Wireshark

https://www.wireshark.org/docs/
Admin
Wireshark is a free, open-source network packet analyzer that captures and inspects packet data to...
Tokens:933,189
Snippets:6,560
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Install plugin from plugins/foo directory

Source: https://www.wireshark.org/docs/wsdg_html_chunked/_development_and_plugins_on_unix.html

Run this command in the plugins/foo directory to rebuild and install your plugin after the initial setup.

```bash
make install
```

--------------------------------

### Install Qt using AQt CLI installer

Source: https://www.wireshark.org/docs/wsdg_html_chunked/ChSetupWindows.html

Downloads and runs the AQt installer to install Qt 6.10.3 with MSVC 2022 64-bit and debug info plus Qt Multimedia. Requires curl.exe and an internet connection. The installation folder is set to C:\Development\Qt.

```powershell
mkdir C:\Development\Qt
cd C:\Development\Qt
curl.exe -LOJ https://github.com/miurahr/aqtinstall/releases/download/v3.3.0/aqt_x64.exe
.\aqt_x64.exe install-qt windows desktop 6.10.3 win64_msvc2022_64 -m debug_info qtmultimedia
```

--------------------------------

### Install Qt 6.10.3 with AQt CLI

Source: https://www.wireshark.org/docs/wsdg_html_chunked/ChSetupUNIX.html

Command to install Qt 6.10.3 and the recommended modules (qtmultimedia and debug_info) using the unofficial AQt installer. This is an alternative to the Qt Online Installer.

```bash
aqt install-qt mac desktop 6.10.3 clang_64 --modules qtmultimedia debug_info
```

--------------------------------

### Install Wireshark

Source: https://www.wireshark.org/docs/wsdg_html_chunked/ChSetupUNIX.html

Install Wireshark to its final destination using 'make install'.

```bash
make install

```

--------------------------------

### Build the User's and Developer's Guide

Source: https://www.wireshark.org/docs/wsdg_html_chunked/ChSetupWindows.html

Builds the Wireshark documentation by building the all_guides target.

```cmd
cd C:\Development\wsbuild64
msbuild doc\all_guides.vcxproj
```

--------------------------------

### Include Example

Source: https://www.wireshark.org/docs/wsug_html_chunked/Config.html

Includes the file 'rtsp.mate' into the current configuration.

```mate
Action=Include; Filename=rtsp.mate;
```

--------------------------------

### services file example

Source: https://www.wireshark.org/docs/man-pages/rawshark.html

Example lines from a services file. Each line contains a service name and a transport identifier (port/protocol) separated by whitespace. Comments start with #.

```text
mydns 5045/udp # My own Domain Name Server
mydns 5045/tcp # My own Domain Name Server
```

--------------------------------

### ciscodump capture example

Source: https://www.wireshark.org/docs/man-pages/ciscodump.html

Example command to start a remote capture on a Cisco device. Requires SSH access and credentials with configuration privileges. The --remote-count option is mandatory.

```text
**ciscodump** **--extcap-interface** =ciscodump **--fifo** =<path to file or pipe> **--capture** **--remote-host** =remotedevice **--remote-port** =22 **--remote-username** =user **--remote-interface** =<the device interface> **--remote-count** =<count>
```

--------------------------------

### Example 5: Timestamp arguments

Source: https://www.wireshark.org/docs/man-pages/extcap.html

Defines two timestamp arguments for start and end times.

```text
arg {number=0}{call=--start}{display=Start Time}{type=timestamp}
arg {number=1}{call=--end}{display=End Time}{type=timestamp}
```

--------------------------------

### Install Visual Studio 2026 Community via Chocolatey

Source: https://www.wireshark.org/docs/wsdg_html_chunked/ChToolsMSChain.html

Use Chocolatey to install Visual Studio 2026 Community with the native desktop workload. This is the recommended way to get the toolchain for Wireshark development.

```powershell
PS:\> choco install visualstudiocommunity2026 visualstudio2026-workload-nativedesktop
```

