Ethereal - Interactively browse network traffic ethereal [ -B byte view height ] [ -c count ] [ -f capture filter expression ] [ -h ] [ -i interface ] [ -k ] [ -m font ] [ -n ] [ -o preference setting ] ... [ -p ] [ -P packet list height ] [ -Q ] [ -r infile ] [ -R display filter expression ] [ -S ] [ -s snaplen ] [ -T tree view height ] [ -t time stamp format ] [ -v ] [ -w savefile] Ethereal is a GUI network protocol analyzer. It lets you interactively browse packet data from a live network or from a previously saved capture file. Ethereal knows how to read libpcap capture files, including those of tcpdump. In addition, Ethereal can read capture files from snoop (including Shomiti) and atmsnoop, LanAlyzer, Sniffer (compressed or uncompressed), Microsoft Network Monitor, AIX's iptrace, NetXray, Sniffer Pro, Etherpeek, RADCOM's WAN/LAN analyzer, Lucent/Ascend router debug output, HP-UX's nettl, the dump output from Toshiba's ISDN routers, the output from i4btrace from the ISDN4BSD project, the output in IPLog format from the Cisco Secure Intrusion Detection System, and pppd logs (pppdump format). There is no need to tell Ethereal what type of file you are reading; it will determine the file type by itself. Ethereal is also capable of reading any of these file formats if they are compressed using gzip. Ethereal recognizes this directly from the file; the '.gz' extension is not required for this purpose. Like other protocol analyzers, Ethereal's main window shows 3 views of a packet. It shows a summary line, briefly describing what the packet is. A protocol tree is shown, allowing you to drill down to exact protocol or field that you interested in. Finally, a hex dump shows you exactly what the packet looks like when it goes over the wire. In addition, Ethereal has some features that make it unique. It can assemble all the packets in a TCP conversation and show you the ASCII (or EBCDIC, or hex) data in that conversation. Display filters in Ethereal are very powerful; more fields are filterable in Ethereal than in other protocol analyzers, and the syntax you can use to create your filters is richer. As Ethereal progresses, expect more and more protocol fields to be allowed in display filters. Packet capturing is performed with the pcap library. The capture filter syntax follows the rules of the pcap library. This syntax is different from the display filter syntax. Compressed file support uses (and therefore requires) the zlib library. If the zlib library is not present, Ethereal will compile, but will be unable to read compressed files. Sets the initial height of the byte view (bottom) pane. Sets the default number of packets to read when capturing live data. Sets the capture filter expression. Prints the version and options and exits. Sets the name of the network interface or pipe to use for live packet capture. Network interface names should match one of the names listed in "netstat -i" or "ifconfig -a". Pipe names should be either the name of a FIFO (named pipe) or ``-'' to read data from the standard input. Data read from pipes must be in libpcap format. Starts the capture session immediately. If the -i flag was specified, the capture uses the specified interface. Otherwise, Ethereal searches the list of interfaces, choosing the first non-loopback interface if there are any non-loopback interfaces, and choosing the first loopback interface if there are no non-loopback interfaces; if there are no interfaces, Ethereal reports an error and doesn't start the capture. Sets the name of the font used by Ethereal for most text. Ethereal will construct the name of the bold font used for the data in the byte view pane that corresponds to the field selected in the protocol tree pane from the name of the main text font. Disables network object name resolution (such as hostname, TCP and UDP port names). Sets a preference value, overriding the default value and any value read from a preference file. The argument to the flag is a string of the form prefname:value, where prefname is the name of the preference (which is the same name that would appear in the preference file), and value is the value to which it should be set. Don't put the interface into promiscuous mode. Note that the interface might be in promiscuous mode for some other reason; hence, -p cannot be used to ensure that the only traffic that is captured is traffic sent to or from the machine on which Ethereal is running, broadcast traffic, and multicast traffic to addresses received by that machine. Sets the initial height of the packet list (top) pane. Causes Ethereal to exit after the end of capture session (useful in batch mode with -c option for instance); this option requires the -i and -w parameters. Reads packet data from file. When reading a capture file specified with the -r flag, causes the specified filter (which uses the syntax of display filters, rather than that of capture filters) to be applied to all packets read from the capture file; packets not matching the filter are discarded. Specifies that the live packet capture will be performed in a separate process, and that the packet display will automatically be updated as packets are seen. Sets the default snapshot length to use when capturing live data. No more than snaplen bytes of each network packet will be read into memory, or saved to disk. Sets the initial height of the tree view (middle) pane. Sets the format of the packet timestamp displayed in the packet list window. The format can be one of 'r' (relative), 'a' (absolute), 'ad' (absolute with date), or 'd' (delta). The relative time is the time elapsed between the first packet and the current packet. The absolute time is the actual time the packet was captured, with no date displayed; the absolute date and time is the actual time and date the packet was captured. The delta time is the time since the previous packet was captured. The default is relative. Prints the version and exits. Sets the default capture file name.

MENU ITEMS
Open, close, or reload a capture file. The File:Open dialog box allows a filter to be specified; when the capture file is read, the filter is applied to all packets read from the file, and packets not matching the filter are discarded. Save the current capture, or the packets currently displayed from that capture, to a file. Check boxes let you select whether to save all packets, or just those that have passed the current display filter and/or those that are currently marked, and an option menu lets you select (from a list of file formats in which at particular capture, or the packets currently displayed from that capture, can be saved), a file format in which to save it. Prints, for all the packets in the current capture, either the summary line for the packet or the protocol tree view of the packet; when printing the protocol tree view, the hex dump of the packet can be printed as well. Printing options can be set with the Edit:Preferences menu item, or in the dialog box popped up by this item. Print a fully-expanded protocol tree view of the currently-selected packet. Printing options can be set with the Edit:Preferences menu item. Exits the application. Allows you to search forward or backward, starting with the currently selected packet (or the most recently selected packet, if no packet is selected), for a packet matching a given display filter. Allows you to go to a particular numbered packet. Allows you to mark (or unmark if currently marked) the selected packet. Allows you to mark all packets that are currently displayed. Allows you to unmark all packets that are currently displayed. Sets the packet printing, column display, TCP stream coloring, and GUI options (see the section on "Preferences" below). Edits the saved list of capture filters, allowing filters to be added, changed, or deleted. Edits the saved list of display filters, allowing filters to be added, changed, or deleted. Edits the list of protocols, allowing protocol dissection to be enabled or disabled. Initiates a live packet capture (see the section on "Capture Preferences" below). A temporary file will be created to hold the capture. The location of the file can be chosen by setting your TMPDIR environment variable before starting Ethereal. Otherwise, the default TMPDIR location is system-dependent, but is likely either /var/tmp or /tmp. In a capture that updates the packet display as packets arrive (so that Ethereal responds to user input other than pressing the "Stop" button in the capture packet statistics dialog box), stops the capture. Allows you to sets the format of the packet timestamp displayed in the packet list window to relative, absolute, absolute date and time, or delta, to enable or disable the automatic scrolling of the packet list while a live capture is in progress or to enable or disable translation of addresses to names in the display. Creates and applies a display filter based on the data that is currently highlighted in the protocol tree. If that data is a field that can be tested in a display filter expression, the display filter will test that field; otherwise, the display filter will be based on absolute offset within the packet, and so could be unreliable if the packet contains protocols with variable-length headers, such as a source-routed token-ring packet. Allows you to change the foreground and background colors of the packet information in the list of packets, based upon display filters. The list of display filters is applied to each packet sequentially. After the first display filter matches a packet, any additional display filters in the list are ignored. Therefore, if you are filtering on the existence of protocols, you should list the higher-level protocols first, and the lower-level protocols last. Collapses the protocol tree branches. Expands all branches of the protocol tree. Expands all branches of the protocol tree. Creates a new window containing a protocol tree view and a hex dump window of the currently selected packet; this window will continue to display that packet's protocol tree and data even if another packet is selected. Creates a new window showing whether any protocol ID to dissector mappings have been changed by the user. This window also allows the user to reset all decodes to their default values. Allows you to see what dynamically loadable dissector plugin modules have been loaded (see "Plugins" below). If you have a TCP packet selected, it will display the contents of the data stream for the TCP connection to which that packet belongs, as text, in a separate window, and will leave the list of packets in a filtered state, with only those packets that are part of that TCP connection being displayed. You can revert to your old view by pressing ENTER in the display filter text box, thereby invoking your old display filter (or resetting it back to no display filter). The window in which the data stream is displayed lets you select whether to display: whether to display the entire conversation, or one or the other side of it; whether the data being displayed is to be treated as ASCII or EBCDIC text or as raw hex data; and lets you print what's currently being displayed, using the same print options that are used for the File:Print Packet menu item, or save it as text to a file. If you have a packet selected, this menu item will present a dialog allowing you to change which dissectors are used to decode this packet. The dialog has one panel each for the link layer, network layer and transport layer protocol/port numbers, and will allow each of these to be changed independently. For example, if the selected packet is a TCP packet to port 12345, using this dialog you can instruct Ethereal to decode all packets to or from that TCP port as HTTP packets. This shows the number of packets, and the number of bytes in those packets, for each protocol in the trace. It organizes the protocols in the same hierarchy in which they were found in the trace. Besides counting the packets in which the protocol exists, a count is also made for packets in which the protocol is the last protocol in the stack. These last-protocol counts show you how many packets (and the byte count associated with those packets) ended in a particular protocol. In the table, they are listed under "End Packets" and "End Bytes".

WINDOWS
The main window is split into three panes. You can resize each pane using a "thumb" at the right end of each divider line. Below the panes is a strip that shows the current filter and informational text. The top pane contains the list of network packets that you can scroll through and select. By default, the packet number, packet timestamp, source and destination addresses, protocol, and description are displayed for each packet; the Columns page in the dialog box popped up by Edit:Preferences lets you change this (although, unfortunately, you currently have to save the preferences, and exit and restart Ethereal, for those changes to take effect). If you click on the heading for a column, the display will be sorted by that column; clicking on the heading again will reverse the sort order for that column. An effort is made to display information as high up the protocol stack as possible, e.g. IP addresses are displayed for IP packets, but the MAC layer address is displayed for unknown packet types. The right mouse button can be used to pop up a menu of operations. The middle mouse button can be used to mark a packet. The middle pane contains a protocol tree for the currently-selected packet. The tree displays each field and its value in each protocol header in the stack. The right mouse button can be used to pop up a menu of operations. The lowest pane contains a hex dump of the actual packet data. Selecting a field in the protocol tree highlights the corresponding bytes in this section. The right mouse button can be used to pop up a menu of operations. A display filter can be entered into the strip at the bottom. A filter for HTTP, HTTPS, and DNS traffic might look like this: tcp.port == 80 || tcp.port == 443 || tcp.port == 53 Selecting the Filter: button lets you choose from a list of named filters that you can optionally save. Pressing the Return or Enter keys will cause the filter to be applied to the current list of packets. Selecting the Reset button clears the display filter so that all packets are displayed. The Preferences dialog lets you control various personal preferences for the behavior of Ethereal. The radio buttons at the top of the Printing page allow you choose between printing packets with the File:Print Packet menu item as text or PostScript, and sending the output directly to a command or saving it to a file. The Command: text entry box is the command to send files to (usually lpr), and the File: entry box lets you enter the name of the file you wish to save to. Additionally, you can select the File: button to browse the file system for a particular save file. The Columns page lets you specify the number, title, and format of each column in the packet list. The Column title entry is used to specify the title of the column displayed at the top of the packet list. The type of data that the column displays can be specified using the Column format option menu. The row of buttons on the left perform the following actions: Adds a new column to the list. Modifies the currently selected list item. Deletes the currently selected list item. Moves the selected list item up or down one position. Currently has no effect. Saves the current column format as the default. Closes the dialog without making any changes. The TCP Streams page can be used to change the color of the text displayed in the TCP stream window. To change a color, simply select an attribute from the "Set:" menu and use the color selector to get the desired color. The new text colors are displayed in a sample window. The GUI page is used to modify small aspects of the GUI to your own personal taste: The vertical scrollbars in the three panes can be set to be either on the left or the right. The selection bar in the packet list and protocol tree can have either a "browse" or "select" behavior. If the selection bar has a "browse" behavior, the arrow keys will move an outline of the selection bar, allowing you to browse the rest of the list or tree without changing the selection until you press the space bar. If the selection bar has a "select" behavior, the arrow keys will move the selection bar and change the selection to the new item in the packet list or protocol tree. The highlight method in the hex dump display for the selected protocol item can be set to use either inverse video, or bold characters. The "Font..." button lets you select the font to be used for most text. The "Colors..." button lets you select the colors to be used for instance for the marked frames. There are also pages for various protocols that Ethereal dissects, controlling the way Ethereal handles those protocols. The Edit Capture Filter List dialog lets you create, modify, and delete capture filters, and the Edit Display Filter List dialog lets you create, modify, and delete display filters. The Capture Filter dialog lets you do all of the editing operations listed, and also lets you choose or construct a filter to be used when capturing packets. The Display Filter dialog lets you do all of the editing operations listed, and also lets you choose or construct a filter to be used to filter the current capture being viewed. The Read Filter dialog lets you do all of the editing operations listed, and also lets you choose or construct a filter to be used to as a read filter for a capture file you open. The Search Filter dialog lets you do all of the editing operations listed, and also lets you choose or construct a filter expression to be used in a find operation. In all of those dialogs, the Filter name entry specifies a descriptive name for a filter, e.g. Web and DNS traffic. The Filter string entry is the text that actually describes the filtering action to take, as described above.The dialog buttons perform the following actions: If there is text in the two entry boxes, creates a new associated list item. Modifies the currently selected list item to match what's in the entry boxes. Makes a copy of the currently selected list item. Deletes the currently selected list item. For display filter expressions, pops up a dialog box to allow you to construct a filter expression to test a particular field; it offers lists of field names, and, when appropriate, lists from which to select tests to perform on the field and values with which to compare it. In that dialog box, the OK button will cause the filter expression you constructed to be entered into the Filter string entry at the current cursor position. In the Capture Filter dialog, closes the dialog box and makes the filter in the Filter string entry the filter in the Capture Preferences dialog. In the Display Filter dialog, closes the dialog box and makes the filter in the Filter string entry the current display filter, and applies it to the current capture. In the Read Filter dialog, closes the dialog box and makes the filter in the Filter string entry the filter in the Open Capture File dialog. In the Search Filter dialog, closes the dialog box and makes the filter in the Filter string entry the filter in the Find Frame dialog. Makes the filter in the Filter string entry the current display filter, and applies it to the current capture. Saves the current filter list in $HOME/.ethereal/cfilters if the list of filters being edited is the list of capture filters or in $HOME/.ethereal/dfilters if the list of filters being edited is the list of display filters. Closes the dialog without doing anything with the filter in the Filter string entry. The Capture Preferences dialog lets you specify various parameters for capturing live packet data. The Interface: combo box lets you specify the interface from which to capture packet data, or the name of a FIFO from which to get the packet data. The Count: entry specifies the number of packets to capture. Entering 0 will capture packets indefinitely. The Filter: entry lets you specify the capture filter using a tcpdump-style filter string as described above. The File: entry specifies the file to save to, as in the Printer Options dialog above. You can specify the maximum number of bytes to capture per packet with the Capture length entry, can specify whether the interface is to be put in promiscuous mode or not with the Capture packets in promiscuous mode check box, can specify that the display should be updated as packets are captured with the Update list of packets in real time check box, can specify whether in such a capture the packet list pane should scroll to show the most recently captured packets with the Automatic scrolling in live capture check box, and can specify whether addresses should be translated to names in the display with the Enable name resolution check box. The Display Options dialog lets you specify the format of the time stamp in the packet list. You can select "Time of day" for absolute time stamps, "Date and time of day" for absolute time stamps with the date, "Seconds since beginning of capture" for relative time stamps, or "Seconds since previous frame" for delta time stamps. You can also specify whether, when the display is updated as packets are captured, the list should automatically scroll to show the most recently captured packets or not and whether addresses should be translated to names in the display. The Plugins dialog lets you view the dissector plugin modules available on your system. The Plugins List shows the name and version of each dissector plugin module found on your system. The plugins are searched in the following directories: /usr/share/ethereal/plugins, /usr/local/share/ethereal/plugins and ~/.ethereal/plugins. Note that a dissector plugin module may support more than one protocol; there is not necessarily a one-to-one correspondence between dissector plugin modules and protocols. Protocols supported by a dissector plugin module are enabled and disabled using the Edit:Protocols dialog box, just as protocols built into Ethereal are. See manual page of tcpdump(8). Display filters help you remove the noise from a packet trace and let you see only the packets that interest you. If a packet meets the requirements expressed in your display filter, then it is displayed in the list of packets. Display filters let you compare the fields within a protocol against a specific value, compare fields against fields, and to check the existence of specified fields or protocols. The simplest display filter allows you to check for the existence of a protocol or field. If you want to see all packets which contain the IPX protocol, the filter would be "ipx". (Without the quotation marks) To see all packets that contain a Token-Ring RIF field, use "tr.rif". Fields can also be compared against values. The comparison operators can be expressed either through C-like symbols, or through English-like abbreviations: eq, == Equal ne, != Not equal gt, > Greater than lt, < Less Than ge, >= Greater than or Equal to le, <= Less than or Equal to Furthermore, each protocol field is typed. The types are: Unsigned integer (either 8-bit, 16-bit, 24-bit, or 32-bit) Signed integer (either 8-bit, 16-bit, 24-bit, or 32-bit) Boolean Ethernet address (6 bytes) Byte string (n-number of bytes) IPv4 address IPv6 address IPX network number String (text) Double-precision floating point number An integer may be expressed in decimal, octal, or hexadecimal notation. The following three display filters are equivalent: frame.pkt_len > 10 frame.pkt_len > 012 frame.pkt_len > 0xa Boolean values are either true or false. In a display filter expression testing the value of a Boolean field, "true" is expressed as 1 or any other non-zero value, and "false" is expressed as zero. For example, a token-ring packet's source route field is boolean. To find any source-routed packets, a display filter would be: tr.sr == 1 Non source-routed packets can be found with: tr.sr == 0 Ethernet addresses, as well as a string of bytes, are represented in hex digits. The hex digits may be separated by colons, periods, or hyphens: fddi.dst eq ff:ff:ff:ff:ff:ff ipx.srcnode == 0.0.0.0.0.1 eth.src == aa-aa-aa-aa-aa-aa If a string of bytes contains only one byte, then it is represented as an unsigned integer. That is, if you are testing for hex value 'ff' in a one-byte byte-string, you must compare it agains '0xff' and not 'ff'. IPv4 addresses can be represented in either dotted decimal notation, or by using the hostname: ip.dst eq www.mit.edu ip.src == 192.168.1.1 IPv4 address can be compared with the same logical relations as numbers: eq, ne, gt, ge, lt, and le. The IPv4 address is stored in host order, so you do not have to worry about how the endianness of an IPv4 address when using it in a display filter. IPX networks are represented by unsigned 32-bit integers. Most likely you will be using hexadecimal when testing for IPX network values: ipx.srcnet == 0xc0a82c00 A slice operator also exists. You can check the substring (byte-string) of any protocol or field. For example, you can filter on the vendor portion of an ethernet address (the first three bytes) like this: eth.src[0:3] == 00:00:83 If the length of your byte-slice is only one byte, then it is still represented in hex, but without the preceding "0x": llc[3] == aa You can use the slice operator on a protocol name, too. And remember, the "frame" protocol encompasses the entire packet, allowing you to look at the nth byte of a packet regardless of its frame type (Ethernet, token-ring, etc.). token[0:5] ne 0.0.0.1.1 ipx[0:2] == ff:ff llc[3:1] eq 0xaa The following syntax governs slices: [i:j] i = start_offset, j = length [i-j] i = start_offet, j = end_offset, inclusive. [i] i = start_offset, length = 1 [:j] start_offset = 0, length = j [i:] start_offset = i, end_offset = end_of_field Offsets and lengths can be negative, in which case they indicate the offset from the *end* of the field. Here's how to check the last 4 bytes of a frame: frame[-4:4] == 0.1.2.3 or frame[-4:] == 0.1.2.3 You can create complex concatenations of slices using the comma operator: field[1,3-5,9:] == 01:03:04:05:09:0a:0b All the above tests can be combined together with logical expressions. These too are expressable in C-like syntax or with English-like abbreviations: and, && Logical AND or, || Logical OR not, ! Logical NOT Expressions can be grouped by parentheses as well. The following are all valid display filter expression: tcp.port == 80 and ip.src == 192.168.2.1 not llc (ipx.srcnet == 0xbad && ipx.srnode == 0.0.0.0.0.1) || ip tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29 A special caveat must be given regarding fields that occur more than once per packet. "ip.addr" occurs twice per IP packet, once for the source address, and once for the destination address. Likewise, tr.rif.ring fields can occur more than once per packet. The following two expressions are not equivalent: ip.addr ne 192.168.4.1 not ip.addr eq 192.168.4.1 The first filter says "show me all packets where an ip.addr exists that does not equal 192.168.4.1". That is, as long as one ip.addr in the packet does not equal 192.168.44.1, the packet passes the display filter. The second filter "don't show me any packets that have at least one ip.addr field equal to 192.168.4.1". If one ip.addr is 192.168.4.1, the packet does not pass. If neither ip.addr fields is 192.168.4.1, then the packet passes. It is easy to think of the 'ne' and 'eq' operators as having an implict "exists" modifier when dealing with multiply-recurring fields. "ip.addr ne 192.168.4.1" can be thought of as "there exists an ip.addr that does not equal 192.168.4.1". Be careful with multiply-recurring fields; they can be confusing. The following is a table of protocol and protocol fields that are filterable in Ethereal. The abbreviation of the protocol or field is given. This abbreviation is what you use in the display filter. The type of the field is also given.

