| blob | 874dc576d7d7469084eddcfc2a14201e19161ee6 |
1 <!-- WSUG Chapter IO -->
2 <!-- $Id$ -->
4 <chapter id="ChapterIO">
5 <title>File Input / Output and Printing</title>
7 <section id="ChIOIntroductionSection"><title>Introduction</title>
8 <para>
9 This chapter will describe input and output of capture data.
10 <itemizedlist>
11 <listitem>
12 <para>
13 Open capture files in various capture file formats
14 </para>
15 </listitem>
16 <listitem>
17 <para>
18 Save/Export capture files in various capture file formats
19 </para>
20 </listitem>
21 <listitem>
22 <para>
23 Merge capture files together
24 </para>
25 </listitem>
26 <listitem>
27 <para>
28 Import text files containing hex dumps of packets
29 </para>
30 </listitem>
31 <listitem>
32 <para>
33 Print packets
34 </para>
35 </listitem>
36 </itemizedlist>
37 </para>
38 </section>
40 <section id="ChIOOpenSection"><title>Open capture files</title>
41 <para>
42 Wireshark can read in previously saved capture files.
43 To read them, simply select the menu or toolbar item: "File/
44 <inlinegraphic entityref="WiresharkToolbarOpen" format="PNG"/>
45 <command>Open</command>".
46 Wireshark will then pop up the File
47 Open dialog box, which is discussed in more detail in
48 <xref linkend="ChIOOpen"/>.
49 </para>
50 <tip><title>It's convenient to use drag-and-drop!</title>
51 <para>
52 ... to open a file, by simply dragging the desired file from your file
53 manager and dropping it onto Wireshark's main window.
54 However, drag-and-drop is not available/won't work in all desktop
55 environments.
56 </para>
57 </tip>
58 <para>
59 If you haven't previously saved the current capture file, you will be asked
60 to do so, to prevent data loss (this behaviour can be disabled in the
61 preferences).
62 </para>
63 <para>
64 In addition to its native file format (libpcap format, also used by
65 tcpdump/WinDump and other libpcap/WinPcap-based programs), Wireshark can
66 read capture files from a large number of other packet capture programs
67 as well. See <xref linkend="ChIOInputFormatsSection"/> for the list of
68 capture formats Wireshark understands.
69 </para>
71 <section id="ChIOOpen">
72 <title>The "Open Capture File" dialog box</title>
73 <para>
74 The "Open Capture File" dialog box allows you to search for a
75 capture file containing previously captured packets for display in
76 Wireshark. <xref linkend="ChIOOpenFileTab"/> shows some examples
77 of the Wireshark Open File Dialog box.
78 </para>
79 <note>
80 <title>The dialog appearance depends on your system!</title>
81 <para>
82 The appearance of this dialog depends on the system and/or GTK+
83 toolkit version used. However, the functionality remains basically
84 the same on any particular system.
85 </para>
86 </note>
88 <para>
89 <command>Common dialog behaviour</command> on all systems:
90 </para>
91 <itemizedlist>
92 <listitem>
93 <para>
94 Select files and directories.
95 </para>
96 </listitem>
97 <listitem>
98 <para>
99 Click the Open/Ok button to accept your selected file and open it.
100 </para>
101 </listitem>
102 <listitem>
103 <para>
104 Click the Cancel button to go back to Wireshark and not load a capture
105 file.
106 </para>
107 </listitem>
108 </itemizedlist>
110 <para>
111 <command>Wireshark extensions</command> to the standard behaviour of
112 these dialogs:
113 </para>
114 <itemizedlist>
115 <listitem>
116 <para>
117 View file preview information (like the filesize, the number of
118 packets, ...), if you've selected a capture file.
119 </para>
120 </listitem>
121 <listitem>
122 <para>
123 Specify a display filter with the "Filter:" button and filter
124 field. This filter will be used when opening the new file.
125 The text field background becomes green for a valid filter string
126 and red for an invalid one.
127 Clicking on the Filter button causes Wireshark to pop up
128 the Filters dialog box (which is discussed further in
129 <xref linkend="ChWorkDisplayFilterSection"/>).
130 </para>
131 <para>
132 XXX - we need a better description of these read filters
133 </para>
134 </listitem>
135 <listitem>
136 <para>
137 Specify which type of name resolution is to be performed for all packets by
138 clicking on one of the "... name resolution" check buttons.
139 Details about name resolution can be found in
140 <xref linkend="ChAdvNameResolutionSection"/>.
141 </para>
142 </listitem>
143 </itemizedlist>
145 <tip><title>Save a lot of time loading huge capture files!</title>
146 <para>
147 You can change the display filter and name resolution settings later
148 while viewing the packets.
149 However, loading huge capture files can take a significant amount of
150 extra time if these settings are changed later, so in such situations it can
151 be a good idea to set at least the filter in advance here.
152 </para>
153 </tip>
155 <!-- frame="none" -->
156 <table id="ChIOOpenFileTab">
157 <title>The system specific "Open Capture File" dialog box</title>
158 <tgroup cols="2">
159 <tbody>
160 <row>
161 <entry valign="top">
162 <para>
163 <figure id="ChIOOpenFileDialogWin32">
164 <title>"Open" on native Windows</title>
165 <graphic entityref="WiresharkOpenDialogWin32" format="PNG"/>
166 </figure>
167 </para>
168 </entry>
169 <entry valign="top">
170 <para><command>Microsoft Windows</command></para>
171 <para>
172 This is the common Windows file open dialog -
173 plus some Wireshark extensions.
174 </para>
175 <para>
176 Specific for this dialog:
177 </para>
178 <itemizedlist>
179 <listitem>
180 <para>
181 If available, the "Help" button will lead you to this section of
182 this "User's Guide".
183 </para>
184 </listitem>
185 <listitem>
186 <note><para>
187 The "Filter:" button currently doesn't work on Windows!
188 </para></note>
189 </listitem>
190 </itemizedlist>
191 </entry>
192 </row>
193 <row>
194 <entry valign="top">
195 <para>
196 <figure id="ChIOOpenFileDialog">
197 <title>"Open" - new GTK version</title>
198 <graphic entityref="WiresharkOpenDialog24" format="PNG"/>
199 </figure>
200 </para>
201 </entry>
202 <entry valign="top">
203 <para><command>Unix/Linux: GTK version >= 2.4</command></para>
204 <para>
205 This is the common Gimp/GNOME file open dialog -
206 plus some Wireshark extensions.
207 </para>
208 <para>
209 Specific for this dialog:
210 </para>
211 <itemizedlist>
212 <listitem>
213 <para>
214 The "+ Add" button allows you to add a directory, selected in the
215 right-hand pane, to the favorites list on the left. Those changes
216 are persistent.