--------------------------------

### wifidump --extcap-interface=wifidump --extcap-config example output

Source: https://www.wireshark.org/docs/man-pages/wifidump.html

Example output listing all configuration arguments, including remote host, port, username, password, SSH key, remote interface, channel, filter, count, and logging options.

```text
arg {number=0}{call=--remote-host}{display=Remote SSH server address}{type=string}
    {tooltip=The remote SSH host. It can be both an IP address or a hostname}{required=true}{group=Server}
arg {number=1}{call=--remote-port}{display=Remote SSH server port}{type=unsigned}
    {tooltip=The remote SSH host port (1-65535)}{range=1,65535}{group=Server}
arg {number=2}{call=--remote-username}{display=Remote SSH server username}{type=string}
    {tooltip=The remote SSH username. If not provided, the current user will be used}{group=Authentication}
arg {number=3}{call=--remote-password}{display=Remote SSH server password}{type=password}
    {tooltip=The SSH password, used when other methods (SSH agent or key files) are unavailable.}{group=Authentication}
arg {number=4}{call=--sshkey}{display=Path to SSH private key}{type=fileselect}
    {tooltip=The path on the local filesystem of the private ssh key}{mustexist=true}{group=Authentication}
arg {number=5}{call=--sshkey-passphrase}{display=SSH key passphrase}{type=password}
    {tooltip=Passphrase to unlock the SSH private key}{group=Authentication}
arg {number=6}{call=--remote-interface}{display=Remote interface}{type=string}
    {tooltip=The remote network interface used to capture}{default=auto}{group=Capture}
arg {number=7}{call=--remote-channel-frequency}{display=Remote channel}{type=selector}
    {tooltip=The remote channel used to capture}{group=Capture}
arg {number=8}{call=--remote-channel-width}{display=Remote channel width}{type=selector}
    {tooltip=The remote channel width used to capture}{group=Capture}
arg {number=9}{call=--remote-filter}{display=Remote capture filter}{type=string}
    {tooltip=The remote capture filter}{group=Capture}
arg {number=10}{call=--remote-count}{display=Packets to capture}{type=unsigned}
    {tooltip=The number of remote packets to capture.}{group=Capture}
arg {number=11}{call=--log-level}{display=Set the log level}{type=selector}
    {tooltip=Set the log level}{required=false}{group=Debug}
arg {number=12}{call=--log-file}{display=Use a file for logging}{type=fileselect}
    {tooltip=Set a file where log messages are written}{required=false}{group=Debug}
```

--------------------------------

### wifidump --extcap-interface=wifidump --extcap-dlts example output

Source: https://www.wireshark.org/docs/man-pages/wifidump.html

Example output showing the supported DLT.

```text
dlt {number=147}{name=wifidump}{display=Remote capture dependent DLT}
```

--------------------------------

### Sample hexdump recognized by text2pcap

Source: https://www.wireshark.org/docs/wsug_html_chunked/AppToolstext2pcap.html

Example of an ASCII hexdump that text2pcap can parse. Each line starts with a hex offset, followed by bytes, and optional trailing text is ignored. Offsets must be correct and an offset of zero starts a new packet.

```text
000000 00 e0 1e a7 05 6f 00 10 ........
000008 5a a0 b9 12 08 00 46 00 ........
000010 03 68 00 00 00 00 0a 2e ........
000018 ee 33 0f 19 08 7f 0f 19 ........
000020 03 80 94 04 00 00 10 01 ........
000028 16 a2 0a 00 03 50 00 0c ........
000030 01 01 0f 19 03 80 11 01 ........
```

--------------------------------

### Check bash version

Source: https://www.wireshark.org/docs/wsdg_html

Checks the installed bash version. The output should be similar to the example shown, but the version string will likely vary.

```bash
$ bash --version
```

--------------------------------

### Example bash --version output

Source: https://www.wireshark.org/docs/wsdg_html

Example output from running 'bash --version'. The version string will likely vary.

```text
GNU bash, version 4.4.12(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2016 Free Software Foundation, Inc.
```