802.1q Virtual LAN (vlan)
vlan.cfi CFI Unsigned 16-bit integer vlan.etype Type Unsigned 16-bit integer vlan.id ID Unsigned 16-bit integer vlan.len Length Unsigned 16-bit integer vlan.priority Priority Unsigned 16-bit integer vlan.trailer Trailer Byte array

AOL Instant Messenger (aim)
aim.channel Channel ID Unsigned 8-bit integer aim.cmd_start Command Start Unsigned 8-bit integer aim.datalen Data Field Length Unsigned 16-bit integer aim.fnac.family FNAC Family ID Unsigned 16-bit integer aim.fnac.subtype FNAC Subtype ID Unsigned 16-bit integer aim.seqno Sequence Number Unsigned 16-bit integer

ATM (atm)
atm.vci VCI Unsigned 16-bit integer atm.vpi VPI Unsigned 8-bit integer

ATM LAN Emulation (lane)

Address Resolution Protocol (arp)
arp.dst.atm_num_e164 Target ATM number (E.164) String arp.dst.atm_num_nsap Target ATM number (NSAP) Byte array arp.dst.atm_subaddr Target ATM subaddress Byte array arp.dst.hlen Target ATM number length Unsigned 8-bit integer arp.dst.htype Target ATM number type Boolean arp.dst.hw Target hardware address Byte array arp.dst.pln Target protocol size Unsigned 8-bit integer arp.dst.proto Target protocol address Byte array arp.dst.slen Target ATM subaddress length Unsigned 8-bit integer arp.dst.stype Target ATM subaddress type Boolean arp.hw.size Hardware size Unsigned 8-bit integer arp.hw.type Hardware type Unsigned 16-bit integer arp.opcode Opcode Unsigned 16-bit integer arp.proto.size Protocol size Unsigned 8-bit integer arp.proto.type Protocol type Unsigned 16-bit integer arp.src.atm_num_e164 Sender ATM number (E.164) String arp.src.atm_num_nsap Sender ATM number (NSAP) Byte array arp.src.atm_subaddr Sender ATM subaddress Byte array arp.src.hlen Sender ATM number length Unsigned 8-bit integer arp.src.htype Sender ATM number type Boolean arp.src.hw Sender hardware address Byte array arp.src.pln Sender protocol size Unsigned 8-bit integer arp.src.proto Sender protocol address Byte array arp.src.slen Sender ATM subaddress length Unsigned 8-bit integer arp.src.stype Sender ATM subaddress type Boolean

Andrew File System (AFS) (afs)
afs.backup Backup Boolean afs.backup.errcode Error Code Unsigned 32-bit integer afs.backup.opcode Operation Unsigned 32-bit integer afs.bos BOS Boolean afs.bos.baktime Backup Time Date/Time stamp afs.bos.cell Cell String afs.bos.cmd Command String afs.bos.content Content String afs.bos.data Data Byte array afs.bos.date Date Unsigned 32-bit integer afs.bos.errcode Error Code Unsigned 32-bit integer afs.bos.error Error String afs.bos.file File String afs.bos.flags Flags Unsigned 32-bit integer afs.bos.host Host String afs.bos.instance Instance String afs.bos.key Key Byte array afs.bos.keychecksum Key Checksum Unsigned 32-bit integer afs.bos.keymodtime Key Modification Time Date/Time stamp afs.bos.keyspare2 Key Spare 2 Unsigned 32-bit integer afs.bos.kvno Key Version Number Unsigned 32-bit integer afs.bos.newtime New Time Date/Time stamp afs.bos.number Number Unsigned 32-bit integer afs.bos.oldtime Old Time Date/Time stamp afs.bos.opcode Operation Unsigned 32-bit integer afs.bos.parm Parm String afs.bos.path Path String afs.bos.size Size Unsigned 32-bit integer afs.bos.spare1 Spare1 String afs.bos.spare2 Spare2 String afs.bos.spare3 Spare3 String afs.bos.status Status Signed 32-bit integer afs.bos.statusdesc Status Description String afs.bos.type Type String afs.bos.user User String afs.cb Callback Boolean afs.cb.callback.expires Expires Date/Time stamp afs.cb.callback.type Type Unsigned 32-bit integer afs.cb.callback.version Version Unsigned 32-bit integer afs.cb.errcode Error Code Unsigned 32-bit integer afs.cb.fid.uniq FileID (Uniqifier) Unsigned 32-bit integer afs.cb.fid.vnode FileID (VNode) Unsigned 32-bit integer afs.cb.fid.volume FileID (Volume) Unsigned 32-bit integer afs.cb.opcode Operation Unsigned 32-bit integer afs.error Error Boolean afs.error.opcode Operation Unsigned 32-bit integer afs.fs File Server Boolean afs.fs.acl.a _A_dminister Unsigned 8-bit integer afs.fs.acl.count.negative ACL Count (Negative) Unsigned 32-bit integer afs.fs.acl.count.positive ACL Count (Positive) Unsigned 32-bit integer afs.fs.acl.d _D_elete Unsigned 8-bit integer afs.fs.acl.datasize ACL Size Unsigned 32-bit integer afs.fs.acl.entity Entity (User/Group) String afs.fs.acl.i _I_nsert Unsigned 8-bit integer afs.fs.acl.k _L_ock Unsigned 8-bit integer afs.fs.acl.l _L_ookup Unsigned 8-bit integer afs.fs.acl.r _R_ead Unsigned 8-bit integer afs.fs.acl.w _W_rite Unsigned 8-bit integer afs.fs.callback.expires Expires Date/Time stamp afs.fs.callback.type Type Unsigned 32-bit integer afs.fs.callback.version Version Unsigned 32-bit integer afs.fs.cps.spare1 CPS Spare1 Unsigned 32-bit integer afs.fs.cps.spare2 CPS Spare2 Unsigned 32-bit integer afs.fs.cps.spare3 CPS Spare3 Unsigned 32-bit integer afs.fs.data Data Byte array afs.fs.errcode Error Code Unsigned 32-bit integer afs.fs.fid.uniq FileID (Uniqifier) Unsigned 32-bit integer afs.fs.fid.vnode FileID (VNode) Unsigned 32-bit integer afs.fs.fid.volume FileID (Volume) Unsigned 32-bit integer afs.fs.flength FLength Unsigned 32-bit integer afs.fs.ipaddr IP Address IPv4 address afs.fs.length Length Unsigned 32-bit integer afs.fs.motd Message of the Day String afs.fs.name Name String afs.fs.newname New Name String afs.fs.offlinemsg Offline Message String afs.fs.offset Offset Unsigned 32-bit integer afs.fs.oldname Old Name String afs.fs.opcode Operation Unsigned 32-bit integer afs.fs.status.anonymousaccess Anonymous Access Unsigned 32-bit integer afs.fs.status.author Author Unsigned 32-bit integer afs.fs.status.calleraccess Caller Access Unsigned 32-bit integer afs.fs.status.clientmodtime Client Modification Time Date/Time stamp afs.fs.status.dataversion Data Version Unsigned 32-bit integer afs.fs.status.dataversionhigh Data Version (High) Unsigned 32-bit integer afs.fs.status.filetype File Type Unsigned 32-bit integer afs.fs.status.group Group Unsigned 32-bit integer afs.fs.status.interfaceversion Interface Version Unsigned 32-bit integer afs.fs.status.length Length Unsigned 32-bit integer afs.fs.status.linkcount Link Count Unsigned 32-bit integer afs.fs.status.mask Mask Unsigned 32-bit integer afs.fs.status.mask.fsync FSync Unsigned 32-bit integer afs.fs.status.mask.setgroup Set Group Unsigned 32-bit integer afs.fs.status.mask.setmode Set Mode Unsigned 32-bit integer afs.fs.status.mask.setmodtime Set Modification Time Unsigned 32-bit integer afs.fs.status.mask.setowner Set Owner Unsigned 32-bit integer afs.fs.status.mask.setsegsize Set Segment Size Unsigned 32-bit integer afs.fs.status.mode Unix Mode Unsigned 32-bit integer afs.fs.status.owner Owner Unsigned 32-bit integer afs.fs.status.parentunique Parent Unique Unsigned 32-bit integer afs.fs.status.parentvnode Parent VNode Unsigned 32-bit integer afs.fs.status.segsize Segment Size Unsigned 32-bit integer afs.fs.status.servermodtime Server Modification Time Date/Time stamp afs.fs.status.spare2 Spare 2 Unsigned 32-bit integer afs.fs.status.spare3 Spare 3 Unsigned 32-bit integer afs.fs.status.spare4 Spare 4 Unsigned 32-bit integer afs.fs.status.synccounter Sync Counter Unsigned 32-bit integer afs.fs.symlink.content Symlink Content String afs.fs.symlink.name Symlink Name String afs.fs.timestamp Timestamp Date/Time stamp afs.fs.token Token Byte array afs.fs.viceid Vice ID Unsigned 32-bit integer afs.fs.vicelocktype Vice Lock Type Unsigned 32-bit integer afs.fs.volid Volume ID Unsigned 32-bit integer afs.fs.volname Volume Name String afs.fs.volsync.spare1 Spare 1 Unsigned 32-bit integer afs.fs.volsync.spare2 Spare 2 Unsigned 32-bit integer afs.fs.volsync.spare3 Spare 3 Unsigned 32-bit integer afs.fs.volsync.spare4 Spare 4 Unsigned 32-bit integer afs.fs.volsync.spare5 Spare 5 Unsigned 32-bit integer afs.fs.volsync.spare6 Spare 6 Unsigned 32-bit integer afs.fs.xstats.clientversion Client Version Unsigned 32-bit integer afs.fs.xstats.collnumber Collection Number Unsigned 32-bit integer afs.fs.xstats.timestamp XStats Timestamp Unsigned 32-bit integer afs.fs.xstats.version XStats Version Unsigned 32-bit integer afs.kauth KAuth Boolean afs.kauth.data Data Byte array afs.kauth.domain Domain String afs.kauth.errcode Error Code Unsigned 32-bit integer afs.kauth.kvno Key Version Number Unsigned 32-bit integer afs.kauth.name Name String afs.kauth.opcode Operation Unsigned 32-bit integer afs.kauth.princ Principal String afs.kauth.realm Realm String afs.prot Protection Boolean afs.prot.count Count Unsigned 32-bit integer afs.prot.errcode Error Code Unsigned 32-bit integer afs.prot.flag Flag Unsigned 32-bit integer afs.prot.gid Group ID Unsigned 32-bit integer afs.prot.id ID Unsigned 32-bit integer afs.prot.maxgid Maximum Group ID Unsigned 32-bit integer afs.prot.maxuid Maximum User ID Unsigned 32-bit integer afs.prot.name Name String afs.prot.newid New ID Unsigned 32-bit integer afs.prot.oldid Old ID Unsigned 32-bit integer afs.prot.opcode Operation Unsigned 32-bit integer afs.prot.pos Position Unsigned 32-bit integer afs.prot.uid User ID Unsigned 32-bit integer afs.rmtsys Rmtsys Boolean afs.rmtsys.opcode Operation Unsigned 32-bit integer afs.ubik Ubik Boolean afs.ubik.activewrite Active Write Unsigned 32-bit integer afs.ubik.addr Address IPv4 address afs.ubik.amsyncsite Am Sync Site Unsigned 32-bit integer afs.ubik.anyreadlocks Any Read Locks Unsigned 32-bit integer afs.ubik.anywritelocks Any Write Locks Unsigned 32-bit integer afs.ubik.beaconsincedown Beacon Since Down Unsigned 32-bit integer afs.ubik.currentdb Current DB Unsigned 32-bit integer afs.ubik.currenttran Current Transaction Unsigned 32-bit integer afs.ubik.epochtime Epoch Time Date/Time stamp afs.ubik.errcode Error Code Unsigned 32-bit integer afs.ubik.file File Unsigned 32-bit integer afs.ubik.interface Interface Address IPv4 address afs.ubik.isclone Is Clone Unsigned 32-bit integer afs.ubik.lastbeaconsent Last Beacon Sent Date/Time stamp afs.ubik.lastvote Last Vote Unsigned 32-bit integer afs.ubik.lastvotetime Last Vote Time Date/Time stamp afs.ubik.lastyesclaim Last Yes Claim Date/Time stamp afs.ubik.lastyeshost Last Yes Host IPv4 address afs.ubik.lastyesstate Last Yes State Unsigned 32-bit integer afs.ubik.lastyesttime Last Yes Time Date/Time stamp afs.ubik.length Length Unsigned 32-bit integer afs.ubik.lockedpages Locked Pages Unsigned 32-bit integer afs.ubik.locktype Lock Type Unsigned 32-bit integer afs.ubik.lowesthost Lowest Host IPv4 address afs.ubik.lowesttime Lowest Time Date/Time stamp afs.ubik.now Now Date/Time stamp afs.ubik.nservers Number of Servers Unsigned 32-bit integer afs.ubik.opcode Operation Unsigned 32-bit integer afs.ubik.position Position Unsigned 32-bit integer afs.ubik.recoverystate Recovery State Unsigned 32-bit integer afs.ubik.site Site IPv4 address afs.ubik.state State Unsigned 32-bit integer afs.ubik.synchost Sync Host IPv4 address afs.ubik.syncsiteuntil Sync Site Until Date/Time stamp afs.ubik.synctime Sync Time Date/Time stamp afs.ubik.tidcounter TID Counter Unsigned 32-bit integer afs.ubik.up Up Unsigned 32-bit integer afs.ubik.version.counter Counter Unsigned 32-bit integer afs.ubik.version.epoch Epoch Date/Time stamp afs.ubik.voteend Vote Ends Date/Time stamp afs.ubik.votestart Vote Started Date/Time stamp afs.ubik.votetype Vote Type Unsigned 32-bit integer afs.ubik.writelockedpages Write Locked Pages Unsigned 32-bit integer afs.ubik.writetran Write Transaction Unsigned 32-bit integer afs.update Update Boolean afs.update.opcode Operation Unsigned 32-bit integer afs.vldb VLDB Boolean afs.vldb.bkvol Backup Volume ID Unsigned 32-bit integer afs.vldb.bump Bumped Volume ID Unsigned 32-bit integer afs.vldb.count Volume Count Unsigned 32-bit integer afs.vldb.errcode Error Code Unsigned 32-bit integer afs.vldb.id Volume ID Unsigned 32-bit integer afs.vldb.index Volume Index Unsigned 32-bit integer afs.vldb.name Volume Name String afs.vldb.nextindex Next Volume Index Unsigned 32-bit integer afs.vldb.numservers Number of Servers Unsigned 32-bit integer afs.vldb.opcode Operation Unsigned 32-bit integer afs.vldb.partition Partition String afs.vldb.rovol Read-Only Volume ID Unsigned 32-bit integer afs.vldb.rwvol Read-Write Volume ID Unsigned 32-bit integer afs.vldb.server Server IPv4 address afs.vldb.serveruuid Server UUID Byte array afs.vldb.type Volume Type Unsigned 32-bit integer afs.vol Volume Server Boolean afs.vol.count Volume Count Unsigned 32-bit integer afs.vol.errcode Error Code Unsigned 32-bit integer afs.vol.id Volume ID Unsigned 32-bit integer afs.vol.name Volume Name String afs.vol.opcode Operation Unsigned 32-bit integer

Appletalk Address Resolution Protocol (aarp)
aarp.dst.ether Target ether Byte array aarp.dst.id Target ID Byte array aarp.hard.size Hardware size Unsigned 8-bit integer aarp.hard.type Hardware type Unsigned 16-bit integer aarp.opcode Opcode Unsigned 16-bit integer aarp.proto.size Protocol size Unsigned 8-bit integer aarp.proto.type Protocol type Unsigned 16-bit integer aarp.src.ether Sender ether Byte array aarp.src.id Sender ID Byte array

Async data over ISDN (V.120) (v120)
v120.address Link Address Unsigned 16-bit integer v120.control Control Field Unsigned 16-bit integer v120.header Header Field String

Authentication Header (ah)
ah.sequence Sequence Unsigned 32-bit integer ah.spi SPI Unsigned 32-bit integer

BACnet Virtual Link Control (bvlc)
bvlc.bdt_ip IP IPv4 address bvlc.bdt_mask Mask Byte array bvlc.bdt_port Port Unsigned 16-bit integer bvlc.fdt_ip IP IPv4 address bvlc.fdt_port Port Unsigned 16-bit integer bvlc.fdt_timeout Timeout Unsigned 16-bit integer bvlc.fdt_ttl TTL Unsigned 16-bit integer bvlc.function Function Unsigned 8-bit integer bvlc.fwd_ip IP IPv4 address bvlc.fwd_port Port Unsigned 16-bit integer bvlc.length Length Unsigned 16-bit integer bvlc.reg_ttl TTL Unsigned 16-bit integer bvlc.result Result Unsigned 16-bit integer bvlc.type Type Unsigned 8-bit integer

Banyan Vines (vines)
vines.protocol Protocol Unsigned 8-bit integer

Banyan Vines Fragmentation Protocol (vines_frp)

Banyan Vines SPP (vines_spp)

Blocks eXtensible eXchange Protocol (bxxp)
bxxp.channel Channel Unsigned 32-bit integer bxxp.end End Boolean bxxp.more.complete Complete Boolean bxxp.more.intermediate Intermediate Boolean bxxp.req Request Boolean bxxp.req.channel Request Channel Number Unsigned 32-bit integer bxxp.rsp Response Boolean bxxp.rsp.channel Response Channel Number Unsigned 32-bit integer bxxp.seq Sequence Boolean bxxp.seq.ackno Ackno Unsigned 32-bit integer bxxp.seq.channel Sequence Channel Number Unsigned 32-bit integer bxxp.seq.window Window Unsigned 32-bit integer bxxp.seqno Seqno Unsigned 32-bit integer bxxp.serial Serial Unsigned 32-bit integer bxxp.size Size Unsigned 32-bit integer bxxp.status.negative Negative Boolean bxxp.status.positive Positive Boolean bxxp.violation Protocol Violation Boolean

Boot Parameters (bootparams)
bootparams.domain Client Domain String bootparams.fileid File ID String bootparams.filepath File Path String bootparams.host Client Host String bootparams.hostaddr Client Address IPv4 address bootparams.routeraddr Router Address IPv4 address bootparams.type Address Type Unsigned 32-bit integer

Bootstrap Protocol (bootp)
bootp.cookie Magic cookie IPv4 address bootp.dhcp Frame is DHCP Boolean bootp.file Boot file name String bootp.flag Broadcast flag Unsigned 16-bit integer bootp.hops Hops Unsigned 8-bit integer bootp.hw.addr Client hardware address Byte array bootp.hw.len Hardware address length Unsigned 8-bit integer bootp.hw.type Hardware type Unsigned 8-bit integer bootp.id Transaction ID Unsigned 32-bit integer bootp.ip.client Client IP address IPv4 address bootp.ip.relay Relay agent IP address IPv4 address bootp.ip.server Next server IP address IPv4 address bootp.ip.your Your (client) IP address IPv4 address bootp.secs Seconds elapsed Unsigned 16-bit integer bootp.server Server host name String bootp.type Message type Unsigned 8-bit integer

Border Gateway Protocol (bgp)
bgp.type BGP message type Unsigned 8-bit integer

Building Automation and Control Network APDU (bacapp)
bacapp.bacapp_type APDU Type Unsigned 8-bit integer

Building Automation and Control Network NPDU (bacnet)
bacnet.control Control Unsigned 8-bit integer bacnet.control_dest Destination Specifier Boolean bacnet.control_expect Expecting Reply Boolean bacnet.control_net NSDU contains Boolean bacnet.control_prio_high Priority Boolean bacnet.control_prio_low Priority Boolean bacnet.control_res1 Reserved Boolean bacnet.control_res2 Reserved Boolean bacnet.control_src Source specifier Boolean bacnet.dadr_eth Destination ISO 8802-3 MAC Address 6-byte Hardware (MAC) Address bacnet.dadr_tmp Unknown Destination MAC Byte array bacnet.dlen Destination MAC Layer Address Length Unsigned 8-bit integer bacnet.dnet Destination Network Address Unsigned 16-bit integer bacnet.hopc Hop Count Unsigned 8-bit integer bacnet.mesgtyp Message Type Unsigned 8-bit integer bacnet.perf Performance Index Unsigned 8-bit integer bacnet.pinfo Port Info Unsigned 8-bit integer bacnet.pinfolen Port Info Length Unsigned 8-bit integer bacnet.portid Port ID Unsigned 8-bit integer bacnet.rejectreason Reject Reason Unsigned 8-bit integer bacnet.rportnum Number of Port Mappings Unsigned 8-bit integer bacnet.sadr_eth SADR 6-byte Hardware (MAC) Address bacnet.sadr_tmp Unknown Source MAC Byte array bacnet.slen Source MAC Layer Address Length Unsigned 8-bit integer bacnet.snet Source Network Address Unsigned 16-bit integer bacnet.vendor Vendor ID Unsigned 16-bit integer bacnet.version Version Unsigned 8-bit integer

Cisco Auto-RP (auto_rp)
auto_rp.group_prefix Prefix IPv4 address auto_rp.holdtime Holdtime Unsigned 16-bit integer auto_rp.mask_len Mask length Unsigned 8-bit integer auto_rp.pim_ver Version Unsigned 8-bit integer auto_rp.prefix_sign Sign Unsigned 8-bit integer auto_rp.rp_addr RP address IPv4 address auto_rp.rp_count RP count Unsigned 8-bit integer auto_rp.type Packet type Unsigned 8-bit integer auto_rp.version Protocol version Unsigned 8-bit integer

Cisco Discovery Protocol (cdp)
cdp.checksum Checksum Unsigned 16-bit integer cdp.tlv.len Length Unsigned 16-bit integer cdp.tlv.type Type Unsigned 16-bit integer cdp.ttl TTL Unsigned 16-bit integer cdp.version Version Unsigned 8-bit integer

Cisco Group Management Protocol (cgmp)
cgmp.count Count Unsigned 8-bit integer cgmp.gda Group Destination Address 6-byte Hardware (MAC) Address cgmp.type Type Unsigned 8-bit integer cgmp.usa Unicast Source Address 6-byte Hardware (MAC) Address cgmp.version Version Unsigned 8-bit integer