217 </para>
218 </listitem>
219 <listitem>
220 <para>
221 The "- Remove" button allows you to remove a selected directory from
222 that list again (the items like: "Home", "Desktop", and "Filesystem"
223 cannot be removed).
224 </para>
225 </listitem>
226 <listitem>
227 <para>
228 If Wireshark doesn't recognize the selected file as a capture file,
229 it will grey out the "Open" button.
230 </para>
231 </listitem>
232 </itemizedlist>
233 </entry>
234 </row>
235 <row>
236 <entry valign="top">
237 <para>
238 <figure id="ChIOOpenFileDialog1">
239 <title>"Open" - old GTK version</title>
240 <graphic entityref="WiresharkOpenDialog20" format="PNG"/>
241 </figure>
242 </para>
243 </entry>
244 <entry valign="top">
245 <para>
246 <command>Unix/Linux: GTK version < 2.4</command></para>
247 <para>
248 This is the file open dialog of former Gimp/GNOME versions -
249 plus some Wireshark extensions.
250 </para>
251 <para>
252 Specific for this dialog:
253 </para>
254 <itemizedlist>
255 <listitem>
256 <para>
257 If Wireshark doesn't recognize the selected file as a capture file,
258 it will grey out the "Ok" button.
259 </para>
260 </listitem>
261 </itemizedlist>
262 </entry>
263 </row>
264 </tbody>
265 </tgroup>
266 </table>
269 </section>
271 <section id="ChIOInputFormatsSection">
272 <title>Input File Formats</title>
273 <para>
274 The following file formats from other capture tools can be opened by
275 <application>Wireshark</application>:
276 <itemizedlist>
277 <listitem><para>libpcap - captures from <emphasis>Wireshark</emphasis>/<emphasis>TShark</emphasis>/<emphasis>dumpcap</emphasis>, <emphasis>tcpdump</emphasis>, and various other tools using libpcap's/tcpdump's capture format</para></listitem>
278 <listitem><para>pcap-ng - "next-generation" successor to libpcap format</para></listitem>
279 <listitem><para>Sun snoop and atmsnoop</para></listitem>
280 <listitem><para>Shomiti/Finisar <emphasis>Surveyor</emphasis> captures</para></listitem>
281 <listitem><para>Novell <emphasis>LANalyzer</emphasis> captures</para></listitem>
282 <listitem><para>Microsoft Network Monitor captures</para></listitem>
283 <listitem><para>AIX's iptrace captures</para></listitem>
284 <listitem><para>Cinco Networks NetXray captures</para></listitem>
285 <listitem><para>Network Associates Windows-based Sniffer and Sniffer Pro captures</para></listitem>
286 <listitem><para>Network General/Network Associates DOS-based Sniffer (compressed or uncompressed) captures</para></listitem>
287 <listitem><para>AG Group/WildPackets EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures</para></listitem>
288 <listitem><para>RADCOM's WAN/LAN Analyzer captures</para></listitem>
289 <listitem><para>Network Instruments Observer version 9 captures</para></listitem>
290 <listitem><para>Lucent/Ascend router debug output</para></listitem>
291 <listitem><para>HP-UX's nettl</para></listitem>
292 <listitem><para>Toshiba's ISDN routers dump output</para></listitem>
293 <listitem><para>ISDN4BSD <emphasis>i4btrace</emphasis> utility</para></listitem>
294 <listitem><para>traces from the EyeSDN USB S0</para></listitem>
295 <listitem><para>IPLog format from the Cisco Secure Intrusion Detection System</para></listitem>
296 <listitem><para>pppd logs (pppdump format)</para></listitem>
297 <listitem><para>the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities</para></listitem>
298 <listitem><para>the text output from the DBS Etherwatch VMS utility</para></listitem>
299 <listitem><para>Visual Networks' Visual UpTime traffic capture</para></listitem>
300 <listitem><para>the output from CoSine L2 debug</para></listitem>
301 <listitem><para>the output from Accellent's 5Views LAN agents</para></listitem>
302 <listitem><para>Endace Measurement Systems' ERF format captures</para></listitem>
303 <listitem><para>Linux Bluez Bluetooth stack hcidump -w traces</para></listitem>
304 <listitem><para>Catapult DCT2000 .out files</para></listitem>
305 <listitem><para>Gammu generated text output from Nokia DCT3 phones in Netmonitor mode</para></listitem>
306 <listitem><para>IBM Series (OS/400) Comm traces (ASCII & UNICODE)</para></listitem>
307 <listitem><para>Juniper Netscreen snoop captures</para></listitem>
308 <listitem><para>Symbian OS btsnoop captures</para></listitem>
309 <listitem><para>Tamosoft CommView captures</para></listitem>
310 <listitem><para>Textronix K12xx 32bit .rf5 format captures</para></listitem>
311 <listitem><para>Textronix K12 text file format captures</para></listitem>
312 <listitem><para>Apple PacketLogger captures</para></listitem>
313 <listitem><para>Captures from Aethra Telecommunications' PC108 software for their test instruments</para></listitem>
314 <listitem><para>... new file formats are added from time to time</para></listitem>
315 </itemizedlist>
316 </para>
317 <note><title>Opening a file may fail due to invalid packet types!</title>
318 <para>
319 It may not be possible to read some formats dependent on the packet types
320 captured. Ethernet captures are usually supported for most file formats but
321 it may not be possible to read other packet types (e.g. token ring packets)
322 from all file formats.
323 </para>
324 </note>
326 </section>
328 </section>
330 <section id="ChIOSaveSection"><title>Saving captured packets</title>
331 <para>
332 You can save captured packets simply by using the Save As... menu
333 item from the File menu under Wireshark. You can choose which
334 packets to save and which file format to be used.
335 </para>
336 <warning>
337 <title>Saving may reduce the available information!</title>
338 <para>
339 Saving the captured packets will slightly reduce the amount of
340 information, e.g. the number of dropped packets will be lost;
341 see <xref linkend="ChAppFilesCaptureFilesSection"/> for details.
342 </para>
343 </warning>
344 <section id="ChIOSaveAs">
345 <title>The "Save Capture File As" dialog box</title>
346 <para>
347 The "Save Capture File As" dialog box allows you to save
348 the current capture to a file.
349 <xref linkend="ChIOSaveFileTab"/> shows some examples of this
350 dialog box.
351 </para>
352 <note>
353 <title>The dialog appearance depends on your system!</title>
354 <para>
355 The appearance of this dialog depends on the system and GTK+ toolkit
356 version used. However, the functionality remains basically the same
357 on any particular system.
