number.reservedReserved  | 
	
  | 
	Byte array  | 
|
  | 
	
  | 
||
sua.sequence_number.sent_sequenceSentSequencenumberNumber  | 
	Unsigned 8-bit integer  | 
||
  | 
	P(S)  | 
	
  | 
	
  | 
sua.sequence_number.spareSparebit Bit  | 
	
  | 
	Boolean  | 
|
  | 
	
  | 
	
  | 
	
  | 
sua.smi.reserved  | 
	Reserved  | 
	
  | 
	Byte array  | 
sua.smi.smi  | 
	SMI  | 
	
  | 
	Unsigned 8-bit integer  | 
sua.source_address.gt_bit  | 
	Include GT  | 
	Boolean  | 
|
sua.source_address.pc_bit  | 
	Include PC  | 
	Boolean  | 
|
sua.source_address.reservedReservedbits  | 
	Bits  | 
	Unsigned 16-bit integer  | 
|
  | 
	
  | 
||
sua.source_address.routing_RoutingindicatorIndicator  | 
	Unsigned 16-bit integer  | 
||
  | 
	
  | 
	
  | 
|
sua.source_address.ssn_bit  | 
	Include SSN  | 
	Boolean  | 
|
  | 
	
  | 
||
sua.source_reference_numberSource.numberReference Number  | 
	Unsigned 32-bit integer  | 
||
  | 
	
  | 
||
sua.ss7_hop_counter.counterSS7 Hop Counter  | 
	Unsigned 8-bit integer  | 
||
  | 
	
  | 
	
  | 
	
  | 
373