Cisco HDLC (chdlc)
chdlc.address Address Unsigned 8-bit integer chdlc.protocol Protocol Unsigned 16-bit integer

Cisco Hot Standby Router Protocol (hsrp)
hsrp.auth_data Authentication Data String hsrp.group Group Unsigned 8-bit integer hsrp.hellotime Hellotime Unsigned 8-bit integer hsrp.holdtime Holdtime Unsigned 8-bit integer hsrp.opcode Op Code Unsigned 8-bit integer hsrp.priority Priority Unsigned 8-bit integer hsrp.reserved Reserved Unsigned 8-bit integer hsrp.state State Unsigned 8-bit integer hsrp.version Version Unsigned 8-bit integer hsrp.virt_ip Virtual IP Address IPv4 address

Cisco ISL (isl)
isl.addr Source or Destination Address 6-byte Hardware (MAC) Address isl.bpdu BPDU Boolean isl.crc CRC Unsigned 32-bit integer isl.dst Destination 6-byte Hardware (MAC) Address isl.dst_route_desc Destination route descriptor Unsigned 16-bit integer isl.esize Esize Unsigned 8-bit integer isl.explorer Explorer Boolean isl.fcs_not_incl FCS Not Included Boolean isl.hsa HSA Unsigned 24-bit integer isl.index Index Unsigned 16-bit integer isl.len Length Unsigned 16-bit integer isl.src Source 6-byte Hardware (MAC) Address isl.src_route_desc Source-route descriptor Unsigned 16-bit integer isl.src_vlan_id Source VLAN ID Unsigned 16-bit integer isl.type Type Unsigned 8-bit integer isl.user User Unsigned 8-bit integer isl.user_eth User Unsigned 8-bit integer isl.vlan_id VLAN ID Unsigned 16-bit integer

Cisco Interior Gateway Routing Protocol (igrp)
igrp.as Autonomous System Unsigned 16-bit integer igrp.update Update Release Unsigned 8-bit integer

Cisco SLARP (slarp)
slarp.address Address IPv4 address slarp.mysequence Outgoing sequence number Unsigned 32-bit integer slarp.ptype Packet type Unsigned 32-bit integer slarp.yoursequence Returned sequence number Unsigned 32-bit integer

Common Open Policy Service (cops)
cops.accttimer.value Contents: ACCT Timer Value Unsigned 16-bit integer cops.c_num C-Num Unsigned 8-bit integer cops.c_type C-Type Unsigned 8-bit integer cops.client_type Client Type Unsigned 16-bit integer cops.context.m_type M-Type Unsigned 16-bit integer cops.context.r_type R-Type Unsigned 16-bit integer cops.decision.cmd Command-Code Unsigned 16-bit integer cops.decision.flags Flags Unsigned 16-bit integer cops.error Error Unsigned 16-bit integer cops.error_sub Error Sub-code Unsigned 16-bit integer cops.flags Flags Unsigned 8-bit integer cops.in-int.ipv4 IPv4 address IPv4 address cops.in-int.ipv6 IPv6 address IPv6 address cops.in-out-int.ifindex ifIndex Unsigned 32-bit integer cops.integrity.key_id Contents: Key ID Unsigned 32-bit integer cops.integrity.seq_num Contents: Sequence Number Unsigned 32-bit integer cops.katimer.value Contents: KA Timer Value Unsigned 16-bit integer cops.lastpdpaddr.ipv4 IPv4 address IPv4 address cops.lastpdpaddr.ipv6 IPv6 address IPv6 address cops.msg_len Message Length Unsigned 32-bit integer cops.obj.len Object Length Unsigned 32-bit integer cops.op_code Op Code Unsigned 8-bit integer cops.out-int.ipv4 IPv4 address IPv4 address cops.out-int.ipv6 IPv6 address IPv6 address cops.pdp.tcp_port TCP Port Number Unsigned 32-bit integer cops.pdprediraddr.ipv4 IPv4 address IPv4 address cops.pdprediraddr.ipv6 IPv6 address IPv6 address cops.pepid.id Contents: PEP Id String cops.reason Reason Unsigned 16-bit integer cops.reason_sub Reason Sub-code Unsigned 16-bit integer cops.report_type Contents: Report-Type Unsigned 16-bit integer cops.ver_flags Version and Flags Unsigned 8-bit integer cops.version Version Unsigned 8-bit integer

Common Unix Printing System (CUPS) Browsing Protocol (cups)
cups.ptype Type Unsigned 32-bit integer cups.state State Unsigned 8-bit integer

DCE RPC (dcerpc)
dcerpc.cn_auth_len Auth Length Unsigned 16-bit integer dcerpc.cn_call_id Call ID Unsigned 32-bit integer dcerpc.cn_flags Packet Flags Unsigned 8-bit integer dcerpc.cn_flags.cancel_pending Cancel Pending Boolean dcerpc.cn_flags.dne Did Not Execute Boolean dcerpc.cn_flags.first_frag First Frag Boolean dcerpc.cn_flags.last_frag Last Frag Boolean dcerpc.cn_flags.maybe Maybe Boolean dcerpc.cn_flags.mpx Multiplex Boolean dcerpc.cn_flags.object Object Boolean dcerpc.cn_flags.reserved Reserved Boolean dcerpc.cn_frag_len Frag Length Unsigned 16-bit integer dcerpc.dg_act_id Activitiy String dcerpc.dg_ahint Activity Hint Unsigned 16-bit integer dcerpc.dg_auth_proto Auth proto Unsigned 8-bit integer dcerpc.dg_flags1 Flags1 Unsigned 8-bit integer dcerpc.dg_flags1_broadcast Broadcast Boolean dcerpc.dg_flags1_frag Fragment Boolean dcerpc.dg_flags1_idempotent Idempotent Boolean dcerpc.dg_flags1_last_frag Last Fragment Boolean dcerpc.dg_flags1_maybe Maybe Boolean dcerpc.dg_flags1_nofack No Fack Boolean dcerpc.dg_flags1_rsrvd_01 Reserved Boolean dcerpc.dg_flags1_rsrvd_80 Reserved Boolean dcerpc.dg_flags2 Flags2 Unsigned 8-bit integer dcerpc.dg_flags2_cancel_pending Cancel Pending Boolean dcerpc.dg_flags2_rsrvd_01 Reserved Boolean dcerpc.dg_flags2_rsrvd_04 Reserved Boolean dcerpc.dg_flags2_rsrvd_08 Reserved Boolean dcerpc.dg_flags2_rsrvd_10 Reserved Boolean dcerpc.dg_flags2_rsrvd_20 Reserved Boolean dcerpc.dg_flags2_rsrvd_40 Reserved Boolean dcerpc.dg_flags2_rsrvd_80 Reserved Boolean dcerpc.dg_frag_len Fragment len Unsigned 16-bit integer dcerpc.dg_frag_num Fragment num Unsigned 16-bit integer dcerpc.dg_if_id Interface String dcerpc.dg_if_ver Interface Ver Unsigned 32-bit integer dcerpc.dg_ihint Interface Hint Unsigned 16-bit integer dcerpc.dg_obj_id Object String dcerpc.dg_opnum Opnum Unsigned 16-bit integer dcerpc.dg_seqnum Sequence num Unsigned 32-bit integer dcerpc.dg_serial_hi Serial High Unsigned 8-bit integer dcerpc.dg_serial_lo Serial Low Unsigned 8-bit integer dcerpc.dg_server_boot Server boot time Unsigned 32-bit integer dcerpc.pkt_type Packet type Unsigned 8-bit integer dcerpc.ver Version Unsigned 8-bit integer dcerpc.ver_minor Version (minor) Unsigned 8-bit integer

DEC Spanning Tree Protocol (dec_stp)

Data (data)

Datagram Delivery Protocol (ddp)
ddp.checksum Checksum Unsigned 16-bit integer ddp.dst.net Destination Net Unsigned 16-bit integer ddp.dst.node Destination Node Unsigned 8-bit integer ddp.dst.socket Destination Socket Unsigned 8-bit integer ddp.hopcount Hop count Unsigned 8-bit integer ddp.len Datagram length Unsigned 16-bit integer ddp.src.net Source Net Unsigned 16-bit integer ddp.src.node Source Node Unsigned 8-bit integer ddp.src.socket Source Socket Unsigned 8-bit integer ddp.type Protocol type Unsigned 8-bit integer

Diameter Protocol (diameter)
diameter.avp.code AVP Code Unsigned 32-bit integer diameter.avp.data.bytes AVP Data Byte array diameter.avp.data.int32 AVP Data Signed 32-bit integer diameter.avp.data.string AVP Data String diameter.avp.data.time AVP Data Date/Time stamp diameter.avp.data.uint32 AVP Data Unsigned 32-bit integer diameter.avp.data.v4addr AVP Data IPv4 address diameter.avp.data.v6addr AVP Data IPv6 address diameter.avp.flags AVP Flags Unsigned 8-bit integer diameter.avp.length AVP length Unsigned 16-bit integer diameter.avp.reserved AVP Reserved Unsigned 8-bit integer diameter.avp.vendorId AVP Vendor Id Unsigned 32-bit integer diameter.code Command Code Unsigned 32-bit integer diameter.endtoendid End-to-End Identifier Unsigned 32-bit integer diameter.flags Flags Unsigned 8-bit integer diameter.hopbyhopid Hop-by-Hop Identifier Unsigned 32-bit integer diameter.length Length Unsigned 16-bit integer diameter.reserved Reserved Unsigned 8-bit integer diameter.vendorId VendorId Unsigned 32-bit integer diameter.version Version Unsigned 8-bit integer

Domain Name Service (dns)
dns.count.add_rr Additional RRs Unsigned 16-bit integer dns.count.answers Answer RRs Unsigned 16-bit integer dns.count.auth_rr Authority RRs Unsigned 16-bit integer dns.count.queries Questions Unsigned 16-bit integer dns.flags Flags Unsigned 16-bit integer dns.id Transaction ID Unsigned 16-bit integer dns.query Query Boolean dns.response Response Boolean

Dynamic DNS Tools Protocol (ddtp)
ddtp.encrypt Encryption Unsigned 32-bit integer ddtp.hostid Hostid Unsigned 32-bit integer ddtp.ipaddr IP address IPv4 address ddtp.msgtype Message type Unsigned 32-bit integer ddtp.opcode Opcode Unsigned 32-bit integer ddtp.status Status Unsigned 32-bit integer ddtp.version Version Unsigned 32-bit integer

Encapsulating Security Payload (esp)
esp.sequence Sequence Unsigned 32-bit integer esp.spi SPI Unsigned 32-bit integer

Enhanced Interior Gateway Routing Protocol (eigrp)
eigrp.as Autonomous System Unsigned 16-bit integer eigrp.opcode Opcode Unsigned 8-bit integer eigrp.tlv Entry Unsigned 16-bit integer

Ethernet (eth)
eth.addr Source or Destination Address 6-byte Hardware (MAC) Address eth.dst Destination 6-byte Hardware (MAC) Address eth.len Length Unsigned 16-bit integer eth.src Source 6-byte Hardware (MAC) Address eth.trailer Trailer Byte array eth.type Type Unsigned 16-bit integer

FTP Data (ftp-data)

Fiber Distributed Data Interface (fddi)
fddi.addr Source or Destination Address 6-byte Hardware (MAC) Address fddi.dst Destination 6-byte Hardware (MAC) Address fddi.fc Frame Control Unsigned 8-bit integer fddi.src Source 6-byte Hardware (MAC) Address

File Transfer Protocol (FTP) (ftp)
ftp.reponse.data Response data String ftp.request Request Boolean ftp.request.command Request command String ftp.request.data Request data String ftp.response Response Boolean ftp.response.code Response code Unsigned 8-bit integer

Frame (frame)
frame.cap_len Capture Frame Length Unsigned 32-bit integer frame.number Frame Number Unsigned 32-bit integer frame.p2p_dir Point-to-Point Direction Unsigned 8-bit integer frame.pkt_len Total Frame Length Unsigned 32-bit integer frame.time Arrival Time Date/Time stamp frame.time_delta Time delta from previous packet Time duration frame.time_relative Time relative to first packet Time duration

Frame Relay (fr)
fr.becn BECN Boolean fr.chdlctype Type Unsigned 16-bit integer fr.cr CR Boolean fr.dc DC Boolean fr.de DE Boolean fr.dlci DLCI Unsigned 16-bit integer fr.ea EA Boolean fr.fecn FECN Boolean fr.nlpid NLPID Unsigned 8-bit integer fr.snap.oui Organization Code Unsigned 24-bit integer fr.snap.pid Protocol ID Unsigned 16-bit integer fr.snaptype Type Unsigned 16-bit integer

GARP VLAN Registration Protocol (gvrp)
garp.attribute_event Event Unsigned 8-bit integer garp.attribute_length Length Unsigned 8-bit integer garp.attribute_type Type Unsigned 8-bit integer garp.attribute_value Value Unsigned 16-bit integer garp.protocol_id Protocol ID Unsigned 16-bit integer

GPRS Tunneling Protocol (gtp)
gtp.ext Extension header Unsigned 8-bit integer gtp.ext.apn APN String gtp.ext.cause Cause Unsigned 8-bit integer gtp.ext.chrg_addr CG address IPv4 address gtp.ext.chrg_id Charging ID Unsigned 32-bit integer gtp.ext.ext_id Ext id Unsigned 16-bit integer gtp.ext.ext_val Ext val String gtp.ext.flow_ii Downlink flow label data Unsigned 16-bit integer gtp.ext.flow_ii_nsapi NSAPI Unsigned 8-bit integer gtp.ext.flow_label Flow label Unsigned 16-bit integer gtp.ext.flow_sig Flow label signature Unsigned 16-bit integer gtp.ext.gsn_addr GSN address IPv4 address gtp.ext.imsi IMSI String gtp.ext.lac LAC Unsigned 16-bit integer gtp.ext.map Ext type Unsigned 8-bit integer gtp.ext.mcc MCC Unsigned 16-bit integer gtp.ext.mnc MNC Unsigned 8-bit integer gtp.ext.ms MS validated Boolean gtp.ext.msisdn MSISDN String gtp.ext.node_addr Node address IPv4 address gtp.ext.proto_conf Protocol configuration String gtp.ext.ptmsi P-TMSI Unsigned 32-bit integer gtp.ext.ptmsi_sig P-TMSI signature Unsigned 24-bit integer gtp.ext.qos_delay QoS delay Unsigned 8-bit integer gtp.ext.qos_mean QoS mean Unsigned 8-bit integer gtp.ext.qos_peak QoS peak Unsigned 8-bit integer gtp.ext.qos_precedence QoS precedence Unsigned 8-bit integer gtp.ext.qos_reliabilty QoS reliability Unsigned 8-bit integer gtp.ext.rac RAC Unsigned 8-bit integer gtp.ext.recover Restart counter Unsigned 8-bit integer gtp.ext.reorder Reordering required Boolean gtp.ext.sel_mode Selection mode Unsigned 8-bit integer gtp.ext.tlli TLLI Unsigned 32-bit integer gtp.ext.tr_comm Transfer command Unsigned 8-bit integer gtp.ext.unknown Unknown data (length) Unsigned 16-bit integer gtp.ext.user_addr End user address IPv4 address gtp.ext.user_addr_pdp_org PDP type organization Unsigned 8-bit integer gtp.ext.user_addr_pdp_type PDP type Unsigned 8-bit integer gtp.flags Flags Unsigned 8-bit integer gtp.flags.payload_type Payload Type Unsigned 8-bit integer gtp.flags.snn Is seq number Unsigned 8-bit integer gtp.flags.spare Reserved Unsigned 8-bit integer gtp.flags.version Version Unsigned 8-bit integer gtp.flow_label Flow label Unsigned 16-bit integer gtp.length Length Unsigned 16-bit integer gtp.message_type Message type Unsigned 8-bit integer gtp.seq_number Sequence number Unsigned 16-bit integer gtp.sndcp_number SNDCP N-PDU LLC Number Unsigned 8-bit integer gtp.tid Tunnel ID String

General Inter-ORB Protocol (giop)
giop.len Message size Unsigned 32-bit integer giop.type Message type Unsigned 8-bit integer

Generic Routing Encapsulation (gre)
gre.proto Protocol Type Unsigned 16-bit integer

Hummingbird NFS Daemon (hclnfsd)
hclnfsd.access Access Unsigned 32-bit integer hclnfsd.cookie Cookie Unsigned 32-bit integer hclnfsd.copies Copies Unsigned 32-bit integer hclnfsd.device Device String hclnfsd.exclusive Exclusive Unsigned 32-bit integer hclnfsd.fileext File Extension Unsigned 32-bit integer hclnfsd.filename Filename String hclnfsd.gid GID Unsigned 32-bit integer hclnfsd.group Group String hclnfsd.host_ip Host IP IPv4 address hclnfsd.hostname Hostname String hclnfsd.jobstatus Job Status Unsigned 32-bit integer hclnfsd.length Length Unsigned 32-bit integer hclnfsd.lockname Lockname String hclnfsd.lockowner Lockowner String hclnfsd.logintext Login Text String hclnfsd.mode Mode Unsigned 32-bit integer hclnfsd.npp Number of Physical Printers Unsigned 32-bit integer hclnfsd.offset Offset Unsigned 32-bit integer hclnfsd.pqn Print Queue Number Unsigned 32-bit integer hclnfsd.printername Printer Name String hclnfsd.printparameters Print Parameters String hclnfsd.printqueuecomment Comment String hclnfsd.printqueuename Name String hclnfsd.queuestatus Queue Status Unsigned 32-bit integer hclnfsd.request_type Request Type Unsigned 32-bit integer hclnfsd.sequence Sequence Unsigned 32-bit integer hclnfsd.server_ip Server IP IPv4 address hclnfsd.size Size Unsigned 32-bit integer hclnfsd.status Status Unsigned 32-bit integer hclnfsd.timesubmitted Time Submitted Unsigned 32-bit integer hclnfsd.uid UID Unsigned 32-bit integer hclnfsd.unknown_data Unknown String hclnfsd.username Username String

Hypertext Transfer Protocol (http)
http.notification Notification Boolean http.request Request Boolean http.response Response Boolean

ICQ Protocol (icq)
icq.checkcode Checkcode Unsigned 32-bit integer icq.cmd Command Unsigned 16-bit integer icq.decode Decode String icq.sessionid Session ID Unsigned 32-bit integer icq.type Type Unsigned 16-bit integer icq.uin UIN Unsigned 32-bit integer

IEEE 802.11 wireless LAN (wlan)
wlan.aid Association ID Unsigned 16-bit integer wlan.bssid BSS Id 6-byte Hardware (MAC) Address wlan.da Destination address 6-byte Hardware (MAC) Address wlan.duration Duration Unsigned 16-bit integer wlan.fc Frame Control Field Unsigned 16-bit integer wlan.fc.ds DS status Unsigned 8-bit integer wlan.fc.frag Fragments Boolean wlan.fc.fromds From DS Boolean wlan.fc.moredata More Data Boolean wlan.fc.order Order flag Boolean wlan.fc.pwrmgt PWR MGT Boolean wlan.fc.retry Retry Boolean wlan.fc.subtype Subtype Unsigned 8-bit integer wlan.fc.tods To DS Boolean wlan.fc.type Type Unsigned 8-bit integer wlan.fc.version Version Unsigned 8-bit integer wlan.fc.wep WEP flag Boolean wlan.fcs Frame Check Sequence (not verified) Unsigned 32-bit integer wlan.fixed.aid Association ID Unsigned 16-bit integer wlan.fixed.all Fixed parameters Unsigned 16-bit integer wlan.fixed.auth.alg Authentication Algorithm Unsigned 16-bit integer wlan.fixed.auth_seq Authentication SEQ Unsigned 16-bit integer wlan.fixed.beacon Beacon Interval Unsigned 16-bit integer wlan.fixed.capabilities Capabilities Unsigned 16-bit integer wlan.fixed.capabilities.cfpoll.ap CFP participation capabilities Unsigned 16-bit integer wlan.fixed.capabilities.cfpoll.sta CFP participation capabilities Unsigned 16-bit integer wlan.fixed.capabilities.ess ESS capabilities Boolean wlan.fixed.capabilities.ibss IBSS status Boolean wlan.fixed.capabilities.privacy Privacy Boolean wlan.fixed.current_ap Current AP 6-byte Hardware (MAC) Address wlan.fixed.listen_ival Listen Interval Unsigned 16-bit integer wlan.fixed.reason_code Reason code Unsigned 16-bit integer wlan.fixed.status_code Status code Unsigned 16-bit integer wlan.fixed.timestamp Timestamp String wlan.flags Protocol Flags Unsigned 8-bit integer wlan.frag Fragment number Unsigned 16-bit integer wlan.ra Receiver address 6-byte Hardware (MAC) Address wlan.sa Source address 6-byte Hardware (MAC) Address wlan.seq Sequence number Unsigned 16-bit integer wlan.ta Transmitter address 6-byte Hardware (MAC) Address wlan.tag.interpretation Tag interpretation String wlan.tag.length Tag length Unsigned 16-bit integer wlan.tag.number Tag Unsigned 16-bit integer wlan.tagged.all Tagged parameters Unsigned 16-bit integer

ILMI (ilmi)

IP Payload Compression (ipcomp)
ipcomp.cpi CPI Unsigned 16-bit integer ipcomp.flags Flags Unsigned 8-bit integer

IPX Message (ipxmsg)
ipxmsg.conn Connection Number Unsigned 8-bit integer ipxmsg.sigchar Signature Char Unsigned 8-bit integer

IPX Routing Information Protocol (ipxrip)
ipxrip.request Request Boolean ipxrip.response Response Boolean

