aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGerald Combs <gerald@wireshark.org>2018-02-25 17:50:01 -0800
committerGerald Combs <gerald@wireshark.org>2018-02-26 02:05:17 +0000
commitc1e5e6c92d7a2af922bbfd7e5b474baf122cf9d5 (patch)
treec9c4b4df952ecd59dbaf1fdf9db9a54c836a865a
parent1585aa950ccfb3a564aa263de5f01c4ab01cc5f1 (diff)
WSUG: Fixup some quotes and apostrophes.
Switch from AsciiDoc's smart quotes markup to the quotes themselves, along with apostrophes. Change-Id: I78930d6902e2691b6a2cb35ed5bae6fef4bb7257 Reviewed-on: https://code.wireshark.org/review/26108 Reviewed-by: Gerald Combs <gerald@wireshark.org>
-rw-r--r--docbook/wsug_src/WSUG_app_files.asciidoc46
-rw-r--r--docbook/wsug_src/WSUG_app_howitworks.asciidoc4
-rw-r--r--docbook/wsug_src/WSUG_app_messages.asciidoc8
-rw-r--r--docbook/wsug_src/WSUG_app_protocols.asciidoc2
-rw-r--r--docbook/wsug_src/WSUG_app_tools.asciidoc8
-rw-r--r--docbook/wsug_src/WSUG_chapter_advanced.asciidoc162
-rw-r--r--docbook/wsug_src/WSUG_chapter_build_install.asciidoc24
-rw-r--r--docbook/wsug_src/WSUG_chapter_capture.asciidoc130
-rw-r--r--docbook/wsug_src/WSUG_chapter_customize.asciidoc72
-rw-r--r--docbook/wsug_src/WSUG_chapter_introduction.asciidoc30
-rw-r--r--docbook/wsug_src/WSUG_chapter_io.asciidoc120
-rw-r--r--docbook/wsug_src/WSUG_chapter_statistics.asciidoc38
-rw-r--r--docbook/wsug_src/WSUG_chapter_telephony.asciidoc8
-rw-r--r--docbook/wsug_src/WSUG_chapter_troubleshoot.asciidoc10
-rw-r--r--docbook/wsug_src/WSUG_chapter_use.asciidoc90
-rw-r--r--docbook/wsug_src/WSUG_chapter_work.asciidoc128
16 files changed, 440 insertions, 440 deletions
diff --git a/docbook/wsug_src/WSUG_app_files.asciidoc b/docbook/wsug_src/WSUG_app_files.asciidoc
index 82bb01aaa3..b6a4e0fa4a 100644
--- a/docbook/wsug_src/WSUG_app_files.asciidoc
+++ b/docbook/wsug_src/WSUG_app_files.asciidoc
@@ -22,8 +22,8 @@ Wireshark also supports the
link:https://wiki.wireshark.org/Development/LibpcapFileFormat[libpcap] file
format. This is a much simpler format and is well established. However, it has
some drawbacks: it’s not extensible and lacks some information that would be
-really helpful (e.g. being able to add a comment to a packet such as ``the
-problems start here'' would be really nice).
+really helpful (e.g. being able to add a comment to a packet such as “the
+problems start here” would be really nice).
In addition to the libpcap format, Wireshark supports several different capture
file formats. However, the problems described above also applies for these
@@ -42,7 +42,7 @@ The following data is saved for each packet:
* The timestamp with millisecond resolution
-* The packet length as it was ``on the wire''
+* The packet length as it was “on the wire”
* The packet length as it’s saved in the file
@@ -63,14 +63,14 @@ You should also know the things that are _not saved_ in capture files:
+
--
Pcapng files can optionally save name resolution information. Libpcap files
-can't. Other file formats have varying levels of support.
+can’t. Other file formats have varying levels of support.
--
* The number of packets dropped while capturing
-* Packet marks set with ``Edit/Mark Packet''
+* Packet marks set with “Edit/Mark Packet”
-* Time references set with ``Edit/Time Reference''
+* Time references set with “Edit/Time Reference”
* The current display filter
@@ -117,7 +117,7 @@ _/Applications/Wireshark.app_. Otherwise, _INSTALLDIR_ is the top-level
directory under which reside the subdirectories in which components of
Wireshark are installed. This will typically be `/usr` if Wireshark is
bundled with the system (for example, provided as a package with a Linux
-distribution) and _/usr/local_ if, for example, you've build Wireshark
+distribution) and _/usr/local_ if, for example, you’ve build Wireshark
from source and installed it.
[[ChAppFilesConfigurationSection]]
@@ -220,11 +220,11 @@ consists of one or more lines, where each line has the following format:
----
At program start, if there is a _cfilters_ file in the personal
-configuration folder, it is read. If there isn't a _cfilters_ file in
+configuration folder, it is read. If there isn’t a _cfilters_ file in
the personal configuration folder, then, if there is a _cfilters_ file
in the global configuration folder, it is read.
-When you press the Save button in the ``Capture Filters'' dialog box,
+When you press the Save button in the “Capture Filters” dialog box,
all the current capture filters are written to the personal capture
filters file.
--
@@ -239,11 +239,11 @@ consists of one or more lines, where each line has the following format:
----
At program start, if there is a _dfilters_ file in the personal
-configuration folder, it is read. If there isn't a _dfilters_ file in
+configuration folder, it is read. If there isn’t a _dfilters_ file in
the personal configuration folder, then, if there is a _dfilters_ file
in the global configuration folder, it is read.
-When you press the Save button in the ``Display Filters'' dialog box,
+When you press the Save button in the “Display Filters” dialog box,
all the current capture filters are written to the personal display
filters file.
--
@@ -258,11 +258,11 @@ consists of one or more lines, where each line has the following format:
----
At program start, if there is a _colorfilters_ file in the personal
-configuration folder, it is read. If there isn't a _colorfilters_ file
+configuration folder, it is read. If there isn’t a _colorfilters_ file
in the personal configuration folder, then, if there is a _colorfilters_
file in the global configuration folder, it is read.
-Wwhen you press the Save button in the ``Coloring Rules'' dialog box,
+Wwhen you press the Save button in the “Coloring Rules” dialog box,
all the current color filters are written to the personal color filters
file.
--
@@ -284,7 +284,7 @@ read; if there is an entry for a protocol set in both files, the setting
in the personal disabled protocols file overrides the setting in the
global disabled protocols file.
-When you press the Save button in the ``Enabled Protocols'' dialog box,
+When you press the Save button in the “Enabled Protocols” dialog box,
the current set of disabled protocols is written to the personal
disabled protocols file.
--
@@ -400,7 +400,7 @@ An example is:
A partially matched name will be printed as “subnet-name.remaining-address”.
For example, “192.168.0.1” under the subnet above would be printed as
-``ws_test_network.1"; if the mask length above had been 16 rather than 24, the
+“ws_test_network.1”; if the mask length above had been 16 rather than 24, the
printed address would be “ws_test_network.0.1”.
The settings from these files are read in at program start and never
@@ -495,21 +495,21 @@ _INSTALLDIR/lib/wireshark/plugins_.
Here you will find some details about the folders used in Wireshark on different
Windows versions.
-As already mentioned, you can find the currently used folders in the ``About
-Wireshark'' dialog.
+As already mentioned, you can find the currently used folders in the “About
+Wireshark” dialog.
[[ChWindowsProfiles]]
==== Windows profiles
Windows uses some special directories to store user configuration files which
-define the ``user profile''. This can be confusing, as the default directory
+define the “user profile”. This can be confusing, as the default directory
location changed from Windows version to version and might also be different for
English and internationalized versions of Windows.
[NOTE]
====
-If you've upgraded to a new Windows version, your profile might be kept in the
+If you’ve upgraded to a new Windows version, your profile might be kept in the
former location. The defaults mentioned here might not apply.
====
@@ -520,8 +520,8 @@ Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Vista, and associated ser
_C:\Users{backslash}**username**\AppData\Roaming\Wireshark_.
Windows XP, Windows Server 2003, and Windows 2000 footnoteref:[historical,No longer supported by Wireshark. For historical reference only.]::
-_C:\Documents and Settings{backslash}**username**\Application Data_. ``Documents and
-Settings'' and ``Application Data'' might be internationalized.
+_C:\Documents and Settings{backslash}**username**\Application Data_. “Documents and
+Settings” and “Application Data” might be internationalized.
Windows NT 4 footnoteref:[historical]::
_C:\WINNT\Profiles{backslash}**username**\Application Data\Wireshark_
@@ -540,11 +540,11 @@ _C:\windows\Application Data\Wireshark_.
==== Windows roaming profiles
Some larger Windows environments use roaming profiles. If this is the case the
-configurations of all programs you use won't be saved on your local hard drive.
+configurations of all programs you use won’t be saved on your local hard drive.
They will be stored on the domain server instead.
Your settings will travel with you from computer to computer with one exception.
-The ``Local Settings'' folder in your profile data (typically something like:
+The “Local Settings” folder in your profile data (typically something like:
_C:\Documents and Settings{backslash}**username**\Local Settings_) will not be
transferred to the domain server. This is the default for temporary capture
files.
diff --git a/docbook/wsug_src/WSUG_app_howitworks.asciidoc b/docbook/wsug_src/WSUG_app_howitworks.asciidoc
index 6a92027362..cb52ec4f90 100644
--- a/docbook/wsug_src/WSUG_app_howitworks.asciidoc
+++ b/docbook/wsug_src/WSUG_app_howitworks.asciidoc
@@ -38,7 +38,7 @@ When Wireshark starts, a lot of things are done:
Each protocol has its own protocol dissector. A dissector is called from
Wireshark, if the packet data seems to be of that corresponding protocol. The
dissector will then process the packet data and call back Wireshark if it
-couldn't dissect all the data in that packet to do any further dissections.
+couldn’t dissect all the data in that packet to do any further dissections.
So Wireshark will dissect a packet from the lowest to the highest protocol
layers.
@@ -61,7 +61,7 @@ There are two ways for a dissector to register itself for packet data:
contains some characteristic data of that protocol. So the dissector can
accept or reject to dissect that packet.
-Let’s look at an example. We'll assume, Wireshark loads a TCP/IP/Ethernet
+Let’s look at an example. We’ll assume, Wireshark loads a TCP/IP/Ethernet
packet. Wireshark will call the Ethernet dissector, which will dissect the
Ethernet related data (usually the first 6 + 6 + 2 bytes). Then this dissector calls
back into Wireshark and will pass the rest of the data back to Wireshark.
diff --git a/docbook/wsug_src/WSUG_app_messages.asciidoc b/docbook/wsug_src/WSUG_app_messages.asciidoc
index 693523a620..045295a58e 100644
--- a/docbook/wsug_src/WSUG_app_messages.asciidoc
+++ b/docbook/wsug_src/WSUG_app_messages.asciidoc
@@ -17,7 +17,7 @@ These messages might appear in the packet list.
==== [Malformed Packet]
-Malformed packet means that the protocol dissector can't dissect the contents of
+Malformed packet means that the protocol dissector can’t dissect the contents of
the packet any further. There can be various reasons:
* __Wrong dissector__: Wireshark erroneously has chosen the wrong protocol
@@ -35,7 +35,7 @@ the packet any further. There can be various reasons:
* __Dissector is buggy__: The corresponding protocol dissector is simply buggy
or still incomplete.
-Any of the above is possible. You'll have to look into the specific situation to
+Any of the above is possible. You’ll have to look into the specific situation to
determine the reason. You could disable the dissector by disabling the protocol
on the Analyze menu and check how Wireshark displays the packet then. You could
(if it’s TCP) enable reassembly for TCP and the specific dissector (if possible)
@@ -46,7 +46,7 @@ wrong.
==== [Packet size limited during capture]
-The packet size was limited during capture, see ``Limit each packet to n bytes''
+The packet size was limited during capture, see “Limit each packet to n bytes”
at the <<ChCapCaptureOptions>>. While dissecting, the current protocol dissector
was simply running out of packet bytes and had to give up. There’s nothing else
you can do now, except to repeat the whole capture process again with a higher
@@ -66,7 +66,7 @@ this message.
==== [Request in frame: 123]
-Same as ``Response in frame: 123'' above, but the other way round.
+Same as “Response in frame: 123” above, but the other way round.
==== [Time from request: 0.123 seconds]
diff --git a/docbook/wsug_src/WSUG_app_protocols.asciidoc b/docbook/wsug_src/WSUG_app_protocols.asciidoc
index 675edbfd36..2535e84a4d 100644
--- a/docbook/wsug_src/WSUG_app_protocols.asciidoc
+++ b/docbook/wsug_src/WSUG_app_protocols.asciidoc
@@ -9,7 +9,7 @@ Wireshark distinguishes between protocols (e.g. tcp) and protocol fields (e.g.
tcp.port).
A comprehensive list of all protocols and protocol fields can be found
-in the ``Display Filter Reference'' at
+in the “Display Filter Reference” at
{wireshark-display-filter-reference-url}
// End of WSUG Appendix Protocols
diff --git a/docbook/wsug_src/WSUG_app_tools.asciidoc b/docbook/wsug_src/WSUG_app_tools.asciidoc
index c8bed2071f..1597caed78 100644
--- a/docbook/wsug_src/WSUG_app_tools.asciidoc
+++ b/docbook/wsug_src/WSUG_app_tools.asciidoc
@@ -20,7 +20,7 @@ link:{wireshark-man-page-url}[the web site].
=== __tshark__: Terminal-based Wireshark
TShark is a terminal oriented version of Wireshark designed for capturing and
-displaying packets when an interactive user interface isn't necessary or
+displaying packets when an interactive user interface isn’t necessary or
available. It supports the same options as `wireshark`. For more information on
`tshark` consult your local manual page (`man tshark`) or
link:{wireshark-man-page-url}tshark.html[the online version].
@@ -36,8 +36,8 @@ include::tshark-h.txt[]
=== __tcpdump__: Capturing with “tcpdump” for viewing with Wireshark
It’s often more useful to capture packets using `tcpdump` rather than
-`wireshark`. For example, you might want to do a remote capture and either don't
-have GUI access or don't have Wireshark installed on the remote machine.
+`wireshark`. For example, you might want to do a remote capture and either don’t
+have GUI access or don’t have Wireshark installed on the remote machine.
Older versions of `tcpdump` truncate packets to 68 or 96 bytes. If this is the case,
use `-s` to capture full-sized packets:
@@ -65,7 +65,7 @@ is pcapng, which is also the format used by Wireshark.
Without any options set it will use the pcap library to capture traffic
from the first available network interface and write the received raw
-packet data, along with the packets' time stamps into a pcapng file. The
+packet data, along with the packets’ time stamps into a pcapng file. The
capture filter syntax follows the rules of the pcap library. For more
information on `dumpcap` consult your local manual page (`man dumpcap`)
or link:{wireshark-man-page-url}dumpcap.html[the online version].
diff --git a/docbook/wsug_src/WSUG_chapter_advanced.asciidoc b/docbook/wsug_src/WSUG_chapter_advanced.asciidoc
index 326507bda0..6e87f6bb42 100644
--- a/docbook/wsug_src/WSUG_chapter_advanced.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_advanced.asciidoc
@@ -29,17 +29,17 @@ TCP stream laid out in order, as shown in <<ChAdvFollowStream>>.
[TIP]
====
-Opening the ``Follow TCP Stream'' applies a display filter which selects
+Opening the “Follow TCP Stream” applies a display filter which selects
all the packets in the TCP stream you have selected. Some people open the
-``Follow TCP Stream'' dialog and immediately close it as a quick way to
+“Follow TCP Stream” dialog and immediately close it as a quick way to
isolate a particular stream.
====
-==== The ``Follow TCP Stream'' dialog box
+==== The “Follow TCP Stream” dialog box
[[ChAdvFollowStream]]
-.The ``Follow TCP Stream'' dialog box
+.The “Follow TCP Stream” dialog box
image::wsug_graphics/ws-follow-stream.png[{screenshot-attrs}]
The stream content is displayed in the same sequence as it appeared on the
@@ -51,8 +51,8 @@ Non-printable characters will be replaced by dots.
// XXX - What about line wrapping (maximum line length) and CRNL conversions?
-The stream content won't be updated while doing a live capture. To get the
-latest content you'll have to reopen the dialog.
+The stream content won’t be updated while doing a live capture. To get the
+latest content you’ll have to reopen the dialog.
You can choose from the following actions:
@@ -60,8 +60,8 @@ You can choose from the following actions:
. __Print__: Print the stream data in the currently selected format.
-. __Direction__: Choose the stream direction to be displayed (``Entire
- conversation'', ``data from A to B only'' or ``data from B to A only'').
+. __Direction__: Choose the stream direction to be displayed (“Entire
+ conversation”, “data from A to B only” or “data from B to A only”).
. __Filter out this stream__: Apply a display filter removing the current TCP
stream data from the display.
@@ -84,7 +84,7 @@ You can choose to view the data in one of the following formats:
. __Raw__: This allows you to load the unaltered stream data into a different
program for further examination. The display will look the same as the ASCII
- setting, but ``Save As'' will result in a binary file.
+ setting, but “Save As” will result in a binary file.
[[ChAdvShowPacketBytes]]
@@ -101,7 +101,7 @@ It’s also possible to select a subset of bytes setting the start byte and end
You can choose from the following actions:
. __Find__: Search for the given text. Matching text will be highlighted,
- and the ``Find Next'' will search for more. In the context menu for the
+ and the “Find Next” will search for more. In the context menu for the
find text it’s possible to configure to use regular expression find.
. __Print__: Print the bytes in the currently selected format.
@@ -152,7 +152,7 @@ You can choose to view the data in one of the following formats:
*Raw*:: This allows you to load the unaltered stream data into a different
program for further examination. The display will show HEX data, but
- ``Save As'' will result in a binary file.