358 </para>
359 </note>
361 <table id="ChIOSaveFileTab">
362 <title>The system specific "Save Capture File As" dialog box</title>
363 <tgroup cols="2">
364 <tbody>
365 <row>
366 <entry valign="top">
367 <para>
368 <figure id="ChIOSaveAsFileWin32">
369 <title>"Save" on native Windows</title>
370 <graphic entityref="WiresharkSaveAsDialogWin32" format="PNG"/>
371 </figure>
372 </para>
373 </entry>
374 <entry valign="top">
375 <para><command>Microsoft Windows</command></para>
376 <para>
377 This is the common Windows file save dialog -
378 plus some Wireshark extensions.
379 </para>
380 <para>
381 Specific for this dialog:
382 </para>
383 <itemizedlist>
384 <listitem>
385 <para>
386 If available, the "Help" button will lead you to this section of
387 this "User's Guide".
388 </para>
389 </listitem>
390 <listitem>
391 <para>
392 If you don't provide a file extension to the filename - e.g. .pcap,
393 Wireshark will append the standard file extension for that file
394 format.
395 </para>
396 </listitem>
397 </itemizedlist>
398 </entry>
399 </row>
400 <row>
401 <entry valign="top">
402 <para>
403 <figure id="ChIOSaveAsFile2">
404 <title>"Save" - new GTK version</title>
405 <graphic entityref="WiresharkSaveAsDialog24" format="PNG"/>
406 </figure>
407 </para>
408 </entry>
409 <entry valign="top">
410 <para><command>Unix/Linux: GTK version >= 2.4</command></para>
411 <para>
412 This is the common Gimp/GNOME file save dialog -
413 plus some Wireshark extensions.
414 </para>
415 <para>
416 Specific for this dialog:
417 </para>
418 <itemizedlist>
419 <listitem>
420 <para>
421 Clicking on the + at "Browse for other folders" will allow you
422 to browse files and folders in your file system.
423 </para>
424 </listitem>
425 </itemizedlist>
426 </entry>
427 </row>
428 <row>
429 <entry valign="top">
430 <para>
431 <figure id="ChIOSaveAsFile1">
432 <title>"Save" - old GTK version</title>
433 <graphic entityref="WiresharkSaveAsDialog20" format="PNG"/>
434 </figure>
435 </para>
436 </entry>
437 <entry valign="top">
438 <para><command>Unix/Linux: GTK version < 2.4</command></para>
439 <para>
440 This is the file save dialog of former Gimp/GNOME versions -
441 plus some Wireshark extensions.
442 </para>
443 </entry>
444 </row>
445 </tbody>
446 </tgroup>
447 </table>
449 <para>
450 With this dialog box, you can perform the following actions:
451 <orderedlist>
452 <listitem>
453 <para>
454 Type in the name of the file you wish to save the captured
455 packets in, as a standard file name in your file system.
456 </para>
457 </listitem>
458 <listitem>
459 <para>
460 Select the directory to save the file into.
461 </para>
462 </listitem>
463 <listitem>
464 <para>
465 Select the range of the packets to be saved, see
466 <xref linkend="ChIOPacketRangeSection"/>
467 </para>
468 </listitem>
469 <listitem>
470 <para>
471 Specify the format of the saved capture file by clicking on
472 the File type drop down box. You can choose from the
473 types, described in <xref linkend="ChIOOutputFormatsSection"/>.
474 </para>
475 <note>
476 <title>The selection of capture formats may be reduced!</title>
477 <para>
478 Some capture formats may not be available, depending on the
479 packet types captured.
480 </para>
481 </note>
482 <tip>
483 <title>File formats can be converted!</title>
484 <para>
485 You can convert capture files from one format to another
486 by reading in a capture file and writing it out using a
487 different format.
488 </para>
489 </tip>
490 </listitem>
491 <listitem>
492 <para>
493 Click on the Save/Ok button to accept your selected file and save to
494 it. If Wireshark has a problem saving the captured packets to
495 the file you specified, it will display an error dialog box.
496 After clicking OK on that error dialog box, you can try again.
497 </para>
498 </listitem>
499 <listitem>
500 <para>
501 Click on the Cancel button to go back to Wireshark and not save the
502 captured packets.
503 </para>
504 </listitem>
505 </orderedlist>
506 </para>
507 </section>
508 <section id="ChIOOutputFormatsSection">
509 <title>Output File Formats</title>
510 <para>
511 Wireshark can save the packet data in its "native" file format (libpcap)
512 and in the file formats of some other protocol analyzers, so other tools
513 can read the capture data.
514 </para>
515 <warning><title>File formats have different time stamp accuracies!</title>
516 <para>
517 Saving from the currently used file format to a different format may reduce the
518 time stamp accuracy; see the <xref linkend="ChAdvTimestamps"/> for details.
519 </para>
520 </warning>
521 <para>
522 The following file formats can be saved by <application>Wireshark</application> (with the known file extensions):
523 <itemizedlist>
524 <listitem><para>libpcap, tcpdump and various other tools using tcpdump's capture format (*.pcap,*.cap,*.dmp)</para></listitem>
525 <listitem><para>Accellent 5Views (*.5vw)</para></listitem>
526 <listitem><para>HP-UX's nettl (*.TRC0,*.TRC1)</para></listitem>
527 <listitem><para>Microsoft Network Monitor - NetMon (*.cap)</para></listitem>
528 <listitem><para>Network Associates Sniffer - DOS (*.cap,*.enc,*.trc,*fdc,*.syc)</para></listitem>
529 <listitem><para>Network Associates Sniffer - Windows (*.cap)</para></listitem>
530 <listitem><para>Network Instruments Observer version 9 (*.bfr)</para></listitem>
531 <listitem><para>Novell LANalyzer (*.tr1)</para></listitem>
532 <listitem><para>Sun snoop (*.snoop,*.cap)</para></listitem>
533 <listitem><para>Visual Networks Visual UpTime traffic (*.*)</para></listitem>
534 <listitem><para>... new file formats are added from time to time</para></listitem>
535 </itemizedlist>
536 </para>
537 <para>
538 If the above tools will be more helpful than Wireshark is a different question ;-)
539 </para>
540 <note><title>Third party protocol analyzers may require specific file extensions!</title>
541 <para>
542 Other protocol analyzers than Wireshark may require that the file has a
543 certain file extension in order to read the files you generate with Wireshark, e.g.:
544 </para>
545 <para>
546 ".cap" for Network Associates Sniffer - Windows
547 </para>
548 </note>
549 </section>
550 </section>
552 <section id="ChIOMergeSection"><title>Merging capture files</title>
553 <para>
554 Sometimes you need to merge several capture files into one. For example
555 this can be useful, if you have captured simultaneously from multiple
556 interfaces at once (e.g. using multiple instances of Wireshark).