ISDN Q.921-User Adaptation Layer (iua)
hf.iua.one_bit One bit Boolean hf.iua.sapi SAPI Unsigned 8-bit integer hf.iua.spare_bit Spare bit Boolean hf.iua.tei TEI Unsigned 8-bit integer hf.iua.zero_bit Zero bit Boolean iua.asp_reason Reason Unsigned 32-bit integer iua.error_code Error code Unsigned 32-bit integer iua.info_string Info string String iua.int_interface_identifier Integer interface identifier Unsigned 32-bit integer iua.interface_range_end End Unsigned 32-bit integer iua.interface_range_start Start Unsigned 32-bit integer iua.message_class Message class Unsigned 8-bit integer iua.message_length Message length Unsigned 32-bit integer iua.message_type Message Type Unsigned 8-bit integer iua.parameter_length Parameter length Unsigned 16-bit integer iua.parameter_tag Parameter Tag Unsigned 16-bit integer iua.release_reason Reason Unsigned 32-bit integer iua.reserved Reserved Unsigned 8-bit integer iua.status_identification Status identification Unsigned 16-bit integer iua.status_type Status type Unsigned 16-bit integer iua.tei_status TEI status Unsigned 32-bit integer iua.text_interface_identifier Text interface identifier String iua.traffic_mode_type Traffic mode type Unsigned 32-bit integer iua.version Version Unsigned 8-bit integer

ISIS HELLO (isis_hello)
isis_hello.circuite_type Circuit type Unsigned 8-bit integer isis_hello.clv_ipv4_int_addr IPv4 interface address IPv4 address isis_hello.holding_timer Holding timer Unsigned 16-bit integer isis_hello.lan_id SystemID{ Designated IS } Byte array isis_hello.local_circuit_id Local circuit ID Unsigned 8-bit integer isis_hello.pdu_length PDU length Unsigned 16-bit integer isis_hello.priority Priority Unsigned 8-bit integer isis_hello.source_id SystemID{ Sender of PDU } Byte array

ISO 10589 ISIS Complete Sequence Numbers Protocol Data Unit (isis_csnp)
isis_csnp.pdu_length PDU length Unsigned 16-bit integer

ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol (isis)
isis.irpd Intra Domain Routing Protocol Discriminator Unsigned 8-bit integer isis.len PDU Header Length Unsigned 8-bit integer isis.max_area_adr Max.AREAs: (0==3) Unsigned 8-bit integer isis.reserved Reserved (==0) Unsigned 8-bit integer isis.sysid_len System ID Length Unsigned 8-bit integer isis.type PDU Type : Unsigned 8-bit integer isis.version Version (==1) Unsigned 8-bit integer isis.version2 Version2 (==1) Unsigned 8-bit integer

ISO 10589 ISIS Link State Protocol Data Unit (isis_lsp)
isis_lsp.checksum Checksum Unsigned 16-bit integer isis_lsp.clv_ipv4_int_addr IPv4 interface address: IPv4 address isis_lsp.pdu_length PDU length Unsigned 16-bit integer isis_lsp.remaining_life Remaining life Unsigned 16-bit integer isis_lsp.sequence_number Sequence number Unsigned 32-bit integer

ISO 10589 ISIS Partial Sequence Numbers Protocol Data Unit (isis_psnp)
isis_psnp.pdu_length PDU length Unsigned 16-bit integer

ISO 8073 COTP Connection-Oriented Transport Protocol (cotp)

ISO 8473 CLNP ConnectionLess Network Protocol (clnp)
clnp.checksum Checksum Unsigned 16-bit integer clnp.dsap DA Byte array clnp.dsap.len DAL Unsigned 8-bit integer clnp.len HDR Length Unsigned 8-bit integer clnp.nlpi Network Layer Protocol Identifier Unsigned 8-bit integer clnp.pdu.len PDU length Unsigned 16-bit integer clnp.ssap SA Byte array clnp.ssap.len SAL Unsigned 8-bit integer clnp.ttl Holding Time Unsigned 8-bit integer clnp.type PDU Type Unsigned 8-bit integer clnp.version Version Unsigned 8-bit integer

ISO 8602 CLTP ConnectionLess Transport Protocol (cltp)

ISO 9542 ESIS Routeing Information Exchange Protocol (esis)
esis.chksum Checksum Unsigned 16-bit integer esis.htime Holding Time Unsigned 16-bit integer esis.length PDU Length Unsigned 8-bit integer esis.nlpi Network Layer Protocol Identifier Unsigned 8-bit integer esis.res Reserved(==0) Unsigned 8-bit integer esis.type PDU Type Unsigned 8-bit integer esis.ver Version (==1) Unsigned 8-bit integer

ITU-T Recommendation H.261 (h261)
h261.ebit End bit position Unsigned 8-bit integer h261.gobn GOB Number Unsigned 8-bit integer h261.hmvd Horizontal motion vctor data Unsigned 8-bit integer h261.i Intra frame encoded data flag Boolean h261.mbap Macroblock address predictor Unsigned 8-bit integer h261.quant Quantizer Unsigned 8-bit integer h261.sbit Start bit position Unsigned 8-bit integer h261.stream H.261 stream Byte array h261.v Motion vector flag Boolean h261.vmvd Vertical motion vector data Unsigned 8-bit integer

Internet Cache Protocol (icp)
icp.length Length Unsigned 16-bit integer icp.nr Request Number Unsigned 32-bit integer icp.opcode Opcode Unsigned 8-bit integer icp.version Version Unsigned 8-bit integer

Internet Control Message Protocol (icmp)
icmp.checksum Checksum Unsigned 16-bit integer icmp.checksum_bad Bad Checksum Boolean icmp.code Code Unsigned 8-bit integer icmp.type Type Unsigned 8-bit integer

Internet Control Message Protocol v6 (icmpv6)
icmpv6.checksum Checksum Unsigned 16-bit integer icmpv6.checksum_bad Bad Checksum Boolean icmpv6.code Code Unsigned 8-bit integer icmpv6.type Type Unsigned 8-bit integer

Internet Group Management Protocol (igmp)
igmp.checksum Checksum Unsigned 16-bit integer igmp.group Group address IPv4 address igmp.type Type Unsigned 8-bit integer igmp.unused Unused Unsigned 8-bit integer igmp.version Version Unsigned 8-bit integer

Internet Message Access Protocol (imap)
imap.request Request Boolean imap.response Response Boolean

Internet Printing Protocol (ipp)

Internet Protocol (ip)
ip.addr Source or Destination Address IPv4 address ip.checksum Header checksum Unsigned 16-bit integer ip.checksum_bad Bad Header checksum Boolean ip.dsfield Differentiated Services field Unsigned 8-bit integer ip.dsfield.ce ECN-CE Unsigned 8-bit integer ip.dsfield.dscp Differentiated Services Codepoint Unsigned 8-bit integer ip.dsfield.ect ECN-Capable Transport (ECT) Unsigned 8-bit integer ip.dst Destination IPv4 address ip.flags Flags Unsigned 8-bit integer ip.flags.df Don't fragment Boolean ip.flags.mf More fragments Boolean ip.frag_offset Fragment offset Unsigned 16-bit integer ip.hdr_len Header Length Unsigned 8-bit integer ip.id Identification Unsigned 16-bit integer ip.len Total Length Unsigned 16-bit integer ip.proto Protocol Unsigned 8-bit integer ip.src Source IPv4 address ip.tos Type of Service Unsigned 8-bit integer ip.tos.cost Cost Boolean ip.tos.delay Delay Boolean ip.tos.precedence Precedence Unsigned 8-bit integer ip.tos.reliability Reliability Boolean ip.tos.throughput Throughput Boolean ip.ttl Time to live Unsigned 8-bit integer ip.version Version Unsigned 8-bit integer

Internet Protocol Version 6 (ipv6)
ipv6.addr Address IPv6 address ipv6.class Traffic class Unsigned 8-bit integer ipv6.dst Destination IPv6 address ipv6.flow Flowlabel Unsigned 32-bit integer ipv6.hlim Hop limit Unsigned 8-bit integer ipv6.mipv6_a_flag Acknowledge (A) Boolean ipv6.mipv6_b_flag Bicasting all (B) Boolean ipv6.mipv6_d_flag Duplicate Address Detection (D) Boolean ipv6.mipv6_h_flag Home Registration (H) Boolean ipv6.mipv6_home_address Home Address IPv6 address ipv6.mipv6_length Option Length Unsigned 8-bit integer ipv6.mipv6_life_time Life Time Unsigned 32-bit integer ipv6.mipv6_m_flag MAP Registration (M) Boolean ipv6.mipv6_prefix_length Prefix Length Unsigned 8-bit integer ipv6.mipv6_r_flag Router (R) Boolean ipv6.mipv6_refresh Refresh Unsigned 32-bit integer ipv6.mipv6_sequence_number Sequence Number Unsigned 16-bit integer ipv6.mipv6_status Status Unsigned 8-bit integer ipv6.mipv6_sub_alternative_COA Alternative Care of Address IPv6 address ipv6.mipv6_sub_length Sub-Option Length Unsigned 8-bit integer ipv6.mipv6_sub_type Sub-Option Type Unsigned 8-bit integer ipv6.mipv6_sub_unique_ID Unique Identifier Unsigned 16-bit integer ipv6.mipv6_type Option Type Unsigned 8-bit integer ipv6.nxt Next header Unsigned 8-bit integer ipv6.plen Payload length Unsigned 16-bit integer ipv6.src Source IPv6 address ipv6.version Version Unsigned 8-bit integer

Internet Relay Chat (irc)
irc.command Command String irc.request Request Boolean irc.response Response Boolean

Internet Security Association and Key Management Protocol (isakmp)

Internetwork Packet eXchange (ipx)
ipx.checksum Checksum Unsigned 16-bit integer ipx.dst.net Destination Network IPX network or server name ipx.dst.node Destination Node 6-byte Hardware (MAC) Address ipx.dst.socket Destination Socket Unsigned 16-bit integer ipx.hops Transport Control (Hops) Unsigned 8-bit integer ipx.len Length Unsigned 16-bit integer ipx.packet_type Packet Type Unsigned 8-bit integer ipx.src.net Source Network IPX network or server name ipx.src.node Source Node 6-byte Hardware (MAC) Address ipx.src.socket Source Socket Unsigned 16-bit integer

Kerberos (kerberos)

Label Distribution Protocol (ldp)
ldp,msg.tlv.hello.requested Hello Requested Boolean ldp.hdr.ldpid.lsid Label Space ID Unsigned 16-bit integer ldp.hdr.ldpid.lsr LSR ID Unsigned 32-bit integer ldp.hdr.pdu_len PDU Length Unsigned 16-bit integer ldp.hdr.version Version Unsigned 16-bit integer ldp.msg.id Message ID Unsigned 32-bit integer ldp.msg.len Message Length Unsigned 16-bit integer ldp.msg.tlv.fec.af FEC Element Address Type Unsigned 16-bit integer ldp.msg.tlv.fec.len FEC Element Length Unsigned 8-bit integer ldp.msg.tlv.fec.pfval FEC Element Prefix Value Unsigned 32-bit integer ldp.msg.tlv.fec.type FEC Element Type Unsigned 8-bit integer ldp.msg.tlv.hello.cnf_seqno Configuration Sequence Number Unsigned 32-bit integer ldp.msg.tlv.hello.hold Hold Time Unsigned 16-bit integer ldp.msg.tlv.hello.res Reserved Unsigned 16-bit integer ldp.msg.tlv.hello.targeted Targeted Hello Boolean ldp.msg.tlv.label Generic Label Unsigned 32-bit integer ldp.msg.tlv.len TLV Length Unsigned 16-bit integer ldp.msg.tlv.type TLV Type Unsigned 16-bit integer ldp.msg.tlv.value TLV Value Byte array ldp.msg.type Message Type Unsigned 16-bit integer ldp.req Request Boolean ldp.rsp Response Boolean

Layer 2 Tunneling Protocol (l2tp)
l2tp.Nr Nr Unsigned 16-bit integer l2tp.Ns Ns Unsigned 16-bit integer l2tp.length Length Unsigned 16-bit integer l2tp.offset Offset Unsigned 16-bit integer l2tp.session Session ID Unsigned 16-bit integer l2tp.tunnel Tunnel ID Unsigned 16-bit integer lt2p.code code Unsigned 16-bit integer lt2p.length_bit Length Bit Boolean lt2p.offset_bit Offset bit Boolean lt2p.priority Priority Boolean lt2p.seq_bit Sequence Bit Boolean lt2p.type Type Unsigned 16-bit integer lt2p.version Version Unsigned 16-bit integer

Lightweight Directory Access Protocol (ldap)
ldap.abandon.msgid Abandon Msg Id Unsigned 32-bit integer ldap.attribute Attribute String ldap.bind.auth_type Auth Type Unsigned 8-bit integer ldap.bind.dn DN String ldap.bind.password Password String ldap.bind.version Version Unsigned 32-bit integer ldap.compare.test Test String ldap.dn Distinguished Name String ldap.length Length Unsigned 32-bit integer ldap.message_id Message Id Unsigned 32-bit integer ldap.message_length Message Length Unsigned 32-bit integer ldap.message_type Message Type Unsigned 8-bit integer ldap.modify.add Add String ldap.modify.delete Delete String ldap.modify.replace Replace String ldap.modrdn.delete Delete Values Boolean ldap.modrdn.name New Name String ldap.modrdn.superior New Location String ldap.result.code Result Code Unsigned 8-bit integer ldap.result.errormsg Error Message String ldap.result.matcheddn Matched DN String ldap.result.referral Referral String ldap.search.basedn Base DN String ldap.search.dereference Dereference Unsigned 8-bit integer ldap.search.filter Filter String ldap.search.scope Scope Unsigned 8-bit integer ldap.search.sizelimit Size Limit Unsigned 32-bit integer ldap.search.timelimit Time Limit Unsigned 32-bit integer ldap.search.typesonly Attributes Only Boolean ldap.value Value String

Line Printer Daemon Protocol (lpd)
lpd.request Request Boolean lpd.response Response Boolean

Link Access Procedure Balanced (LAPB) (lapb)
lapb.address Address Field Unsigned 8-bit integer lapb.control Control Field Unsigned 8-bit integer

Link Access Procedure Balanced Ethernet (LAPBETHER) (lapbether)
lapbether.length Length Field Unsigned 16-bit integer

Link Access Procedure, Channel D (LAPD) (lapd)
lapd.address Address Field Unsigned 16-bit integer lapd.control Control Field Unsigned 16-bit integer lapd.cr C/R Unsigned 16-bit integer lapd.ea1 EA1 Unsigned 16-bit integer lapd.ea2 EA2 Unsigned 16-bit integer lapd.sapi SAPI Unsigned 16-bit integer lapd.tei TEI Unsigned 16-bit integer

Linux cooked-mode capture (sll)
sll.etype Protocol Unsigned 16-bit integer sll.halen Link-layer address length Unsigned 16-bit integer sll.hatype Link-layer address type Unsigned 16-bit integer sll.ltype Protocol Unsigned 16-bit integer sll.pkttype Packet type Unsigned 16-bit integer sll.src.eth Source 6-byte Hardware (MAC) Address sll.src.other Source Byte array sll.trailer Trailer Byte array

Local Management Interface (lmi)
lmi.cmd Call reference Unsigned 8-bit integer lmi.dlci_act DLCI Active Unsigned 8-bit integer lmi.dlci_hi DLCI High Unsigned 8-bit integer lmi.dlci_low DLCI Low Unsigned 8-bit integer lmi.dlci_new DLCI New Unsigned 8-bit integer lmi.ele_rcd_type Record Type Unsigned 8-bit integer lmi.inf_ele Information Element Unsigned 8-bit integer lmi.inf_ele_len Length Unsigned 8-bit integer lmi.inf_ele_type Type Unsigned 8-bit integer lmi.msg_type Message Type Unsigned 8-bit integer lmi.recv_seq Recv Seq Unsigned 8-bit integer lmi.send_seq Send Seq Unsigned 8-bit integer

Logical-Link Control (llc)
llc.control Control Unsigned 16-bit integer llc.dsap DSAP Unsigned 8-bit integer llc.dsap.ig IG Bit Boolean llc.oui Organization Code Unsigned 24-bit integer llc.pid Protocol ID Unsigned 16-bit integer llc.ssap SSAP Unsigned 8-bit integer llc.ssap.cr CR Bit Boolean llc.type Type Unsigned 16-bit integer

Lucent/Ascend debug output (ascend)
ascend.chunk WDD Chunk Unsigned 32-bit integer ascend.number Called number String ascend.sess Session ID Unsigned 32-bit integer ascend.task Task Unsigned 32-bit integer ascend.type Link type Unsigned 32-bit integer ascend.user User name String

MAPI (mapi)
mapi.request Request Boolean mapi.response Response Boolean

MS Proxy Protocol (msproxy)
msproxy.bindaddr Destination IPv4 address msproxy.bindid Bound Port Id Unsigned 32-bit integer msproxy.bindport Bind Port Unsigned 16-bit integer msproxy.boundport Bound Port Unsigned 16-bit integer msproxy.clntport Client Port Unsigned 16-bit integer msproxy.command Command Unsigned 16-bit integer msproxy.dstaddr Destination Address IPv4 address msproxy.dstport Destination Port Unsigned 16-bit integer msproxy.resolvaddr Address IPv4 address msproxy.server_ext_addr Server External Address IPv4 address msproxy.server_ext_port Server External Port Unsigned 16-bit integer msproxy.server_int_addr Server Internal Address IPv4 address msproxy.server_int_port Server Internal Port Unsigned 16-bit integer msproxy.serveraddr Server Address IPv4 address msproxy.serverport Server Port Unsigned 16-bit integer msproxy.srcport Source Port Unsigned 16-bit integer

MTP 3 User Adaptation Layer (m3ua)
m3ua.affected_dpc Affected DPC Unsigned 24-bit integer m3ua.congestion_level Congestion level Unsigned 8-bit integer m3ua.error_code Error code Unsigned 32-bit integer m3ua.info_string Info string String m3ua.mask Mask Unsigned 8-bit integer m3ua.message_class Message class Unsigned 8-bit integer m3ua.message_length Message length Unsigned 32-bit integer m3ua.message_type Message Type Unsigned 8-bit integer m3ua.network_appearance Network appearance Unsigned 32-bit integer m3ua.parameter_length Parameter length Unsigned 16-bit integer m3ua.parameter_tag Parameter Tag Unsigned 16-bit integer m3ua.reason Reason Unsigned 32-bit integer m3ua.reserved Reserved Unsigned 8-bit integer m3ua.routing_context Routing context Unsigned 32-bit integer m3ua.status_info Status info Unsigned 16-bit integer m3ua.status_type Status type Unsigned 16-bit integer m3ua.traffic_mode_type Traffic mode Type Unsigned 32-bit integer m3ua.unavailability_cause Unavailability cause Unsigned 16-bit integer m3ua.user_identity User Identity Unsigned 16-bit integer m3ua.version Version Unsigned 8-bit integer

Malformed Frame (malformed)

Microsoft Windows Browser Protocol (browser)

Microsoft Windows Lanman Protocol (lanman)

Microsoft Windows Logon Protocol (netlogon)

Mobile IP (mip)
mip.auth.auth Authenticator Byte array mip.auth.spi SPI Signed 32-bit integer mip.b Broadcast Datagrams Boolean mip.coa Care of Address IPv4 address mip.code Reply Code Unsigned 8-bit integer mip.d Co-lcated Care-of Address Boolean mip.ext.len Extension Length Signed 8-bit integer mip.ext.type Extension Type Signed 8-bit integer mip.g GRE Boolean mip.haaddr Home Agent IPv4 address mip.homeaddr Home Address IPv4 address mip.ident Identification Date/Time stamp mip.life Lifetime Unsigned 16-bit integer mip.m Minimal Encapsulation Boolean mip.nai NAI String mip.s Simultaneous Bindings Boolean mip.t Reverse Tunneling Boolean mip.type Message Type Signed 8-bit integer mip.v Van Jacobson Boolean

Mount Service (mount)
mount.dump.directory Directory String mount.dump.entry Mount List Entry No value mount.dump.hostname Hostname String mount.export.directory Directory String mount.export.entry Export List Entry No value mount.export.group Group String mount.export.groups Groups No value mount.flavor Flavor Unsigned 32-bit integer mount.flavors Flavors Unsigned 32-bit integer mount.path Path String mount.pathconf.link_max Maximum number of links to a file Unsigned 32-bit integer mount.pathconf.mask Reply error/status bits Unsigned 16-bit integer mount.pathconf.mask.chown_restricted CHOWN_RESTRICTED Boolean mount.pathconf.mask.error_all ERROR_ALL Boolean mount.pathconf.mask.error_link_max ERROR_LINK_MAX Boolean mount.pathconf.mask.error_max_canon ERROR_MAX_CANON Boolean mount.pathconf.mask.error_max_input ERROR_MAX_INPUT Boolean mount.pathconf.mask.error_name_max ERROR_NAME_MAX Boolean mount.pathconf.mask.error_path_max ERROR_PATH_MAX Boolean mount.pathconf.mask.error_pipe_buf ERROR_PIPE_BUF Boolean mount.pathconf.mask.error_vdisable ERROR_VDISABLE Boolean mount.pathconf.mask.no_trunc NO_TRUNC Boolean mount.pathconf.max_canon Maximum terminal input line length Unsigned 16-bit integer mount.pathconf.max_input Terminal input buffer size Unsigned 16-bit integer mount.pathconf.name_max Maximum file name length Unsigned 16-bit integer mount.pathconf.path_max Maximum path name length Unsigned 16-bit integer mount.pathconf.pipe_buf Pipe buffer size Unsigned 16-bit integer mount.pathconf.vdisable_char VDISABLE character Unsigned 8-bit integer mount.status Status Unsigned 32-bit integer

MultiProtocol Label Switching Header (mpls)
mpls.bottom MPLS Bottom Of Label Stack Unsigned 8-bit integer mpls.exp MPLS Experimental Bits Unsigned 8-bit integer mpls.label MPLS Label Unsigned 32-bit integer mpls.ttl MPLS TTL Unsigned 8-bit integer