+ “Save As” will result in a binary file.
*UTF8*:: In this view you see the bytes as UTF-8.
@@ -165,7 +165,7 @@ You can choose to view the data in one of the following formats:
The expert infos is a kind of log of the anomalies found by Wireshark in a
capture file.
-The general idea behind the following ``Expert Info'' is to have a better
+The general idea behind the following “Expert Info” is to have a better
display of “uncommon” or just notable network behaviour. This way, both novice
and expert users will hopefully find probable network problems a lot faster,
compared to scanning the packet list “manually” .
@@ -174,12 +174,12 @@ compared to scanning the packet list “manually” .
.Expert infos are only a hint
====
Take expert infos as a hint what’s worth looking at, but not more. For example,
-the absence of expert infos doesn't necessarily mean everything is OK.
+the absence of expert infos doesn’t necessarily mean everything is OK.
====
The amount of expert infos largely depends on the protocol being used. While
some common protocols like TCP/IP will show detailed expert infos, most other
-protocols currently won't show any expert infos at all.
+protocols currently won’t show any expert infos at all.
The following will first describe the components of a single expert info, then
the User Interface.
@@ -230,7 +230,7 @@ There are some common groups of expert infos. The following are currently implem
* __Checksum__: a checksum was invalid
-* __Sequence__: protocol sequence suspicious, e.g. sequence wasn't continuous or
+* __Sequence__: protocol sequence suspicious, e.g. sequence wasn’t continuous or
a retransmission was detected or ...
* __Response Code__: problem with application response code, e.g. HTTP 404 page
@@ -239,7 +239,7 @@ There are some common groups of expert infos. The following are currently implem
* __Request Code__: an application request (e.g. File Handle == x), usually Chat
level
-* __Undecoded__: dissector incomplete or data can't be decoded for other reasons
+* __Undecoded__: dissector incomplete or data can’t be decoded for other reasons
* __Reassemble__: problems while reassembling, e.g. not all fragments were
available or an exception happened while reassembling
@@ -268,13 +268,13 @@ Each expert info will also have a short additional text with some further explan
[[ChAdvExpertDialog]]
-==== ``Expert Info'' dialog
+==== “Expert Info” dialog
You can open the expert info dialog by selecting menu:Analyze[Expert Info].
// XXX - add explanation of the dialogs context menu.
-.The ``Expert Info'' dialog box
+.The “Expert Info” dialog box
image::wsug_graphics/ws-expert-infos.png[{screenshot-attrs}]
[[ChAdvExpertDialogTabs]]
@@ -295,7 +295,7 @@ sign shows the individual packet numbers in a tree view.
===== Details tab
-The Details tab provides the expert infos in a ``log like'' view, each entry on
+The Details tab provides the expert infos in a “log like” view, each entry on
its own line (much like the packet list). As the amount of expert infos for a
capture file can easily become very large, getting an idea of the interesting
infos with this view can take quite a while. The advantage of this tab is to
@@ -314,7 +314,7 @@ background for a note severity level. This color is propagated to the toplevel
protocol item in the tree, so it’s easy to find the field that caused the expert
info.
-For the example screenshot above, the IP ``Time to live'' value is very low
+For the example screenshot above, the IP “Time to live” value is very low
(only 1), so the corresponding protocol field is marked with a cyan background.
To easier find that item in the packet tree, the IP protocol toplevel item is
marked cyan as well.
@@ -326,7 +326,7 @@ marked cyan as well.
.The “Expert” packet list column
image::wsug_graphics/ws-expert-column.png[{screenshot-attrs}]
-An optional ``Expert Info Severity'' packet list column is available that
+An optional “Expert Info Severity” packet list column is available that
displays the most significant severity of a packet or stays empty if everything
seems OK. This column is not displayed by default but can be easily added using
the Preferences Columns page described in <<ChCustPreferencesSection>>.
@@ -340,15 +340,15 @@ session and provides additional information when problems or potential
problems are detected. Analysis is done once for each TCP packet when a
capture file is first opened. Packets are processed in the order in
which they appear in the packet list. You can enable or disable this
-feature via the ``Analyze TCP sequence numbers'' TCP dissector preference.
+feature via the “Analyze TCP sequence numbers” TCP dissector preference.
-.``TCP Analysis'' packet detail items
+.“TCP Analysis” packet detail items
image::wsug_graphics/ws-tcp-analysis.png[{screenshot-attrs}]
-TCP Analysis flags are added to the TCP protocol tree under ``SEQ/ACK
-analysis''. Each flag is described below. Terms such as ``next expected
-sequence number'' and ``next expected acknowledgement number'' refer to
-the following'':
+TCP Analysis flags are added to the TCP protocol tree under “SEQ/ACK
+analysis”. Each flag is described below. Terms such as “next expected
+sequence number” and “next expected acknowledgement number” refer to
+the following”:
// tcp_analyze_seq_info->nextseq
Next expected sequence number:: The last-seen sequence number plus
@@ -383,7 +383,7 @@ direction and it’s less than the current acknowledgement number.
Set when all of the following are true:
- The segment size is zero.
-- The window size is non-zero and hasn't changed.
+- The window size is non-zero and hasn’t changed.
- The next expected sequence number and last-seen acknowledgment number are non-zero (i.e. the connection has been established).
- SYN, FIN, and RST are not set.
@@ -400,7 +400,7 @@ Set when all of the following are true:
- The current sequence number equals the next expected acknowledgement number.
- We saw the last acknowledgement less than 20ms ago.
-Supersedes “Out-Of-Order”, ``Spurious Retransmission'', and “Retransmission”.
+Supersedes “Out-Of-Order”, “Spurious Retransmission”, and “Retransmission”.
// TCP_A_KEEP_ALIVE
[float]
@@ -410,8 +410,8 @@ Set when the segment size is zero or one, the current sequence number
is one byte less than the next expected sequence number, and any of SYN,
FIN, or RST are set.
-Supersedes ``Fast Retransmission'', “Out-Of-Order”, ``Spurious
-Retransmission'', and “Retransmission”.
+Supersedes “Fast Retransmission”, “Out-Of-Order”, “Spurious
+Retransmission”, and “Retransmission”.
// TCP_A_KEEP_ALIVE_ACK
[float]
@@ -420,13 +420,13 @@ Retransmission'', and “Retransmission”.
Set when all of the following are true:
- The segment size is zero.
-- The window size is non-zero and hasn't changed.
+- The window size is non-zero and hasn’t changed.
- The current sequence number is the same as the next expected sequence number.
- The current acknowledgement number is the same as the last-seen acknowledgement number.
- The most recently seen packet in the reverse direction was a keepalive.
- The packet is not a SYN, FIN, or RST.
-Supersedes ``Dup ACK'' and “ZeroWindowProbeAck”.
+Supersedes “Dup ACK” and “ZeroWindowProbeAck”.
// TCP_A_OUT_OF_ORDER
[float]
@@ -440,7 +440,7 @@ Set when all of the following are true:
- The next expected sequence number and the next sequence number differ.
- The last segment arrived within the calculated RTT (3ms by default).
-Supersedes ``Spurious Retransmission'' and “Retransmission”.
+Supersedes “Spurious Retransmission” and “Retransmission”.
// TCP_A_REUSED_PORTS
[float]
@@ -525,7 +525,7 @@ Set when the all of the following are true:
- The acknowledgement number is equal to the last-seen acknowledgement number.
- The last-seen packet in the reverse direction was a zero window probe.
-Supersedes ``TCP Dup ACK''.
+Supersedes “TCP Dup ACK”.
[[ChAdvTimestamps]]
@@ -549,7 +549,7 @@ Wireshark obviously gets the data from that file.
The internal format that Wireshark uses to keep a packet time stamp consists of
the date (in days since 1.1.1970) and the time of day (in nanoseconds since
midnight). You can adjust the way Wireshark displays the time stamp data in the
-packet list, see the ``Time Display Format'' item in the
+packet list, see the “Time Display Format” item in the
<<ChUseViewMenuSection>> for details.
While reading or writing capture files, Wireshark converts the time stamp data
@@ -571,7 +571,7 @@ some file formats are even capable of storing the time stamp precision itself
The common libpcap capture file format that is used by Wireshark (and a lot of
other tools) supports a fixed microsecond resolution “0.123456” only.
-Writing data into a capture file format that doesn't provide the capability to
+Writing data into a capture file format that doesn’t provide the capability to
store the actual precision will lead to loss of information. For example, if you
load a capture file with nanosecond resolution and store the capture data in a
libpcap file (with microsecond resolution) Wireshark obviously must reduce the
@@ -579,21 +579,21 @@ precision from nanosecond to microsecond.
==== Accuracy
-People often ask ``Which time stamp accuracy is provided by Wireshark?''. Well,
-Wireshark doesn't create any time stamps itself but simply gets them from
-``somewhere else'' and displays them. So accuracy will depend on the capture
+People often ask “Which time stamp accuracy is provided by Wireshark?”. Well,
+Wireshark doesn’t create any time stamps itself but simply gets them from
+“somewhere else” and displays them. So accuracy will depend on the capture
system (operating system, performance, etc) that you use. Because of this, the
above question is difficult to answer in a general way.
[NOTE]
====
USB connected network adapters often provide a very bad time stamp accuracy. The
-incoming packets have to take ``a long and winding road'' to travel through the
+incoming packets have to take “a long and winding road” to travel through the
USB cable until they actually reach the kernel. As the incoming packets are time
stamped when they are processed by the kernel, this time stamping mechanism
becomes very inaccurate.
-Don't use USB connected NICs when you need precise time stamp
+Don’t use USB connected NICs when you need precise time stamp
accuracy.
====
@@ -612,10 +612,10 @@ First of all, there are two reasons why you may not need to think about time
zones at all:
* You are only interested in the time differences between the packet time stamps
- and don't need to know the exact date and time of the captured packets (which
+ and don’t need to know the exact date and time of the captured packets (which
is often the case).
-* You don't get capture files from different time zones than your own, so there
+* You don’t get capture files from different time zones than your own, so there
are simply no time zone problems. For example, everyone in your team is
working in the same time zone as yourself.
@@ -631,16 +631,16 @@ For that reason, the earth is split into several different time zones, each zone
with a local time that corresponds to the local sunset.
The time zone’s base time is UTC (Coordinated Universal Time) or Zulu Time
-(military and aviation). The older term GMT (Greenwich Mean Time) shouldn't be
+(military and aviation). The older term GMT (Greenwich Mean Time) shouldn’t be
used as it is slightly incorrect (up to 0.9 seconds difference to UTC). The UTC
base time equals to 0 (based at Greenwich, England) and all time zones have an
offset to UTC between -12 to +14 hours!
For example: If you live in Berlin you are in a time zone one hour earlier than
UTC, so you are in time zone “+1” (time difference in hours compared to UTC).
-If it’s 3 o'clock in Berlin it’s 2 o'clock in UTC ``at the same moment''.
+If it’s 3 o’clock in Berlin it’s 2 o’clock in UTC “at the same moment”.
-Be aware that at a few places on earth don't use time zones with even hour
+Be aware that at a few places on earth don’t use time zones with even hour
offsets (e.g. New Delhi uses UTC+05:30)!
Further information can be found at: {wikipedia-main-url}Time_zone and
@@ -654,8 +654,8 @@ Further information can be found at: {wikipedia-main-url}Time_zone and
Daylight Saving Time (DST), also known as Summer Time is intended to “save”
some daylight during the summer months. To do this, a lot of countries (but not
all!) add a DST hour to the already existing UTC offset. So you may need to take
-another hour (or in very rare cases even two hours!) difference into your ``time
-zone calculations''.
+another hour (or in very rare cases even two hours!) difference into your “time
+zone calculations”.
Unfortunately, the date at which DST actually takes effect is different
throughout the world. You may also note, that the northern and southern
@@ -689,7 +689,7 @@ networking gear to UTC in order to make coordination and troubleshooting easier.
[TIP]
====
If you travel around the world, it’s an often made mistake to adjust the hours
-of your computer clock to the local time. Don't adjust the hours but your time
+of your computer clock to the local time. Don’t adjust the hours but your time
zone setting instead! For your computer, the time is essentially the same as
before, you are simply in a different time zone with a different local time.
====
@@ -707,7 +707,7 @@ So what’s the relationship between Wireshark and time zones anyway?
Wireshark’s native capture file format (libpcap format), and some other capture
file formats, such as the Windows Sniffer, EtherPeek, AiroPeek, and Sun snoop
formats, save the arrival time of packets as UTC values. UN*X systems, and
-``Windows NT based'' systems represent time internally as UTC. When Wireshark is
+“Windows NT based” systems represent time internally as UTC. When Wireshark is
capturing, no conversion is necessary. However, if the system time zone is not
set correctly, the system’s UTC time might not be correctly set even if the
system clock appears to display correct local time. When capturing, WinPcap has
@@ -746,21 +746,21 @@ in which the packet was captured.
|===============
For example let’s assume that someone in Los Angeles captured a packet with
-Wireshark at exactly 2 o'clock local time and sends you this capture file. The
-capture file’s time stamp will be represented in UTC as 10 o'clock. You are
-located in Berlin and will see 11 o'clock on your Wireshark display.
+Wireshark at exactly 2 o’clock local time and sends you this capture file. The
+capture file’s time stamp will be represented in UTC as 10 o’clock. You are
+located in Berlin and will see 11 o’clock on your Wireshark display.
Now you have a phone call, video conference or Internet meeting with that one to
talk about that capture file. As you are both looking at the displayed time on
-your local computers, the one in Los Angeles still sees 2 o'clock but you in
-Berlin will see 11 o'clock. The time displays are different as both Wireshark
+your local computers, the one in Los Angeles still sees 2 o’clock but you in
+Berlin will see 11 o’clock. The time displays are different as both Wireshark
displays will show the (different) local times at the same point in time.
__Conclusion__: You may not bother about the date/time of the time stamp you
currently look at unless you must make sure that the date/time is as expected.
-So, if you get a capture file from a different time zone and/or DST, you'll have
+So, if you get a capture file from a different time zone and/or DST, you’ll have
to find out the time zone/DST difference between the two local times and
-``mentally adjust'' the time stamps accordingly. In any case, make sure that
+“mentally adjust” the time stamps accordingly. In any case, make sure that
every computer in question has the correct time and time zone setting.
[[ChAdvReassemblySection]]
@@ -773,7 +773,7 @@ every computer in question has the correct time and time zone setting.
Network protocols often need to transport large chunks of data which are
complete in themselves, e.g. when transferring a file. The underlying protocol
might not be able to handle that chunk size (e.g. limitation of the network
-packet size), or is stream-based like TCP, which doesn't know data chunks at
+packet size), or is stream-based like TCP, which doesn’t know data chunks at
all.
In that case the network protocol has to handle the chunk boundaries itself and
@@ -789,16 +789,16 @@ defragmentation, etc).
For some of the network protocols Wireshark knows of, a mechanism is implemented
to find, decode and display these chunks of data. Wireshark will try to find the
corresponding packets of this chunk, and will show the combined data as
-additional pages in the ``Packet Bytes'' pane (for information about this pane.
+additional pages in the “Packet Bytes” pane (for information about this pane.
See <<ChUsePacketBytesPaneSection>>).
[[ChAdvWiresharkBytesPaneTabs]]
-.The ``Packet Bytes'' pane with a reassembled tab
+.The “Packet Bytes” pane with a reassembled tab
image::wsug_graphics/ws-bytes-pane-tabs.png[{screenshot-attrs}]
Reassembly might take place at several protocol layers, so it’s possible that
-multiple tabs in the ``Packet Bytes'' pane appear.
+multiple tabs in the “Packet Bytes” pane appear.
[NOTE]
====
@@ -807,7 +807,7 @@ You will find the reassembled data in the last packet of the chunk.
For example, in a _HTTP_ GET response, the requested data (e.g. an HTML page) is
returned. Wireshark will show the hex dump of the data in a new tab
-``Uncompressed entity body'' in the ``Packet Bytes'' pane.
+“Uncompressed entity body” in the “Packet Bytes” pane.
Reassembly is enabled in the preferences by default but can be disabled in the
preferences for the protocol in question. Enabling or disabling reassembly
@@ -849,7 +849,7 @@ you hours of work. Unfortunately, it also has its drawbacks.
* _The resolved names are not stored in the capture file or somewhere else._ So
the resolved names might not be available if you open the capture file later
or on a different machine. Each time you open a capture file it may look
- ``slightly different'' simply because you can't connect to the name server
+ “slightly different” simply because you can’t connect to the name server
(which you could connect to before).
* _DNS may add additional packets to your capture file._ You may see packets
@@ -860,22 +860,22 @@ you hours of work. Unfortunately, it also has its drawbacks.
* _Resolved DNS names are cached by Wireshark._ This is required for acceptable
performance. However, if the name resolution information should change while
- Wireshark is running, Wireshark won't notice a change in the name resolution
+ Wireshark is running, Wireshark won’t notice a change in the name resolution
information once it gets cached. If this information changes while Wireshark
- is running, e.g. a new DHCP lease takes effect, Wireshark won't notice it.
+ is running, e.g. a new DHCP lease takes effect, Wireshark won’t notice it.
// XXX Is this true for all or only for DNS info?
Name resolution in the packet list is done while the list is filled. If a name
-can be resolved after a packet is added to the list, its former entry won't be
+can be resolved after a packet is added to the list, its former entry won’t be
changed. As the name resolution results are cached, you can use
menu:View[Reload] to rebuild the packet list with the correctly resolved names.
-However, this isn't possible while a capture is in progress.
+However, this isn’t possible while a capture is in progress.
==== Ethernet name resolution (MAC layer)
Try to resolve an Ethernet MAC address (e.g. 00:09:5b:01:02:03) to something
-more ``human readable''.
