aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGerald Combs <gerald@wireshark.org>2017-09-25 14:06:37 -0700
committerGerald Combs <gerald@wireshark.org>2017-09-25 23:05:11 +0000
commite2d43e7d4b352206bac6bdd42f2c8f04d1e126b2 (patch)
tree03d51a4ecfe9c4aa3cc1225ed93f2ae6c4200992
parentf3d9766cbc83316544aae7fdd0f0f854160eafa3 (diff)
Docbook: Automatically generate the tools help output.
Add a CMake target that dumps the help output for our command line tools to individual files. Include those files in the tools appendix instead of pasting them in manually. Fixup the output of some tools so that they pass the pre-commit checks. Change-Id: I925f24818422a190927a96531c21f4d16d3fe5b5 Reviewed-on: https://code.wireshark.org/review/23737 Petri-Dish: Gerald Combs <gerald@wireshark.org> Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org> Reviewed-by: Gerald Combs <gerald@wireshark.org>
-rw-r--r--docbook/CMakeLists.txt57
-rw-r--r--docbook/Makefile.am15
-rw-r--r--docbook/wsug_src/WSUG_app_tools.asciidoc703
-rw-r--r--docbook/wsug_src/capinfos-h.txt61
-rw-r--r--docbook/wsug_src/dumpcap-h.txt58
-rw-r--r--docbook/wsug_src/editcap-F.txt39
-rw-r--r--docbook/wsug_src/editcap-T.txt199
-rw-r--r--docbook/wsug_src/editcap-h.txt91
-rw-r--r--docbook/wsug_src/mergecap-h.txt19
-rw-r--r--docbook/wsug_src/rawshark-h.txt31
-rw-r--r--docbook/wsug_src/reordercap-h.txt9
-rw-r--r--docbook/wsug_src/text2pcap-h.txt79
-rw-r--r--docbook/wsug_src/tshark-h.txt115
-rw-r--r--editcap.c1
-rw-r--r--rawshark.c2
-rw-r--r--wiretap/file_access.c2
16 files changed, 792 insertions, 689 deletions
diff --git a/docbook/CMakeLists.txt b/docbook/CMakeLists.txt
index 2f32590..797b14f 100644
--- a/docbook/CMakeLists.txt
+++ b/docbook/CMakeLists.txt
@@ -67,6 +67,61 @@ set(COMMON_GRAPHICS
common_graphics/warning.svg
)
+set(WSUG_TOOLS_HELP_COMMANDS
+ capinfos
+ dumpcap
+ editcap
+ mergecap
+ rawshark
+ reordercap
+ text2pcap
+ tshark
+)
+
+# We want the wsug_* targets to depend on the tools help files.
+# We want update_tools_help to be an independent target.
+# We don't necessarily want to depend on building our executables before
+# being able to build our documentation.
+set(WSUG_TOOLS_HELP_FILES)
+set(WSUG_TOOLS_PHONY_DEPS)
+
+# General help output
+foreach(th_command ${WSUG_TOOLS_HELP_COMMANDS})
+ set(th_file ${CMAKE_CURRENT_SOURCE_DIR}/wsug_src/${th_command}-h.txt)
+ set(th_phony ${th_command}_h_tools_help)
+ list(APPEND WSUG_TOOLS_HELP_FILES ${th_file})
+ list(APPEND WSUG_TOOLS_PHONY_DEPS ${th_phony})
+ add_custom_command(
+ OUTPUT ${th_phony}
+ COMMAND ${CMAKE_BINARY_DIR}/run/${th_command} -h > ${th_file}
+ DEPENDS ${CMAKE_BINARY_DIR}/run/${th_command}
+ )
+endforeach()
+
+# Extra command output
+# Note that these won't work on Windows unless we make -F and -T write
+# to stdout and return 0 or wrap the commands similar to hhc.exe.