557 </para>
558 <para>
559 Merging capture files can be done in three ways:
560 <itemizedlist>
561 <listitem><para>
562 Use the <command>menu item "Merge"</command> from the "File" menu,
563 to open the merge dialog, see <xref linkend="ChIOMergeDialog"/>.
564 This menu item will be disabled, until you have loaded a capture file.
565 </para></listitem>
566 <listitem><para>
567 Use <command>drag-and-drop</command> to drop multiple files on the
568 main window. Wireshark will try to merge the packets in chronological
569 order from the dropped files into a newly created temporary file. If
570 you drop only a single file, it will simply replace a (maybe) existing
571 one.
572 </para></listitem>
573 <listitem><para>
574 Use the <command>mergecap</command> tool, which is a command
575 line tool to merge capture files. This tool provides the most options
576 to merge capture files, see <xref linkend="AppToolsmergecap"/>.
577 </para></listitem>
578 </itemizedlist>
579 </para>
580 <section id="ChIOMergeDialog">
581 <title>The "Merge with Capture File" dialog box</title>
582 <para>
584 This dialog box let you select a file to be merged into the currently
585 loaded file.
586 </para>
587 <note><title>You will be prompted for an unsaved file first!</title>
588 <para>If your current data wasn't saved before, you will be asked to save
589 it first, before this dialog box is shown.</para>
590 </note>
592 <para>
593 Most controls of this dialog will work the same way as described in the
594 "Open Capture File" dialog box, see <xref linkend="ChIOOpen"/>.
595 </para>
596 <para>
597 Specific controls of this merge dialog are:
598 </para>
600 <variablelist>
601 <varlistentry>
602 <term><command>Prepend packets to existing file</command></term>
603 <listitem>
604 <para>
605 Prepend the packets from the selected file before the currently loaded
606 packets.
607 </para>
608 </listitem>
609 </varlistentry>
610 <varlistentry>
611 <term><command>Merge packets chronologically</command></term>
612 <listitem>
613 <para>
614 Merge both the packets from the selected and currently loaded file in
615 chronological order.
616 </para>
617 </listitem>
618 </varlistentry>
619 <varlistentry>
620 <term><command>Append packets to existing file</command></term>
621 <listitem>
622 <para>
623 Append the packets from the selected file after the currently loaded
624 packets.
625 </para>
626 </listitem>
627 </varlistentry>
628 </variablelist>
630 <table id="ChIOMergeFileTab">
631 <title>The system specific "Merge Capture File As" dialog box</title>
632 <tgroup cols="2">
633 <tbody>
634 <row>
635 <entry valign="top">
636 <para>
637 <figure id="ChIOMergeFileWin32">
638 <title>"Merge" on native Windows</title>
639 <graphic entityref="WiresharkMergeDialogWin32" format="PNG"/>
640 </figure>
641 </para>
642 </entry>
643 <entry valign="top">
644 <para><command>Microsoft Windows</command></para>
645 <para>
646 This is the common Windows file open dialog -
647 plus some Wireshark extensions.
648 </para>
649 </entry>
650 </row>
651 <row>
652 <entry valign="top">
653 <para>
654 <figure id="ChIOMergeFile2">
655 <title>"Merge" - new GTK version</title>
656 <graphic entityref="WiresharkMergeDialog24" format="PNG"/>
657 </figure>
658 </para>
659 </entry>
660 <entry valign="top">
661 <para><command>Unix/Linux: GTK version >= 2.4</command></para>
662 <para>
663 This is the common Gimp/GNOME file open dialog -
664 plus some Wireshark extensions.
665 </para>
666 </entry>
667 </row>
668 <row>
669 <entry valign="top">
670 <para>
671 <figure id="ChIOMergeFile1">
672 <title>"Merge" - old GTK version</title>
673 <graphic entityref="WiresharkMergeDialog20" format="PNG"/>
674 </figure>
675 </para>
676 </entry>
677 <entry valign="top">
678 <para><command>Unix/Linux: GTK version < 2.4</command></para>
679 <para>
680 This is the file open dialog of former Gimp/GNOME versions -
681 plus some Wireshark extensions.
682 </para>
683 </entry>
684 </row>
685 </tbody>
686 </tgroup>
687 </table>
689 </section>
690 </section>
692 <section id="ChIOImportSection"><title>Import hex dump</title>
693 <para>
694 Wireshark can read in an ASCII hex dump and write the data described
695 into a temporary libpcap capture file. It can read hex dumps with multiple
696 packets in them, and build a capture file of multiple packets. It is also
697 capable of generating dummy Ethernet, IP and UDP, TCP, or SCTP headers,
698 in order to build fully processable packet dumps from hexdumps of
699 application-level data only.
700 </para>
701 <para>
702 Wireshark understands a hexdump of the form generated by
703 <command>od -Ax -tx1 -v</command>.
704 In other words, each byte is individually displayed and surrounded with a space.
705 Each line begins with an offset describing the position in the file. The offset
706 is a hex number (can also be octal or decimal), of more than two hex
707 digits. Here is a sample dump that can be imported:
708 </para>
709 <programlisting>
710 000000 00 e0 1e a7 05 6f 00 10 ........
711 000008 5a a0 b9 12 08 00 46 00 ........
712 000010 03 68 00 00 00 00 0a 2e ........
713 000018 ee 33 0f 19 08 7f 0f 19 ........
714 000020 03 80 94 04 00 00 10 01 ........
715 000028 16 a2 0a 00 03 50 00 0c ........
716 000030 01 01 0f 19 03 80 11 01 ........
717 </programlisting>
718 <para>
719 There is no limit on the width or number of bytes per line. Also the text dump at
720 the end of the line is ignored. Bytes/hex numbers can be uppercase or lowercase.
721 Any text before the offset is ignored, including email forwarding characters '>'.
722 Any lines of text between the bytestring lines are ignored. The offsets are used
723 to track the bytes, so offsets must be correct. Any line which has only bytes
724 without a leading offset is ignored. An offset is recognized as being a hex
725 number longer than two characters. Any text after the bytes is ignored (e.g. the
726 character dump). Any hex numbers in this text are also ignored. An offset of zero
727 is indicative of starting a new packet, so a single text file with a series of
728 hexdumps can be converted into a packet capture with multiple packets. Packets may
729 be preceded by a timestamp. These are interpreted according to the format
730 given. If not the first packet is timestamped with the current time the import
731 takes place. Multiple packets are read in with timestamps differing by one
732 microsecond each. In general, short of these restrictions, Wireshark is pretty
733 liberal about reading in hexdumps and has been tested with a variety of mangled
734 outputs (including being forwarded through email multiple times, with limited
735 line wrap etc.)