+more “human readable”.
__ARP name resolution (system service)__: Wireshark will ask the operating
system to convert an Ethernet address to the corresponding IP address (e.g.
@@ -893,8 +893,8 @@ an abbreviated manufacturer name, which has been assigned by the IEEE (e.g.
==== IP name resolution (network layer)
-Try to resolve an IP address (e.g. 216.239.37.99) to something more ``human
-readable''.
+Try to resolve an IP address (e.g. 216.239.37.99) to something more “human
+readable”.
__DNS name resolution (system/library service)__: Wireshark will use a name
resolver to convert an IP address to the hostname associated with it
@@ -915,13 +915,13 @@ server is unavailable, this might take quite a while (several seconds).
[WARNING]
====
To provide acceptable performance Wireshark depends on
-an asynchronous DNS library to do name resolution. If one isn't available
+an asynchronous DNS library to do name resolution. If one isn’t available
during compilation the feature will be unavailable.
====
The asynchronous DNS service works a bit differently. It will also ask the DNS
-server, but it won't wait for the answer. It will just return to Wireshark in a
-very short amount of time. The actual (and the following) address fields won't
+server, but it won’t wait for the answer. It will just return to Wireshark in a
+very short amount of time. The actual (and the following) address fields won’t
show the resolved name until the DNS server returns an answer. As mentioned
above, the values get cached, so you can use menu:View[Reload] to “update” these
fields to show the resolved values.
@@ -932,7 +932,7 @@ hosts file provided by the user (e.g. 216.239.37.99 -> www.google.com).
==== TCP/UDP port name resolution (transport layer)
-Try to resolve a TCP/UDP port (e.g. 80) to something more ``human readable''.
+Try to resolve a TCP/UDP port (e.g. 80) to something more “human readable”.
__TCP/UDP port conversion (system service)__: Wireshark will ask the operating
system to convert a TCP or UDP port to its well known name (e.g. 80 -> http).
@@ -941,7 +941,7 @@ system to convert a TCP or UDP port to its well known name (e.g. 80 -> http).
To get a descriptive name for a VLAN tag ID a vlans file can be used.
-// XXX - mention the role of the /etc/services file (but don't forget the files and folders section)!
+// XXX - mention the role of the /etc/services file (but don’t forget the files and folders section)!
[[ChAdvChecksums]]
@@ -965,7 +965,7 @@ Because of these transmission errors, network protocols very often use checksums
to detect such errors. The transmitter will calculate a checksum of the data and
transmits the data together with the checksum. The receiver will calculate the
checksum of the received data with the same algorithm as the transmitter. If the
-received and calculated checksums don't match a transmission error has occurred.
+received and calculated checksums don’t match a transmission error has occurred.
Some checksum algorithms are able to recover (simple) errors by calculating
where the expected error must be and repairing it.
@@ -994,7 +994,7 @@ Further information about checksums can be found at:
Wireshark will validate the checksums of many protocols, e.g. IP, TCP, UDP, etc.
-It will do the same calculation as a ``normal receiver'' would do, and shows the
+It will do the same calculation as a “normal receiver” would do, and shows the
checksum fields in the packet details with a comment, e.g. [correct] or
[invalid, must be 0x12345678].
@@ -1002,7 +1002,7 @@ Checksum validation can be switched off for various protocols in the Wireshark
protocol preferences, e.g. to (very slightly) increase performance.
If the checksum validation is enabled and it detected an invalid checksum,
-features like packet reassembly won't be processed. This is avoided as
+features like packet reassembly won’t be processed. This is avoided as
incorrect connection data could “confuse” the internal database.
==== Checksum offloading
@@ -1012,14 +1012,14 @@ even in hardware.
For example: The Ethernet transmitting hardware calculates the Ethernet CRC32
checksum and the receiving hardware validates this checksum. If the received
-checksum is wrong Wireshark won't even see the packet, as the Ethernet hardware
+checksum is wrong Wireshark won’t even see the packet, as the Ethernet hardware
internally throws away the packet.
Higher level checksums are “traditionally” calculated by the protocol
implementation and the completed packet is then handed over to the hardware.
Recent network hardware can perform advanced features such as IP checksum
-calculation, also known as checksum offloading. The network driver won't
+calculation, also known as checksum offloading. The network driver won’t
calculate the checksum itself but will simply hand over an empty (zero or
garbage filled) checksum field to the hardware.
diff --git a/docbook/wsug_src/WSUG_chapter_build_install.asciidoc b/docbook/wsug_src/WSUG_chapter_build_install.asciidoc
index 3e222e5818..951681d9b1 100644
--- a/docbook/wsug_src/WSUG_chapter_build_install.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_build_install.asciidoc
@@ -80,7 +80,7 @@ On the _Choose Components_ page of the installer you can select from the followi
* *Wireshark* - The network protocol analyzer that we all know and mostly love.
-* *TShark* - A command-line network protocol analyzer. If you haven't tried it
+* *TShark* - A command-line network protocol analyzer. If you haven’t tried it
you should.
* *Wireshark 1 Legacy* - The old (GTK+) user interface in case you need it.
@@ -141,9 +141,9 @@ Files\Wireshark` on most systems.
The Wireshark installer contains the latest WinPcap installer.
-If you don't have WinPcap installed you won't be able to capture live network
+If you don’t have WinPcap installed you won’t be able to capture live network
traffic but you will still be able to open saved capture files. By default the
-latest version of WinPcap will be installed. If you don't wish to do this or if
+latest version of WinPcap will be installed. If you don’t wish to do this or if
you wish to reinstall WinPcap you can check the _Install WinPcap_ box as needed.
For more information about WinPcap see {winpcap-main-url} and
@@ -160,11 +160,11 @@ For special cases, there are some command line parameters available:
silent installer *will not* install WinPCap.
* `/desktopicon` installation of the desktop icon, `=yes` - force installation,
- `=no` - don't install, otherwise use default settings. This option can be
+ `=no` - don’t install, otherwise use default settings. This option can be
useful for a silent installer.
* `/quicklaunchicon` installation of the quick launch icon, `=yes` - force
- installation, `=no` - don't install, otherwise use default settings.
+ installation, `=no` - don’t install, otherwise use default settings.
* `/D` sets the default installation directory ($INSTDIR), overriding InstallDir
and InstallDirRegKey. It must be the last parameter used in the command line
@@ -221,7 +221,7 @@ version.
==== Uninstall Wireshark
You can uninstall Wireshark using the _Programs and Features_ control panel.
-Select the "Wireshark" entry to start the uninstallation procedure.
+Select the “Wireshark” entry to start the uninstallation procedure.
The Wireshark uninstaller provides several options for removal. The default is
to remove the core components but keep your personal settings and WinPcap.
@@ -233,7 +233,7 @@ WinPcap is left installed by default in case other programs need it.
You can uninstall WinPcap independently of Wireshark using the _WinPcap_ entry
in the _Programs and Features_ control panel. Remember that if you uninstall
-WinPcap you won't be able to capture anything with Wireshark.
+WinPcap you won’t be able to capture anything with Wireshark.
//
// macOS
@@ -339,7 +339,7 @@ together with the Qt GUI:
yum install wireshark wireshark-qt
----
-If you've built your own RPMs from the Wireshark sources you can install them
+If you’ve built your own RPMs from the Wireshark sources you can install them
by running, for example:
----
@@ -365,13 +365,13 @@ Use the following command to install downloaded Wireshark debs under Debian:
$ dpkg -i wireshark-common_2.0.5.0-1_i386.deb wireshark_wireshark-2.0.5.0-1_i386.deb
----
-dpkg doesn't take care of all dependencies, but reports what’s missing.
+dpkg doesn’t take care of all dependencies, but reports what’s missing.
[NOTE]
.Capturing requires privileges
====
-By installing Wireshark packages non-root users won't gain rights automatically
+By installing Wireshark packages non-root users won’t gain rights automatically
to capture packets. To allow non-root users to capture packets follow the
procedure described in
file:///usr/share/doc/wireshark-common/README.Debian[/usr/share/doc/wireshark-common/README.Debian]
@@ -408,8 +408,8 @@ file `config.log` in the source directory to find out what failed. The last few
lines of this file should help in determining the problem.
The standard problems are that you do not have a required development package on
-your system or that the development package isn't new enough. Note that
-installing a library package isn't enough. You need to install its development
+your system or that the development package isn’t new enough. Note that
+installing a library package isn’t enough. You need to install its development
package as well. `configure` will also fail if you do not have libpcap (at least
the required include files) on your system.
diff --git a/docbook/wsug_src/WSUG_chapter_capture.asciidoc b/docbook/wsug_src/WSUG_chapter_capture.asciidoc
index 1ae58cf998..0ffb09cfe9 100644
--- a/docbook/wsug_src/WSUG_chapter_capture.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_capture.asciidoc
@@ -37,7 +37,7 @@ The capture engine still lacks the following features:
=== Prerequisites
Setting up Wireshark to capture packets for the first time can be
-tricky. A comprehensive guide ``How To setup a Capture'' is available at
+tricky. A comprehensive guide “How To setup a Capture” is available at
{wireshark-wiki-url}CaptureSetup.
Here are some common pitfalls:
@@ -60,8 +60,8 @@ The following methods can be used to start capturing packets with Wireshark:
* You can double-click on an interface in the main window.
-* You can get an overview of the available interfaces using the ``Capture
- Interfaces'' dialog box (menu:Capture[Options...]). See
+* You can get an overview of the available interfaces using the “Capture
+ Interfaces” dialog box (menu:Capture[Options...]). See
<<ChCapCaptureInterfacesDialogWin32>> or <<ChCapCaptureInterfacesDialog>> for
more information. You can start a capture from this dialog box using the
btn:[Start] button.
@@ -81,17 +81,17 @@ at <<ChCustCommandLine>>.
[[ChCapInterfaceSection]]
-=== The ``Capture Interfaces'' dialog box
+=== The “Capture Interfaces” dialog box
When you select menu:Capture[Options...] from the main menu Wireshark pops up
-the ``Capture Interfaces'' dialog box as shown in
+the “Capture Interfaces” dialog box as shown in
<<ChCapCaptureInterfacesDialogWin32>> or <<ChCapCaptureInterfacesDialog>>.
// XXX Not sure this is the case any more
//[WARNING]
//.This dialog consumes lots of system resources
//====
-//As the ``Capture Interfaces'' dialog is showing live captured data, it is
+//As the “Capture Interfaces” dialog is showing live captured data, it is
//consuming a lot of system resources. Close this dialog as soon as possible to
//prevent excessive system load.
//====
@@ -111,12 +111,12 @@ simultaneously.
[[ChCapCaptureInterfacesDialogWin32]]
-.The ``Capture Interfaces'' dialog box on Microsoft Windows
+.The “Capture Interfaces” dialog box on Microsoft Windows
image::wsug_graphics/ws-capture-interfaces-win32.png[{screenshot-attrs}]
[[ChCapCaptureInterfacesDialog]]
-.The ``Capture Interfaces'' dialog box on Unix/Linux
+.The “Capture Interfaces” dialog box on Unix/Linux
image::wsug_graphics/ws-capture-interfaces.png[{screenshot-attrs}]
_Device (Unix/Linux only)_::
@@ -163,14 +163,14 @@ Close this dialog box.
[[ChCapCaptureOptions]]
-=== The ``Capture Options'' dialog box
+=== The “Capture Options” dialog box
When you select menu:Capture[Options...] (or use the corresponding item in the
-main toolbar), Wireshark pops up the ``Capture Options'' dialog box as shown in
+main toolbar), Wireshark pops up the “Capture Options” dialog box as shown in
<<ChCapCaptureOptionsDialog>>.
[[ChCapCaptureOptionsDialog]]
-.The ``Capture Options'' dialog box
+.The “Capture Options” dialog box
image::wsug_graphics/ws-capture-options.png[{screenshot-attrs}]
[TIP]
@@ -207,7 +207,7 @@ Loopback interfaces are not available on Windows platforms.
* The chosen capture filter.
By marking the checkboxes in the first column the interfaces are selected to be
-captured from. By double-clicking on an interface the ``Edit Interface Settings''
+captured from. By double-clicking on an interface the “Edit Interface Settings”
dialog box as shown in <<ChCapEditInterfacesSettingsDialog>> will be opened.
_Capture on all interfaces_::
@@ -301,7 +301,7 @@ Stop capturing after the given number of packets have been captured.
_... after n megabytes(s)_::
Stop capturing after the given number of
byte(s)/kilobyte(s)/megabyte(s)/gigabyte(s) have been captured. This option is
-greyed out if ``Use multiple files'' is selected.
+greyed out if “Use multiple files” is selected.
_... after n minute(s)_::
Stop capturing after the given number of second(s)/minutes(s)/hours(s)/days(s)
@@ -320,7 +320,7 @@ This option allows you to specify that Wireshark should scroll the packet list
pane as new packets come in, so you are always looking at the last packet. If
you do not specify this Wireshark simply adds new packets onto the end of the
list but does not scroll the packet list pane. This option is greyed out if
-``Update list of packets in real time'' is disabled.
+“Update list of packets in real time” is disabled.
// XXX ChCapRunningSection currently disabled
//_Hide capture info dialog_::
@@ -352,12 +352,12 @@ cancel the capture.
[[ChCapEditInterfaceSettingsSection]]
-=== The ``Edit Interface Settings'' dialog box
+=== The “Edit Interface Settings” dialog box
If you double-click on an interface in <<ChCapCaptureOptionsDialog>> the following dialog box pops up.
[[ChCapEditInterfacesSettingsDialog]]
-.The ``Edit Interface Settings'' dialog box
+.The “Edit Interface Settings” dialog box
image::wsug_graphics/ws-capture-options-settings.png[{screenshot-attrs}]
You can set the following fields in this dialog box:
@@ -389,7 +389,7 @@ segment).
If some other process has put the interface in promiscuous mode you may be
capturing in promiscuous mode even if you turn off this option.
-Even in promiscuous mode you still won't necessarily see all packets on your LAN
+Even in promiscuous mode you still won’t necessarily see all packets on your LAN
segment. See link:{wireshark-faq-url}#promiscsniff[the Wireshark FAQ] for more information.
====
@@ -401,14 +401,14 @@ most protocols. Some rules of thumb:
* If you are unsure just keep the default value.
-* If you don't need or don't want all of the data in a packet - for example, if
+* If you don’t need or don’t want all of the data in a packet - for example, if
you only need the link-layer, IP, and TCP headers - you might want to choose a
small snapshot length, as less CPU time is required for copying packets, less
buffer space is required for packets, and thus perhaps fewer packets will be
dropped if traffic is very heavy.
-* If you don't capture all of the data in a packet you might find that the
- packet data you want is in the part that’s dropped or that reassembly isn't
+* If you don’t capture all of the data in a packet you might find that the
+ packet data you want is in the part that’s dropped or that reassembly isn’t
possible as the data required for reassembly is missing.
_Buffer size: n megabyte(s)_::
@@ -435,7 +435,7 @@ in more details in <<ChCapCaptureFilterSection>>. It defaults to empty, or no
filter.
+
You can also click on the btn:[Capture Filter] button and Wireshark will
-bring up the ``Capture Filters'' dialog box and allow you to create and/or
+bring up the “Capture Filters” dialog box and allow you to create and/or
select a filter. Please see <<ChWorkDefineFilterSection>>
_Compile BPF_::
@@ -445,12 +445,12 @@ working of the capture filter you created.
[[ChCapCompileSelectedBpfsSection]]
-=== The ``Compile Results'' dialog box
+=== The “Compile Results” dialog box
This figure shows the compile results of the selected interfaces.
[[ChCapCompileSelectedBpfsDialog]]
-.The ``Compile Results'' dialog box
+.The “Compile Results” dialog box
image::wsug_graphics/ws-capture-options-compile-selected-bpfs.png[{screenshot-attrs}]
In the left window the interface names are listed. The results of an individual
@@ -458,19 +458,19 @@ interface are shown in the right window when it is selected.
[[ChCapManageInterfacesSection]]
-=== The ``Add New Interfaces'' dialog box
+=== The “Add New Interfaces” dialog box
As a central point to manage interfaces this dialog box consists of three tabs
to add or remove interfaces.
[[ChCapManageInterfacesDialog]]
-.The ``Add New Interfaces'' dialog box
+.The “Add New Interfaces” dialog box
image::wsug_graphics/ws-capture-options-manage-interfaces.png[{screenshot-attrs}]
==== Add or remove pipes
[[ChCapManageInterfacesPipesDialog]]
-.The ``Add New Interfaces - Pipes'' dialog box
+.The “Add New Interfaces - Pipes” dialog box
image::wsug_graphics/ws-capture-options-manage-interfaces-pipes.png[{screenshot-attrs}]
To successfully add a pipe, this pipe must have already been created. Click the
@@ -485,10 +485,10 @@ click the btn:[Delete] button.
==== Add or hide local interfaces
[[ChCapManageInterfacesLocalDialog]]
-.The ``Add New Interfaces - Local Interfaces'' dialog box
+.The “Add New Interfaces - Local Interfaces” dialog box
image::wsug_graphics/ws-capture-options-manage-interfaces-local.png[{screenshot-attrs}]
-The tab ``Local Interfaces'' contains a list of available local interfaces,
+The tab “Local Interfaces” contains a list of available local interfaces,
including the hidden ones, which are not shown in the other lists.
If a new local interface is added, for example, a wireless interface has been
@@ -498,13 +498,13 @@ rescan can be done.
One way to hide an interface is to change the preferences. If the “Hide”
checkbox is activated and the btn:[Apply] button clicked, the interface will
-not be seen in the lists of the ``Capture Interfaces'' dialog box any more. The
+not be seen in the lists of the “Capture Interfaces” dialog box any more. The
changes are also saved in the `preferences` file.