+set(th_file ${CMAKE_CURRENT_SOURCE_DIR}/wsug_src/editcap-F.txt)
+set(th_phony editcap_F_tools_help)
+list(APPEND WSUG_TOOLS_HELP_FILES ${th_file})
+list(APPEND WSUG_TOOLS_PHONY_DEPS ${th_phony})
+add_custom_command(
+ OUTPUT ${th_phony}
+ COMMAND ${CMAKE_BINARY_DIR}/run/editcap -F > ${th_file} 2>&1 || true
+)
+set(th_file ${CMAKE_CURRENT_SOURCE_DIR}/wsug_src/editcap-T.txt)
+set(th_phony editcap_T_tools_help)
+list(APPEND WSUG_TOOLS_HELP_FILES ${th_file})
+list(APPEND WSUG_TOOLS_PHONY_DEPS ${th_phony})
+add_custom_command(
+ OUTPUT ${th_phony}
+ COMMAND ${CMAKE_BINARY_DIR}/run/editcap -T > ${th_file} 2>&1 || true
+)
+
+add_custom_target(update_tools_help
+ DEPENDS ${WSUG_TOOLS_PHONY_DEPS}
+)
+
set(WSUG_FILES
wsug_src/WSUG_app_files.asciidoc
wsug_src/WSUG_app_howitworks.asciidoc
@@ -265,7 +320,7 @@ if(NOT CMAKE_SOURCE_DIR STREQUAL CMAKE_BINARY_DIR)
)
endif()
-set( WSUG_BUILT_DEPS ws.css )
+set( WSUG_BUILT_DEPS ws.css ${WSUG_TOOLS_HELP_FILES})
set(WSDG_SOURCE
${WSDG_FILES}
diff --git a/docbook/Makefile.am b/docbook/Makefile.am
index 3434ff9..e67bbe6 100644
--- a/docbook/Makefile.am
+++ b/docbook/Makefile.am
@@ -36,6 +36,18 @@ WSUG_FILES = \
wsug_src/WSUG_preface.asciidoc \
ws.css
+WSUG_TOOLS_HELP_FILES = \
+ wsug_src/capinfos-h.txt
+ wsug_src/dumpcap-h.txt
+ wsug_src/editcap-F.txt
+ wsug_src/editcap-T.txt
+ wsug_src/editcap-h.txt
+ wsug_src/mergecap-h.txt
+ wsug_src/rawshark-h.txt
+ wsug_src/reordercap-h.txt
+ wsug_src/text2pcap-h.txt
+ wsug_src/tshark-h.txt
+
WSUG_GENERATED_SOURCE = \
user-guide.xml
@@ -229,6 +241,7 @@ WSUG_DIST = \
custom_layer_chm.xsl \
custom_layer_pdf.xsl \
$(WSUG_FILES) \
+ $(WSUG_TOOLS_HELP_FILES) \
$(WSUG_GRAPHICS) \
$(COMMON_FILES) \
$(COMMON_GRAPHICS)
@@ -357,7 +370,7 @@ wsug: wsug_html_chunked wsug_html
wsug-pdf: wsug user-guide-a4.pdf user-guide-us.pdf
-user-guide.xml: user-guide.asciidoc $(WSUG_FILES)
+user-guide.xml: user-guide.asciidoc $(WSUG_FILES) $(WSUG_TOOLS_HELP_FILES)
$(A2X) --verbose \
--attribute=docinfo \
--asciidoc-opts="--conf-file=$(srcdir)/asciidoc.conf --conf-file=$(srcdir)/asciidoctor-asciidoc.conf" \
diff --git a/docbook/wsug_src/WSUG_app_tools.asciidoc b/docbook/wsug_src/WSUG_app_tools.asciidoc
index e05b033..cd07ea2 100644
--- a/docbook/wsug_src/WSUG_app_tools.asciidoc
+++ b/docbook/wsug_src/WSUG_app_tools.asciidoc
@@ -12,9 +12,10 @@
=== Introduction
Along with the main application, Wireshark comes with an array of
-command line tools which can be helpful for specialized tasks. These
-tools will be described in this chapter. You can find more information
-about each command in the link:{wireshark-man-page-url}[Manual Pages].
+command line tools which can be helpful for specialized tasks. Some of
+these tools will be described in this chapter. You can find more
+information about all of Wireshark's command line tools on
+link:{wireshark-man-page-url}[the web site].
[[AppToolstshark]]
@@ -28,112 +29,11 @@ available. It supports the same options as `wireshark`. For more information on
[[AppToolstsharkEx]]
.Help information available from `tshark`
----
-TShark (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master)
-Dump and analyze network traffic.
-See https://www.wireshark.org for more information.
-
-Usage: tshark [options] ...