736 </para>
737 <para>
738 There are a couple of other special features to note. Any line where the first
739 non-whitespace character is '#' will be ignored as a comment. Any line beginning
740 with #TEXT2PCAP is a directive and options can be inserted after this command to
741 be processed by Wireshark. Currently there are no directives implemented; in the
742 future, these may be used to give more fine grained control on the dump and the
743 way it should be processed e.g. timestamps, encapsulation type etc.
744 Wireshark also allows the user to read in dumps of application-level data, by
745 inserting dummy L2, L3 and L4 headers before each packet. The user can elect to
746 insert Ethernet headers, Ethernet and IP, or Ethernet, IP and UDP/TCP/SCTP headers
747 before each packet. This allows Wireshark or any other full-packet decoder to
748 handle these dumps.
749 </para>
750 <section id="ChIOImportDialog">
751 <title>The "Import from Hex Dump" dialog box</title>
752 <para>
753 This dialog box lets you select a text file, containing a hex dump
754 of packet data, to be imported and set import parameters.
755 </para>
756 <para>
757 <figure id="ChIOFileImportDialog">
758 <title>The "Import from Hex Dump" dialog</title>
759 <graphic entityref="WiresharkFileImportDialog" format="PNG"/>
760 </figure>
761 </para>
762 <para>
763 Specific controls of this import dialog are split in two sections:
764 <variablelist>
765 <varlistentry>
766 <term>Input</term>
767 <listitem><para>Determine which input file has to be imported and
768 how it is to be interpreted.
769 </para></listitem>
770 </varlistentry>
771 <varlistentry>
772 <term>Import</term>
773 <listitem><para>Determine how the data is to be imported.</para></listitem>
774 </varlistentry>
775 </variablelist>
776 </para>
777 <para>
778 The input parameters are as follows:
779 </para>
780 <variablelist>
781 <varlistentry>
782 <term><command>Filename / Browse</command></term>
783 <listitem>
784 <para>
785 Enter the name of the text file to import. You can use
786 <command>Browse</command> to browse for a file.
787 </para>
788 </listitem>
789 </varlistentry>
790 <varlistentry>
791 <term><command>Offsets</command></term>
792 <listitem>
793 <para>
794 Select the radix of the offsets given in the text file to import.
795 This is usually hexadecimal, but decimal and octal are also supported.
796 </para>
797 </listitem>
798 </varlistentry>
799 <varlistentry>
800 <term><command>Date/Time</command></term>
801 <listitem>
802 <para>
803 Tick this checkbox if there are timestamps associated with the frames
804 in the text file to import you would like to use. Otherwise the current time
805 is used for timestamping the frames.
806 </para>
807 </listitem>
808 </varlistentry>
809 <varlistentry>
810 <term><command>Format</command></term>
811 <listitem>
812 <para>
813 This is the format specifier used to parse the timestamps in the text file
814 to import. It uses a simple syntax to describe the format of the timestamps,
815 using %H for hours, %M for minutes, %S for seconds, etc. The straightforward
816 HH:MM:SS format is covered by %T. For a full definition of the syntax look for
817 <command>strptime(3)</command>.
818 </para>
819 </listitem>
820 </varlistentry>
821 </variablelist>
822 <para>
823 The import parameters are as follows:
824 </para>
825 <variablelist>
826 <varlistentry>
827 <term><command>Encapsulation type</command></term>
828 <listitem>
829 <para>
830 Here you can select which type of frames you are importing. This all depends on
831 from what type of medium the dump to import was taken. It lists all types that
832 Wireshark understands, so as to pass the capture file contents to the right dissector.
833 </para>
834 </listitem>
835 </varlistentry>
836 <varlistentry>
837 <term><command>Dummy header</command></term>
838 <listitem>
839 <para>
840 When Ethernet encapsulation is selected you have to option to prepend dummy
841 headers to the frames to import. These headers can provide artificial Ethernet, IP,
842 UDP or TCP or SCTP headers and SCTP data chunks. When selecting a type of dummy
843 header the applicable entries are enabled, others are grayed out and default values
844 are used.
845 </para>
846 </listitem>
847 </varlistentry>
848 <varlistentry>
849 <term><command>Max. frame length</command></term>
850 <listitem>
851 <para>
852 You may not be interested in the full frames from the text file, just the first part.
853 Here you can define how much data from the start of the frame you want to import.
854 If you leave this open the maximum is set to 65535 bytes.
855 </para>
856 </listitem>
857 </varlistentry>
858 </variablelist>
859 <para>
860 Once all input and import parameters are setup click <command>OK</command>
861 to start the import.
862 </para>
863 <para>
864 <note><title>You will be prompted for an unsaved file first!</title>
865 <para>If your current data wasn't saved before, you will be asked to save
866 it first, before this dialog box is shown.</para>
867 </note>
868 </para>
869 <para>
870 When completed there will be a new capture file loaded with the frames imported
871 from the text file.
872 </para>
873 </section>
874 </section>
876 <section id="ChIOFileSetSection"><title>File Sets</title>
877 <para>
878 When using the "Multiple Files" option while doing a capture
879 (see: <xref linkend="ChCapCaptureFiles"/>),
880 the capture data is spread over several capture files, called a file
881 set.
882 </para>
883 <para>
884 As it can become tedious to work with a file set by hand, Wireshark
885 provides some features to handle these file sets in a convenient way.
886 </para>
887 <sidebar><title>How does Wireshark detect the files of a file set?</title>
888 <para>
889 A filename in a file set uses the format Prefix_Number_DateTimeSuffix
890 which might look like this: "test_00001_20060420183910.pcap".
891 All files of a file set share the same prefix (e.g. "test") and suffix
892 (e.g. ".pcap") and a varying middle part.
893 </para>
894 <para>
895 To find the files of a file set, Wireshark scans the directory where the
896 currently loaded file resides and checks for files matching the filename
897 pattern (prefix and suffix) of the currently loaded file.
898 </para>
899 <para>
900 This simple mechanism usually works well, but has its drawbacks. If several
901 file sets were captured with the same prefix and suffix, Wireshark will detect
902 them as a single file set. If files were renamed or spread over several
903 directories the mechanism will fail to find all files of a set.
904 </para>
905 </sidebar>
906 <para>
907 The following features in the "File Set" submenu of the "File" menu are
908 available to work with file sets in a convenient way:
909 </para>
910 <itemizedlist>
911 <listitem><para>
912 The <command>List Files</command> dialog box will list the files
913 Wireshark has recognized as being part of the current file set.
914 </para></listitem>
915 <listitem><para>
916 <command>Next File</command> closes the current and opens the next
917 file in the file set.