--------------------------------

### treeitem:children() with field extractors example

Source: https://www.wireshark.org/docs/wsdg_html_chunked/lua_module_Tree.html

Shows proper setup of field extractors before using children() with filters, ensuring fields exist in the tree.

```lua
    -- Define field extractors first
    local tcp_flags_extractor = Field.new("tcp.flags")
    local tcp_port_extractor = Field.new("tcp.port")

    -- Then use tree navigation (extractors ensure fields exist in tree)
    for child in tree:children("tcp.flags") do
        local field_info = child:get_field_info()
        print("TCP Flags:", field_info.value)
    end
```

--------------------------------

### Example interface configuration options

Source: https://www.wireshark.org/docs/wsdg_html_chunked/ChCaptureExtcap.html

Example output of the --extcap-config command, showing various argument types (integer, string, boolflag, selector) and value entries for a selector.

```bash
$ extcap_example.py --extcap-interface <iface> --extcap-config
arg {number=0}{call=--delay}{display=Time delay}{tooltip=Time delay between packages}{type=integer}{range=1,15}{required=true}
arg {number=1}{call=--message}{display=Message}{tooltip=Package message content}{placeholder=Please enter a message here ...}{type=string}
arg {number=2}{call=--verify}{display=Verify}{tooltip=Verify package content}{type=boolflag}
arg {number=3}{call=--remote}{display=Remote Channel}{tooltip=Remote Channel Selector}{type=selector}
arg {number=4}{call=--server}{display=IP address for log server}{type=string}{validation=\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b}
value {arg=3}{value=if1}{display=Remote1}{default=true}
value {arg=3}{value=if2}{display=Remote2}{default=false}
```

--------------------------------

### MATE GOP with bogus Stop to group multiple Start PDUs

Source: https://www.wireshark.org/docs/wsug_html_chunked/_mate_frame_analysis.html

Defines a GOP (frame_ses) that groups all PDUs matching the key by using a bogus Stop condition. Without a Stop, the GOP stops immediately, but PDUs still get assigned unless they match Start.

```mate
Gop frame_ses On frame_pdu Match (frame_time) {
    Start (frame_time);
    Stop (frame_time="FOO");
};
```

--------------------------------

### wifidump --extcap-interfaces example output

Source: https://www.wireshark.org/docs/man-pages/wifidump.html

Example output showing the supported interface.

```text
interface {value=wifidump}{display=Wi-Fi remote capture}
```

--------------------------------

### Bourne shell root user commands

Source: https://www.wireshark.org/docs/wsdg_html_chunked/PrefaceTypographicConventions.html

Example of commands run as the root user in a Bourne shell. The prompt is '#'. Includes a comment and a ninja install command.

```shell
# # This is a comment
# ninja install
```

--------------------------------

### Install WSL2 and Debian

Source: https://www.wireshark.org/docs/wsdg_html_chunked/ChSetupWindows.html

Install WSL2 and the Debian distribution from the command line. Run as administrator.

```bash
wsl --install
wsl --install -d Debian
```

--------------------------------

### Determine capture file start and end times with capinfos

Source: https://www.wireshark.org/docs/man-pages/mergecap.html

Use capinfos with the -aeS flags to display the start and end times of capture files as seconds since January 1, 1970, 00:00:00 UTC. This is the first step in the merge example to calculate the time adjustment needed.

```shell
capinfos -aeS a.pcap b.pcap
```

--------------------------------

### Settings Example

Source: https://www.wireshark.org/docs/wsug_html_chunked/Config.html

Example of MATE Settings configuration with SessionExpiration and DiscardPduData parameters.

```mate
Action=Settings; SessionExpiration=3.5; DiscardPduData=FALSE;
```

--------------------------------

### Count field occurrences with count()

Source: https://www.wireshark.org/docs/wsug_html

Use count() to get the number of occurrences of a field in a frame. The example finds packets with more than two IP addresses, which can happen with ICMP errors or tunneling.

```wireshark-filter
count(ip.addr) > 2
```
Tokens:
Raw