-
-Capture interface:
- -i <interface> name or idx of interface (def: first non-loopback)
- -f <capture filter> packet filter in libpcap filter syntax
- -s <snaplen> packet snapshot length (def: 262144)
- -p don't capture in promiscuous mode
- -I capture in monitor mode, if available
- -B <buffer size> size of kernel buffer (def: 2MB)
- -y <link type> link layer type (def: first appropriate)
- --time-stamp-type <type> timestamp method for interface
- -D print list of interfaces and exit
- -L print list of link-layer types of iface and exit
- --list-time-stamp-types print list of timestamp types for iface and exit
-
-Capture stop conditions:
- -c <packet count> stop after n packets (def: infinite)
- -a <autostop cond.> ... duration:NUM - stop after NUM seconds
- filesize:NUM - stop this file after NUM KB
- files:NUM - stop after NUM files
-Capture output:
- -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
- filesize:NUM - switch to next file after NUM KB
- files:NUM - ringbuffer: replace after NUM files
-RPCAP options:
- -A <user>:<password> use RPCAP password authentication
-Input file:
- -r <infile> set the filename to read from (- to read from stdin)
-
-Processing:
- -2 perform a two-pass analysis
- -R <read filter> packet Read filter in Wireshark display filter syntax
- -Y <display filter> packet displaY filter in Wireshark display filter
- syntax
- -n disable all name resolutions (def: all enabled)
- -N <name resolve flags> enable specific name resolution(s): "mnNtCd"
- -d <layer_type>==<selector>,<decode_as_protocol> ...
- "Decode As", see the man page for details
- Example: tcp.port==8888,http
- -H <hosts file> read a list of entries from a hosts file, which will
- then be written to a capture file. (Implies -W n)
- --disable-protocol <proto_name>
- disable dissection of proto_name
- --enable-heuristic <short_name>
- enable dissection of heuristic protocol
- --disable-heuristic <short_name>
- disable dissection of heuristic protocol
-Output:
- -w <outfile|-> write packets to a pcap-format file named "outfile"
- (or to the standard output for "-")
- -C <config profile> start with specified configuration profile
- -F <output file type> set the output file type, default is pcapng
- an empty "-F" option will list the file types
- -V add output of packet tree (Packet Details)
- -O <protocols> Only show packet details of these protocols, comma
- separated
- -P print packet summary even when writing to a file
- -S <separator> the line separator to print between packets
- -x add output of hex and ASCII dump (Packet Bytes)
- -T pdml|ps|psml|text|fields
- format of text output (def: text)
- -e <field> field to print if -Tfields selected (e.g. tcp.port,
- _ws.col.Info)
- this option can be repeated to print multiple fields
- -E<fieldsoption>=<value> set options for output when -Tfields selected:
- header=y|n switch headers on and off
- separator=/t|/s|<char> select tab, space, printable character as separator
- occurrence=f|l|a print first, last or all occurrences of each field
- aggregator=,|/s|<char> select comma, space, printable character as
- aggregator
- quote=d|s|n select double, single, no quotes for values
- -t a|ad|d|dd|e|r|u|ud output format of time stamps (def: r: rel. to first)
- -u s|hms output format of seconds (def: s: seconds)
- -l flush standard output after each packet
- -q be more quiet on stdout (e.g. when using statistics)
- -Q only log true errors to stderr (quieter than -q)
- -g enable group read access on the output file(s)
- -W n Save extra information in the file, if supported.
- n = write network address resolution information
- -X <key>:<value> eXtension options, see the man page for details
- -z <statistics> various statistics, see the man page for details
- --capture-comment <comment>
- add a capture comment to the newly created
- output file (only for pcapng)
-
-Miscellaneous:
- -h display this help and exit
- -v display version info and exit
- -o <name>:<value> ... override preference setting
- -K <keytab> keytab file to use for kerberos decryption
- -G [report] dump one of several available reports and exit
- default report="fields"
- use "-G ?" for more help
-
-WARNING: dumpcap will enable kernel BPF JIT compiler if available.
-You might want to reset it
-By doing "echo 0 > /proc/sys/net/core/bpf_jit_enable"
+include::tshark-h.txt[]
----
[[AppToolstcpdump]]
-
=== __tcpdump__: Capturing with `tcpdump` for viewing with Wireshark
It's often more useful to capture packets using `tcpdump` rather than
@@ -168,75 +68,9 @@ with the packets' time stamps into a pcapng file. The capture filter syntax
follows the rules of the pcap library.
[[AppToolsdumpcapEx]]
-.Help information available from dumpcap
+.Help information available from `dumpcap`
----
-Dumpcap (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master)
-Capture network packets and dump them into a pcapng or pcap file.