Name Binding Protocol (nbp)
nbp.count Count Unsigned 8-bit integer nbp.enum Enumerator Unsigned 8-bit integer nbp.info Info Unsigned 8-bit integer nbp.net Network Unsigned 16-bit integer nbp.node Node Unsigned 8-bit integer nbp.object Object String nbp.op Operation Unsigned 8-bit integer nbp.port Port Unsigned 8-bit integer nbp.tid Transaction ID Unsigned 8-bit integer nbp.type Type String nbp.zone Zone String

Name Management Protocol over IPX (nmpi)

NetBIOS (netbios)
netbios.ack Acknowledge Boolean netbios.ack_expected Acknowledge expected Boolean netbios.ack_with_data Acknowledge with data Boolean netbios.call_name_type Call Name Type Signed 16-bit integer netbios.command Command Unsigned 16-bit integer netbios.data2 DATA2 value Unsigned 16-bit integer netbios.hdr_len Header Length Unsigned 16-bit integer netbios.largest_frame Largest Frame Unsigned 8-bit integer netbios.local_session Local Session No. Unsigned 8-bit integer netbios.name Netbios Name String netbios.name_type Netbios Name Type Unsigned 16-bit integer netbios.recv_cont_req RECEIVE_CONTINUE requested Boolean netbios.remote_session Remote Session No. Unsigned 8-bit integer netbios.resp_corrl Response Correlator Signed 16-bit integer netbios.send_no_ack Handle SEND.NO.ACK Boolean netbios.version NetBIOS Version Boolean netbios.xmit_corrl Transmit Correlator Signed 16-bit integer

NetBIOS Datagram Service (nbdgm)
nbdgm.dgram_id Datagram ID Unsigned 16-bit integer nbdgm.first First fragment Boolean nbdgm.next Fragmented Boolean nbdgm.node_type Node Type Unsigned 8-bit integer nbdgm.src.ip Source IP IPv4 address nbdgm.src.port Source Port Unsigned 16-bit integer nbdgm.type Message Type Unsigned 8-bit integer

NetBIOS Name Service (nbns)
nbns.count.add_rr Additional RRs Unsigned 16-bit integer nbns.count.answers Answer RRs Unsigned 16-bit integer nbns.count.auth_rr Authority RRs Unsigned 16-bit integer nbns.count.queries Questions Unsigned 16-bit integer nbns.id Transaction ID Unsigned 16-bit integer nbns.query Query Boolean nbns.response Response Boolean

NetBIOS Session Service (nbss)
nbss.flags Flags Unsigned 8-bit integer nbss.type Message Type Unsigned 8-bit integer

NetBIOS over IPX (nbipx)

NetWare Core Protocol (ncp)
ncp.buffer_size Buffer Size Unsigned 16-bit integer ncp.completion_code Completion Code Unsigned 8-bit integer ncp.connection Connection Number Unsigned 16-bit integer ncp.connection_number Connection Number Unsigned 32-bit integer ncp.connection_status Connection Status Unsigned 8-bit integer ncp.file_handle File Handle Byte array ncp.file_offset File Offset Unsigned 32-bit integer ncp.file_size File Size Unsigned 32-bit integer ncp.func Function Unsigned 8-bit integer ncp.ip.length NCP over IP length Unsigned 32-bit integer ncp.ip.replybufsize NCP over IP Reply Buffer Size Unsigned 32-bit integer ncp.ip.signature NCP over IP signature Unsigned 32-bit integer ncp.ip.version NCP over IP Version Unsigned 32-bit integer ncp.job_type Job Type Unsigned 16-bit integer ncp.length Packet Length Unsigned 16-bit integer ncp.max_bytes Maximum Number of Bytes Unsigned 16-bit integer ncp.num_bytes Number of Bytes Unsigned 16-bit integer ncp.object_flags Object Flags Unsigned 8-bit integer ncp.object_has_properites Object Has Properties Unsigned 8-bit integer ncp.object_id Object ID Unsigned 32-bit integer ncp.object_name Object Name ncp.object_name1 Object Name String ncp.object_security Object Security Unsigned 8-bit integer ncp.object_type Object Type Unsigned 16-bit integer ncp.property_data Property Data Byte array ncp.property_has_more_segments Property Has More Segments Unsigned 8-bit integer ncp.property_name Property Name ncp.property_segment Property Segment Unsigned 8-bit integer ncp.property_type Property Type Unsigned 8-bit integer ncp.seq Sequence Number Unsigned 8-bit integer ncp.subfunc SubFunction Unsigned 8-bit integer ncp.task Task Number Unsigned 8-bit integer ncp.task_number Task Number Unsigned 32-bit integer ncp.type Type Unsigned 16-bit integer ncp.unknown_byte Unknown Byte Unsigned 8-bit integer

Network File System (nfs)
nfs.ace ace String nfs.attr mand_attr Unsigned 32-bit integer nfs.call.operation Opcode Unsigned 32-bit integer nfs.change_info.atomic Atomic Boolean nfs.clientid Client ID String nfs.createmode Create Mode Unsigned 32-bit integer nfs.data Data String nfs.data_follows data_follows Boolean nfs.dirlist4.eof eof Boolean nfs.fattr4.attr_vals attr_vals String nfs.fattr4_archive fattr4_archive Boolean nfs.fattr4_cansettime fattr4_cansettime Boolean nfs.fattr4_case_insensitive fattr4_case_insensitive Boolean nfs.fattr4_case_preserving fattr4_case_preserving Boolean nfs.fattr4_chown_restricted fattr4_chown_restricted Boolean nfs.fattr4_expire_type fattr4_expire_type Unsigned 32-bit integer nfs.fattr4_hidden fattr4_hidden Boolean nfs.fattr4_homogeneous fattr4_homogeneous Boolean nfs.fattr4_link_support fattr4_link_support Boolean nfs.fattr4_mimetype fattr4_mimetype String nfs.fattr4_named_attr fattr4_named_attr Boolean nfs.fattr4_no_trunc fattr4_no_trunc Boolean nfs.fattr4_owner fattr4_owner String nfs.fattr4_owner_group fattr4_owner_group String nfs.fattr4_symlink_support fattr4_symlink_support Boolean nfs.fattr4_system fattr4_system Boolean nfs.fattr4_unique_handles fattr4_unique_handles Boolean nfs.fh.dentry dentry Unsigned 32-bit integer nfs.fh.dev device Unsigned 32-bit integer nfs.fh.dirinode directory inode Unsigned 32-bit integer nfs.fh.fn file number Unsigned 32-bit integer nfs.fh.fn.generation generation Unsigned 32-bit integer nfs.fh.fn.inode inode Unsigned 32-bit integer nfs.fh.fn.len length Unsigned 32-bit integer nfs.fh.fsid.major major Unsigned 32-bit integer nfs.fh.fsid.minor minor Unsigned 32-bit integer nfs.fh.fstype file system type Unsigned 32-bit integer nfs.fh.hp.len length Unsigned 32-bit integer nfs.fh.pinode pseudo inode Unsigned 32-bit integer nfs.fh.xdev exported device Unsigned 32-bit integer nfs.fh.xfn exported file number Unsigned 32-bit integer nfs.fh.xfn.generation generation Unsigned 32-bit integer nfs.fh.xfn.inode exported inode Unsigned 32-bit integer nfs.fh.xfn.len length Unsigned 32-bit integer nfs.fh.xfsid.major exported major Unsigned 32-bit integer nfs.fh.xfsid.minor exported minor Unsigned 32-bit integer nfs.fsinfo.dtpref dtpref Unsigned 32-bit integer nfs.fsinfo.propeties Properties Unsigned 32-bit integer nfs.fsinfo.rtmax rtmax Unsigned 32-bit integer nfs.fsinfo.rtmult rtmult Unsigned 32-bit integer nfs.fsinfo.rtpref rtpref Unsigned 32-bit integer nfs.fsinfo.wtmax wtmax Unsigned 32-bit integer nfs.fsinfo.wtmult wtmult Unsigned 32-bit integer nfs.fsinfo.wtpref wtpref Unsigned 32-bit integer nfs.fsstat.invarsec invarsec Unsigned 32-bit integer nfs.name Name String nfs.nfs_ftype4 nfs_ftype4 Unsigned 32-bit integer nfs.open.claim_type Claim Type Unsigned 32-bit integer nfs.open.delegation_type Delegation Type Unsigned 32-bit integer nfs.open.limit_by Space Limit Unsigned 32-bit integer nfs.open.opentype Open Type Unsigned 32-bit integer nfs.open4.share_access share_access Unsigned 32-bit integer nfs.open4.share_deny share_deny Unsigned 32-bit integer nfs.pathconf.case_insensitive case_insensitive Boolean nfs.pathconf.case_preserving case_preserving Boolean nfs.pathconf.chown_restricted chown_restricted Boolean nfs.pathconf.linkmax linkmax Unsigned 32-bit integer nfs.pathconf.name_max name_max Unsigned 32-bit integer nfs.pathconf.no_trunc no_trunc Boolean nfs.pathname.component Filename String nfs.read.count Count Unsigned 32-bit integer nfs.read.eof EOF Boolean nfs.read.offset Offset Unsigned 32-bit integer nfs.read.totalcount Total Count Unsigned 32-bit integer nfs.readdir.cookie Cookie Unsigned 32-bit integer nfs.readdir.count Count Unsigned 32-bit integer nfs.readdir.entry Entry No value nfs.readdir.entry.cookie Cookie Unsigned 32-bit integer nfs.readdir.entry.fileid File ID Unsigned 32-bit integer nfs.readdir.entry.name Name String nfs.readdir.eof EOF Unsigned 32-bit integer nfs.readdirplus.entry.name Name String nfs.readlink.data Data String nfs.recall EOF Boolean nfs.reply.operation Opcode Unsigned 32-bit integer nfs.seqid seqid Unsigned 32-bit integer nfs.server server String nfs.set_it set_it Unsigned 32-bit integer nfs.stable_how4 stable_how4 Unsigned 32-bit integer nfs.statfs.bavail Available Blocks Unsigned 32-bit integer nfs.statfs.bfree Free Blocks Unsigned 32-bit integer nfs.statfs.blocks Total Blocks Unsigned 32-bit integer nfs.statfs.bsize Block Size Unsigned 32-bit integer nfs.statfs.tsize Transfer Size Unsigned 32-bit integer nfs.status Status Unsigned 32-bit integer nfs.status2 Status Unsigned 32-bit integer nfs.symlink.linktext Name String nfs.symlink.to To String nfs.tag Tag String nfs.type Type Unsigned 32-bit integer nfs.who who String nfs.write.beginoffset Begin Offset Unsigned 32-bit integer nfs.write.committed Committed Unsigned 32-bit integer nfs.write.offset Offset Unsigned 32-bit integer nfs.write.stable Stable Unsigned 32-bit integer nfs.write.totalcount Total Count Unsigned 32-bit integer

Network Lock Manager Protocol (nlm)
nlm.block block Boolean nlm.cookie cookie String nlm.exclusive exclusive Boolean nlm.holder holder No value nlm.lock lock No value nlm.lock.caller_name caller_name String nlm.lock.l_len l_len Unsigned 32-bit integer nlm.lock.l_offset l_offset Unsigned 32-bit integer nlm.lock.owner owner String nlm.lock.svid svid Unsigned 32-bit integer nlm.reclaim reclaim Boolean nlm.sequence sequence Signed 32-bit integer nlm.share share No value nlm.share.access access Unsigned 32-bit integer nlm.share.mode mode Unsigned 32-bit integer nlm.share.name name String nlm.state state Unsigned 32-bit integer nlm.test_stat test_stat No value nlm.test_stat.stat stat Unsigned 32-bit integer

Network News Transfer Protocol (nntp)
nntp.request Request Boolean nntp.response Response Boolean

Network Status Monitor CallBack Protocol (stat-cb)
statnotify.name Name String statnotify.priv Priv Byte array statnotify.state State Unsigned 32-bit integer

Network Status Monitor Protocol (stat)
stat.mon Monitor No value stat.mon_id.name Monitor ID Name String stat.my_id My ID No value stat.my_id.hostname Hostname String stat.my_id.proc Procedure Unsigned 32-bit integer stat.my_id.prog Program Unsigned 32-bit integer stat.my_id.vers Version Unsigned 32-bit integer stat.name Name String stat.priv Priv Byte array stat.stat_chge Status Change No value stat.stat_res Status Result No value stat.stat_res.res Result Unsigned 32-bit integer stat.stat_res.state State Unsigned 32-bit integer stat.state State Unsigned 32-bit integer

Network Time Protocol (ntp)
ntp.flags Flags Unsigned 8-bit integer ntp.flags.li Leap Indicator Unsigned 8-bit integer ntp.flags.mode Mode Unsigned 8-bit integer ntp.flags.vn Version number Unsigned 8-bit integer ntp.keyid Key ID Byte array ntp.mac Message Authentication Code Byte array ntp.org Originate Time Stamp Byte array ntp.ppoll Peer Polling Interval Unsigned 8-bit integer ntp.precision Peer Clock Precision Unsigned 8-bit integer ntp.rec Receive Time Stamp Byte array ntp.refid Reference Clock ID Byte array ntp.reftime Reference Clock Update Time Byte array ntp.rootdelay Root Delay Double-precision floating point ntp.rootdispersion Clock Dispersion Double-precision floating point ntp.stratum Peer Clock Stratum Unsigned 8-bit integer ntp.xmt Transmit Time Stamp Byte array

Null/Loopback (null)
null.family Family Unsigned 32-bit integer null.type Type Unsigned 16-bit integer

Open Shortest Path First (ospf)

PPP IP Control Protocol (ipcp)

PPP Link Control Protocol (lcp)

PPP Multilink Protocol (mp)
mp.first First fragment Boolean mp.last Last fragment Boolean mp.seq Sequence number Unsigned 24-bit integer

PPP-over-Ethernet Discovery (pppoed)

PPP-over-Ethernet Session (pppoes)

Point-to-Point Protocol (ppp)

Point-to-Point Tunnelling Protocol (pptp)
pptp.type Message type Unsigned 16-bit integer

Portmap (portmap)
portmap.answer Answer Boolean portmap.args Arguments Byte array portmap.port Port Unsigned 32-bit integer portmap.proc Procedure Unsigned 32-bit integer portmap.prog Program Unsigned 32-bit integer portmap.proto Protocol Unsigned 32-bit integer portmap.result Result Byte array portmap.rpcb RPCB No value portmap.rpcb.addr Universal Address String portmap.rpcb.netid Network Id String portmap.rpcb.owner Owner of this Service String portmap.rpcb.prog Program Unsigned 32-bit integer portmap.rpcb.version Version Unsigned 32-bit integer portmap.uaddr Universal Address String portmap.version Version Unsigned 32-bit integer

Post Office Protocol (pop)
pop.request Request Boolean pop.response Response Boolean

Protocol Independent Multicast (pim)
pim.cksum Checksum Unsigned 16-bit integer pim.type Type Unsigned 8-bit integer pim.version Version Unsigned 8-bit integer

Q.2931 (q2931)
q2931.call_ref Call reference value Byte array q2931.call_ref_len Call reference value length Unsigned 8-bit integer q2931.disc Protocol discriminator Unsigned 8-bit integer q2931.message_action_indicator Action indicator Unsigned 8-bit integer q2931.message_flag Flag Boolean q2931.message_len Message length Unsigned 16-bit integer q2931.message_type Message type Unsigned 8-bit integer q2931.message_type_ext Message type extension Unsigned 8-bit integer

Q.931 (q931)
q931.call_ref Call reference value Byte array q931.call_ref_len Call reference value length Unsigned 8-bit integer q931.disc Protocol discriminator Unsigned 8-bit integer q931.message_type Message type Unsigned 8-bit integer

Quake Network Protocol (quake)
quake.control.accept.port Port Unsigned 32-bit integer quake.control.command Command Unsigned 8-bit integer quake.control.connect.game Game String quake.control.connect.version Version Unsigned 8-bit integer quake.control.player_info.address Address String quake.control.player_info.colors Colors Unsigned 32-bit integer quake.control.player_info.colors.pants Pants Unsigned 8-bit integer quake.control.player_info.colors.shirt Shirt Unsigned 8-bit integer quake.control.player_info.connect_time Connect Time Unsigned 32-bit integer quake.control.player_info.frags Frags Unsigned 32-bit integer quake.control.player_info.name Name String quake.control.player_info.player Player Unsigned 8-bit integer quake.control.reject.reason Reason String quake.control.rule_info.lastrule Last Rule String quake.control.rule_info.rule Rule String quake.control.rule_info.value Value String quake.control.server_info.address Address String quake.control.server_info.game Game String quake.control.server_info.map Map String quake.control.server_info.max_player Maximal Number of Players Unsigned 8-bit integer quake.control.server_info.num_player Number of Players Unsigned 8-bit integer quake.control.server_info.server Server String quake.control.server_info.version Version Unsigned 8-bit integer quake.header.flags Flags Unsigned 16-bit integer quake.header.length Length Unsigned 16-bit integer quake.header.sequence Sequence Unsigned 32-bit integer

RIPng (ripng)
ripng.cmd Command Unsigned 8-bit integer ripng.version Version Unsigned 8-bit integer

RX Protocol (rx)
rx.callnumber Call Number Unsigned 32-bit integer rx.cid CID Unsigned 32-bit integer rx.epoch Epoch Date/Time stamp rx.flags Flags Unsigned 8-bit integer rx.flags.client_init Client Initiated Unsigned 8-bit integer rx.flags.free_packet Free Packet Unsigned 8-bit integer rx.flags.last_packet Last Packet Unsigned 8-bit integer rx.flags.more_packets More Packets Unsigned 8-bit integer rx.flags.request_ack Request Ack Unsigned 8-bit integer rx.securityindex Security Index Unsigned 32-bit integer rx.seq Sequence Number Unsigned 32-bit integer rx.serial Serial Unsigned 32-bit integer rx.serviceid Service ID Unsigned 16-bit integer rx.spare Spare/Checksum Unsigned 16-bit integer rx.type Type Unsigned 8-bit integer rx.userstatus User Status Unsigned 32-bit integer

Radius Protocol (radius)
radius.code Code Unsigned 8-bit integer radius.id Identifier Unsigned 8-bit integer radius.length Length Unsigned 16-bit integer

Real Time Streaming Protocol (rtsp)
rtsp.method Method String rtsp.status Status Unsigned 32-bit integer rtsp.url URL String

Real-Time Transport Protocol (rtp)
rtp.cc Contributing source identifiers count Unsigned 8-bit integer rtp.csrc.item CSRC item Unsigned 32-bit integer rtp.ext Extension Boolean rtp.ext.len Extension length Unsigned 16-bit integer rtp.ext.profile Defined by profile Unsigned 16-bit integer rtp.hdr_ext Header extension Unsigned 32-bit integer rtp.marker Marker Boolean rtp.p_type Payload type Unsigned 8-bit integer rtp.padding Padding Boolean rtp.padding.count Padding count Unsigned 8-bit integer rtp.padding.data Padding data Byte array rtp.payload Payload Byte array rtp.seq Sequence number Unsigned 16-bit integer rtp.ssrc Synchronization Source identifier Unsigned 32-bit integer rtp.timestamp Timestamp Unsigned 32-bit integer rtp.version Version Unsigned 8-bit integer

Real-time Transport Control Protocol (rtcp)
rtcp.app.data Application specific data Byte array rtcp.app.name Name (ASCII) String rtcp.app.subtype Subtype Unsigned 8-bit integer rtcp.length Length Unsigned 16-bit integer rtcp.nack.blp Bitmask of following lost packets Unsigned 16-bit integer rtcp.nack.fsn First sequence number Unsigned 16-bit integer rtcp.padding Padding Boolean rtcp.padding.count Padding count Unsigned 8-bit integer rtcp.padding.data Padding data Byte array rtcp.pt Packet type Unsigned 8-bit integer rtcp.rc Reception report count Unsigned 8-bit integer rtcp.sc Source count Unsigned 8-bit integer rtcp.sdes.length Length Unsigned 32-bit integer rtcp.sdes.prefix.length Prefix length Unsigned 8-bit integer rtcp.sdes.prefix.string Prefix string String rtcp.sdes.ssrc_csrc SSRC / CSRC identifier Unsigned 32-bit integer rtcp.sdes.text Text String rtcp.sdes.type Type Unsigned 8-bit integer rtcp.sender.octetcount Sender's octet count Unsigned 32-bit integer rtcp.sender.packetcount Sender's packet count Unsigned 32-bit integer rtcp.senderssrc Sender SSRC Unsigned 32-bit integer rtcp.ssrc.cum_nr Cumulative number of packets lost Unsigned 32-bit integer rtcp.ssrc.dlsr Delay since last SR timestamp Unsigned 32-bit integer rtcp.ssrc.ext_high Extended highest sequence number received Unsigned 32-bit integer rtcp.ssrc.fraction Fraction lost Unsigned 8-bit integer rtcp.ssrc.high_cycles Sequence number cycles count Unsigned 16-bit integer rtcp.ssrc.high_seq Highest sequence number received Unsigned 16-bit integer rtcp.ssrc.identifier Identifier Unsigned 32-bit integer rtcp.ssrc.jitter Interarrival jitter Unsigned 32-bit integer rtcp.ssrc.lsr Last SR timestamp Unsigned 32-bit integer rtcp.timestamp.ntp NTP timestamp String rtcp.timestamp.rtp RTP timestamp Unsigned 32-bit integer rtcp.version Version Unsigned 8-bit integer