==== Add or hide remote interfaces
[[ChCapManageInterfacesRemoteDialog]]
-.The ``Add New Interfaces - Remote Interfaces'' dialog box
+.The “Add New Interfaces - Remote Interfaces” dialog box
image::wsug_graphics/ws-capture-options-manage-interfaces-remote.png[{screenshot-attrs}]
In this tab interfaces on remote hosts can be added. One or more of these
@@ -518,7 +518,7 @@ For a detailed description see <<ChCapInterfaceRemoteSection>>
[[ChCapInterfaceRemoteSection]]
-=== The ``Remote Capture Interfaces'' dialog box
+=== The “Remote Capture Interfaces” dialog box
Besides doing capture on local interfaces Wireshark is capable of reaching out
across the network to a so called capture daemon or service processes to receive
@@ -544,13 +544,13 @@ the port where the Remote Packet Capture Protocol service can be reached by
default.
====
-To access the Remote Capture Interfaces dialog use the ``Add New Interfaces -
-Remote'' dialog. See <<ChCapManageInterfacesRemoteDialog>> and select btn:[Add].
+To access the Remote Capture Interfaces dialog use the “Add New Interfaces -
+Remote” dialog. See <<ChCapManageInterfacesRemoteDialog>> and select btn:[Add].
==== Remote Capture Interfaces
[[ChCapInterfaceRemoteDialog]]
-.The ``Remote Capture Interfaces'' dialog box
+.The “Remote Capture Interfaces” dialog box
image::wsug_graphics/ws-capture-options-manage-interfaces-remote-plus.png[{screenshot-attrs}]
You have to set the following parameters in this dialog:
@@ -559,14 +559,14 @@ _Host_::
Enter the IP address or host name of the target platform where the Remote Packet
Capture Protocol service is listening. The drop down list contains the hosts
that have previously been successfully contacted. The list can be emptied by
-choosing ``Clear list'' from the drop down list.
+choosing “Clear list” from the drop down list.
_Port_::
Set the port number where the Remote Packet Capture Protocol service is
listening on. Leave open to use the default port (2002).
_Null authentication_::
-Select this if you don't need authentication to take place for a remote capture
+Select this if you don’t need authentication to take place for a remote capture
to be started. This depends on the target platform. Configuring the target
platform like this makes it insecure.
@@ -582,14 +582,14 @@ you this option. It pops up the dialog shown in
<<ChCapInterfaceRemoteSettingsDialog>>.
[[ChCapInterfaceRemoteSettingsDialog]]
-.The ``Remote Capture Settings'' dialog box
+.The “Remote Capture Settings” dialog box
image::wsug_graphics/ws-capture-options-remote-settings.png[{screenshot-attrs}]
You can set the following parameters in this dialog:
_Do not capture own RPCAP traffic_::
This option sets a capture filter so that the traffic flowing back from the
-Remote Packet Capture Protocol service to Wireshark isn't captured as well and
+Remote Packet Capture Protocol service to Wireshark isn’t captured as well and
also send back. The recursion in this saturates the link with duplicate traffic.
+
You only should switch this off when capturing on an interface other than the
@@ -618,10 +618,10 @@ narrow band capture session of a higher bandwidth interface.
[[ChCapInterfaceDetailsSection]]
-=== The ``Interface Details'' dialog box
+=== The “Interface Details” dialog box
When you select Details from the Capture Interface menu, Wireshark pops up the
-``Interface Details'' dialog box as shown in <<ChCapInterfaceDetailsDialog>>. This
+“Interface Details” dialog box as shown in <<ChCapInterfaceDetailsDialog>>. This
dialog shows various characteristics and statistics for the selected interface.
[NOTE]
@@ -631,7 +631,7 @@ This dialog is only available on Microsoft Windows
====
[[ChCapInterfaceDetailsDialog]]
-.The ``Interface Details'' dialog box
+.The “Interface Details” dialog box
image::wsug_graphics/ws-capture-interface-details.png[{screenshot-attrs}]
[[ChCapCaptureFiles]]
@@ -646,7 +646,7 @@ By default Wireshark saves packets to a temporary file. You can also tell
Wireshark to save to a specific (“permanent”) file and switch to a
different file after a given time has elapsed or a given number of packets
have been captured. These options are controlled in the “Output” tab in
-the ``Capture Options'' dialog.
+the “Capture Options” dialog.
[[ChCapCaptureOptionsOutputDialog]]
.Capture output options
@@ -656,7 +656,7 @@ image::wsug_graphics/ws-capture-options-output.png[{screenshot-attrs}]
====
Working with large files (several hundred MB) can be quite slow. If you plan to do
a long term capture or capturing from a high traffic network, think about using
-one of the ``Multiple files'' options. This will spread the captured packets over
+one of the “Multiple files” options. This will spread the captured packets over
several smaller files which can be much more pleasant to work with.
====
@@ -676,7 +676,7 @@ Information about the folders used for capture files can be found in
.Capture file mode selected by capture options
[options="header",cols="2,2,2,3,5"]
|===============
-|File Name|``Create a new file...''|``Use a ring buffer...''|Mode|Resulting filename(s) used
+|File Name|“Create a new file...”|“Use a ring buffer...”|Mode|Resulting filename(s) used
|-|-|-|_Single temporary file_|wiresharkXXXXXX (where XXXXXX is a unique number)
|foo.cap|-|-|_Single named file_|foo.cap
|foo.cap|x|-|_Multiple files, continuous_|foo_00001_20100205110102.cap, foo_00002_20100205110318.cap, ...
@@ -692,14 +692,14 @@ _Single named file_::
a specific folder choose this mode.
_Multiple files, continuous_::
- Like the ``Single named file'' mode, but a new file is created and used after
- reaching one of the multiple file switch conditions (one of the ``Next file every
- ...'' values).
+ Like the “Single named file” mode, but a new file is created and used after
+ reaching one of the multiple file switch conditions (one of the “Next file every
+ ...” values).
_Multiple files, ring buffer_::
- Much like ``Multiple files continuous'', reaching one of the multiple files switch
- conditions (one of the ``Next file every ...'' values) will switch to the next
- file. This will be a newly created file if value of ``Ring buffer with n files''
+ Much like “Multiple files continuous”, reaching one of the multiple files switch
+ conditions (one of the “Next file every ...” values) will switch to the next
+ file. This will be a newly created file if value of “Ring buffer with n files”
is not reached, otherwise it will replace the oldest of the formerly used files
(thus forming a “ring”).
+
@@ -710,7 +710,7 @@ _Multiple files, ring buffer_::
=== Link-layer header type
-In most cases you won't have to modify link-layer header type. Some exceaptions
+In most cases you won’t have to modify link-layer header type. Some exceaptions
are as follows:
If you are capturing on an Ethernet device you might be offered a choice of
@@ -722,19 +722,19 @@ If you are capturing on an 802.11 device on some versions of BSD you might be
offered a choice of “Ethernet” or “802.11”. “Ethernet” will cause the
captured packets to have fake (“cooked”) Ethernet headers. “802.11” will
cause them to have full IEEE 802.11 headers. Unless the capture needs to be read
-by an application that doesn't support 802.11 headers you should select
+by an application that doesn’t support 802.11 headers you should select
“802.11”.
If you are capturing on an Endace DAG card connected to a synchronous serial
-line you might be offered a choice of ``PPP over serial'' or ``Cisco HDLC''. If
-the protocol on the serial line is PPP, select ``PPP over serial'' and if the
-protocol on the serial line is Cisco HDLC, select ``Cisco HDLC''.
+line you might be offered a choice of “PPP over serial” or “Cisco HDLC”. If
+the protocol on the serial line is PPP, select “PPP over serial” and if the
+protocol on the serial line is Cisco HDLC, select “Cisco HDLC”.
If you are capturing on an Endace DAG card connected to an ATM network you might
-be offered a choice of ``RFC 1483 IP-over-ATM'' or ``Sun raw ATM''. If the only
+be offered a choice of “RFC 1483 IP-over-ATM” or “Sun raw ATM”. If the only
traffic being captured is RFC 1483 LLC-encapsulated IP, or if the capture needs
-to be read by an application that doesn't support SunATM headers, select ``RFC
-1483 IP-over-ATM'', otherwise select ``Sun raw ATM''.
+to be read by an application that doesn’t support SunATM headers, select “RFC
+1483 IP-over-ATM”, otherwise select “Sun raw ATM”.
[[ChCapCaptureFilterSection]]
@@ -746,7 +746,7 @@ the link:{pcap-filter-man-page-url}[pcap-filter man page]. You can find
a lot of Capture Filter examples at {wireshark-wiki-url}CaptureFilters.
You enter the capture filter into the “Filter” field of the Wireshark
-``Capture Options'' dialog box, as shown in <<ChCapCaptureOptionsDialog>>.
+“Capture Options” dialog box, as shown in <<ChCapCaptureOptionsDialog>>.
A capture filter takes the form of a series of primitive expressions connected
by conjunctions (__and/or__) and optionally preceded by __not__:
@@ -889,7 +889,7 @@ On Windows it asks the operating system if it’s running in a Remote Desktop Se
While a capture is running, the following dialog box is shown:
[[ChCapCaptureInfoDialog]]
-.The ``Capture Info'' dialog box
+.The “Capture Info” dialog box
image::wsug_graphics/ws-capture-info.png[{screenshot-attrs}]
This dialog box will inform you about the number of captured packets and the
@@ -898,8 +898,8 @@ cannot be changed.
[TIP]
====
-This ``Capture Info'' dialog box can be hidden using the ``Hide capture info
-dialog'' option in the Capture Options dialog box.
+This “Capture Info” dialog box can be hidden using the “Hide capture info
+dialog” option in the Capture Options dialog box.
====
////
@@ -909,12 +909,12 @@ dialog'' option in the Capture Options dialog box.
A running capture session will be stopped in one of the following ways:
-. Using the btn:[Stop] button from the ``Capture Info'' dialog box.
+. Using the btn:[Stop] button from the “Capture Info” dialog box.
[NOTE]
====
-The ``Capture Info'' dialog box might be hidden if the ``Hide capture info
-dialog'' option is used.
+The “Capture Info” dialog box might be hidden if the “Hide capture info
+dialog” option is used.
====
. Using the menu:Capture[Stop] menu item.
diff --git a/docbook/wsug_src/WSUG_chapter_customize.asciidoc b/docbook/wsug_src/WSUG_chapter_customize.asciidoc
index ab465bf023..96e443468e 100644
--- a/docbook/wsug_src/WSUG_chapter_customize.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_customize.asciidoc
@@ -47,7 +47,7 @@ Capture interface:
-f <capfilter|predef:> packet filter in libpcap filter syntax or
predef:filtername - predefined filtername from GUI
-s <snaplen> packet snapshot length (def: 262144)
- -p don't capture in promiscuous mode
+ -p don’t capture in promiscuous mode
-k start capturing immediately (def: do nothing)
-S update packet display when new packets are captured
-l turn on automatic scrolling while -S is in use
@@ -78,7 +78,7 @@ Processing:
-n disable all name resolutions (def: all enabled)
-N <name resolve flags> enable specific name resolution(s): "mnNtCd"
-d <layer_type>==<selector>,<decode_as_protocol> ...
- "Decode As", see the man page for details
+ "Decode As”, see the man page for details
Example: tcp.port==8888,http
--disable-protocol <proto_name>
disable dissection of proto_name
@@ -144,14 +144,14 @@ is one of:
-b <capture ring buffer option>::
If a maximum capture file size was specified, this option causes Wireshark to run
-in ``ring buffer'' mode, with the specified number of files. In ``ring
-buffer'' mode, Wireshark will write to several capture files. Their
+in “ring buffer” mode, with the specified number of files. In “ring
+buffer” mode, Wireshark will write to several capture files. Their
name is based on the number of the file and on the creation date and
time.
+
When the first capture file fills up Wireshark will switch to writing
to the next file, and so on. With the <command>files</command> option it’s
-also possible to form a ``ring buffer.'' This will fill up new files until the
+also possible to form a “ring buffer.” This will fill up new files until the
number of files specified, at which point the data in the first file will be
discarded so a new file can be written.
+
@@ -192,11 +192,11 @@ each network interface, a number and an interface name, possibly followed by a
text description of the interface, is printed. The interface name or the number
can be supplied to the `-i` flag to specify an interface on which to capture.
+
-This can be useful on systems that don't have a command to list them (e.g.,
+This can be useful on systems that don’t have a command to list them (e.g.,
Windows systems, or UNIX systems lacking `ifconfig -a`). The number can be
especially useful on Windows, where the interface name is a GUID.
+
-Note that ``can capture'' means that Wireshark was able to open that device to
+Note that “can capture” means that Wireshark was able to open that device to
do a live capture. If, on your system, a program doing a network capture must be
run from an account with special privileges (for example, as root), then, if
Wireshark is run with the `-D` flag and is not run from such an account, it will
@@ -223,7 +223,7 @@ Set the name of the network interface or pipe to use for live packet capture.
+
Network interface names should match one of the names listed in `wireshark -D`
(described above). A number, as reported by `wireshark -D`, can also be used. If
-you're using UNIX, `netstat -i` or `ifconfig -a` might also work to list
+you’re using UNIX, `netstat -i` or `ifconfig -a` might also work to list
interface names, although not all versions of UNIX support the `-a` flag to
`ifconfig`.
+
@@ -231,7 +231,7 @@ If no interface is specified, Wireshark searches the list of interfaces,
choosing the first non-loopback interface if there are any non-loopback
interfaces, and choosing the first loopback interface if there are no
non-loopback interfaces; if there are no interfaces, Wireshark reports an error
-and doesn't start the capture.
+and doesn’t start the capture.
+
Pipe names should be either the name of a FIFO (named pipe) or “-” to read
data from the standard input. Data read from pipes must be in standard libpcap
@@ -333,7 +333,7 @@ HTTP, just as if you had configured it in the DLT_USER protocol preferences.
-p::
-Don't put the interface into promiscuous mode. Note that the interface might be
+Don’t put the interface into promiscuous mode. Note that the interface might be
in promiscuous mode for some other reason. Hence, `-p` cannot be used to ensure
that the only traffic that is captured is traffic sent to or from the machine on
which Wireshark is running, broadcast traffic, and multicast traffic to
@@ -384,8 +384,8 @@ Wireshark will only capture _snaplen_ bytes of data for each packet.
This option specifies that Wireshark will display packets as it captures them.
This is done by capturing in one process and displaying them in a separate
-process. This is the same as ``Update list of packets in real time'' in the
-``Capture Options'' dialog box.
+process. This is the same as “Update list of packets in real time” in the
+“Capture Options” dialog box.
-t <time stamp format>::
@@ -487,14 +487,14 @@ filters can also be created by selecting the menu:Colorize with Filter[Color X]
menu items when right-clicking in the packet detail pane.
To permanently colorize packets, select menu:View[Coloring Rules...]. Wireshark
-will display the ``Coloring Rules'' dialog box as shown in
+will display the “Coloring Rules” dialog box as shown in
<<ChCustColoringRulesDialog>>.
[[ChCustColoringRulesDialog]]
-.The ``Coloring Rules'' dialog box
+.The “Coloring Rules” dialog box
image::wsug_graphics/ws-coloring-rules-dialog.png[{screenshot-attrs}]
-If this is the first time using the Coloring Rules dialog and you're using the
+If this is the first time using the Coloring Rules dialog and you’re using the
default configuration profile you should see the default rules, shown above.
[NOTE]
@@ -511,7 +511,7 @@ one or more rules by clicking the btn:[-] button. The “copy” button will
duplicate a rule.
You can edit a rule by double-clicking on its name or filter. In
-<<ChCustColoringRulesDialog>> the name of the rule ``Checksum Errors'' is being
+<<ChCustColoringRulesDialog>> the name of the rule “Checksum Errors” is being
edited. Clicking on the btn:[Foreground] and btn:[Background] buttons will
open a color chooser (<<ChCustChooseColorDialog>>) for the foreground (text) and
background colors respectively.
@@ -525,7 +525,7 @@ picker is shown. Select the color you desire for the selected packets and click
btn:[OK].
<<ChCustColorFilterMany>> shows an example of several color filters being used
-in Wireshark. Note that the frame detail shows that the ``Bad TCP'' rule rule
+in Wireshark. Note that the frame detail shows that the “Bad TCP” rule rule
was applied, along with the matching filter.
[[ChCustColorFilterMany]]
@@ -541,9 +541,9 @@ The user can control how protocols are dissected.
Each protocol has its own dissector, so dissecting a complete packet will
typically involve several dissectors. As Wireshark tries to find the right
-dissector for each packet (using static “routes” and heuristics ``guessing"),
+dissector for each packet (using static “routes” and heuristics “guessing”),
it might choose the wrong dissector in your specific case. For example,
-Wireshark won't know if you use a common protocol on an uncommon TCP port, e.g.
+Wireshark won’t know if you use a common protocol on an uncommon TCP port, e.g.
using HTTP on TCP port 800 instead of the standard port 80.
There are two ways to control the relations between protocol dissectors: disable
@@ -552,7 +552,7 @@ the dissectors.
[[ChAdvEnabledProtocols]]
-==== The ``Enabled Protocols'' dialog box
+==== The “Enabled Protocols” dialog box
The Enabled Protocols dialog box lets you enable or disable specific protocols.
All protocols are enabled by default. When a protocol is disabled, Wireshark
@@ -568,11 +568,11 @@ disabling IP would prevent it and the other protocols from being displayed.
====
To enable or disable protocols select menu:Analyze[Enabled Protocols...].