-See https://www.wireshark.org for more information.
-
-Usage: dumpcap [options] ...
-
-Capture interface:
- -i <interface> name or idx of interface (def: first non-loopback),
- or for remote capturing, use one of these formats:
- rpcap://<host>/<interface>
- TCP@<host>:<port>
- -f <capture filter> packet filter in libpcap filter syntax
- -s <snaplen> packet snapshot length (def: 262144)
- -p don't capture in promiscuous mode
- -I capture in monitor mode, if available
- -B <buffer size> size of kernel buffer in MiB (def: 2MiB)
- -y <link type> link layer type (def: first appropriate)
- --time-stamp-type <type> timestamp method for interface
- -D print list of interfaces and exit
- -L print list of link-layer types of iface and exit
- --list-time-stamp-types print list of timestamp types for iface and exit
- -d print generated BPF code for capture filter
- -k set channel on wifi interface <freq>,[<type>]
- -S print statistics for each interface once per second
- -M for -D, -L, and -S, produce machine-readable output
-
-RPCAP options:
- -r don't ignore own RPCAP traffic in capture
- -u use UDP for RPCAP data transfer
- -A <user>:<password> use RPCAP password authentication
- -m <sampling type> use packet sampling
- count:NUM - capture one packet of every NUM
- timer:NUM - capture no more than 1 packet in NUM ms
-Stop conditions:
- -c <packet count> stop after n packets (def: infinite)
- -a <autostop cond.> ... duration:NUM - stop after NUM seconds
- filesize:NUM - stop this file after NUM KB
- files:NUM - stop after NUM files
-Output (files):
- -w <filename> name of file to save (def: tempfile)
- -g enable group read access on the output file(s)
- -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
- filesize:NUM - switch to next file after NUM KB
- files:NUM - ringbuffer: replace after NUM files
- -n use pcapng format instead of pcap (default)
- -P use libpcap format instead of pcapng
- --capture-comment <comment>
- add a capture comment to the output file
- (only for pcapng)
-
-Miscellaneous:
- -N <packet_limit> maximum number of packets buffered within dumpcap
- -C <byte_limit> maximum number of bytes used for buffering packets
- within dumpcap
- -t use a separate thread per interface
- -q don't report packet capture counts
- -v print version information and exit
- -h display this help and exit
-
-WARNING: dumpcap will enable kernel BPF JIT compiler if available.
-You might want to reset it
-By doing "echo 0 > /proc/sys/net/core/bpf_jit_enable"
-
-Example: dumpcap -i eth0 -a duration:60 -w output.pcapng
-"Capture packets from interface eth0 until 60s passed into output.pcapng"
-
-Use Ctrl-C to stop capturing at any time.
+include::dumpcap-h.txt[]
----
[[AppToolscapinfos]]
@@ -246,68 +80,9 @@ Use Ctrl-C to stop capturing at any time.
+capinfos+ can print information about binary capture files.
[[AppToolscapinfosEx]]
-.Help information available from capinfos
+.Help information available from `capinfos`
----
-Capinfos (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master)
-Print various information (infos) about capture files.
-See https://www.wireshark.org for more information.
-
-Usage: capinfos [options] <infile> ...
-
-General infos:
- -t display the capture file type
- -E display the capture file encapsulation
- -I display the capture file interface information
- -F display additional capture file information
- -H display the SHA1, RMD160, and MD5 hashes of the file
- -k display the capture comment
-
-Size infos:
- -c display the number of packets
- -s display the size of the file (in bytes)
- -d display the total length of all packets (in bytes)
- -l display the packet size limit (snapshot length)
-
-Time infos:
- -u display the capture duration (in seconds)
- -a display the capture start time
- -e display the capture end time
- -o display the capture file chronological status (True/False)
- -S display start and end times as seconds
-
-Statistic infos:
- -y display average data rate (in bytes/sec)
- -i display average data rate (in bits/sec)
- -z display average packet size (in bytes)
- -x display average packet rate (in packets/sec)
-
-Output format:
- -L generate long report (default)
- -T generate table report
- -M display machine-readable values in long reports
-
-Table report options:
- -R generate header record (default)
- -r do not generate header record
-
- -B separate infos with TAB character (default)
- -m separate infos with comma (,) character
- -b separate infos with SPACE character
-
- -N do not quote infos (default)
- -q quote infos with single quotes (')
- -Q quote infos with double quotes (")
-
-Miscellaneous:
- -h display this help and exit
- -C cancel processing if file open fails (default is to continue)
- -A generate all infos (default)
-
-Options are processed from left to right order with later options superceding
-or adding to earlier options.