Remote Procedure Call (rpc)
rpc.auth.flavor Flavor Unsigned 32-bit integer rpc.auth.gid GID Unsigned 32-bit integer rpc.auth.length Length Unsigned 32-bit integer rpc.auth.machinename Machine Name String rpc.auth.stamp Stamp Unsigned 32-bit integer rpc.auth.uid UID Unsigned 32-bit integer rpc.authgss.checksum GSS Checksum Byte array rpc.authgss.context GSS Context Byte array rpc.authgss.data GSS Data Byte array rpc.authgss.data.length Length Unsigned 32-bit integer rpc.authgss.major GSS Major Status Unsigned 32-bit integer rpc.authgss.minor GSS Minor Status Unsigned 32-bit integer rpc.authgss.procedure GSS Procedure Unsigned 32-bit integer rpc.authgss.seqnum GSS Sequence Number Unsigned 32-bit integer rpc.authgss.service GSS Service Unsigned 32-bit integer rpc.authgss.token GSS Token Byte array rpc.authgss.version GSS Version Unsigned 32-bit integer rpc.authgss.window GSS Sequence Window Unsigned 32-bit integer rpc.call.dup Duplicate Call Unsigned 32-bit integer rpc.dup Duplicate Transaction Unsigned 32-bit integer rpc.fraglen Fragment Length Unsigned 32-bit integer rpc.lastfrag Last Fragment Boolean rpc.msgtyp Message Type Unsigned 32-bit integer rpc.procedure Procedure Unsigned 32-bit integer rpc.program Program Unsigned 32-bit integer rpc.programversion Program Version Unsigned 32-bit integer rpc.programversion.max Program Version (Maximum) Unsigned 32-bit integer rpc.programversion.min Program Version (Minimum) Unsigned 32-bit integer rpc.reply.dup Duplicate Reply Unsigned 32-bit integer rpc.replystat Reply State Unsigned 32-bit integer rpc.state_accept Accept State Unsigned 32-bit integer rpc.state_auth Auth State Unsigned 32-bit integer rpc.state_reject Reject State Unsigned 32-bit integer rpc.value_follows Value Follows Boolean rpc.version RPC Version Unsigned 32-bit integer rpc.version.max RPC Version (Maximum) Unsigned 32-bit integer rpc.version.min RPC Version (Minimum) Unsigned 32-bit integer rpc.xid XID Unsigned 32-bit integer

Remote Quota (rquota)

Remote Shell (rsh)
rsh.request Request Boolean rsh.response Response Boolean

Remote Wall protocol (rwall)
rwall.message Message String

Resource ReserVation Protocol (RSVP) (rsvp)
rsvp.adspec ADSPEC Unsigned 8-bit integer rsvp.confirm CONFIRM Unsigned 8-bit integer rsvp.error ERROR Unsigned 8-bit integer rsvp.explicit_route EXPLICIT ROUTE Unsigned 8-bit integer rsvp.filter FILTERSPEC Unsigned 8-bit integer rsvp.flowspec FLOWSPEC Unsigned 8-bit integer rsvp.hop HOP Unsigned 8-bit integer rsvp.integrity INTEGRITY Unsigned 8-bit integer rsvp.label LABEL Unsigned 8-bit integer rsvp.label_request LABEL REQUEST Unsigned 8-bit integer rsvp.msg Message Type Unsigned 8-bit integer rsvp.obj_unknown Unknown object Unsigned 8-bit integer rsvp.path Path Message Boolean rsvp.perr Path Error Message Boolean rsvp.policy POLICY Unsigned 8-bit integer rsvp.ptear Path Tear Message Boolean rsvp.record_route RECORD ROUTE Unsigned 8-bit integer rsvp.rerr Resv Error Message Boolean rsvp.resv Resv Message Boolean rsvp.resvconf Resv Confirm Message Boolean rsvp.rtear Resv Tear Message Boolean rsvp.rtearconf Resv Tear Confirm Message Boolean rsvp.scope SCOPE Unsigned 8-bit integer rsvp.sender SENDER TEMPLATE Unsigned 8-bit integer rsvp.sender.ip Sender IPv4 address IPv4 address rsvp.sender.lsp_id Sender LSP ID Unsigned 16-bit integer rsvp.sender.port Sender port number Unsigned 16-bit integer rsvp.session SESSION Unsigned 8-bit integer rsvp.session.ext_tunnel_id Extended tunnel ID Unsigned 32-bit integer rsvp.session.ip Destination address IPv4 address rsvp.session.port Port number Unsigned 16-bit integer rsvp.session.proto Protocol Unsigned 8-bit integer rsvp.session.tunnel_id Tunnel ID Unsigned 16-bit integer rsvp.session_attribute SESSION ATTRIBUTE Unsigned 8-bit integer rsvp.style STYLE Unsigned 8-bit integer rsvp.time TIME VALUES Unsigned 8-bit integer rsvp.tspec SENDER TSPEC Unsigned 8-bit integer

Rlogin Protocol (rlogin)
rlogin.user_info User Info No value rlogin.window_size Window Info No value rlogin.window_size.cols Columns Unsigned 16-bit integer rlogin.window_size.rows Rows Unsigned 16-bit integer rlogin.window_size.x_pixels X Pixels Unsigned 16-bit integer rlogin.window_size.y_pixels Y Pixels Unsigned 16-bit integer

Routing Information Protocol (rip)

Routing Table Maintenance Protocol (rtmp)
nbp.nodeid Node Unsigned 8-bit integer nbp.nodeid.length Node Length Unsigned 8-bit integer rtmp.function Function Unsigned 8-bit integer rtmp.net Net Unsigned 16-bit integer rtmp.tuple.dist Distance Unsigned 16-bit integer rtmp.tuple.net Net Unsigned 16-bit integer rtmp.tuple.range_end Range End Unsigned 16-bit integer rtmp.tuple.range_start Range Start Unsigned 16-bit integer

SCCP user adaptation layer light (sual)
sual.message_length Message length Unsigned 32-bit integer sual.message_type Message Type Unsigned 16-bit integer sual.spare_1 Spare Unsigned 8-bit integer sual.spare_2 Spare Unsigned 16-bit integer sual.subsystem_number Subsystem number Unsigned 16-bit integer sual.version Version Unsigned 8-bit integer

SMB (Server Message Block Protocol) (smb)
smb.cmd SMB Command Unsigned 8-bit integer

SMB MailSlot Protocol (mailslot)

SNMP Multiplex Protocol (smux)

SSCOP (sscop)

Sequenced Packet eXchange (spx)
spx.ack Acknowledgment Number Unsigned 16-bit integer spx.alloc Allocation Number Unsigned 16-bit integer spx.ctl Connection Control Unsigned 8-bit integer spx.dst Destination Connection ID Unsigned 16-bit integer spx.seq Sequence Number Unsigned 16-bit integer spx.src Source Connection ID Unsigned 16-bit integer spx.type Datastream type Unsigned 8-bit integer

Service Advertisement Protocol (ipxsap)
ipxsap.request Request Boolean ipxsap.response Response Boolean

Service Location Protocol (srvloc)
srvloc.err Error Code Unsigned 16-bit integer srvloc.flags Flags Unsigned 8-bit integer srvloc.function Function Unsigned 8-bit integer srvloc.version Version Unsigned 8-bit integer

Session Announcement Protocol (sap)
sap.auth Authentication data No value sap.auth.flags Authentication data flags Unsigned 8-bit integer sap.auth.flags.p Padding Bit Boolean sap.auth.flags.t Authentication Type Unsigned 8-bit integer sap.auth.flags.v Version Number Unsigned 8-bit integer sap.flags Flags Unsigned 8-bit integer sap.flags.a Address Type Boolean sap.flags.c Compression Bit Boolean sap.flags.e Encryption Bit Boolean sap.flags.r Reserved Boolean sap.flags.t Message Type Boolean sap.flags.v Version Number Unsigned 8-bit integer

Session Description Protocol (sdp)

Session Initiation Protocol (sip)
sip.msg_hdr Message Header No value

Short Frame (short)

Simple Mail Transfer Protocol (smtp)
smtp.req Request Boolean smtp.rsp Response Boolean

Simple Network Management Protocol (snmp)
snmpv3.flags SNMPv3 Flags Unsigned 8-bit integer snmpv3.flags.auth Authenticated Boolean snmpv3.flags.crypt Encrypted Boolean snmpv3.flags.report Reportable Boolean

Sinec H1 Protocol (h1)
h1.dbnr Memory block number Unsigned 8-bit integer h1.dlen Length in words Signed 16-bit integer h1.dwnr Address within memory block Unsigned 16-bit integer h1.empty Empty field Unsigned 8-bit integer h1.empty_len Empty field length Unsigned 8-bit integer h1.header H1-Header Unsigned 16-bit integer h1.len Length indicator Unsigned 16-bit integer h1.opcode Opcode Unsigned 8-bit integer h1.opfield Operation identifier Unsigned 8-bit integer h1.oplen Operation length Unsigned 8-bit integer h1.org Memory type Unsigned 8-bit integer h1.reqlen Request length Unsigned 8-bit integer h1.request Request identifier Unsigned 8-bit integer h1.reslen Response length Unsigned 8-bit integer h1.response Response identifier Unsigned 8-bit integer h1.resvalue Response value Unsigned 8-bit integer

Socks Protocol (socks)
socks.command Command Unsigned 16-bit integer socks.dst Remote Address IPv4 address socks.dstV6 Remote Address IPv6 address socks.dstport Remote Port Unsigned 16-bit integer socks.username User Name String socks.ver Version Unsigned 8-bit integer

Spanning Tree Protocol (stp)
stp.bridge.hw Bridge Identifier 6-byte Hardware (MAC) Address stp.flags BPDU flags Unsigned 8-bit integer stp.forward Forward Delay Double-precision floating point stp.hello Hello Time Double-precision floating point stp.max_age Max Age Double-precision floating point stp.msg_age Message Age Double-precision floating point stp.port Port identifier Unsigned 16-bit integer stp.protocol Protocol Identifier Unsigned 16-bit integer stp.root.cost Root Path Cost Unsigned 32-bit integer stp.root.hw Root Identifier 6-byte Hardware (MAC) Address stp.type BPDU type Unsigned 8-bit integer stp.version Protocol Version Identifier Unsigned 8-bit integer

Stream Control Transmission Protcol (sctp)
sctp.cause.code Cause code Unsigned 16-bit integer sctp.cause.length Cause length Unsigned 16-bit integer sctp.cause.measure_of_staleness Measure of staleness in usec Unsigned 32-bit integer sctp.cause.missing_parameter_type Missing parameters type Unsigned 16-bit integer sctp.cause.nr_of_missing_parameters Number of missing parameters Unsigned 32-bit integer sctp.cause.stream_identifier Stream identifier Unsigned 16-bit integer sctp.cause.tsn TSN Unsigned 32-bit integer sctp.checksum Adler-32 checksum Unsigned 32-bit integer sctp.chunk_flags Flags Unsigned 8-bit integer sctp.chunk_length Length Unsigned 16-bit integer sctp.chunk_type Identifier Unsigned 8-bit integer sctp.cumulative.tsn.ack Cumulative TSN Ack Unsigned 32-bit integer sctp.cwr.lowest_tsn Lowest TSN Unsigned 32-bit integer sctp.data.b_bit B-Bit Boolean sctp.data.e_bit E-Bit Boolean sctp.data.u.bit U-Bit Boolean sctp.dstport Destination port Unsigned 16-bit integer sctp.ecne.lowest_tsn Lowest TSN Unsigned 32-bit integer sctp.init.chunk.credit Advertised reciever window credit (a_rwnd) Unsigned 32-bit integer sctp.init.chunk.initial.tsn Initial TSN Unsigned 32-bit integer sctp.init.chunk.initiate.tag Initiate tag Unsigned 32-bit integer sctp.init.chunk.nr.in.streams Number of inbound streams Unsigned 16-bit integer sctp.init.chunk.nr.out.streams Number of outbound streams Unsigned 16-bit integer sctp.parameter.cookie_preservative_incr Suggested Cookie life-span increment (msec) Unsigned 32-bit integer sctp.parameter.hostname.hostname Hostname String sctp.parameter.ipv4_address IP Version 4 address IPv4 address sctp.parameter.ipv6_address IP Version 6 address IPv6 address sctp.parameter.length Parameter length Unsigned 16-bit integer sctp.parameter.supported_addres_type Supported address type Unsigned 16-bit integer sctp.parameter.type Parameter type Unsigned 16-bit integer sctp.payload_proto_id Payload Protocol identifier Unsigned 32-bit integer sctp.sack.a_rwnd Advertised receiver window credit (a_rwnd) Unsigned 32-bit integer sctp.sack.cumulative_tsn_ack Cumulative TSN ACK Unsigned 32-bit integer sctp.sack.duplicate.tsn Duplicate TSN Unsigned 16-bit integer sctp.sack.gap_block_end End Unsigned 16-bit integer sctp.sack.gap_block_start Start Unsigned 16-bit integer sctp.sack.number_of_duplicated_tsns Number of duplicated TSNs Unsigned 16-bit integer sctp.sack.number_of_gap_blocks Number of gap acknowldgement blocks Unsigned 16-bit integer sctp.shutdown.cumulative_tsn_ack Cumulative TSN Ack Unsigned 32-bit integer sctp.shutdown_complete.t_bit E-Bit Boolean sctp.srcport Source port Unsigned 16-bit integer sctp.stream_id Stream Identifier Unsigned 16-bit integer sctp.stream_seq_number Stream sequence number Unsigned 16-bit integer sctp.tsn TSN Unsigned 32-bit integer sctp.verfication_tag Verification tag Unsigned 32-bit integer

Syslog message (syslog)
syslog.facility Facility Unsigned 8-bit integer syslog.level Level Unsigned 8-bit integer syslog.msg_len Message length Unsigned 32-bit integer

Systems Network Architecture (sna)
sna.rh Request/Response Header No value sna.rh.0 Request/Response Header Byte 0 Unsigned 8-bit integer sna.rh.1 Request/Response Header Byte 1 Unsigned 8-bit integer sna.rh.2 Request/Response Header Byte 2 Unsigned 8-bit integer sna.rh.bbi Begin Bracket Indicator Boolean sna.rh.bci Begin Chain Indicator Boolean sna.rh.cdi Change Direction Indicator Boolean sna.rh.cebi Conditional End Bracket Indicator Boolean sna.rh.csi Code Selection Indicator Unsigned 8-bit integer sna.rh.dr1 Definite Response 1 Indicator Boolean sna.rh.dr2 Definite Response 2 Indicator Boolean sna.rh.ebi End Bracket Indicator Boolean sna.rh.eci End Chain Indicator Boolean sna.rh.edi Enciphered Data Indicator Boolean sna.rh.eri Exception Response Indicator Boolean sna.rh.fi Format Indicator Boolean sna.rh.lcci Length-Checked Compression Indicator Boolean sna.rh.pdi Padded Data Indicator Boolean sna.rh.pi Pacing Indicator Boolean sna.rh.qri Queued Response Indicator Boolean sna.rh.rlwi Request Larger Window Indicator Boolean sna.rh.rri Request/Response Indicator Unsigned 8-bit integer sna.rh.rti Response Type Indicator Boolean sna.rh.ru_category Request/Response Unit Category Unsigned 8-bit integer sna.rh.sdi Sense Data Included Boolean sna.th Transmission Header No value sna.th.0 Transmission Header Byte 0 Unsigned 8-bit integer sna.th.cmd_fmt Command Format Unsigned 8-bit integer sna.th.cmd_sn Command Sequence Number Unsigned 16-bit integer sna.th.cmd_type Command Type Unsigned 8-bit integer sna.th.daf Destination Address Field Unsigned 16-bit integer sna.th.dcf Data Count Field Unsigned 16-bit integer sna.th.def Destination Element Field Unsigned 16-bit integer sna.th.dsaf Destination Subarea Address Field Unsigned 32-bit integer sna.th.efi Expedited Flow Indicator Unsigned 8-bit integer sna.th.er_vr_supp_ind ER and VR Support Indicator Unsigned 8-bit integer sna.th.ern Explicit Route Number Unsigned 8-bit integer sna.th.fid Format Identifer Unsigned 8-bit integer sna.th.iern Initial Explicit Route Number Unsigned 8-bit integer sna.th.lsid Local Session Identification Unsigned 8-bit integer sna.th.mft MPR FID4 Type Boolean sna.th.mpf Mapping Field Unsigned 8-bit integer sna.th.nlp_cp NLP Count or Padding Unsigned 8-bit integer sna.th.nlpoi NLP Offset Indicator Unsigned 8-bit integer sna.th.ntwk_prty Network Priority Unsigned 8-bit integer sna.th.oaf Origin Address Field Unsigned 16-bit integer sna.th.odai ODAI Assignment Indicator Unsigned 8-bit integer sna.th.oef Origin Element Field Unsigned 16-bit integer sna.th.osaf Origin Subarea Address Field Unsigned 32-bit integer sna.th.piubf PIU Blocking Field Unsigned 8-bit integer sna.th.sa Session Address Byte array sna.th.snai SNA Indicator Boolean sna.th.snf Sequence Number Field Unsigned 16-bit integer sna.th.tg_nonfifo_ind Transmission Group Non-FIFO Indicator Boolean sna.th.tg_snf Transmission Group Sequence Number Field Unsigned 16-bit integer sna.th.tg_sweep Transmission Group Sweep Unsigned 8-bit integer sna.th.tgsf Transmission Group Segmenting Field Unsigned 8-bit integer sna.th.tpf Transmission Priority Field Unsigned 8-bit integer sna.th.vr_cwi Virtual Route Change Window Indicator Unsigned 16-bit integer sna.th.vr_cwri Virtual Route Change Window Reply Indicator Unsigned 16-bit integer sna.th.vr_pac_cnt_ind Virtual Route Pacing Count Indicator Unsigned 8-bit integer sna.th.vr_rwi Virtual Route Reset Window Indicator Boolean sna.th.vr_snf_send Virtual Route Send Sequence Number Field Unsigned 16-bit integer sna.th.vr_sqti Virtual Route Sequence and Type Indicator Unsigned 16-bit integer sna.th.vrn Virtual Route Number Unsigned 8-bit integer sna.th.vrprq Virtual Route Pacing Request Boolean sna.th.vrprs Virtual Route Pacing Response Boolean

TACACS (tacacs)
tacacs.request Request Boolean tacacs.response Response Boolean tacacs.version Tacacs Version String

TPKT (tpkt)
tpkt.length Length Unsigned 16-bit integer tpkt.reserved Reserved Unsigned 8-bit integer tpkt.version Version Unsigned 8-bit integer

Telnet (telnet)

Time Protocol (time)
time.time Time Unsigned 32-bit integer

Token-Ring (tr)
tr.ac Access Control Unsigned 8-bit integer tr.addr Source or Destination Address 6-byte Hardware (MAC) Address tr.broadcast Broadcast Type Unsigned 8-bit integer tr.direction Direction Unsigned 8-bit integer tr.dst Destination 6-byte Hardware (MAC) Address tr.fc Frame Control Unsigned 8-bit integer tr.frame Frame Boolean tr.frame_pcf Frame PCF Unsigned 8-bit integer tr.frame_type Frame Type Unsigned 8-bit integer tr.max_frame_size Maximum Frame Size Unsigned 8-bit integer tr.monitor_cnt Monitor Count Unsigned 8-bit integer tr.priority Priority Unsigned 8-bit integer tr.priority_reservation Priority Reservation Unsigned 8-bit integer tr.rif Ring-Bridge Pairs String tr.rif.bridge RIF Bridge Unsigned 8-bit integer tr.rif.ring RIF Ring Unsigned 16-bit integer tr.rif_bytes RIF Bytes Unsigned 8-bit integer tr.sr Source Routed Boolean tr.src Source 6-byte Hardware (MAC) Address

Token-Ring Media Access Control (trmac)
trmac.dstclass Destination Class Unsigned 8-bit integer trmac.errors.abort Abort Delimiter Transmitted Errors Unsigned 8-bit integer trmac.errors.ac A/C Errors Unsigned 8-bit integer trmac.errors.burst Burst Errors Unsigned 8-bit integer trmac.errors.congestion Receiver Congestion Errors Unsigned 8-bit integer trmac.errors.fc Frame-Copied Errors Unsigned 8-bit integer trmac.errors.freq Frequency Errors Unsigned 8-bit integer trmac.errors.internal Internal Errors Unsigned 8-bit integer trmac.errors.iso Isolating Errors Unsigned 16-bit integer trmac.errors.line Line Errors Unsigned 8-bit integer trmac.errors.lost Lost Frame Errors Unsigned 8-bit integer trmac.errors.noniso Non-Isolating Errors Unsigned 16-bit integer trmac.errors.token Token Errors Unsigned 8-bit integer trmac.length Total Length Unsigned 8-bit integer trmac.mvec Major Vector Unsigned 8-bit integer trmac.naun NAUN 6-byte Hardware (MAC) Address trmac.srcclass Source Class Unsigned 8-bit integer trmac.svec Sub-Vector Unsigned 8-bit integer

Transmission Control Protocol (tcp)
tcp.ack Acknowledgement number Unsigned 32-bit integer tcp.checksum Checksum Unsigned 16-bit integer tcp.checksum_bad Bad Checksum Boolean tcp.dstport Destination Port Unsigned 16-bit integer tcp.flags Flags Unsigned 8-bit integer tcp.flags.ack Acknowledgment Boolean tcp.flags.cwr Congestion Window Reduced (CWR) Boolean tcp.flags.ecn ECN-Echo Boolean tcp.flags.fin Fin Boolean tcp.flags.push Push Boolean tcp.flags.reset Reset Boolean tcp.flags.syn Syn Boolean tcp.flags.urg Urgent Boolean tcp.hdr_len Header Length Unsigned 8-bit integer tcp.nxtseq Next sequence number Unsigned 32-bit integer tcp.port Source or Destination Port Unsigned 16-bit integer tcp.seq Sequence number Unsigned 32-bit integer tcp.srcport Source Port Unsigned 16-bit integer tcp.urgent_pointer Urgent pointer Unsigned 16-bit integer tcp.window_size Window size Unsigned 16-bit integer

Transparent Network Substrate Protocol (tns)
tns.compat_version Version (Compatible) Unsigned 16-bit integer tns.connect Connect Boolean tns.data_flag Data Flag Unsigned 16-bit integer tns.header_checksum Header Checksum Unsigned 16-bit integer tns.length Packet Length Unsigned 32-bit integer tns.packet_checksum Packet Checksum Unsigned 16-bit integer tns.request Request Boolean tns.reserved_byte Reserved Byte Byte array tns.response Response Boolean tns.service_options Service Options Unsigned 16-bit integer tns.sns Secure Network Services Boolean tns.type Packet Type Unsigned 8-bit integer tns.version Version Unsigned 16-bit integer