-Wireshark will pop up the ``Enabled Protocols'' dialog box as shown in
+Wireshark will pop up the “Enabled Protocols” dialog box as shown in
<<ChAdvEnabledProtocolsFig>>.
[[ChAdvEnabledProtocolsFig]]
-.The ``Enabled Protocols'' dialog box
+.The “Enabled Protocols” dialog box
image::wsug_graphics/ws-enabled-protocols.png[{screenshot-attrs}]
To disable or enable a protocol, simply click on it using the mouse or press the
@@ -605,15 +605,15 @@ You can choose from the following actions:
==== User Specified Decodes
-The ``Decode As'' functionality lets you temporarily divert specific protocol
+The “Decode As” functionality lets you temporarily divert specific protocol
dissections. This might be useful for example, if you do some uncommon
experiments on your network.
Decode As is accessed by selecting the menu:Analyze[Decode As...]. Wireshark
-will pop up the ``Decode As'' dialog box as shown in <<ChAdvDecodeAsFig>>.
+will pop up the “Decode As” dialog box as shown in <<ChAdvDecodeAsFig>>.
[[ChAdvDecodeAsFig]]
-.The ``Decode As'' dialog box
+.The “Decode As” dialog box
image::wsug_graphics/ws-decode-as.png[{screenshot-attrs}]
The content of this dialog box depends on the selected packet when it was opened.
@@ -626,8 +626,8 @@ save the entries in the _Show User Specified Decodes..._ windows
. btn:[Do not decode]: Do not decode packets the selected way.
-. btn:[Link/Network/Transport]: Specify the network layer at which ``Decode
- As'' should take place. Which of these pages are available depends on the
+. btn:[Link/Network/Transport]: Specify the network layer at which “Decode
+ As” should take place. Which of these pages are available depends on the
content of the selected packet when this dialog box is opened.
. btn:[Show Current]: Open a dialog box showing the current list of user
@@ -648,7 +648,7 @@ This dialog box shows the currently active user specified decodes. These entries
can be saved into current profile for later session.
[[ChAdvDecodeAsShowFig]]
-.The ``Decode As: Show'' dialog box
+.The “Decode As: Show” dialog box
image::wsug_graphics/ws-decode-as-show.png[{screenshot-attrs}]
. btn:[OK]: Close this dialog box.
@@ -664,7 +664,7 @@ image::wsug_graphics/ws-decode-as-show.png[{screenshot-attrs}]
There are a number of preferences you can set. Simply select the
menu:Edit[Preferences...] (menu:Wireshark[Preferences...] on macOS) and
Wireshark will pop up the Preferences dialog box as shown in
-<<ChCustGUIPrefPage>>, with the ``User Interface'' page as default. On the left
+<<ChCustGUIPrefPage>>, with the “User Interface” page as default. On the left
side is a tree where you can select the page to be shown.
* The btn:[OK] button will apply the preferences settings and close the dialog.
@@ -785,7 +785,7 @@ image::wsug_graphics/ws-gui-config-profiles.png[{screenshot-attrs}]
New::
This button adds a new profile to the profiles list. The name of the created
-profile is ``New profile'' and can be changed in the Properties field.
+profile is “New profile” and can be changed in the Properties field.
Copy::
This button adds a new profile to the profiles list, copying all configuration
@@ -805,8 +805,8 @@ Profile name::
You can change the name of the currently selected profile here.
+
--
-The profile name will be used as a folder name in the configured ``Personal
-configurations'' folder. If adding multiple profiles with the same name, only
+The profile name will be used as a folder name in the configured “Personal
+configurations” folder. If adding multiple profiles with the same name, only
one profile will be created.
On Windows the profile name cannot start or end with a period (.), and cannot
@@ -880,7 +880,7 @@ The textual representation for the value.
=== GeoIP Database Paths
-If your copy of Wireshark supports link:http://www.maxmind.com/[MaxMind's]
+If your copy of Wireshark supports link:http://www.maxmind.com/[MaxMind’s]
GeoIP library, you can use their databases to match IP addresses to countries,
cites, autonomous system numbers, ISPs, and other bits of information. Some
databases are link:http://www.maxmind.com/download/geoip/database/[available
@@ -1036,7 +1036,7 @@ MIB and PIB modules here.
Directory name::
A module directory, e.g. `/usr/local/snmp/mibs`. Wireshark automatically uses
-the standard SMI path for your system, so you usually don't have to add anything
+the standard SMI path for your system, so you usually don’t have to add anything
here.
[[ChSNMPEnterpriseSpecificTrapTypes]]
@@ -1089,7 +1089,7 @@ _\x01\x02\x03\x04\x05\x06_. The _\_ character must be treated as an unprintable
character, i.e. it must be entered as _\x5C_ or _\x5c_.
Privacy protocol::
-Which encryption algorithm to use (either “DES” or ``AES").
+Which encryption algorithm to use (either “DES” or “AES”).
Privacy password::
The privacy password. Use _\xDD_ for unprintable characters. An hexadecimal
@@ -1103,7 +1103,7 @@ as _\x5C_ or _\x5c_.
=== Tektronix K12xx/15 RF5 protocols Table
The Tektronix K12xx/15 rf5 file format uses helper files (*.stk) to identify the
-various protocols that are used by a certain interface. Wireshark doesn't read
+various protocols that are used by a certain interface. Wireshark doesn’t read
these stk files, it uses a table that helps it identify which lowest layer
protocol to use.
diff --git a/docbook/wsug_src/WSUG_chapter_introduction.asciidoc b/docbook/wsug_src/WSUG_chapter_introduction.asciidoc
index 74acde7490..e5eaf442cf 100644
--- a/docbook/wsug_src/WSUG_chapter_introduction.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_introduction.asciidoc
@@ -118,13 +118,13 @@ Wireshark, either as plugins, or built into the source, and they often do!
Here are some things Wireshark does not provide:
-* Wireshark isn't an intrusion detection system. It will not warn you when
- someone does strange things on your network that he/she isn't allowed to do.
+* Wireshark isn’t an intrusion detection system. It will not warn you when
+ someone does strange things on your network that he/she isn’t allowed to do.
However, if strange things happen, Wireshark might help you figure out what is
really going on.
-* Wireshark will not manipulate things on the network, it will only "measure"
- things from it. Wireshark doesn't send packets on the network or do other
+* Wireshark will not manipulate things on the network, it will only “measure”
+ things from it. Wireshark doesn’t send packets on the network or do other
active things (except for name resolutions, but even that can be disabled).
[[ChIntroPlatforms]]
@@ -149,7 +149,7 @@ If Wireshark runs out of memory it will crash. See
{wireshark-wiki-url}KnownBugs/OutOfMemory for details and workarounds.
Although Wireshark captures packets using a separate process the main interface
-is single-threaded and won't benefit much from multi-core systems.
+is single-threaded and won’t benefit much from multi-core systems.
==== Microsoft Windows
@@ -268,7 +268,7 @@ started applying patches and contributing dissectors to Ethereal.
In late 1998 Richard Sharpe, who was giving TCP/IP courses, saw its potential
on such courses and started looking at it to see if it supported the protocols
-he needed. While it didn't at that point new protocols could be easily added.
+he needed. While it didn’t at that point new protocols could be easily added.
So he started contributing dissectors and contributing patches.
The list of people who have contributed to the project has become very long
@@ -361,7 +361,7 @@ The Wireshark Q&amp;A site at {wireshark-qa-url} offers a resource where
questions and answers come together. You have the option to search what
questions were asked before and what answers were given by people who
knew about the issue. Answers are graded, so you can pick out the best
-ones easily. If your question hasn't been discussed before you can post
+ones easily. If your question hasn’t been discussed before you can post
one yourself.
[[ChIntroFAQ]]
@@ -415,7 +415,7 @@ list. The links to the archives are included on that page as well.
.The lists are archived
====
You can search in the list archives to see if someone asked the same question
-some time before and maybe already got an answer. That way you don't have to
+some time before and maybe already got an answer. That way you don’t have to
wait until someone answers your question.
====
@@ -440,11 +440,11 @@ When reporting problems with Wireshark please supply the following information:
. If you get an error/warning message, copy the text of that message (and also a
few lines before and after it, if there are some) so others may find the
- place where things go wrong. Please don't give something like: "I get a
- warning while doing x" as this won't give a good idea where to look.
+ place where things go wrong. Please don’t give something like: “I get a
+ warning while doing x” as this won’t give a good idea where to look.
[NOTE]
-.Don't send large files
+.Don’t send large files
====
Do not send large files (> 1 MB) to the mailing lists. Just place a note that
further data is available on request. Large files will only annoy a lot of
@@ -453,9 +453,9 @@ you will be asked for further data by the persons who really can help you.
====
[WARNING]
-.Don't send confidential information!
+.Don’t send confidential information!
====
-If you send capture files to the mailing lists be sure they don't contain any
+If you send capture files to the mailing lists be sure they don’t contain any
sensitive or confidential information like passwords or personally identifiable
information (PII).
====
@@ -463,7 +463,7 @@ information (PII).
==== Reporting Crashes on UNIX/Linux platforms
When reporting crashes with Wireshark it is helpful if you supply the traceback
-information along with the information mentioned in "Reporting Problems".
+information along with the information mentioned in “Reporting Problems”.
You can obtain this traceback information with the following commands on UNIX or
Linux (note the backticks):
@@ -480,7 +480,7 @@ Mail _backtrace.txt_ to mailto:{wireshark-dev-list-email}[].
==== Reporting Crashes on Windows platforms
-The Windows distributions don't contain the symbol files (.pdb) because they are
+The Windows distributions don’t contain the symbol files (.pdb) because they are
very large. You can download them separately at
{wireshark-main-url}download/win32/all-versions/ and
{wireshark-main-url}download/win64/all-versions/ .
diff --git a/docbook/wsug_src/WSUG_chapter_io.asciidoc b/docbook/wsug_src/WSUG_chapter_io.asciidoc
index d900560006..04210589cf 100644
--- a/docbook/wsug_src/WSUG_chapter_io.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_io.asciidoc
@@ -26,7 +26,7 @@ This chapter will describe input and output of capture data.
Wireshark can read in previously saved capture files. To read them, simply
select the menu:File[Open] menu or toolbar item. Wireshark will then pop up
-the ``File Open'' dialog box, which is discussed in more detail in <<ChIOOpen>>.
+the “File Open” dialog box, which is discussed in more detail in <<ChIOOpen>>.
[TIP]
.It’s convenient to use drag-and-drop
@@ -36,7 +36,7 @@ onto Wireshark’s main window. However, drag-and-drop may not be available in a
desktop environments.
====
-If you haven't previously saved the current capture file you will be asked to
+If you haven’t previously saved the current capture file you will be asked to
do so to prevent data loss. This warning can be disabled in the preferences.
In addition to its native file format (pcapng), Wireshark can read and write
@@ -46,11 +46,11 @@ understands.
[[ChIOOpen]]
-==== The ``Open Capture File'' dialog box
+==== The “Open Capture File” dialog box
-The ``Open Capture File'' dialog box allows you to search for a capture file
+The “Open Capture File” dialog box allows you to search for a capture file
containing previously captured packets for display in Wireshark. The following
-sections show some examples of the Wireshark ``Open File'' dialog box. The
+sections show some examples of the Wireshark “Open File” dialog box. The
appearance of this dialog depends on the system. However, the functionality
should be the same across systems.
@@ -77,7 +77,7 @@ Wireshark extensions to the standard behaviour of these dialogs:
// XXX - we need a better description of these read filters
* Specify which type of name resolution is to be performed for all packets by
- clicking on one of the ``... name resolution'' check buttons. Details about name
+ clicking on one of the “... name resolution” check buttons. Details about name
resolution can be found in <<ChAdvNameResolutionSection>>.
[TIP]
@@ -98,7 +98,7 @@ This is the common Windows file open dialog - plus some Wireshark extensions.
Specific for this dialog:
-* The btn:[Help] button will lead you to this section of this “`User”s Guide''.
+* The btn:[Help] button will lead you to this section of this “User”s Guide”.
[[ChIOOpenFileDialog]]
@@ -116,7 +116,7 @@ Specific for this dialog:
* The btn:[-] button allows you to remove a selected directory from the list.
Some items (such as “Desktop”) cannot be removed from the favorites list.
-* If Wireshark doesn't recognize the selected file as a capture file it will
+* If Wireshark doesn’t recognize the selected file as a capture file it will
grey out the btn:[Open] button.
// XXX Add macOS
@@ -175,13 +175,13 @@ The following file formats from other capture tools can be opened by Wireshark:
* the text output from the DBS Etherwatch VMS utility
-* Visual Networks' Visual UpTime traffic capture
+* Visual Networks’ Visual UpTime traffic capture
* the output from CoSine L2 debug
* the output from Accellent’s 5Views LAN agents
-* Endace Measurement Systems' ERF format captures
+* Endace Measurement Systems’ ERF format captures
* Linux Bluez Bluetooth stack hcidump -w traces
@@ -203,7 +203,7 @@ The following file formats from other capture tools can be opened by Wireshark:
* Apple PacketLogger captures
-* Captures from Aethra Telecommunications' PC108 software for their test instruments
+* Captures from Aethra Telecommunications’ PC108 software for their test instruments
New file formats are added from time to time.
@@ -220,14 +220,14 @@ You can save captured packets simply by using the menu:File[Save As...] menu
item. You can choose which packets to save and which file format to be used.
Not all information will be saved in a capture file. For example, most file
-formats don't record the number of dropped packets. See
+formats don’t record the number of dropped packets. See
<<ChAppFilesCaptureFilesSection>> for details.
[[ChIOSaveAs]]
-==== The ``Save Capture File As'' dialog box
+==== The “Save Capture File As” dialog box
-The ``Save Capture File As'' dialog box allows you to save the current capture
+The “Save Capture File As” dialog box allows you to save the current capture
to a file. The following sections show some examples of this dialog box. The
appearance of this dialog depends on the system. However, the functionality
should be the same across systems.
@@ -241,9 +241,9 @@ This is the common Windows file save dialog with some additional Wireshark exten
Specific behavior for this dialog:
-* If available, the “Help” button will lead you to this section of this "User’s Guide".
+* If available, the “Help” button will lead you to this section of this “User’s Guide”.
-* If you don't provide a file extension to the filename (e.g. `.pcap`) Wireshark
+* If you don’t provide a file extension to the filename (e.g. `.pcap`) Wireshark
will append the standard file extension for that file format.
[[ChIOSaveAsFile2]]
@@ -255,7 +255,7 @@ This is the common Gimp/GNOME file save dialog with additional Wireshark extensi
Specific for this dialog:
-* Clicking on the + at "Browse for other folders" will allow you to browse files and folders in your file system.
+* Clicking on the + at “Browse for other folders” will allow you to browse files and folders in your file system.
// XXX Add macOS
@@ -370,14 +370,14 @@ There are three ways to merge capture files using Wireshark:
[[ChIOMergeDialog]]
-==== The ``Merge with Capture File'' dialog box
+==== The “Merge with Capture File” dialog box
This dialog box let you select a file to be merged into the currently loaded
file. If your current data has not been saved you will be asked to save it
first.
-Most controls of this dialog will work the same way as described in the ``Open
-Capture File'' dialog box, see <<ChIOOpen>>.
+Most controls of this dialog will work the same way as described in the “Open
+Capture File” dialog box, see <<ChIOOpen>>.
Specific controls of this merge dialog are:
@@ -393,7 +393,7 @@ Append the packets from the selected file after the currently loaded packets.
[[ChIOMergeFileTab]]
-.The system specific ``Merge Capture File As'' dialog box
+.The system specific “Merge Capture File As” dialog box
[[ChIOMergeFileWin32]]
@@ -468,14 +468,14 @@ handle these dumps.
[[ChIOImportDialog]]
-==== The ``Import from Hex Dump'' dialog box
+==== The “Import from Hex Dump” dialog box
This dialog box lets you select a text file, containing a hex dump of packet
data, to be imported and set import parameters.
[[ChIOFileImportDialog]]
-.The ``Import from Hex Dump'' dialog
+.The “Import from Hex Dump” dialog
image::wsug_graphics/ws-file-import.png[{screenshot-attrs}]
Specific controls of this import dialog are split in two sections:
@@ -528,7 +528,7 @@ part. Here you can define how much data from the start of the frame you want to
import. If you leave this open the maximum is set to 65535 bytes.
Once all input and import parameters are setup click btn:[OK] to start the
-import. If your current data wasn't saved before you will be asked to save it
+import. If your current data wasn’t saved before you will be asked to save it
first.
When completed there will be a new capture file loaded with the frames imported
@@ -538,7 +538,7 @@ from the text file.
=== File Sets
-When using the "Multiple Files" option while doing a capture (see:
+When using the “Multiple Files” option while doing a capture (see:
<<ChCapCaptureFiles>>), the capture data is spread over several capture files,
called a file set.
@@ -565,7 +565,7 @@ the mechanism will fail to find all files of a set.
The following features in the menu:File[File Set] submenu are available to work
with file sets in a convenient way:
-* The ``List Files'' dialog box will list the files Wireshark has recognized as
+* The “List Files” dialog box will list the files Wireshark has recognized as
being part of the current file set.
* btn:[Next File] closes the current and opens the next file in the file
@@ -576,9 +576,9 @@ with file sets in a convenient way:
[[ChIOFileSetListDialog]]
-==== The ``List Files'' dialog box
+==== The “List Files” dialog box
-.The "List Files" dialog box
+.The “List Files” dialog box
image::wsug_graphics/ws-file-set-dialog.png[{screenshot-attrs}]
Each line contains information about a file of the file set:
@@ -616,7 +616,7 @@ elsewhere.