918 </para></listitem>
919 <listitem><para>
920 <command>Previous File</command> closes the current and opens the
921 previous file in the file set.
922 </para></listitem>
923 </itemizedlist>
924 <section id="ChIOFileSetListDialog">
925 <title>The "List Files" dialog box</title>
926 <figure>
927 <title>The "List Files" dialog box</title>
928 <graphic entityref="WiresharkFileSetDialog" format="PNG"/>
929 </figure>
930 <para>
931 Each line contains information about a file of the file set:
932 <itemizedlist>
933 <listitem><para>
934 <command>Filename</command> the name of the file. If you click on
935 the filename (or the radio button left to it), the current file will
936 be closed and the corresponding capture file will be opened.
937 </para></listitem>
938 <listitem><para>
939 <command>Created</command> the creation time of the file
940 </para></listitem>
941 <listitem><para>
942 <command>Last Modified</command> the last time the file was modified
943 </para></listitem>
944 <listitem><para>
945 <command>Size</command> the size of the file
946 </para></listitem>
947 </itemizedlist>
948 The last line will contain info about the currently used directory where
949 all of the files in the file set can be found.
950 </para>
951 <para>
952 The content of this dialog box is updated each time a capture file is
953 opened/closed.
954 </para>
955 <para>
956 The Close button will, well, close the dialog box.
957 </para>
958 </section>
959 </section>
960 <section id="ChIOExportSection"><title>Exporting data</title>
961 <para>
962 Wireshark provides several ways and formats to export packet data. This
963 section describes general ways to export data from Wireshark.
964 </para>
965 <note><title>Note!</title>
966 <para>
967 There are more specialized functions to export specific data,
968 which will be described at the appropriate places.
969 </para>
970 </note>
971 <para>
972 XXX - add detailed descriptions of the output formats and some sample
973 output, too.
974 </para>
975 <section id="ChIOExportPlainDialog">
976 <title>The "Export as Plain Text File" dialog box</title>
977 <para id="ChIOExportPlain">
978 Export packet data into a plain ASCII text file, much like the format
979 used to print packets.
980 <tip><title>Tip!</title>
981 <para>
982 If you would like to be able to import any previously exported
983 packets from a plain text file, it is recommended that you:
984 <itemizedlist>
985 <listitem><para>
986 Add the "Absolute date and time" column.
987 </para></listitem>
988 <listitem><para>
989 Temporarily hide all other columns.
990 </para></listitem>
991 <listitem><para>
992 Turn off: Edit/Preferences/Protocols/Data/
993 "Show not dissected data on new Packet Bytes pane". More detail is
994 provided in <xref linkend="ChCustPreferencesSection"/>
995 </para></listitem>
996 <listitem><para>
997 Include the packet summary line.
998 </para></listitem>
999 <listitem><para>
1000 Exclude the column headings.
1001 </para></listitem>
1002 <listitem><para>
1003 Exclude the packet details.
1004 </para></listitem>
1005 <listitem><para>
1006 Include the packet bytes.
1007 </para></listitem>
1008 </itemizedlist>
1009 </para>
1010 </tip>
1011 <figure>
1012 <title>The "Export as Plain Text File" dialog box</title>
1013 <graphic entityref="WiresharkExportPlainDialog" format="PNG"/>
1014 </figure>
1015 <itemizedlist>
1016 <listitem><para>
1017 <command>Export to file:</command> frame chooses the file to export
1018 the packet data to.
1019 </para></listitem>
1020 <listitem><para>
1021 The <command>Packet Range</command> frame is described in <xref
1022 linkend="ChIOPacketRangeSection"/>.
1023 </para></listitem>
1024 <listitem><para>
1025 The <command>Packet Details</command> frame is described in <xref
1026 linkend="ChIOPacketFormatSection"/>.
1027 </para></listitem>
1028 </itemizedlist>
1029 </para>
1030 </section>
1031 <section id="ChIOExportPSDialog">
1032 <title>The "Export as PostScript File" dialog box</title>
1033 <para>
1034 Export packet data into PostScript, much like the format used
1035 to print packets.
1036 <tip><title>Tip!</title>
1037 <para>
1038 You can easily convert PostScript files to PDF files using ghostscript.
1039 For example: export to a file named foo.ps and then call:
1040 <command>ps2pdf foo.ps</command>
1041 </para>
1042 </tip>
1043 <figure>
1044 <title>The "Export as PostScript File" dialog box</title>
1045 <graphic entityref="WiresharkExportPSDialog" format="PNG"/>
1046 </figure>
1047 <itemizedlist>
1048 <listitem><para>
1049 <command>Export to file:</command> frame chooses the file to export
1050 the packet data to.
1051 </para></listitem>
1052 <listitem><para>
1053 The <command>Packet Range</command> frame is described in <xref
1054 linkend="ChIOPacketRangeSection"/>.
1055 </para></listitem>
1056 <listitem><para>
1057 The <command>Packet Details</command> frame is described in <xref
1058 linkend="ChIOPacketFormatSection"/>.
1059 </para></listitem>
1060 </itemizedlist>
1061 </para>
1062 </section>
1063 <section id="ChIOExportCSVDialog">
1064 <title>The "Export as CSV (Comma Separated Values) File" dialog box</title>
1065 <para>XXX - add screenshot</para>
1066 <para>
1067 Export packet summary into CSV, used e.g. by spreadsheet programs to
1068 im-/export data.
1069 <!--<figure>
1070 <title>The "Export as Comma Separated Values File" dialog box</title>
1071 <graphic entityref="WiresharkExportCSVDialog" format="PNG"/>
1072 </figure>-->
1073 <itemizedlist>
1074 <listitem><para>
1075 <command>Export to file:</command> frame chooses the file to export
1076 the packet data to.
1077 </para></listitem>
1078 <listitem><para>
1079 The <command>Packet Range</command> frame is described in <xref
1080 linkend="ChIOPacketRangeSection"/>.
1081 </para></listitem>
1082 </itemizedlist>
1083 </para>
1084 </section>
1085 <section id="ChIOExportCArraysDialog">
1086 <title>The "Export as C Arrays (packet bytes) file" dialog box</title>
1087 <para>XXX - add screenshot</para>
1088 <para>
1089 Export packet bytes into C arrays so you can import the stream data
1090 into your own C program.
1091 <!--
1092 <figure>
1093 <title>The "Export as C Arrays (packet bytes) file" dialog box</title>
1094 <graphic entityref="WiresharkExportCArraysDialog" format="PNG"/>
1095 </figure>
1096 -->
1097 <itemizedlist>
1098 <listitem><para>
1099 <command>Export to file:</command> frame chooses the file to export
1100 the packet data to.