Trivial File Transfer Protocol (tftp)
tftp.block Block Unsigned 16-bit integer tftp.destination_file DESTINATION File tftp.error.code Error code Unsigned 16-bit integer tftp.error.message Error message tftp.opcode Opcode Unsigned 16-bit integer tftp.source_file Source File tftp.type Type

User Datagram Protocol (udp)
udp.checksum Checksum Unsigned 16-bit integer udp.checksum_bad Bad Checksum Boolean udp.dstport Destination Port Unsigned 16-bit integer udp.length Length Unsigned 16-bit integer udp.port Source or Destination Port Unsigned 16-bit integer udp.srcport Source Port Unsigned 16-bit integer

Virtual Router Redundancy Protocol (vrrp)
vrrp.type VRRP packet type Unsigned 8-bit integer vrrp.typever VRRP message version and type Unsigned 8-bit integer vrrp.version VRRP protocol version Unsigned 8-bit integer

Virtual Trunking Protocol (vtp)
vtp.code Code Unsigned 8-bit integer vtp.conf_rev_num Configuration Revision Number Unsigned 32-bit integer vtp.followers Followers Unsigned 8-bit integer vtp.md Management Domain String vtp.md5_digest MD5 Digest Byte array vtp.md_len Management Domain Length Unsigned 8-bit integer vtp.seq_num Sequence Number Unsigned 8-bit integer vtp.start_value Start Value Unsigned 16-bit integer vtp.upd_id Updater Identity IPv4 address vtp.upd_ts Update Timestamp String vtp.version Version Unsigned 8-bit integer vtp.vlan_info.802_10_index 802.10 Index Unsigned 32-bit integer vtp.vlan_info.isl_vlan_id ISL VLAN ID Unsigned 16-bit integer vtp.vlan_info.len VLAN Information Length Unsigned 8-bit integer vtp.vlan_info.mtu_size MTU Size Unsigned 16-bit integer vtp.vlan_info.status.vlan_susp VLAN suspended Boolean vtp.vlan_info.tlv_len Length Unsigned 8-bit integer vtp.vlan_info.tlv_type Type Unsigned 8-bit integer vtp.vlan_info.vlan_name VLAN Name String vtp.vlan_info.vlan_name_len VLAN Name Length Unsigned 8-bit integer vtp.vlan_info.vlan_type VLAN Type Unsigned 8-bit integer

Web Cache Coordination Protocol (wccp)
wccp.cache_ip Web Cache IP address IPv4 address wccp.change_num Change Number Unsigned 32-bit integer wccp.hash_revision Hash Revision Unsigned 32-bit integer wccp.message WCCP Message Type Unsigned 32-bit integer wccp.recvd_id Received ID Unsigned 32-bit integer wccp.version WCCP Version Unsigned 32-bit integer

Wellfleet Compression (wcp)
wcp.alg Alg Unsigned 8-bit integer wcp.alg1 Alg 1 Unsigned 8-bit integer wcp.alg2 Alg 2 Unsigned 8-bit integer wcp.alg3 Alg 3 Unsigned 8-bit integer wcp.alg4 Alg 4 Unsigned 8-bit integer wcp.alg_cnt Alg Count Unsigned 8-bit integer wcp.checksum Checksum Unsigned 8-bit integer wcp.cmd Command Unsigned 8-bit integer wcp.ext_cmd Extended Command Unsigned 8-bit integer wcp.flag Compress Flag Unsigned 8-bit integer wcp.hist History Unsigned 8-bit integer wcp.init Initiator Unsigned 8-bit integer wcp.long_comp Long Compression Unsigned 16-bit integer wcp.long_len Compress Length Unsigned 8-bit integer wcp.mark Compress Marker Unsigned 8-bit integer wcp.off Source offset Unsigned 16-bit integer wcp.pib PIB Unsigned 8-bit integer wcp.ppc PerPackComp Unsigned 8-bit integer wcp.rev Revision Unsigned 8-bit integer wcp.rexmit Rexmit Unsigned 8-bit integer wcp.seq SEQ Unsigned 16-bit integer wcp.seq_size Seq Size Unsigned 8-bit integer wcp.short_comp Short Compression Unsigned 8-bit integer wcp.short_len Compress Length Unsigned 8-bit integer wcp.tid TID Unsigned 16-bit integer

Who (who)
who.boottime Boot Time Date/Time stamp who.hostname Hostname String who.idle Time Idle Unsigned 32-bit integer who.loadav_10 Load Average Over Past 10 Minutes Double-precision floating point who.loadav_15 Load Average Over Past 15 Minutes Double-precision floating point who.loadav_5 Load Average Over Past 5 Minutes Double-precision floating point who.recvtime Receive Time Date/Time stamp who.sendtime Send Time Date/Time stamp who.timeon Time On Date/Time stamp who.tty TTY Name String who.type Type Unsigned 8-bit integer who.uid User ID String who.vers Version Unsigned 8-bit integer who.whoent Who utmp Entry No value

Wireless Session Protocol (wap-wsp)
wsp.TID Transmission ID Unsigned 8-bit integer wsp.capabilities Capabilities No value wsp.capability.length Capability Length Unsigned 32-bit integer wsp.content_type.parameter.charset Charset Unsigned 16-bit integer wsp.content_type.type Content Type Unsigned 8-bit integer wsp.header.accept Accept Unsigned 8-bit integer wsp.header.accept.string Accept String wsp.header.accept_charset Accept-Charset Unsigned 16-bit integer wsp.header.accept_charset.string Accept-Charset String wsp.header.accept_language Accept-Language Unsigned 8-bit integer wsp.header.accept_language.string Accept-Language String wsp.header.accept_ranges Accept-Ranges Unsigned 8-bit integer wsp.header.age Age Unsigned 32-bit integer wsp.header.application_header Application Header String wsp.header.application_header.value Application Header Value String wsp.header.cache_control Cache-Control Unsigned 8-bit integer wsp.header.content_length Content-Length Unsigned 32-bit integer wsp.header.date Date Date/Time stamp wsp.header.etag Etag String wsp.header.expires Expires Date/Time stamp wsp.header.if_modified_since If-Modified-Since Date/Time stamp wsp.header.last_modified Last-Modified Date/Time stamp wsp.header.location Location String wsp.header.server Server String wsp.header.transfer_enc Transfer Encoding Unsigned 8-bit integer wsp.header.transfer_enc_str Transfer Encoding String wsp.header.user_agent User-Agent String wsp.header.via Via String wsp.header.x_wap_tod X-WAP.TOD Date/Time stamp wsp.headers Headers No value wsp.headers.header Header No value wsp.headers_length Headers Length Unsigned 32-bit integer wsp.pdu_type PDU Type Unsigned 8-bit integer wsp.post.data Post Data No value wsp.reply.data Data No value wsp.reply.status Status Unsigned 8-bit integer wsp.server.session_id Server Session ID Unsigned 32-bit integer wsp.uri URI String wsp.uri_length URI Length Unsigned 32-bit integer wsp.version.major Version (Major) Unsigned 8-bit integer wsp.version.minor Version (Minor) Unsigned 8-bit integer

Wireless Transaction Protocol (wap-wsp-wtp)
wtp.RID Re-transmission Indicator Boolean wtp.TID Transmission ID Unsigned 16-bit integer wtp.TID.response TID Response Boolean wtp.abort.reason.provider Abort Reason Unsigned 8-bit integer wtp.abort.reason.user Abort Reason Unsigned 8-bit integer wtp.abort.type Abort Type Unsigned 8-bit integer wtp.ack.tvetok Tve/Tok flag Boolean wtp.continue_flag Continue Flag Boolean wtp.header.TIDNew TIDNew Boolean wtp.header.UP U/P flag Boolean wtp.header.missing_packets Missing Packets Unsigned 8-bit integer wtp.header.sequence Packet Sequence Number Unsigned 8-bit integer wtp.header.version Version Unsigned 8-bit integer wtp.header_data Data Byte array wtp.header_fixed_part Header Byte array wtp.header_variable_part Header: Variable part Byte array wtp.inv.reserved Reserved Unsigned 8-bit integer wtp.inv.transaction_class Transaction Class Unsigned 8-bit integer wtp.pdu_type PDU Type Unsigned 8-bit integer wtp.trailer_flags Trailer Flags Unsigned 8-bit integer

Wireless Transport Layer Security (wap-wtls)
wsp.wtls.alert Alert No value wsp.wtls.alert.description Description Unsigned 8-bit integer wsp.wtls.alert.level Level Unsigned 8-bit integer wsp.wtls.handshake Handshake Unsigned 8-bit integer wsp.wtls.handshake.certificate Certificate No value wsp.wtls.handshake.certificate.after Valid not after Date/Time stamp wsp.wtls.handshake.certificate.before Valid not before Date/Time stamp wsp.wtls.handshake.certificate.issuer.charset Charset Unsigned 16-bit integer wsp.wtls.handshake.certificate.issuer.name Name String wsp.wtls.handshake.certificate.issuer.type Issuer Unsigned 8-bit integer wsp.wtls.handshake.certificate.parameter Parameter Set String wsp.wtls.handshake.certificate.parameter_index Parameter Index Unsigned 8-bit integer wsp.wtls.handshake.certificate.public.type Public Key Type Unsigned 8-bit integer wsp.wtls.handshake.certificate.rsa.exponent RSA Exponent Size Unsigned 32-bit integer wsp.wtls.handshake.certificate.rsa.modulus RSA Modulus Size Unsigned 32-bit integer wsp.wtls.handshake.certificate.signature.signature Signature Size Unsigned 32-bit integer wsp.wtls.handshake.certificate.signature.type Signature Type Unsigned 8-bit integer wsp.wtls.handshake.certificate.subject.charset Charset Unsigned 16-bit integer wsp.wtls.handshake.certificate.subject.name Name String wsp.wtls.handshake.certificate.subject.type Subject Unsigned 8-bit integer wsp.wtls.handshake.certificate.type Type Unsigned 8-bit integer wsp.wtls.handshake.certificate.version Version Unsigned 8-bit integer wsp.wtls.handshake.certificates Certificates No value wsp.wtls.handshake.client_hello Client Hello No value wsp.wtls.handshake.client_hello.cipher Cipher No value wsp.wtls.handshake.client_hello.cipher.bulk Cipher Bulk Unsigned 8-bit integer wsp.wtls.handshake.client_hello.cipher.mac Cipher MAC Unsigned 8-bit integer wsp.wtls.handshake.client_hello.ciphers Cipher Suites No value wsp.wtls.handshake.client_hello.client_keys_id Client Keys No value wsp.wtls.handshake.client_hello.comp_methods Compression Methods No value wsp.wtls.handshake.client_hello.compression Compression Unsigned 8-bit integer wsp.wtls.handshake.client_hello.gmt Time GMT Date/Time stamp wsp.wtls.handshake.client_hello.ident_type Identifier Type Unsigned 8-bit integer wsp.wtls.handshake.client_hello.key.key_exchange Key Exchange Unsigned 8-bit integer wsp.wtls.handshake.client_hello.key.key_exchange.suite Suite Unsigned 8-bit integer wsp.wtls.handshake.client_hello.parameter Parameter Set String wsp.wtls.handshake.client_hello.parameter_index Parameter Index Unsigned 8-bit integer wsp.wtls.handshake.client_hello.random Random No value wsp.wtls.handshake.client_hello.refresh Refresh Unsigned 8-bit integer wsp.wtls.handshake.client_hello.sequence_mode Sequence Mode Unsigned 8-bit integer wsp.wtls.handshake.client_hello.sessionid Session ID No value wsp.wtls.handshake.client_hello.trusted_keys_id Trusted Keys No value wsp.wtls.handshake.client_hello.version Version Unsigned 8-bit integer wsp.wtls.handshake.length Length Unsigned 16-bit integer wsp.wtls.handshake.server_hello Server Hello No value wsp.wtls.handshake.server_hello.cipher Cipher No value wsp.wtls.handshake.server_hello.cipher.bulk Cipher Bulk Unsigned 8-bit integer wsp.wtls.handshake.server_hello.cipher.mac Cipher MAC Unsigned 8-bit integer wsp.wtls.handshake.server_hello.compression Compression Unsigned 8-bit integer wsp.wtls.handshake.server_hello.gmt Time GMT Date/Time stamp wsp.wtls.handshake.server_hello.key Client Key ID Unsigned 8-bit integer wsp.wtls.handshake.server_hello.random Random No value wsp.wtls.handshake.server_hello.refresh Refresh Unsigned 8-bit integer wsp.wtls.handshake.server_hello.sequence_mode Sequence Mode Unsigned 8-bit integer wsp.wtls.handshake.server_hello.sessionid Session ID No value wsp.wtls.handshake.server_hello.version Version Unsigned 8-bit integer wsp.wtls.handshake.type Type Unsigned 8-bit integer wsp.wtls.rec_cipher Record Ciphered No value wsp.wtls.rec_length Record Length Unsigned 16-bit integer wsp.wtls.rec_seq Record Sequence Unsigned 16-bit integer wsp.wtls.rec_type Record Type Unsigned 8-bit integer wsp.wtls.record Record Unsigned 8-bit integer

X.25 (x.25)
x.25.a A Bit Boolean x.25.d D Bit Boolean x.25.gfi GFI Unsigned 16-bit integer x.25.lcn Logical Channel Unsigned 16-bit integer x.25.m M Bit Boolean x.25.mod Modulo Unsigned 16-bit integer x.25.p_r P(R) Unsigned 8-bit integer x.25.p_s P(S) Unsigned 8-bit integer x.25.q Q Bit Boolean x.25.type Packet Type Unsigned 8-bit integer

X.25 over TCP (xot)