[[ChIOExportPlainDialog]]
-==== The ``Export as Plain Text File'' dialog box
+==== The “Export as Plain Text File” dialog box
[[ChIOExportPlain]]
@@ -627,12 +627,12 @@ Export packet data into a plain ASCII text file, much like the format used to pr
If you would like to be able to import any previously exported packets from a
plain text file it is recommended that you:
-* Add the ``Absolute date and time'' column.
+* Add the “Absolute date and time” column.
* Temporarily hide all other columns.
-* Disable the menu:Edit[Preferences,Protocols,Data] ``Show not dissected data
- on new Packet Bytes pane'' preference. More details are provided in
+* Disable the menu:Edit[Preferences,Protocols,Data] “Show not dissected data
+ on new Packet Bytes pane” preference. More details are provided in
<<ChCustPreferencesSection>>
* Include the packet summary line.
@@ -644,20 +644,20 @@ plain text file it is recommended that you:
* Include the packet bytes.
====
-.The ``Export as Plain Text File'' dialog box
+.The “Export as Plain Text File” dialog box
image::wsug_graphics/ws-export-plain.png[{screenshot-attrs}]
-* The ``Export to file:'' frame chooses the file to export the packet data to.
+* The “Export to file:” frame chooses the file to export the packet data to.
-* The ``Packet Range'' frame is described in <<ChIOPacketRangeSection>>.
+* The “Packet Range” frame is described in <<ChIOPacketRangeSection>>.
-* The ``Packet Details'' frame is described in <<ChIOPacketFormatSection>>.
+* The “Packet Details” frame is described in <<ChIOPacketFormatSection>>.
[[ChIOExportPSDialog]]
-==== The ``Export as PostScript File'' dialog box
+==== The “Export as PostScript File” dialog box
-.The "Export as PostScript File" dialog box
+.The “Export as PostScript File” dialog box
image::wsug_graphics/ws-export-ps.png[{screenshot-attrs}]
* _Export to file:_ frame chooses the file to export the packet data to.
@@ -668,14 +668,14 @@ image::wsug_graphics/ws-export-ps.png[{screenshot-attrs}]
[[ChIOExportCSVDialog]]
-==== The "Export as CSV (Comma Separated Values) File" dialog box
+==== The “Export as CSV (Comma Separated Values) File” dialog box
// XXX - add screenshot
Export packet summary into CSV, used e.g. by spreadsheet programs to im-/export data.
//<!--<figure>
-// <title>The "Export as Comma Separated Values File" dialog box</title>
+// <title>The “Export as Comma Separated Values File” dialog box</title>
// <graphic entityref="WiresharkExportCSVDialog" format="PNG"/>
// </figure>-->
@@ -685,14 +685,14 @@ Export packet summary into CSV, used e.g. by spreadsheet programs to im-/export
[[ChIOExportCArraysDialog]]
-==== The "Export as C Arrays (packet bytes) file" dialog box
+==== The “Export as C Arrays (packet bytes) file” dialog box
// XXX - add screenshot
Export packet bytes into C arrays so you can import the stream data into your own C program.
// <figure>
-// <title>The "Export as C Arrays (packet bytes) file" dialog box</title>
+// <title>The “Export as C Arrays (packet bytes) file” dialog box</title>
// <graphic entityref="WiresharkExportCArraysDialog" format="PNG"/>
// </figure>
@@ -702,13 +702,13 @@ Export packet bytes into C arrays so you can import the stream data into your ow
[[ChIOExportPSMLDialog]]
-==== The "Export as PSML File" dialog box
+==== The “Export as PSML File” dialog box
Export packet data into PSML. This is an XML based format including only the
packet summary. The PSML file specification is available at:
link:http://www.nbee.org/doku.php?id=netpdl:psml_specification[].
-.The "Export as PSML File" dialog box
+.The “Export as PSML File” dialog box
image::wsug_graphics/ws-export-psml.png[{screenshot-attrs}]
* _Export to file:_ frame chooses the file to export the packet data to.
@@ -720,7 +720,7 @@ format is defined by the PSML specification.
[[ChIOExportPDMLDialog]]
-==== The "Export as PDML File" dialog box
+==== The “Export as PDML File” dialog box
Export packet data into PDML. This is an XML based format including the packet
details. The PDML file specification is available at:
@@ -733,7 +733,7 @@ of it is still in an early beta state, so please expect changes in future
Wireshark versions.
====
-.The "Export as PDML File" dialog box
+.The “Export as PDML File” dialog box
image::wsug_graphics/ws-export-pdml.png[{screenshot-attrs}]
* _Export to file:_ frame chooses the file to export the packet data to.
@@ -745,11 +745,11 @@ format is defined by the PDML specification.
[[ChIOExportSelectedDialog]]
-==== The "Export selected packet bytes" dialog box
+==== The “Export selected packet bytes” dialog box
-Export the bytes selected in the "Packet Bytes" pane into a raw binary file.
+Export the bytes selected in the “Packet Bytes” pane into a raw binary file.
-.The "Export Selected Packet Bytes" dialog box
+.The “Export Selected Packet Bytes” dialog box
image::wsug_graphics/ws-export-selected.png[{screenshot-attrs}]
* _Name:_ the filename to export the packet data to.
@@ -760,7 +760,7 @@ image::wsug_graphics/ws-export-selected.png[{screenshot-attrs}]
[[ChIOExportObjectsDialog]]
-==== The "Export Objects" dialog box
+==== The “Export Objects” dialog box
This feature scans through HTTP streams in the currently open capture file or
running capture and takes reassembled objects such as HTML documents, image
@@ -771,7 +771,7 @@ be opened with the proper viewer or executed in the case of executables (if it
is for the same platform you are running Wireshark on) without any further work
on your part. This feature is not available when using GTK2 versions below 2.4.
-.The "Export Objects" dialog box
+.The “Export Objects” dialog box
image::wsug_graphics/ws-export-objects.png[{screenshot-attrs}]
* _Packet num:_ The packet number in which this object was found. In some
@@ -860,7 +860,7 @@ packet is printed, see <<ChIOPacketFormatFrame>>
[[ChIOPacketRangeSection]]
-=== The ``Packet Range'' frame
+=== The “Packet Range” frame
The packet range frame is a part of various output related dialog boxes. It
provides options to select which packets should be processed by the output
@@ -868,7 +868,7 @@ function.
[[ChIOPacketRangeFrame]]
-.The ``Packet Range'' frame
+.The “Packet Range” frame
image::wsug_graphics/ws-packet-range.png[{screenshot-attrs}]
If the btn:[Captured] button is set (default), all packets from the selected rule
@@ -899,24 +899,24 @@ function.
[[ChIOPacketFormatFrame]]
-.The ``Packet Format'' frame
+.The “Packet Format” frame
image::wsug_graphics/ws-packet-format.png[{screenshot-attrs}]
* _Packet summary line_ enable the output of the summary line, just as in the
- ``Packet List'' pane.
+ “Packet List” pane.
* _Packet details_ enable the output of the packet details tree.
-* _All collapsed_ the info from the ``Packet Details'' pane in ``all collapsed''
+* _All collapsed_ the info from the “Packet Details” pane in “all collapsed”
state.
-* _As displayed_ the info from the ``Packet Details'' pane in the current state.
+* _As displayed_ the info from the “Packet Details” pane in the current state.
-* _All expanded_ the info from the ``Packet Details'' pane in ``all expanded''
+* _All expanded_ the info from the “Packet Details” pane in “all expanded”
state.
-* _Packet bytes_ enable the output of the packet bytes, just as in the ``Packet
- Bytes'' pane.
+* _Packet bytes_ enable the output of the packet bytes, just as in the “Packet
+ Bytes” pane.
* _Each packet on a new page_ put each packet on a separate page (e.g. when
saving/printing to a text file, this will put a form feed character between
diff --git a/docbook/wsug_src/WSUG_chapter_statistics.asciidoc b/docbook/wsug_src/WSUG_chapter_statistics.asciidoc
index cbd2912c03..88937380a5 100644
--- a/docbook/wsug_src/WSUG_chapter_statistics.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_statistics.asciidoc
@@ -70,11 +70,11 @@ image::wsug_graphics/ws-stats-summary.png[{screenshot-attrs}]
[[ChStatHierarchy]]
-=== The ``Protocol Hierarchy'' window
+=== The “Protocol Hierarchy” window
The protocol hierarchy of the captured packets.
-.The ``Protocol Hierarchy'' window
+.The “Protocol Hierarchy” window
image::wsug_graphics/ws-stats-hierarchy.png[{screenshot-attrs}]
This is a tree of all the protocols in the capture. Each row contains the
@@ -113,7 +113,7 @@ Packets usually contain multiple protocols. As a result more than one protocol w
be counted for each packet. Example: In the screenshot IP has 99.9% and TCP
98.5% (which is together much more than 100%).
-Protocol layers can consist of packets that won't contain any higher layer
+Protocol layers can consist of packets that won’t contain any higher layer
protocol, so the sum of all higher layer packets may not sum up to the protocols
packet count. Example: In the screenshot TCP has 98.5% but the sum of the
subprotocols (SSL, HTTP, etc) is much less. This can be caused by continuation
@@ -139,10 +139,10 @@ description of the known endpoint types can be found in
The conversations window is similar to the endpoint Window. See
<<ChStatEndpointsWindow>> for a description of their common features. Along with
addresses, packet counters, and byte counters the conversation window adds four
-columns: the start time of the conversation (``Rel Start'') or (``Abs Start''),
+columns: the start time of the conversation (“Rel Start”) or (“Abs Start”),
the duration of the conversation in seconds, and the average bits (not bytes)
per second in each direction. A timeline graph is also drawn across the
-``Rel Start'' / ``Abs Start'' and “Duration” columns.
+“Rel Start” / “Abs Start” and “Duration” columns.
.The “Conversations” window
image::wsug_graphics/ws-stats-conversations.png[{screenshot-attrs}]
@@ -153,9 +153,9 @@ _Name resolution_ will be done if selected in the window and if it is active for
the specific protocol layer (MAC layer for the selected Ethernet endpoints
page). _Limit to display filter_ will only show conversations matching the
current display filter. _Absolute start time_ switches the start time column
-between relative (``Rel Start'') and absolute (``Abs Start'') times. Relative start
-times match the ``Seconds Since Beginning of Capture'' time display format in the
-packet list and absolute start times match the ``Time of Day'' display format.
+between relative (“Rel Start”) and absolute (“Abs Start”) times. Relative start
+times match the “Seconds Since Beginning of Capture” time display format in the
+packet list and absolute start times match the “Time of Day” display format.
The btn:[Copy] button will copy the list values to the clipboard in CSV
(Comma Separated Values) or YAML format. The btn:[Follow Stream...] button
@@ -187,7 +187,7 @@ following endpoints into account:
====
If you are looking for a feature other network tools call a _hostlist_, here is
the right place to look. The list of Ethernet or IP endpoints is usually what
-you're looking for.
+you’re looking for.
====
.Endpoint and Conversation types
@@ -234,7 +234,7 @@ _USB_:: Identical to the 7-bit USB address.
.Broadcast and multicast endpoints
====
Broadcast and multicast traffic will be shown separately as additional
-endpoints. Of course, as these aren't physical endpoints the real traffic
+endpoints. Of course, as these aren’t physical endpoints the real traffic
will be received by some or all of the listed unicast endpoints.
====
@@ -248,7 +248,7 @@ This window shows statistics about the endpoints captured.
image::wsug_graphics/ws-stats-endpoints.png[{screenshot-attrs}]
For each supported protocol, a tab is shown in this window. Each tab label shows
-the number of endpoints captured (e.g. the tab label ``Ethernet &#183; 4'' tells
+the number of endpoints captured (e.g. the tab label “Ethernet &#183; 4” tells
you that four ethernet endpoints have been captured). If no endpoints of a
specific protocol were captured, the tab label will be greyed out (although the
related page can still be selected).
@@ -280,13 +280,13 @@ it before (or while) you are doing a live capture.
[[ChStatIOGraphs]]
-=== The ``IO Graphs'' window
+=== The “IO Graphs” window
User configurable graph of the captured network packets.
You can define up to five differently colored graphs.
-.The ``IO Graphs'' window
+.The “IO Graphs” window
image::wsug_graphics/ws-stats-iographs.png[{screenshot-attrs}]
The user can configure the following things:
@@ -362,19 +362,19 @@ different) compared to the following description.
[[ChStatSRTDceRpc]]
-==== The "Service Response Time DCE-RPC" window
+==== The “Service Response Time DCE-RPC” window
The service response time of DCE-RPC is the time between the request and the
corresponding response.
First of all, you have to select the DCE-RPC interface:
-.The "Compute DCE-RPC statistics" window
+.The “Compute DCE-RPC statistics” window
image::wsug_graphics/ws-stats-srt-dcerpc-filter.png[{screenshot-attrs}]
You can optionally set a display filter, to reduce the amount of packets.
-.The "DCE-RPC Statistic for ..." window
+.The “DCE-RPC Statistic for ...” window
image::wsug_graphics/ws-stats-srt-dcerpc.png[{screenshot-attrs}]
Each row corresponds to a method of the interface selected (so the EPM interface
@@ -395,11 +395,11 @@ is found it is checked for:
* IP header checksums
-* Excessive delay (defined by the "Time variance" setting)
+* Excessive delay (defined by the “Time variance” setting)
* Packet order
-.The "Compare" window
+.The “Compare” window
image::wsug_graphics/ws-stats-compare.png[{screenshot-attrs}]
You can configure the following:
@@ -435,7 +435,7 @@ Statistics of the captured WLAN traffic. This window will summarize the wireless
network traffic found in the capture. Probe requests will be merged into an
existing network if the SSID matches.
-.The "WLAN Traffic Statistics" window
+.The “WLAN Traffic Statistics” window
image::wsug_graphics/ws-stats-wlan-traffic.png[{screenshot-attrs}]
Each row in the list shows the statistical values for exactly one wireless
diff --git a/docbook/wsug_src/WSUG_chapter_telephony.asciidoc b/docbook/wsug_src/WSUG_chapter_telephony.asciidoc
index c7397d4aa7..200f2ac509 100644
--- a/docbook/wsug_src/WSUG_chapter_telephony.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_telephony.asciidoc
@@ -22,7 +22,7 @@ can even be played.
The RTP analysis function takes the selected RTP stream (and the reverse stream,
if possible) and generates a list of statistics on it.
-.The ``RTP Stream Analysis'' window
+.The “RTP Stream Analysis” window
image::wsug_graphics/ws-tel-rtpstream-analysis.png[{screenshot-attrs}]
Starting with basic data as packet number and sequence number, further
@@ -40,7 +40,7 @@ a to export and plot various statistics on the RTP streams.
=== IAX2 Analysis
-The ``IAX2 Analysis'' dialog shows statistics for the forward and reverse
+The “IAX2 Analysis” dialog shows statistics for the forward and reverse
streams of a selected IAX2 call along with a graph.
[[ChTelVoipCalls]]
@@ -68,7 +68,7 @@ More details can be found on the
Statistics of the captured LTE MAC traffic. This window will summarize the LTE
MAC traffic found in the capture.
-.The ``LTE MAC Traffic Statistics'' window
+.The “LTE MAC Traffic Statistics” window
image::wsug_graphics/ws-stats-lte-mac-traffic.png[{screenshot-attrs}]
The top pane shows statistics for common channels. Each row in the middle pane
@@ -83,7 +83,7 @@ individual channel.
Statistics of the captured LTE RLC traffic. This window will summarize the LTE
RLC traffic found in the capture.
-.The ``LTE RLC Traffic Statistics'' window
+.The “LTE RLC Traffic Statistics” window
image::wsug_graphics/ws-stats-lte-rlc-traffic.png[{screenshot-attrs}]
At the top, the check-box allows this window to include RLC PDUs found within
diff --git a/docbook/wsug_src/WSUG_chapter_troubleshoot.asciidoc b/docbook/wsug_src/WSUG_chapter_troubleshoot.asciidoc
index 5a768282b0..abd298e38d 100644
--- a/docbook/wsug_src/WSUG_chapter_troubleshoot.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_troubleshoot.asciidoc
@@ -49,12 +49,12 @@ more details on capturing with _tcpdump_, see <<Ch05tcpdump>>.
In the old days of Ethernet, all network traffic was spread over one “yellow”
cable through the whole network. Capturing data was easy, as all packets from
-the network could be captured using the ``promiscuous mode'' at any place in the
+the network could be captured using the “promiscuous mode” at any place in the
network. The only devices blocking network traffic, were routers. But as routers
were extremely expensive, they were not widely used.
Then Ethernet wiring using hubs become the state of the art. As the hubs still
-spaded the packets all over the network, things regarding capturing didn't
+spaded the packets all over the network, things regarding capturing didn’t
change.
At the next stage, Ethernet switches became widely available. This complicated
@@ -65,9 +65,9 @@ the promiscuous mode of the capturing network card.
There are some ways to circumvent this.
-Many vendor’s switches support a feature known as ``port spanning'' or ``port
-mirroring'' in which all of the traffic to and from port A are also sent out
-port B. An excellent reference on the ``port spanning'' feature of Cisco
+Many vendor’s switches support a feature known as “port spanning” or “port
+mirroring” in which all of the traffic to and from port A are also sent out
+port B. An excellent reference on the “port spanning” feature of Cisco
switches can be found at
link:$$http://www.cisco.com/warp/public/473/41.html$$[Configuring the Catalyst Switched Port Analyzer (SPAN) Feature]
diff --git a/docbook/wsug_src/WSUG_chapter_use.asciidoc b/docbook/wsug_src/WSUG_chapter_use.asciidoc
index 20a0728e16..fd21e7afa2 100644
--- a/docbook/wsug_src/WSUG_chapter_use.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_use.asciidoc
@@ -91,8 +91,8 @@ a capture file. See <<ChUseTabGo>> for additional navigation keystrokes.
|kbd:[Tab] or kbd:[Shift+Tab]|Move between screen elements, e.g. from the toolbars to the packet list to the packet detail.
|kbd:[↓] |Move to the next packet or detail item.
|kbd:[↑] |Move to the previous packet or detail item.