1101 </para></listitem>
1102 <listitem><para>
1103 The <command>Packet Range</command> frame is described in <xref
1104 linkend="ChIOPacketRangeSection"/>.
1105 </para></listitem>
1106 </itemizedlist>
1107 </para>
1108 </section>
1109 <section id="ChIOExportPSMLDialog">
1110 <title>The "Export as PSML File" dialog box</title>
1111 <para>
1112 Export packet data into PSML. This is an XML based format including
1113 only the packet summary. The PSML file specification is available at:
1114 <ulink url="http://www.nbee.org/doku.php?id=netpdl:psml_specification"/>.
1115 <figure>
1116 <title>The "Export as PSML File" dialog box</title>
1117 <graphic entityref="WiresharkExportPSMLDialog" format="PNG"/>
1118 </figure>
1119 <itemizedlist>
1120 <listitem><para>
1121 <command>Export to file:</command> frame chooses the file to export
1122 the packet data to.
1123 </para></listitem>
1124 <listitem><para>
1125 The <command>Packet Range</command> frame is described in <xref
1126 linkend="ChIOPacketRangeSection"/>.
1127 </para></listitem>
1128 </itemizedlist>
1129 There's no such thing as a packet details frame for PSML export, as the
1130 packet format is defined by the PSML specification.
1131 </para>
1132 </section>
1133 <section id="ChIOExportPDMLDialog">
1134 <title>The "Export as PDML File" dialog box</title>
1135 <para>
1136 Export packet data into PDML. This is an XML based format including
1137 the packet details. The PDML file specification is available at:
1138 <ulink url="http://www.nbee.org/doku.php?id=netpdl:pdml_specification"/>.
1139 <note><title></title>
1140 <para>
1141 The PDML specification is not officially released and Wireshark's
1142 implementation of it is still in an early beta state, so please expect
1143 changes in future Wireshark versions.
1144 </para>
1145 </note>
1146 <figure>
1147 <title>The "Export as PDML File" dialog box</title>
1148 <graphic entityref="WiresharkExportPDMLDialog" format="PNG"/>
1149 </figure>
1150 <itemizedlist>
1151 <listitem><para>
1152 <command>Export to file:</command> frame chooses the file to export
1153 the packet data to.
1154 </para></listitem>
1155 <listitem><para>
1156 The <command>Packet Range</command> frame is described in <xref
1157 linkend="ChIOPacketRangeSection"/>.
1158 </para></listitem>
1159 </itemizedlist>
1160 There's no such thing as a packet details frame for PDML export, as the
1161 packet format is defined by the PDML specification.
1162 </para>
1163 </section>
1164 <section id="ChIOExportSelectedDialog">
1165 <title>The "Export selected packet bytes" dialog box</title>
1166 <para>
1167 Export the bytes selected in the "Packet Bytes" pane into a raw
1168 binary file.
1169 <figure>
1170 <title>The "Export Selected Packet Bytes" dialog box</title>
1171 <graphic entityref="WiresharkExportSelectedDialog" format="PNG"/>
1172 </figure>
1173 <itemizedlist>
1174 <listitem><para>
1175 <command>Name:</command> the filename to export the packet data to.
1176 </para></listitem>
1177 <listitem><para>
1178 The <command>Save in folder:</command> field lets you select the
1179 folder to save to (from some predefined folders).
1180 </para></listitem>
1181 <listitem><para>
1182 <command>Browse for other folders</command> provides a flexible
1183 way to choose a folder.
1184 </para></listitem>
1185 </itemizedlist>
1186 </para>
1187 </section>
1188 <section id="ChIOExportObjectsDialog">
1189 <title>The "Export Objects" dialog box</title>
1190 <para>
1191 This feature scans through HTTP streams in the currently
1192 open capture file or running capture and takes reassembled
1193 objects such as HTML documents, image files, executables
1194 and anything else that can be transferred over HTTP and
1195 lets you save them to disk. If you have a capture
1196 running, this list is automatically updated every few
1197 seconds with any new objects seen. The saved objects can then be
1198 opened with the proper viewer or executed in the case of
1199 executables (if it is for the same platform you are
1200 running Wireshark on) without any further work on your
1201 part. This feature is not available when using GTK2 versions
1202 below 2.4.
1203 </para>
1204 <figure>
1205 <title>The "Export Objects" dialog box</title>
1206 <graphic entityref="WiresharkExportObjectsDialog" format="PNG"/>
1207 </figure>
1209 <itemizedlist>
1210 <para>Columns:</para>
1211 <listitem><para>
1212 <command>Packet num:</command> The packet number in
1213 which this object was found. In some cases, there can
1214 be multiple objects in the same packet.
1215 </para></listitem>
1217 <listitem><para>
1218 <command>Hostname:</command> The hostname of the
1219 server that sent the object as a response to an HTTP request.
1220 </para></listitem>
1222 <listitem><para>
1223 <command>Content Type:</command> The HTTP content type
1224 of this object.
1225 </para></listitem>
1227 <listitem><para>
1228 <command>Bytes:</command> The size of this object in bytes.
1229 </para></listitem>
1231 <listitem><para>
1232 <command>Filename:</command> The final part of the URI
1233 (after the last slash). This is typically a filename,
1234 but may be a long complex looking string, which
1235 typically indicates that the file was received in response to
1236 a HTTP POST request.
1237 </para></listitem>
1238 </itemizedlist>
1240 <itemizedlist>
1241 <para>Buttons:</para>
1242 <listitem><para>
1243 <command>Help:</command> Opens this section in the
1244 user's guide.
1245 </para></listitem>
1247 <listitem><para>
1248 <command>Close:</command> Closes this dialog.
1249 </para></listitem>
1251 <listitem><para>
1252 <command>Save As:</command> Saves the currently
1253 selected object as a filename you specify. The
1254 default filename to save as is taken from the filename
1255 column of the objects list.
1256 </para></listitem>
1258 <listitem><para>
1259 <command>Save All:</command> Saves all objects in the
1260 list using the filename from the filename column. You
1261 will be asked what directory / folder to save them
1262 in. If the filename is invalid for the operating system /
1263 file system you are running Wireshark on, then an error
1264 will appear and that object will not be saved (but all
1265 of the others will be).
1266 </para></listitem>
1267 </itemizedlist>
1268 </section>
1269 </section>
1271 <section id="ChIOPrintSection"><title>Printing packets</title>
1272 <para>
1273 To print packets, select the "Print..." menu item from the File menu.
1274 When you do this, Wireshark pops up the Print dialog box as shown in
1275 <xref linkend="ChIOPrintDialogBox"/>.