X11 (x11)
x11.acceleration-denominator acceleration-denominator Signed 16-bit integer x11.acceleration-numerator acceleration-numerator Signed 16-bit integer x11.access-mode access-mode Unsigned 8-bit integer x11.address address Byte array x11.address-length address-length Unsigned 16-bit integer x11.alloc alloc Unsigned 8-bit integer x11.allow-events-mode allow-events-mode Unsigned 8-bit integer x11.allow-exposures allow-exposures Unsigned 8-bit integer x11.arc arc No value x11.arc.angle1 angle1 Signed 16-bit integer x11.arc.angle2 angle2 Signed 16-bit integer x11.arc.height height Unsigned 16-bit integer x11.arc.mode mode Unsigned 8-bit integer x11.arc.width width Unsigned 16-bit integer x11.arc.x x Signed 16-bit integer x11.arc.y y Signed 16-bit integer x11.arcs arcs No value x11.atom atom Unsigned 32-bit integer x11.auto-repeat-mode auto-repeat-mode Unsigned 8-bit integer x11.back-blue back-blue Unsigned 16-bit integer x11.back-green back-green Unsigned 16-bit integer x11.back-red back-red Unsigned 16-bit integer x11.background background Unsigned 32-bit integer x11.background-pixel background-pixel Unsigned 32-bit integer x11.background-pixmap background-pixmap Unsigned 32-bit integer x11.backing-pixel backing-pixel Unsigned 32-bit integer x11.backing-planes backing-planes Unsigned 32-bit integer x11.backing-store backing-store Unsigned 8-bit integer x11.bell-duration bell-duration Signed 16-bit integer x11.bell-percent bell-percent Signed 8-bit integer x11.bell-pitch bell-pitch Signed 16-bit integer x11.bit-gravity bit-gravity Unsigned 8-bit integer x11.bit-plane bit-plane Unsigned 32-bit integer x11.blue blue Unsigned 16-bit integer x11.blues blues Unsigned 16-bit integer x11.border-pixel border-pixel Unsigned 32-bit integer x11.border-pixmap border-pixmap Unsigned 32-bit integer x11.border-width border-width Unsigned 16-bit integer x11.button button Unsigned 8-bit integer x11.cap-style cap-style Unsigned 8-bit integer x11.change-host-mode change-host-mode Unsigned 8-bit integer x11.cid cid Unsigned 32-bit integer x11.class class Unsigned 8-bit integer x11.clip-mask clip-mask Unsigned 32-bit integer x11.clip-x-origin clip-x-origin Signed 16-bit integer x11.clip-y-origin clip-y-origin Signed 16-bit integer x11.close-down-mode close-down-mode Unsigned 8-bit integer x11.cmap cmap Unsigned 32-bit integer x11.color-items color-items No value x11.coloritem coloritem No value x11.coloritem.blue blue Unsigned 16-bit integer x11.coloritem.flags flags Unsigned 8-bit integer x11.coloritem.flags.do-blue do-blue Boolean x11.coloritem.flags.do-green do-green Boolean x11.coloritem.flags.do-red do-red Boolean x11.coloritem.flags.unused unused Boolean x11.coloritem.green green Unsigned 16-bit integer x11.coloritem.pixel pixel Unsigned 32-bit integer x11.coloritem.red red Unsigned 16-bit integer x11.coloritem.unused unused No value x11.colormap colormap Unsigned 32-bit integer x11.colors colors Unsigned 16-bit integer x11.configure-window-mask configure-window-mask Unsigned 16-bit integer x11.configure-window-mask.border-width border-width Boolean x11.configure-window-mask.height height Boolean x11.configure-window-mask.sibling sibling Boolean x11.configure-window-mask.stack-mode stack-mode Boolean x11.configure-window-mask.width width Boolean x11.configure-window-mask.x x Boolean x11.configure-window-mask.y y Boolean x11.confine-to confine-to Unsigned 32-bit integer x11.contiguous contiguous Boolean x11.coordinate-mode coordinate-mode Unsigned 8-bit integer x11.count count Unsigned 8-bit integer x11.cursor cursor Unsigned 32-bit integer x11.dash-offset dash-offset Unsigned 16-bit integer x11.dashes dashes Byte array x11.dashes-length dashes-length Unsigned 16-bit integer x11.data data Byte array x11.data-length data-length Unsigned 32-bit integer x11.delete delete Boolean x11.delta delta Signed 16-bit integer x11.depth depth Unsigned 8-bit integer x11.direction direction Unsigned 8-bit integer x11.do-acceleration do-acceleration Boolean x11.do-not-propagate-mask do-not-propagate-mask Unsigned 32-bit integer x11.do-not-propagate-mask.Button1Motion Button1Motion Boolean x11.do-not-propagate-mask.Button2Motion Button2Motion Boolean x11.do-not-propagate-mask.Button3Motion Button3Motion Boolean x11.do-not-propagate-mask.Button4Motion Button4Motion Boolean x11.do-not-propagate-mask.Button5Motion Button5Motion Boolean x11.do-not-propagate-mask.ButtonMotion ButtonMotion Boolean x11.do-not-propagate-mask.ButtonPress ButtonPress Boolean x11.do-not-propagate-mask.ButtonRelease ButtonRelease Boolean x11.do-not-propagate-mask.KeyPress KeyPress Boolean x11.do-not-propagate-mask.KeyRelease KeyRelease Boolean x11.do-not-propagate-mask.PointerMotion PointerMotion Boolean x11.do-not-propagate-mask.erroneous-bits erroneous-bits Boolean x11.do-threshold do-threshold Boolean x11.drawable drawable Unsigned 32-bit integer x11.dst-drawable dst-drawable Unsigned 32-bit integer x11.dst-gc dst-gc Unsigned 32-bit integer x11.dst-window dst-window Unsigned 32-bit integer x11.dst-x dst-x Signed 16-bit integer x11.dst-y dst-y Signed 16-bit integer x11.event-mask event-mask Unsigned 32-bit integer x11.event-mask.Button1Motion Button1Motion Boolean x11.event-mask.Button2Motion Button2Motion Boolean x11.event-mask.Button3Motion Button3Motion Boolean x11.event-mask.Button4Motion Button4Motion Boolean x11.event-mask.Button5Motion Button5Motion Boolean x11.event-mask.ButtonMotion ButtonMotion Boolean x11.event-mask.ButtonPress ButtonPress Boolean x11.event-mask.ButtonRelease ButtonRelease Boolean x11.event-mask.ColormapChange ColormapChange Boolean x11.event-mask.EnterWindow EnterWindow Boolean x11.event-mask.Exposure Exposure Boolean x11.event-mask.FocusChange FocusChange Boolean x11.event-mask.KeyPress KeyPress Boolean x11.event-mask.KeyRelease KeyRelease Boolean x11.event-mask.KeymapState KeymapState Boolean x11.event-mask.LeaveWindow LeaveWindow Boolean x11.event-mask.OwnerGrabButton OwnerGrabButton Boolean x11.event-mask.PointerMotion PointerMotion Boolean x11.event-mask.PointerMotionHint PointerMotionHint Boolean x11.event-mask.PropertyChange PropertyChange Boolean x11.event-mask.ResizeRedirect ResizeRedirect Boolean x11.event-mask.StructureNotify StructureNotify Boolean x11.event-mask.SubstructureNotify SubstructureNotify Boolean x11.event-mask.SubstructureRedirect SubstructureRedirect Boolean x11.event-mask.VisibilityChange VisibilityChange Boolean x11.event-mask.erroneous-bits erroneous-bits Boolean x11.exposures exposures Boolean x11.family family Unsigned 8-bit integer x11.fid fid Unsigned 32-bit integer x11.fill-rule fill-rule Unsigned 8-bit integer x11.fill-style fill-style Unsigned 8-bit integer x11.first-keycode first-keycode Unsigned 8-bit integer x11.focus focus Unsigned 8-bit integer x11.font font Unsigned 32-bit integer x11.fore-blue fore-blue Unsigned 16-bit integer x11.fore-green fore-green Unsigned 16-bit integer x11.fore-red fore-red Unsigned 16-bit integer x11.foreground foreground Unsigned 32-bit integer x11.format format Unsigned 8-bit integer x11.function function Unsigned 8-bit integer x11.gc gc Unsigned 32-bit integer x11.gc-dashes gc-dashes Unsigned 8-bit integer x11.gc-value-mask gc-value-mask Unsigned 32-bit integer x11.gc-value-mask.arc-mode arc-mode Boolean x11.gc-value-mask.background background Boolean x11.gc-value-mask.cap-style cap-style Boolean x11.gc-value-mask.clip-mask clip-mask Boolean x11.gc-value-mask.clip-x-origin clip-x-origin Boolean x11.gc-value-mask.clip-y-origin clip-y-origin Boolean x11.gc-value-mask.dash-offset dash-offset Boolean x11.gc-value-mask.fill-rule fill-rule Boolean x11.gc-value-mask.fill-style fill-style Boolean x11.gc-value-mask.font font Boolean x11.gc-value-mask.foreground foreground Boolean x11.gc-value-mask.function function Boolean x11.gc-value-mask.gc-dashes gc-dashes Boolean x11.gc-value-mask.graphics-exposures graphics-exposures Boolean x11.gc-value-mask.join-style join-style Boolean x11.gc-value-mask.line-style line-style Boolean x11.gc-value-mask.line-width line-width Boolean x11.gc-value-mask.plane-mask plane-mask Boolean x11.gc-value-mask.stipple stipple Boolean x11.gc-value-mask.subwindow-mode subwindow-mode Boolean x11.gc-value-mask.tile tile Boolean x11.gc-value-mask.tile-stipple-x-origin tile-stipple-x-origin Boolean x11.gc-value-mask.tile-stipple-y-origin tile-stipple-y-origin Boolean x11.get-property-type get-property-type Unsigned 32-bit integer x11.grab_window grab_window Unsigned 32-bit integer x11.graphics-exposures graphics-exposures Boolean x11.green green Unsigned 16-bit integer x11.greens greens Unsigned 16-bit integer x11.height height Unsigned 16-bit integer x11.image-format image-format Unsigned 8-bit integer x11.image-pixmap-format image-pixmap-format Unsigned 8-bit integer x11.interval interval Signed 16-bit integer x11.items items No value x11.join-style join-style Unsigned 8-bit integer x11.key key Unsigned 8-bit integer x11.key-click-percent key-click-percent Signed 8-bit integer x11.keyboard-key keyboard-key Unsigned 8-bit integer x11.keyboard-mode keyboard-mode Unsigned 8-bit integer x11.keyboard-value-mask keyboard-value-mask Unsigned 32-bit integer x11.keyboard-value-mask.auto-repeat-mode auto-repeat-mode Boolean x11.keyboard-value-mask.bell-duration bell-duration Boolean x11.keyboard-value-mask.bell-percent bell-percent Boolean x11.keyboard-value-mask.bell-pitch bell-pitch Boolean x11.keyboard-value-mask.key-click-percent key-click-percent Boolean x11.keyboard-value-mask.keyboard-key keyboard-key Boolean x11.keyboard-value-mask.led led Boolean x11.keyboard-value-mask.led-mode led-mode Boolean x11.keycode-count keycode-count Unsigned 8-bit integer x11.keycodes keycodes No value x11.keycodes-per-modifier keycodes-per-modifier Unsigned 8-bit integer x11.keycodes.item item Byte array x11.keysyms keysyms No value x11.keysyms-per-keycode keysyms-per-keycode Unsigned 8-bit integer x11.keysyms.item item No value x11.keysyms.item.keysym keysym Unsigned 32-bit integer x11.led led Unsigned 8-bit integer x11.led-mode led-mode Unsigned 8-bit integer x11.left-pad left-pad Unsigned 8-bit integer x11.line-style line-style Unsigned 8-bit integer x11.line-width line-width Unsigned 16-bit integer x11.long-length long-length Unsigned 32-bit integer x11.long-offset long-offset Unsigned 32-bit integer x11.map map Byte array x11.map-length map-length Unsigned 8-bit integer x11.mask mask Unsigned 32-bit integer x11.mask-char mask-char Unsigned 16-bit integer x11.mask-font mask-font Unsigned 32-bit integer x11.max-names max-names Unsigned 16-bit integer x11.mid mid Unsigned 32-bit integer x11.mode mode Unsigned 8-bit integer x11.modifiers-mask modifiers-mask Unsigned 16-bit integer x11.modifiers-mask.AnyModifier AnyModifier Unsigned 16-bit integer x11.modifiers-mask.Control Control Boolean x11.modifiers-mask.Lock Lock Boolean x11.modifiers-mask.Mod1 Mod1 Boolean x11.modifiers-mask.Mod2 Mod2 Boolean x11.modifiers-mask.Mod3 Mod3 Boolean x11.modifiers-mask.Mod4 Mod4 Boolean x11.modifiers-mask.Mod5 Mod5 Boolean x11.modifiers-mask.Shift Shift Boolean x11.modifiers-mask.erroneous-bits erroneous-bits Boolean x11.name name String x11.name-length name-length Unsigned 16-bit integer x11.odd-length odd-length Boolean x11.only-if-exists only-if-exists Boolean x11.opcode opcode Unsigned 8-bit integer x11.ordering ordering Unsigned 8-bit integer x11.override-redirect override-redirect Boolean x11.owner owner Unsigned 32-bit integer x11.owner-events owner-events Boolean x11.parent parent Unsigned 32-bit integer x11.path path No value x11.path.string string String x11.pattern pattern String x11.pattern-length pattern-length Unsigned 16-bit integer x11.percent percent Unsigned 8-bit integer x11.pid pid Unsigned 32-bit integer x11.pixel pixel Unsigned 32-bit integer x11.pixels pixels No value x11.pixels_item pixels_item Unsigned 32-bit integer x11.pixmap pixmap Unsigned 32-bit integer x11.plane-mask plane-mask Unsigned 32-bit integer x11.planes planes Unsigned 16-bit integer x11.point point No value x11.point-x point-x Signed 16-bit integer x11.point-y point-y Signed 16-bit integer x11.pointer-event-mask pointer-event-mask Unsigned 16-bit integer x11.pointer-event-mask.Button1Motion Button1Motion Boolean x11.pointer-event-mask.Button2Motion Button2Motion Boolean x11.pointer-event-mask.Button3Motion Button3Motion Boolean x11.pointer-event-mask.Button4Motion Button4Motion Boolean x11.pointer-event-mask.Button5Motion Button5Motion Boolean x11.pointer-event-mask.ButtonMotion ButtonMotion Boolean x11.pointer-event-mask.ButtonPress ButtonPress Boolean x11.pointer-event-mask.ButtonRelease ButtonRelease Boolean x11.pointer-event-mask.EnterWindow EnterWindow Boolean x11.pointer-event-mask.KeymapState KeymapState Boolean x11.pointer-event-mask.LeaveWindow LeaveWindow Boolean x11.pointer-event-mask.PointerMotion PointerMotion Boolean x11.pointer-event-mask.PointerMotionHint PointerMotionHint Boolean x11.pointer-event-mask.erroneous-bits erroneous-bits Boolean x11.pointer-mode pointer-mode Unsigned 8-bit integer x11.points points No value x11.prefer-blanking prefer-blanking Unsigned 8-bit integer x11.properties properties No value x11.properties.item item Unsigned 32-bit integer x11.property property Unsigned 32-bit integer x11.property-number property-number Unsigned 16-bit integer x11.rectangle rectangle No value x11.rectangle-height rectangle-height Unsigned 16-bit integer x11.rectangle-width rectangle-width Unsigned 16-bit integer x11.rectangle-x rectangle-x Signed 16-bit integer x11.rectangle-y rectangle-y Signed 16-bit integer x11.rectangles rectangles No value x11.red red Unsigned 16-bit integer x11.reds reds Unsigned 16-bit integer x11.request request Unsigned 8-bit integer x11.request-length request-length Unsigned 16-bit integer x11.requestor requestor Unsigned 32-bit integer x11.resource resource Unsigned 32-bit integer x11.revert-to revert-to Unsigned 8-bit integer x11.save-set-mode save-set-mode Unsigned 8-bit integer x11.save-under save-under Boolean x11.screen-saver-mode screen-saver-mode Unsigned 8-bit integer x11.segment segment No value x11.segment_x1 segment_x1 Signed 16-bit integer x11.segment_x2 segment_x2 Signed 16-bit integer x11.segment_y1 segment_y1 Signed 16-bit integer x11.segment_y2 segment_y2 Signed 16-bit integer x11.segments segments No value x11.selection selection Unsigned 32-bit integer x11.shape shape Unsigned 8-bit integer x11.sibling sibling Unsigned 32-bit integer x11.source-char source-char Unsigned 16-bit integer x11.source-font source-font Unsigned 32-bit integer x11.source-pixmap source-pixmap Unsigned 32-bit integer x11.src-cmap src-cmap Unsigned 32-bit integer x11.src-drawable src-drawable Unsigned 32-bit integer x11.src-gc src-gc Unsigned 32-bit integer x11.src-height src-height Unsigned 16-bit integer x11.src-width src-width Unsigned 16-bit integer x11.src-window src-window Unsigned 32-bit integer x11.src-x src-x Signed 16-bit integer x11.src-y src-y Signed 16-bit integer x11.stack-mode stack-mode Unsigned 8-bit integer x11.start start Unsigned 32-bit integer x11.stipple stipple Unsigned 32-bit integer x11.stop stop Unsigned 32-bit integer x11.str-number-in-path str-number-in-path Unsigned 16-bit integer x11.string string String x11.string-length string-length Unsigned 32-bit integer x11.string16 string16 String x11.string16.bytes bytes Byte array x11.subwindow-mode subwindow-mode Unsigned 8-bit integer x11.target target Unsigned 32-bit integer x11.textitem textitem No value x11.textitem.font font Unsigned 32-bit integer x11.textitem.string string No value x11.textitem.string.delta delta Signed 8-bit integer x11.textitem.string.string16 string16 String x11.textitem.string.string16.bytes bytes Byte array x11.textitem.string.string8 string8 String x11.threshold threshold Signed 16-bit integer x11.tile tile Unsigned 32-bit integer x11.tile-stipple-x-origin tile-stipple-x-origin Signed 16-bit integer x11.tile-stipple-y-origin tile-stipple-y-origin Signed 16-bit integer x11.time time Unsigned 32-bit integer x11.timeout timeout Signed 16-bit integer x11.type type Unsigned 32-bit integer x11.undecoded undecoded No value x11.unused unused No value x11.visual visual Unsigned 32-bit integer x11.visualid visualid Unsigned 32-bit integer x11.warp-pointer-dst-window warp-pointer-dst-window Unsigned 32-bit integer x11.warp-pointer-src-window warp-pointer-src-window Unsigned 32-bit integer x11.wid wid Unsigned 32-bit integer x11.width width Unsigned 16-bit integer x11.win-gravity win-gravity Unsigned 8-bit integer x11.window window Unsigned 32-bit integer x11.window-class window-class Unsigned 16-bit integer x11.window-value-mask window-value-mask Unsigned 32-bit integer x11.window-value-mask.background-pixel background-pixel Boolean x11.window-value-mask.background-pixmap background-pixmap Boolean x11.window-value-mask.backing-pixel backing-pixel Boolean x11.window-value-mask.backing-planes backing-planes Boolean x11.window-value-mask.backing-store backing-store Boolean x11.window-value-mask.bit-gravity bit-gravity Boolean x11.window-value-mask.border-pixel border-pixel Boolean x11.window-value-mask.border-pixmap border-pixmap Boolean x11.window-value-mask.colormap colormap Boolean x11.window-value-mask.cursor cursor Boolean x11.window-value-mask.do-not-propagate-mask do-not-propagate-mask Boolean x11.window-value-mask.event-mask event-mask Boolean x11.window-value-mask.override-redirect override-redirect Boolean x11.window-value-mask.save-under save-under Boolean x11.window-value-mask.win-gravity win-gravity Boolean x11.x x Signed 16-bit integer x11.y y Signed 16-bit integer

Yahoo Messenger Protocol (yhoo)
yhoo.connection_id Connection ID Unsigned 32-bit integer yhoo.content Content String yhoo.len Packet Length Unsigned 32-bit integer yhoo.magic_id Magic ID Unsigned 32-bit integer yhoo.msgtype Message Type Unsigned 32-bit integer yhoo.nick1 Real Nick (nick1) String yhoo.nick2 Active Nick (nick2) String yhoo.service Service Type Unsigned 32-bit integer yhoo.unknown1 Unknown 1 Unsigned 32-bit integer yhoo.version Version String

Yellow Pages Bind (ypbind)

Yellow Pages Service (ypserv)
ypserv.domain Domain String ypserv.key Key String ypserv.map Map Name String ypserv.map_parms YP Map Parameters No value ypserv.more More Boolean ypserv.ordernum Order Number Unsigned 32-bit integer ypserv.peer Peer Name String ypserv.port Port Unsigned 32-bit integer ypserv.prog Program Number Unsigned 32-bit integer ypserv.servesdomain Serves Domain Boolean ypserv.status Status Signed 32-bit integer ypserv.transid Host Transport ID IPv4 address ypserv.value Value String ypserv.xfrstat Xfrstat Signed 32-bit integer

Yellow Pages Transfer (ypxfr)

Zebra Protocol (zebra)
zebra.bandwidth Bandwidth Unsigned 32-bit integer zebra.command Command Unsigned 8-bit integer zebra.dest4 Destination IPv4 address zebra.dest6 Destination IPv6 address zebra.distance Distance Unsigned 8-bit integer zebra.family Family Unsigned 32-bit integer zebra.index Index Unsigned 32-bit integer zebra.indexnum Index Number Unsigned 8-bit integer zebra.interface Interface String zebra.intflags Flags Unsigned 32-bit integer zebra.len Length Unsigned 16-bit integer zebra.message Message Unsigned 8-bit integer zebra.message.distance Message Distance Boolean zebra.message.index Message Index Boolean zebra.message.metric Message Metric Boolean zebra.message.nexthop Message Nexthop Boolean zebra.metric Metric Unsigned 32-bit integer zebra.mtu MTU Unsigned 32-bit integer zebra.nexthop4 Nexthop IPv4 address zebra.nexthop6 Nexthop IPv6 address zebra.nexthopnum Nexthop Number Unsigned 8-bit integer zebra.prefix4 Prefix IPv4 address zebra.prefix6 Prefix IPv6 address zebra.prefixlen Prefix length Unsigned 32-bit integer zebra.request Request Boolean zebra.rtflags Flags Unsigned 8-bit integer zebra.type Type Unsigned 8-bit integer /usr/local/etc/ethereal.conf and $HOME/.ethereal/preferences contain system-wide and personal preference settings, respectively. The file contains preference settings of the form prefname:value, one per line, where prefname is the name of the preference (which is the same name that would appear in the preference file), and value is the value to which it should be set; white space is allowed between : and value. A preference setting can be continued on subsequent lines by indenting the continuation lines with white space. A # character starts a comment that runs to the end of the line. The system-wide preference file is read first, if it exists, overriding Ethereal's default values; the personal preferences file is then read, if it exists, overriding default values and values read from the system-wide preference file. Note that whenever the preferences are saved by using the Save button in the Edit:Preferences dialog box, $HOME/.ethereal/preferences will be overwritten with the new settings, destroying any comments that were in the file. /etc/ethers is consulted to correlate 6-byte hardware addresses to names. If an address is not found in /etc/ethers, the $HOME/.ethereal/ethers file is consulted next. Each line contains one hardware address and name, separated by whitespace. The digits of the hardware address are separated by either a colon (:), a dash (-), or a period (.). The following three lines are valid lines of an ethers file: ff:ff:ff:ff:ff:ff Broadcast c0-00-ff-ff-ff-ff TR_broadcast 00.00.00.00.00.00 Zero_broadcast /usr/local/etc/manuf matches the 3-byte vendor portion of a 6-byte hardware address with the manufacturer's name. The format of the file is the same as the /etc/ethers file, except that each address is three bytes instead of six. /etc/ipxnets and $HOME/.ethereal/ipxnets correlate 4-byte IPX network numbers to names. The format is the same as the /etc/ethers file, except that each address if four bytes instead of six. Additionally, the address can be represented a single hexadecimal number, as is more common in the IPX world, rather than four hex octets. For example, these four lines are valid lines of an ipxnets file. C0.A8.2C.00 HR c0-a8-1c-00 CEO 00:00:BE:EF IT_Server1 110f FileServer3 tethereal(1), editcap(1), tcpdump(8), pcap(3) The latest version of Ethereal can be found at http://www.ethereal.com. Original Author -------- ------ Gerald Combs <gerald@ethereal.com> Contributors ------------ Gilbert Ramirez <gram@xiexie.org> Hannes R. Boehm <hannes@boehm.org> Mike Hall <mlh@io.com> Bobo Rajec <bobo@bsp-consulting.sk> Laurent Deniel <deniel@worldnet.fr> Don Lafontaine <lafont02@cn.ca> Guy Harris <guy@alum.mit.edu> Simon Wilkinson <sxw@dcs.ed.ac.uk> Joerg Mayer <jmayer@telemation.de> Martin Maciaszek <fastjack@i-s-o.net> Didier Jorand <Didier.Jorand@alcatel.fr> Jun-ichiro itojun Hagino <itojun@iijlab.net> Richard Sharpe <sharpe@ns.aus.com> John McDermott <jjm@jkintl.com> Jeff Jahr <jjahr@shastanets.com> Brad Robel-Forrest <bradr@watchguard.com> Ashok Narayanan <ashokn@cisco.com> Aaron Hillegass <aaron@classmax.com> Jason Lango <jal@netapp.com> Johan Feyaerts <Johan.Feyaerts@siemens.atea.be> Olivier Abad <oabad@cybercable.fr> Thierry Andry <Thierry.Andry@advalvas.be> Jeff Foster <jjfoste@woodward.com> Peter Torvals <petertv@xoommail.com> Christophe Tronche <ch.tronche@computer.org> Nathan Neulinger <nneul@umr.edu> Tomislav Vujec <tvujec@carnet.hr> Kojak <kojak@bigwig.net> Uwe Girlich <Uwe.Girlich@philosys.de> Warren Young <tangent@mail.com> Heikki Vatiainen <hessu@cs.tut.fi> Greg Hankins <gregh@twoguys.org> Jerry Talkington <jerryt@netapp.com> Dave Chapeskie <dchapes@ddm.on.ca> James Coe <jammer@cin.net> Bert Driehuis <driehuis@playbeing.org> Stuart Stanley <stuarts@mxmail.net> John Thomes <john@ensemblecom.com> Laurent Cazalet <laurent.cazalet@mailclub.net> Thomas Parvais <thomas.parvais@advalvas.be> Gerrit Gehnen <G.Gehnen@atrie.de> Craig Newell <craign@cheque.uq.edu.au> Ed Meaney <emeaney@altiga.com> Dietmar Petras <DPetras@ELSA.de> Fred Reimer <fwr@ga.prestige.net> Florian Lohoff <flo@rfc822.org> Jochen Friedrich <jochen+ethereal@scram.de> Paul Welchinski <paul.welchinski@telusplanet.net> Doug Nazar <nazard@dragoninc.on.ca> Andreas Sikkema <andreas.sikkema@philips.com> Mark Muhlestein <mmm@netapp.com> Graham Bloice <graham.bloice@trihedral.com> Ralf Schneider <ralf.schneider@alcatel.se> Yaniv Kaul <ykaul@netvision.net.il> Paul Ionescu <ipaul@romsys.ro> Mark Burton <markb@ordern.com> Stefan Raab <sraab@cisco.com> Mark Clayton <clayton@shore.net> Michael Rozhavsky <mike@tochna.technion.ac.il> Dug Song <dugsong@monkey.org> Michael Tuexen <Michael.Tuexen@icn.siemens.de> Bruce Korb <bkorb@sco.com> Jose Pedro Oliveira <jpo@di.uminho.pt> David Frascone <dave@frascone.com> Peter Kjellerstedt <pkj@axis.com> Phil Techau <phil_t@altavista.net> Wes Hardaker <wjhardaker@ucdavis.edu> Robert Tsai <rtsai@netapp.com> Craig Metz <cmetz@inner.net> Per Flock <per.flock@axis.com> Jack Keane <jkeane@OpenReach.com> Brian Wellington <bwelling@xbill.org> Santeri Paavolainen <santtu@ssh.com> Ulrich Kiermayr <uk@ap.univie.ac.at> Neil Hunter <neil.hunter@energis-squared.com> Ralf Holzer <ralf@well.com> Craig Rodrigues <rodrigc@mediaone.net> Ed Warnicke <hagbard@physics.rutgers.edu> Johan Jorgensen <johan.jorgensen@axis.com> Frank Singleton <frank.singleton@ericsson.com> Kevin Shi <techishi@ms22.hinet.net> Mike Frisch <mfrisch@saturn.tlug.org> Burke Lau <burke_lau@agilent.com> Martti Kuparinen <martti.kuparinen@nomadiclab.com> David Hampton <dhampton@mac.com> Kent Engström <kent@unit.liu.se> Ronnie Sahlberg <rsahlber@bigpond.net.au> Alexandre P. Ferreira <alexandref@spliceip.com.br> Simharajan Srishylam <Simharajan.Srishylam@netapp.com> Greg Kilfoyle <gregk@redback.com> James E. Flemer <jflemer@acm.jhu.edu> Peter Lei <peterlei@cisco.com> Thomas Gimpel <thomas.gimpel@ferrari.de> Albert Chin <china@thewrittenword.com> Charles Levert <charles@comm.polymtl.ca> Todd Sabin <tas@webspan.net> Eduardo Pérez Ureta <eperez@dei.inf.uc3m.es> Martin Thomas <martin_a_thomas@yahoo.com> Hartmut Mueller <hartmut@wendolene.ping.de> Michal Melerowicz <Michal.Melerowicz@nokia.com> Hannes Gredler <hannes@juniper.net> Alain Magloire <alainm@rcsm.ece.mcgill.ca> was kind enough to give his permission to use his version of snprintf.c. Dan Lasley <dlasley@promus.com> gave permission for his dumpit() hex-dump routine to be used.