-|kbd:[Ctrl+↓] or kbd:[F8] |Move to the next packet, even if the packet list isn't focused.
-|kbd:[Ctrl+↑] or kbd:[F7] |Move to the previous packet, even if the packet list isn't focused.
+|kbd:[Ctrl+↓] or kbd:[F8] |Move to the next packet, even if the packet list isn’t focused.
+|kbd:[Ctrl+↑] or kbd:[F7] |Move to the previous packet, even if the packet list isn’t focused.
|kbd:[Ctrl+.] |Move to the next packet of the conversation (TCP, UDP or IP).
|kbd:[Ctrl+&#44;] |Move to the previous packet of the conversation (TCP, UDP or IP).
|kbd:[Alt+→] or kbd:[Option+→] (macOS) |Move to the next packet in the selection history.
@@ -120,8 +120,8 @@ Linux) or at the top of your main screen (macOS). An example is shown in
[NOTE]
====
-Some menu items will be disabled (greyed out) if the corresponding feature isn't
-available. For example, you cannot save a capture file if you haven't captured
+Some menu items will be disabled (greyed out) if the corresponding feature isn’t
+available. For example, you cannot save a capture file if you haven’t captured
or loaded any packets.
====
@@ -187,7 +187,7 @@ Each of these menu items is described in more detail in the sections that follow
====
Most common menu items have keyboard shortcuts. For example, you can
press the Control (or Strg in German) and the K keys together to open the
-``Capture Options'' dialog.
+“Capture Options” dialog.
====
[[ChUseFileMenuSection]]
@@ -225,7 +225,7 @@ text file containing a hex dump into a new temporary capture. It is discussed in
more detail in <<ChIOImportSection>>.
|menu:Close[] |kbd:[Ctrl+W]|
-This menu item closes the current capture. If you haven't saved the capture, you
+This menu item closes the current capture. If you haven’t saved the capture, you
will be asked to do so first (this can be disabled by a preference setting).
|menu:Save[] |kbd:[Ctrl+S]|
@@ -251,12 +251,12 @@ Wireshark List File Set dialog box (which is discussed further in
|menu:File Set[Next File] ||
If the currently loaded file is part of a file set, jump to the next file in the
-set. If it isn't part of a file set or just the last file in that set, this item
+set. If it isn’t part of a file set or just the last file in that set, this item
is greyed out.
|menu:File Set[Previous File] ||
If the currently loaded file is part of a file set, jump to the previous file in
-the set. If it isn't part of a file set or just the first file in that set, this
+the set. If it isn’t part of a file set or just the first file in that set, this
item is greyed out.
|menu:Export Specified Packets...[] ||
@@ -281,7 +281,7 @@ file. It pops up the Wireshark Print dialog box (which is discussed further in
|menu:Quit[] |kbd:[Ctrl+Q]|
This menu item allows you to quit from Wireshark. Wireshark will ask to save
-your capture file if you haven't previously saved it (this can be disabled by a
+your capture file if you haven’t previously saved it (this can be disabled by a
preference setting).
|===============
@@ -311,12 +311,12 @@ criteria. There is further information on finding packets in
<<ChWorkFindPacketSection>>.
|menu:Find Next[] |kbd:[Ctrl+N] |
-This menu item tries to find the next packet matching the settings from ``Find
-Packet...''.
+This menu item tries to find the next packet matching the settings from “Find
+Packet...”.
|menu:Find Previous[] |kbd:[Ctrl+B] |
This menu item tries to find the previous packet matching the settings from
-``Find Packet...''.
+“Find Packet...”.
|menu:Mark/Unmark Packet[] |kbd:[Ctrl+M] |
This menu item marks the currently selected packet. See
@@ -408,9 +408,9 @@ image::wsug_graphics/ws-view-menu.png[{screenshot-attrs}]
|menu:Packet Bytes[] ||This menu item hides or shows the packet bytes pane, see <<ChUsePacketBytesPaneSection>>.
|menu:Time Display Format[Date and Time of Day: 1970-01-01 01:02:03.123456]|| Selecting this tells Wireshark to display the time stamps in date and time of day format, see <<ChWorkTimeFormatsSection>>.
-The fields "Time of Day", "Date and Time of Day", "Seconds Since Beginning of
-Capture", "Seconds Since Previous Captured Packet" and "Seconds Since Previous
-Displayed Packet" are mutually exclusive.
+The fields “Time of Day”, “Date and Time of Day”, “Seconds Since Beginning of
+Capture”, “Seconds Since Previous Captured Packet” and “Seconds Since Previous
+Displayed Packet” are mutually exclusive.
|menu:Time Display Format[Time of Day: 01:02:03.123456]||Selecting this tells Wireshark to display time stamps in time of day format, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Seconds Since Epoch (1970-01-01): 1234567890.123456]||Selecting this tells Wireshark to display time stamps in seconds since 1970-01-01 00:00:00, see <<ChWorkTimeFormatsSection>>.
@@ -419,7 +419,7 @@ Displayed Packet" are mutually exclusive.
|menu:Time Display Format[Seconds Since Previous Displayed Packet: 1.123456]||Selecting this tells Wireshark to display time stamps in seconds since previous displayed packet format, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Automatic (File Format Precision)]||Selecting this tells Wireshark to display time stamps with the precision given by the capture file format used, see <<ChWorkTimeFormatsSection>>.
-The fields "Automatic", "Seconds" and "...seconds" are mutually exclusive.
+The fields “Automatic”, “Seconds” and “...seconds” are mutually exclusive.
|menu:Time Display Format[Seconds: 0]||Selecting this tells Wireshark to display time stamps with a precision of one second, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[...seconds: 0....]||Selecting this tells Wireshark to display time stamps with a precision of one second, decisecond, centisecond, millisecond, microsecond or nanosecond, see <<ChWorkTimeFormatsSection>>.
@@ -472,13 +472,13 @@ image::wsug_graphics/ws-go-menu.png[{screenshot-attrs}]
|menu:Back[] |kbd:[Alt+←] |Jump to the recently visited packet in the packet history, much like the page history in a web browser.
|menu:Forward[] |kbd:[Alt+→] |Jump to the next visited packet in the packet history, much like the page history in a web browser.
|menu:Go to Packet...[] |kbd:[Ctrl+G] |Bring up a window frame that allows you to specify a packet number, and then goes to that packet. See <<ChWorkGoToPacketSection>> for details.
-|menu:Go to Corresponding Packet[] | |Go to the corresponding packet of the currently selected protocol field. If the selected field doesn't correspond to a packet, this item is greyed out.
-|menu:Previous Packet[] |kbd:[Ctrl+↑]|Move to the previous packet in the list. This can be used to move to the previous packet even if the packet list doesn't have keyboard focus.
-|menu:Next Packet[] |kbd:[Ctrl+↓]|Move to the next packet in the list. This can be used to move to the previous packet even if the packet list doesn't have keyboard focus.
+|menu:Go to Corresponding Packet[] | |Go to the corresponding packet of the currently selected protocol field. If the selected field doesn’t correspond to a packet, this item is greyed out.
+|menu:Previous Packet[] |kbd:[Ctrl+↑]|Move to the previous packet in the list. This can be used to move to the previous packet even if the packet list doesn’t have keyboard focus.
+|menu:Next Packet[] |kbd:[Ctrl+↓]|Move to the next packet in the list. This can be used to move to the previous packet even if the packet list doesn’t have keyboard focus.
|menu:First Packet[] |kbd:[Ctrl+Home] |Jump to the first packet of the capture file.
|menu:Last Packet[] |kbd:[Ctrl+End] |Jump to the last packet of the capture file.
-|menu:Previous Packet In Conversation[] |kbd:[Ctrl+&#44;] |Move to the previous packet in the current conversation. This can be used to move to the previous packet even if the packet list doesn't have keyboard focus.
-|menu:Next Packet In Conversation[] |kbd:[Ctrl+.] |Move to the next packet in the current conversation. This can be used to move to the previous packet even if the packet list doesn't have keyboard focus.
+|menu:Previous Packet In Conversation[] |kbd:[Ctrl+&#44;] |Move to the previous packet in the current conversation. This can be used to move to the previous packet even if the packet list doesn’t have keyboard focus.
+|menu:Next Packet In Conversation[] |kbd:[Ctrl+.] |Move to the next packet in the current conversation. This can be used to move to the previous packet even if the packet list doesn’t have keyboard focus.
|===============
[[ChUseCaptureMenuSection]]
@@ -523,13 +523,13 @@ image::wsug_graphics/ws-analyze-menu.png[{screenshot-attrs}]
|menu:Display Filter Macros...[] ||This menu item brings up a dialog box that allows you to create and edit display filter macros. You can name filter macros, and you can save them for future use. More detail on this subject is provided in <<ChWorkDefineFilterMacrosSection>>
|menu:Apply as Column[] ||This menu item adds the selected protocol item in the packet details pane as a column to the packet list.
|menu:Apply as Filter[...] ||These menu items will change the current display filter and apply the changed filter immediately. Depending on the chosen menu item, the current display filter string will be replaced or appended to by the selected protocol field in the packet details pane.
-|menu:Prepare a Filter[...] ||These menu items will change the current display filter but won't apply the changed filter. Depending on the chosen menu item, the current display filter string will be replaced or appended to by the selected protocol field in the packet details pane.
+|menu:Prepare a Filter[...] ||These menu items will change the current display filter but won’t apply the changed filter. Depending on the chosen menu item, the current display filter string will be replaced or appended to by the selected protocol field in the packet details pane.
|menu:Enabled Protocols...[] |kbd:[Shift+Ctrl+E]|This menu item allows the user to enable/disable protocol dissectors, see <<ChAdvEnabledProtocols>>
|menu:Decode As...[] ||This menu item allows the user to force Wireshark to decode certain packets as a particular protocol, see <<ChAdvDecodeAs>>
|menu:User Specified Decodes...[] ||This menu item allows the user to force Wireshark to decode certain packets as a particular protocol, see <<ChAdvDecodeAsShow>>
|menu:Follow TCP Stream[] ||This menu item brings up a separate window and displays all the TCP segments captured that are on the same TCP connection as a selected packet, see <<ChAdvFollowTCPSection>>
-|menu:Follow UDP Stream[] ||Same functionality as ``Follow TCP Stream'' but for UDP streams.
-|menu:Follow SSL Stream[] ||Same functionality as ``Follow TCP Stream'' but for SSL streams. See the wiki page on link:{wireshark-wiki-url}SSL[SSL] for instructions on providing SSL keys.
+|menu:Follow UDP Stream[] ||Same functionality as “Follow TCP Stream” but for UDP streams.
+|menu:Follow SSL Stream[] ||Same functionality as “Follow TCP Stream” but for SSL streams. See the wiki page on link:{wireshark-wiki-url}SSL[SSL] for instructions on providing SSL keys.
|menu:Expert Info[] ||Open a dialog showing some expert information about the captured packets. The amount of information will depend on the protocol and varies from very detailed to non-existent. XXX - add a new section about this and link from here
|menu:Conversation Filter[...] ||In this menu you will find conversation filter for various protocols.
|===============
@@ -628,7 +628,7 @@ image::wsug_graphics/ws-tools-menu.png[{screenshot-attrs}]
It is assumed that the rules will be applied to an outside interface.
-|menu:Lua[]|| These options allow you to work with the Lua interpreter optionally build into Wireshark. See the ``Lua Support in Wireshark'' in the Wireshark Developer’s Guide.
+|menu:Lua[]|| These options allow you to work with the Lua interpreter optionally build into Wireshark. See the “Lua Support in Wireshark” in the Wireshark Developer’s Guide.
|===============
[[ChUseInternalsMenuSection]]
@@ -696,7 +696,7 @@ View menu, if the space on the screen is needed to show even more packet data.
As in the menu, only the items useful in the current program state will be
available. The others will be greyed out (e.g. you cannot save a capture file if
-you haven't loaded one).
+you haven’t loaded one).
[[ChUseWiresharkMainToolbar]]
@@ -760,12 +760,12 @@ image::wsug_graphics/ws-filter-toolbar.png[{screenshot-attrs}]
|image:wsug_graphics/toolbar/display_filter_24.png[{toolbar-icon-attrs}]|btn:[Filter:]|Brings up the filter construction dialog, described in <<FiltersDialog>>.
||_Filter input_|The area to enter or edit a display filter string, see <<ChWorkBuildDisplayFilterSection>>. A syntax check of your filter string is done while you are typing. The background will turn red if you enter an incomplete or invalid string, and will become green when you enter a valid string. You can click on the pull down arrow to select a previously-entered filter string from a list. The entries in the pull down list will remain available even after a program restart.
-After you've changed something in this field, don't forget to press the Apply
+After you’ve changed something in this field, don’t forget to press the Apply
button (or the Enter/Return key), to apply this filter string to the display.
This field is also where the current filter in effect is displayed.
-|image:wsug_graphics/toolbar/stock_add_24.png[{toolbar-icon-attrs}] |btn:[Expression...]|The middle button labeled "Add Expression..." opens a dialog box that lets you edit a display filter from a list of protocol fields, described in <<ChWorkFilterAddExpressionSection>>
+|image:wsug_graphics/toolbar/stock_add_24.png[{toolbar-icon-attrs}] |btn:[Expression...]|The middle button labeled “Add Expression...” opens a dialog box that lets you edit a display filter from a list of protocol fields, described in <<ChWorkFilterAddExpressionSection>>
|image:wsug_graphics/toolbar/stock_clear_24.png[{toolbar-icon-attrs}] |btn:[Clear]|Reset the current display filter and clears the edit area.
|image:wsug_graphics/toolbar/stock_apply_20.png[{toolbar-icon-attrs}] |btn:[Apply]|Apply the current value in the edit area as the new display filter.
@@ -775,17 +775,17 @@ Applying a display filter on large capture files might take quite a long time.
[[ChUsePacketListPaneSection]]
-=== The ``Packet List'' pane
+=== The “Packet List” pane
The packet list pane displays all the packets in the current capture file.
[[ChUseWiresharkListPane]]
-.The ``Packet List'' pane
+.The “Packet List” pane
image::wsug_graphics/ws-list-pane.png[{screenshot-attrs}]
Each line in the packet list corresponds to one packet in the capture file. If
-you select a line in this pane, more details will be displayed in the ``Packet
-Details'' and ``Packet Bytes'' panes.
+you select a line in this pane, more details will be displayed in the “Packet
+Details” and “Packet Bytes” panes.
While dissecting a packet, Wireshark will place information from the protocol
dissectors into the columns. As higher level protocols might overwrite
@@ -802,7 +802,7 @@ be selected by preference settings, see <<ChCustPreferencesSection>>.
The default columns will show:
-* btn:[No.] The number of the packet in the capture file. This number won't
+* btn:[No.] The number of the packet in the capture file. This number won’t
change, even if a display filter is used.
* btn:[Time] The timestamp of the packet. The presentation format of this
@@ -873,18 +873,18 @@ Right clicking will show a context menu, described in
[[ChUsePacketDetailsPaneSection]]
-=== The ``Packet Details'' pane
+=== The “Packet Details” pane
-The packet details pane shows the current packet (selected in the ``Packet List''
+The packet details pane shows the current packet (selected in the “Packet List”
pane) in a more detailed form.
[[ChUseWiresharkDetailsPane]]
-.The ``Packet Details'' pane
+.The “Packet Details” pane
image::wsug_graphics/ws-details-pane.png[{screenshot-attrs}]
This pane shows the protocols and protocol fields of the packet selected in the
-``Packet List'' pane. The protocols and fields of the packet shown in a tree
+“Packet List” pane. The protocols and fields of the packet shown in a tree
which can be expanded and collapsed.
There is a context menu (right mouse click) available. See details in
@@ -893,7 +893,7 @@ There is a context menu (right mouse click) available. See details in
Some protocol fields have special meanings.
* *Generated fields.* Wireshark itself will generate additional protocol
- information which isn't present in the captured data. This information is
+ information which isn’t present in the captured data. This information is
enclosed in square brackets (“[” and “]”). Generated information includes
response times, TCP analysis, GeoIP information, and checksum validation.
@@ -904,17 +904,17 @@ Some protocol fields have special meanings.
[[ChUsePacketBytesPaneSection]]
-=== The ``Packet Bytes'' pane
+=== The “Packet Bytes” pane
The packet bytes pane shows the data of the current packet (selected in the
-``Packet List'' pane) in a hexdump style.
+“Packet List” pane) in a hexdump style.
[[ChUseWiresharkBytesPane]]
-.The ``Packet Bytes'' pane
+.The “Packet Bytes” pane
image::wsug_graphics/ws-bytes-pane.png[{screenshot-attrs}]
-The ``Packet Bytes'' pane shows a canonical
+The “Packet Bytes” pane shows a canonical
https://en.wikipedia.org/wiki/Hex_dump[hex dump] of the packet data. Each line
contains the data offset, sixteen hexadecimal bytes, and sixteen ASCII bytes.
Non-printalbe bytes are replaced with a period (“.”).
@@ -925,7 +925,7 @@ when Wireshark has reassembled some packets into a single chunk of data. (See
source by clicking its corresponding tab at the bottom of the pane.