1276 </para>
1277 <section><title>The "Print" dialog box</title>
1278 <figure id="ChIOPrintDialogBox">
1279 <title>The "Print" dialog box</title>
1280 <graphic entityref="WiresharkPrint" format="PNG"/>
1281 </figure>
1282 <para>
1283 The following fields are available in the Print dialog box:
1284 <variablelist>
1285 <varlistentry><term><command>Printer</command></term>
1286 <listitem>
1287 <para>
1288 This field contains a pair of mutually exclusive radio buttons:
1289 <itemizedlist>
1290 <listitem>
1291 <para>
1292 <command>Plain Text</command> specifies that
1293 the packet print should be in plain text.
1294 </para>
1295 </listitem>
1296 <listitem>
1297 <para>
1298 <command>PostScript</command> specifies that
1299 the packet print process should use PostScript to
1300 generate a better print output on PostScript aware printers.
1301 </para>
1302 </listitem>
1303 <listitem>
1304 <para>
1305 <command>Output to file:</command> specifies that printing
1306 be done to a file, using the filename entered in the field or selected
1307 with the browse button.
1308 </para>
1309 <para>
1310 This field is where you enter the <command>file</command> to
1311 print to if you have selected Print to a file, or you can click the
1312 button to browse the filesystem. It is greyed out if Print to a file
1313 is not selected.
1314 </para>
1315 </listitem>
1316 <listitem>
1317 <para>
1318 <command>Print command</command> specifies that a
1319 command be used for printing.
1320 </para>
1321 <note><title>Note!</title>
1322 <para>
1323 These <command>Print command</command> fields are not available on
1324 windows platforms.
1325 </para>
1326 </note>
1327 <para>
1328 This field specifies the command to use for printing. It
1329 is typically <command>lpr</command>. You would change it
1330 to specify a particular queue if you need to print to a
1331 queue other than the default. An example might be:
1332 <programlisting>
1333 lpr -Pmypostscript
1334 </programlisting>
1335 This field is greyed out if <command>Output to file:</command> is
1336 checked above.
1337 </para>
1338 </listitem>
1339 </itemizedlist>
1340 </para>
1341 </listitem>
1342 </varlistentry>
1343 <varlistentry>
1344 <term><command>Packet Range</command></term>
1345 <listitem>
1346 <para>
1347 Select the packets to be printed, see <xref
1348 linkend="ChIOPacketRangeSection"/>
1349 </para>
1350 </listitem>
1351 </varlistentry>
1352 <varlistentry>
1353 <term><command>Packet Format</command></term>
1354 <listitem>
1355 <para>
1356 Select the output format of the packets to be printed. You can
1357 choose, how each packet is printed, see
1358 <xref linkend="ChIOPacketFormatFrame"/>
1359 </para>
1360 </listitem>
1361 </varlistentry>
1362 </variablelist>
1363 </para>
1364 </section>
1365 </section>
1367 <section id="ChIOPacketRangeSection"><title>The Packet Range frame</title>
1368 <para>
1369 The packet range frame is a part of various output related dialog boxes.
1370 It provides options to select which packets should be processed by the
1371 output function.
1372 <figure id="ChIOPacketRangeFrame">
1373 <title>The "Packet Range" frame</title>
1374 <graphic entityref="WiresharkPacketRangeFrame" format="PNG"/>
1375 </figure>
1376 </para>
1377 <para>
1378 If the <command>Captured</command> button is set (default), all packets
1379 from the selected rule will be processed. If the <command>Displayed
1380 </command> button is set, only the currently displayed packets are taken
1381 into account to the selected rule.
1382 </para>
1383 <para>
1384 <itemizedlist>
1385 <listitem>
1386 <para>
1387 <command>All packets</command> will process all packets.
1388 </para>
1389 </listitem>
1390 <listitem>
1391 <para>
1392 <command>Selected packet only</command> process only the selected
1393 packet.
1394 </para>
1395 </listitem>
1396 <listitem>
1397 <para>
1398 <command>Marked packets only</command> process only the marked
1399 packets.
1400 </para>
1401 </listitem>
1402 <listitem>
1403 <para>
1404 <command>From first to last marked packet</command> process the
1405 packets from the first to the last marked one.
1406 </para>
1407 </listitem>
1408 <listitem>
1409 <para>
1410 <command>Specify a packet range</command> process a user specified
1411 range of packets, e.g. specifying <command>5,10-15,20-</command> will
1412 process the packet number five, the packets from packet number ten
1413 to fifteen (inclusive) and every packet from number twenty to the
1414 end of the capture.
1415 </para>
1416 </listitem>
1417 </itemizedlist>
1418 </para>
1419 </section>
1421 <section id="ChIOPacketFormatSection"><title>The Packet Format frame</title>
1422 <para>
1423 The packet format frame is a part of various output related dialog boxes.
1424 It provides options to select which parts of a packet should be used for
1425 the output function.
1426 <figure id="ChIOPacketFormatFrame">
1427 <title>The "Packet Format" frame</title>
1428 <graphic entityref="WiresharkPacketFormatFrame" format="PNG"/>
1429 </figure>
1430 <itemizedlist>
1431 <listitem>
1432 <para>
1433 <command>Packet summary line</command> enable the output of the
1434 summary line, just as in the "Packet List" pane.
1435 </para>
1436 </listitem>
1437 <listitem>
1438 <para>
1439 <command>Packet details</command> enable the output of the packet
1440 details tree.
1441 </para>
1442 <itemizedlist>
1443 <listitem>
1444 <para>
1445 <command>All collapsed</command> the info from the "Packet Details"
1446 pane in "all collapsed" state.
1447 </para>
1448 </listitem>
1449 <listitem>
1450 <para>
1451 <command>As displayed</command> the info from the "Packet Details"
1452 pane in the current state.
1453 </para>
1454 </listitem>
1455 <listitem>
1456 <para>
1457 <command>All expanded</command> the info from the "Packet Details"
1458 pane in "all expanded" state.
1459 </para>
1460 </listitem>
1461 </itemizedlist>
1462 </listitem>
1463 <listitem>
1464 <para>
1465 <command>Packet bytes</command> enable the output of the packet
1466 bytes, just as in the "Packet Bytes" pane.
1467 </para>
1468 </listitem>
1469 <listitem>
1470 <para>
1471 <command>Each packet on a new page</command> put each packet on a
1472 separate page (e.g. when saving/printing to a text file, this will
1473 put a form feed character between the packets).
1474 </para>
1475 </listitem>
1476 </itemizedlist>
1477 </para>
1478 </section>
1480 </chapter>
1481 <!-- End of WSUG Chapter IO -->