[[ChUseWiresharkBytesPaneTabs]]
-.The ``Packet Bytes'' pane with tabs
+.The “Packet Bytes” pane with tabs
image::wsug_graphics/ws-bytes-pane-tabs.png[{screenshot-attrs}]
Additional pages typically contain data reassembled from multiple packets or
@@ -998,8 +998,8 @@ For a detailed description of configuration profiles, see <<ChCustConfigProfiles
.The Statusbar with a selected protocol field
image::wsug_graphics/ws-statusbar-selected.png[{statusbar-attrs}]
-This is displayed if you have selected a protocol field from the ``Packet
-Details'' pane.
+This is displayed if you have selected a protocol field from the “Packet
+Details” pane.
[TIP]
diff --git a/docbook/wsug_src/WSUG_chapter_work.asciidoc b/docbook/wsug_src/WSUG_chapter_work.asciidoc
index 9907baa8a8..ce8eba4a6e 100644
--- a/docbook/wsug_src/WSUG_chapter_work.asciidoc
+++ b/docbook/wsug_src/WSUG_chapter_work.asciidoc
@@ -25,8 +25,8 @@ header selected, which shows up in the byte view as the selected bytes.
image::wsug_graphics/ws-packet-selected.png[{screenshot-attrs}]
You can also select and view packets the same way while Wireshark is capturing
-if you selected ``Update list of packets in real time'' in the ``Capture
-Preferences'' dialog box.
+if you selected “Update list of packets in real time” in the “Capture
+Preferences” dialog box.
In addition you can view individual packets in a separate window as shown in
<<ChWorkPacketSepView>>. You can do this by double-clicking on an item in the
@@ -51,16 +51,16 @@ number of other ways to open a new packet window:
=== Pop-up menus
-You can bring up a pop-up menu over either the ``Packet List'', its column header,
-or ``Packet Details'' pane by clicking your right mouse button at the
+You can bring up a pop-up menu over either the “Packet List”, its column header,
+or “Packet Details” pane by clicking your right mouse button at the
corresponding pane.
[[ChWorkColumnHeaderPopUpMenuSection]]
-==== Pop-up menu of the ``Packet List'' column header
+==== Pop-up menu of the “Packet List” column header
[[ChWorkColumnHeaderPopUpMenu]]
-.Pop-up menu of the ``Packet List'' column header
+.Pop-up menu of the “Packet List” column header
image::wsug_graphics/ws-column-header-popup-menu.png[{screenshot-attrs}]
The following table gives an overview of which functions are available in this
@@ -68,7 +68,7 @@ header, where to find the corresponding function in the main menu, and a short
description of each item.
[[ColumnHeaderPopupMenuTable]]
-.The menu items of the ``Packet List'' column header pop-up menu
+.The menu items of the “Packet List” column header pop-up menu
[options="header",cols="3,2,5"]
|===============
|Item|Identical to main menu’s item:|Description
@@ -88,17 +88,17 @@ description of each item.
[[ChWorkPacketListPanePopUpMenuSection]]
-==== Pop-up menu of the ``Packet List'' pane
+==== Pop-up menu of the “Packet List” pane
[[ChWorkPacketListPanePopUpMenu]]
-.Pop-up menu of the ``Packet List'' pane
+.Pop-up menu of the “Packet List” pane
image::wsug_graphics/ws-packet-pane-popup-menu.png[{screenshot-attrs}]
The following table gives an overview of which functions are available in this pane, where to find the corresponding function in the main menu, and a short description of each item.
[[PacketListPopupMenuTable]]
-.The menu items of the ``Packet List'' pop-up menu
+.The menu items of the “Packet List” pop-up menu
[options="header",cols="3,2,5"]
|===============
|Item|Identical to main menu’s item:|Description
@@ -113,7 +113,7 @@ The following table gives an overview of which functions are available in this
|menu:SCTP[]|| Allows you to analyze and prepare a filter for this SCTP association.
|menu:Follow TCP Stream[]|menu:Analyze[]| Allows you to view all the data on a TCP stream between a pair of nodes.
|menu:Follow UDP Stream[]|menu:Analyze[]| Allows you to view all the data on a UDP datagram stream between a pair of nodes.
-|menu:Follow SSL Stream[]|menu:Analyze[]| Same as ``Follow TCP Stream'' but for SSL. XXX - add a new section describing this better.
+|menu:Follow SSL Stream[]|menu:Analyze[]| Same as “Follow TCP Stream” but for SSL. XXX - add a new section describing this better.
|menu:Copy/ Summary (Text)[]|| Copy the summary fields as displayed to the clipboard, as tab-separated text.
|menu:Copy/ Summary (CSV)[]|| Copy the summary fields as displayed to the clipboard, as comma-separated text.
|menu:Copy/ As Filter[]|| Prepare a display filter based on the currently selected item and copy that filter to the clipboard.
@@ -130,11 +130,11 @@ The following table gives an overview of which functions are available in this
[[ChWorkPacketDetailsPanePopUpMenuSection]]
-==== Pop-up menu of the ``Packet Details'' pane
+==== Pop-up menu of the “Packet Details” pane
[[ChWorkPacketDetailsPanePopUpMenu]]
-.Pop-up menu of the ``Packet Details'' pane
+.Pop-up menu of the “Packet Details” pane
image::wsug_graphics/ws-details-pane-popup-menu.png[{screenshot-attrs}]
The following table gives an overview of which functions are available in this
@@ -143,7 +143,7 @@ description of each item.
[[PacketDetailsPopupMenuTable]]
-.The menu items of the ``Packet Details'' pop-up menu
+.The menu items of the “Packet Details” pop-up menu
[options="header",cols="3,2,5"]
|===============
|Item|Identical to main menu’s item:|Description
@@ -157,7 +157,7 @@ description of each item.
|menu:Colorize with Filter[]|| This menu item uses a display filter with the information from the selected protocol item to build a new colorizing rule.
|menu:Follow TCP Stream[]|menu:Analyze[]| Allows you to view all the data on a TCP stream between a pair of nodes.
|menu:Follow UDP Stream[]|menu:Analyze[]| Allows you to view all the data on a UDP datagram stream between a pair of nodes.
-|menu:Follow SSL Stream[]|menu:Analyze[]| Same as ``Follow TCP Stream'' but for SSL. XXX - add a new section describing this better.
+|menu:Follow SSL Stream[]|menu:Analyze[]| Same as “Follow TCP Stream” but for SSL. XXX - add a new section describing this better.
|menu:Copy/ Description[]|menu:Edit[]| Copy the displayed text of the selected field to the system clipboard.
|menu:Copy/ Fieldname[]|menu:Edit[]| Copy the name of the selected field to the system clipboard.
|menu:Copy/ Value[]|menu:Edit[]| Copy the value of the selected field to the system clipboard.
@@ -208,7 +208,7 @@ example of what happens when you type _tcp_ in the filter field.
[NOTE]
====
-All protocol and field names are entered in lowercase. Also, don't forget to press enter after entering the filter expression.
+All protocol and field names are entered in lowercase. Also, don’t forget to press enter after entering the filter expression.
====
@@ -263,8 +263,8 @@ result in showing only the packets where this field exists. For example: the
filter string: _tcp_ will show all packets containing the tcp protocol.
There is a complete list of all filter fields available through the menu item
-menu:Help[Supported Protocols] in the page ``Display Filter Fields'' of the
-``Supported Protocols'' dialog.
+menu:Help[Supported Protocols] in the page “Display Filter Fields” of the
+“Supported Protocols” dialog.
// XXX - add some more info here and a link to the statusbar info.
@@ -366,11 +366,11 @@ http.host matches "acme\.(org|com|net)"
----
The example above match HTTP packets where the HOST header contains acme.org or acme.com
or acme.net. Comparisons are case-insensitive. Note: Wireshark needs to be built with
-libpcre in order to be able to use the `matches` resp. `~`` operator.
+libpcre in order to be able to use the `matches` resp. `{tilde}` operator.
----
tcp.flags & 0x02
----
-That expression will match all packets that contain a "tcp.flags" field with the 0x02 bit,
+That expression will match all packets that contain a “tcp.flags” field with the 0x02 bit,
i.e. the SYN bit, set.
==== Combining expressions
@@ -387,8 +387,8 @@ You can combine filter expressions in Wireshark using the logical operators sho
|or |\|\| | Logical OR. `ip.scr==10.0.0.5 or ip.src==192.1.1.1`
|xor |^^ | Logical XOR. `tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29`
|not |! | Logical NOT. `not llc`
-|[...] | | See ``Substring Operator'' below.
-|in | | See ``Membership Operator'' below.
+|[...] | | See “Substring Operator” below.
+|in | | See “Membership Operator” below.
|===============
==== Substring Operator
@@ -455,39 +455,39 @@ address 1.2.3.4 in it. Unfortunately, this does _not_ do the expected.
Instead, that expression will even be true for packets where either source or
destination IP address equals 1.2.3.4. The reason for this, is that the
-expression `ip.addr != 1.2.3.4` must be read as ``the packet contains a field
-named ip.addr with a value different from 1.2.3.4''. As an IP datagram contains
+expression `ip.addr != 1.2.3.4` must be read as “the packet contains a field
+named ip.addr with a value different from 1.2.3.4”. As an IP datagram contains
both a source and a destination address, the expression will evaluate to true
whenever at least one of the two addresses differs from 1.2.3.4.
If you want to filter out all packets containing IP datagrams to or from IP
address 1.2.3.4, then the correct filter is `!(ip.addr == 1.2.3.4)` as it reads
-``show me all the packets for which it is not true that a field named ip.addr
-exists with a value of 1.2.3.4'', or in other words, ``filter out all packets
+“show me all the packets for which it is not true that a field named ip.addr
+exists with a value of 1.2.3.4”, or in other words, “filter out all packets
for which there are no occurrences of a field named ip.addr with the value
-1.2.3.4''.
+1.2.3.4”.
[[ChWorkFilterAddExpressionSection]]
-=== The ``Filter Expression'' dialog box
+=== The “Filter Expression” dialog box
When you are accustomed to Wireshark’s filtering system and know what labels you
wish to use in your filters it can be very quick to simply type a filter string.
However if you are new to Wireshark or are working with a slightly unfamiliar
protocol it can be very confusing to try to figure out what to type. The
-``Filter Expression'' dialog box helps with this.
+“Filter Expression” dialog box helps with this.
[TIP]
====
-The ``Filter Expression'' dialog box is an excellent way to learn how to write
+The “Filter Expression” dialog box is an excellent way to learn how to write
Wireshark display filter strings.
====
[[ChWorkFilterAddExpression1]]
-.The ``Filter Expression'' dialog box
+.The “Filter Expression” dialog box
image::wsug_graphics/ws-filter-add-expression.png[{screenshot-attrs}]
When you first bring up the Filter Expression dialog box you are shown a tree
@@ -528,7 +528,7 @@ When you have built a satisfactory expression click btn:[OK] and a filter string
will be built for you.
_Cancel_::
-You can leave the ``Add Expression...'' dialog box without any effect by
+You can leave the “Add Expression...” dialog box without any effect by
clicking the btn:[Cancel] button.
[[ChWorkDefineFilterSection]]
@@ -557,7 +557,7 @@ Wireshark.
[[FiltersDialog]]
-.The ``Capture Filters'' and ``Display Filters'' dialog boxes
+.The “Capture Filters” and “Display Filters” dialog boxes
image::wsug_graphics/ws-filters.png[{screenshot-attrs}]
_New_::
@@ -626,11 +626,11 @@ a previously saved capture file. Simply select the _Find Packet..._ menu item
from the _Edit_ menu. Wireshark will pop up the dialog box shown in
<<ChWorkFindPacketDialog>>.
-==== The ``Find Packet'' dialog box
+==== The “Find Packet” dialog box
[[ChWorkFindPacketDialog]]
-.The ``Find Packet'' dialog box
+.The “Find Packet” dialog box
image::wsug_graphics/ws-find-packet.png[{screenshot-attrs}]
You might first select the kind of thing to search for:
@@ -669,14 +669,14 @@ Search upwards in the packet list (decreasing packet numbers).
+
Search downwards in the packet list (increasing packet numbers).
-==== The ``Find Next'' command
+==== The “Find Next” command
-``Find Next'' will continue searching with the same options used in the last
-``Find Packet''.
+“Find Next” will continue searching with the same options used in the last
+“Find Packet”.
-==== The ``Find Previous'' command
+==== The “Find Previous” command
-``Find Previous'' will do the same thing as ``Find Next'', but in the reverse
+“Find Previous” will do the same thing as “Find Next”, but in the reverse
direction.
[[ChWorkGoToPacketSection]]
@@ -685,25 +685,25 @@ direction.
You can easily jump to specific packets with one of the menu items in the Go menu.
-==== The ``Go Back'' command
+==== The “Go Back” command
Go back in the packet history, works much like the page history in current web browsers.
-==== The ``Go Forward'' command
+==== The “Go Forward” command
Go forward in the packet history, works much like the page history in current web browsers.
-==== The ``Go to Packet'' dialog box
+==== The “Go to Packet” dialog box
[[ChWorkGoToPacketDialog]]
-.The ``Go To Packet'' dialog box
+.The “Go To Packet” dialog box
image::wsug_graphics/ws-goto-packet.png[{screenshot-attrs}]
This dialog box will let you enter a packet number. When you press btn:[OK],
Wireshark will jump to that packet.
-==== The ``Go to Corresponding Packet'' command
+==== The “Go to Corresponding Packet” command
If a protocol field is selected which points to another packet in the capture
file, this command will jump to that packet.
@@ -711,11 +711,11 @@ file, this command will jump to that packet.
As these protocol fields now work like links (just as in your Web browser), it’s
easier to simply double-click on the field to jump to the corresponding field.
-==== The ``Go to First Packet'' command
+==== The “Go to First Packet” command
This command will simply jump to the first packet displayed.
-==== The ``Go to Last Packet'' command
+==== The “Go to Last Packet” command
This command will simply jump to the last packet displayed.
@@ -723,7 +723,7 @@ This command will simply jump to the last packet displayed.
=== Marking packets
-You can mark packets in the ``Packet List'' pane. A marked packet will be shown
+You can mark packets in the “Packet List” pane. A marked packet will be shown
with black background, regardless of the coloring rules set. Marking a packet
can be useful to find it later while analyzing in a large capture file.
@@ -742,21 +742,21 @@ There are three functions to manipulate the marked state of a packet:
* _Unmark all packets_ reset the mark state of all packets.
-These mark functions are available from the “Edit” menu, and the ``Mark packet
-(toggle)'' function is also available from the pop-up menu of the ``Packet
-List'' pane.
+These mark functions are available from the “Edit” menu, and the “Mark packet
+(toggle)” function is also available from the pop-up menu of the “Packet
+List” pane.
[[ChWorkIgnorePacketSection]]
=== Ignoring packets
-You can ignore packets in the ``Packet List'' pane. Wireshark will then pretend
+You can ignore packets in the “Packet List” pane. Wireshark will then pretend
that this packets does not exist in the capture file. An ignored packet will be
shown with white background and gray foreground, regardless of the coloring
rules set.
The packet ignored marks are not stored in the capture file or anywhere else.
-All ``packet ignored'' marks will be lost when you close the capture file.
+All “packet ignored” marks will be lost when you close the capture file.
There are three functions to manipulate the ignored state of a packet:
@@ -766,9 +766,9 @@ There are three functions to manipulate the ignored state of a packet:
* _Un-Ignore all packets_ reset the ignored state of all packets.
-These ignore functions are available from the “Edit” menu, and the ``Ignore
-packet (toggle)'' function is also available from the pop-up menu of the
-``Packet List'' pane.
+These ignore functions are available from the “Edit” menu, and the “Ignore
+packet (toggle)” function is also available from the pop-up menu of the
+“Packet List” pane.
[[ChWorkTimeFormatsSection]]
@@ -792,7 +792,7 @@ The available presentation formats are:
was captured.
* _Seconds Since Beginning of Capture: 123.123456_ The time relative to the
- start of the capture file or the first ``Time Reference'' before this packet
+ start of the capture file or the first “Time Reference” before this packet
(see <<ChWorkTimeReferencePacketSection>>).
* _Seconds Since Previous Captured Packet: 1.123456_ The time relative to the
@@ -814,8 +814,8 @@ The available precisions (aka. the number of displayed decimal places) are:
the actually available precision is smaller, zeros will be appended. If the
precision is larger, the remaining decimal places will be cut off.
-Precision example: If you have a timestamp and it’s displayed using, ``Seconds
-Since Previous Packet'' the value might be 1.123456. This will be displayed
+Precision example: If you have a timestamp and it’s displayed using, “Seconds
+Since Previous Packet” the value might be 1.123456. This will be displayed
using the “Automatic” setting for libpcap files (which is microseconds). If
you use Seconds it would show simply 1 and if you use Nanoseconds it shows
1.123456000.
@@ -833,20 +833,20 @@ The time references will not be saved permanently and will be lost when you
close the capture file.
Time referencing will only be useful if the time display format is set to
-``Seconds Since Beginning of Capture''. If one of the other time display formats
+“Seconds Since Beginning of Capture”. If one of the other time display formats
are used, time referencing will have no effect (and will make no sense either).
To work with time references, choose one of the menu:Time Reference[] items in
-the menu:[Edit] menu or from the pop-up menu of the ``Packet List'' pane. See
+the menu:[Edit] menu or from the pop-up menu of the “Packet List” pane. See
<<ChUseEditMenuSection>>.
* _Set Time Reference (toggle)_ Toggles the time reference state of the
currently selected packet to on or off.
-* _Find Next_ Find the next time referenced packet in the ``Packet List'' pane.
+* _Find Next_ Find the next time referenced packet in the “Packet List” pane.
-* _Find Previous_ Find the previous time referenced packet in the ``Packet
- List'' pane.
+* _Find Previous_ Find the previous time referenced packet in the “Packet
+ List” pane.
[[ChWorkTimeReference]]