-
-If no options are given the default is to display all infos in long report
-output format.
+include::capinfos-h.txt[]
----
[[AppToolsrawshark]]
@@ -319,38 +94,9 @@ describing its output, followed by a set of matching fields for each packet on
stdout.
[[AppToolsrawsharkEx]]
-.Help information available from rawshark
+.Help information available from `rawshark`
----
-Rawshark (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master)
-Dump and analyze network traffic.
-See https://www.wireshark.org for more information.
-
-Usage: rawshark [options] ...
-
-Input file:
- -r <infile> set the pipe or file name to read from
-
-Processing:
- -d <encap:linktype>|<proto:protoname>
- packet encapsulation or protocol
- -F <field> field to display
- -n disable all name resolution (def: all enabled)
- -N <name resolve flags> enable specific name resolution(s): "mnNtCd"
- -p use the system's packet header format
- (which may have 64-bit timestamps)
- -R <read filter> packet filter in Wireshark display filter syntax
- -s skip PCAP header on input
-
-Output:
- -l flush output after each packet
- -S format string for fields
- (%D - name, %S - stringval, %N numval)
- -t ad|a|r|d|dd|e output format of time stamps (def: r: rel. to first)
-
-Miscellaneous:
- -h display this help and exit
- -o <name>:<value> ... override preference setting
- -v display version info and exit
+include::rawshark-h.txt[]
----
[[AppToolseditcap]]
@@ -365,327 +111,20 @@ information about capture files.
[[AppToolseditcapEx]]
.Help information available from editcap
----
-Editcap (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master)
-Edit and/or translate the format of capture files.
-See https://www.wireshark.org for more information.
-
-Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ]
-
-<infile> and <outfile> must both be present.
-A single packet or a range of packets can be selected.
-
-Packet selection:
- -r keep the selected packets; default is to delete them.
- -A <start time> only output packets whose timestamp is after (or equal
- to) the given time (format as YYYY-MM-DD hh:mm:ss).
- -B <stop time> only output packets whose timestamp is before the
- given time (format as YYYY-MM-DD hh:mm:ss).
-
-Duplicate packet removal:
- -d remove packet if duplicate (window == 5).
- -D <dup window> remove packet if duplicate; configurable <dup window>
- Valid <dup window> values are 0 to 1000000.
- NOTE: A <dup window> of 0 with -v (verbose option) is
- useful to print MD5 hashes.
- -w <dup time window> remove packet if duplicate packet is found EQUAL TO OR
- LESS THAN <dup time window> prior to current packet.
- A <dup time window> is specified in relative seconds
- (e.g. 0.000001).
- -a <framenum>:<comment> Add or replace comment for given frame number
-
- -I <bytes to ignore> ignore the specified bytes at the beginning of
- the frame during MD5 hash calculation
- Useful to remove duplicated packets taken on
- several routers(differents mac addresses for
- example)
- e.g. -I 26 in case of Ether/IP/ will ignore
- ether(14) and IP header(20 - 4(src ip) - 4(dst ip)).
-
- NOTE: The use of the 'Duplicate packet removal' options with
- other editcap options except -v may not always work as expected.
- Specifically the -r, -t or -S options will very likely NOT have the
- desired effect if combined with the -d, -D or -w.
-
-Packet manipulation:
- -s <snaplen> truncate each packet to max. <snaplen> bytes of data.
- -C [offset:]<choplen> chop each packet by <choplen> bytes. Positive values
- chop at the packet beginning, negative values at the
- packet end. If an optional offset precedes the length,
- then the bytes chopped will be offset from that value.
- Positive offsets are from the packet beginning,
- negative offsets are from the packet end. You can use
- this option more than once, allowing up to 2 chopping
- regions within a packet provided that at least 1
- choplen is positive and at least 1 is negative.
- -L adjust the frame (i.e. reported) length when chopping
- and/or snapping
- -t <time adjustment> adjust the timestamp of each packet;
- <time adjustment> is in relative seconds (e.g. -0.5).
- -S <strict adjustment> adjust timestamp of packets if necessary to insure
- strict chronological increasing order. The <strict
- adjustment> is specified in relative seconds with
- values of 0 or 0.000001 being the most reasonable.
- A negative adjustment value will modify timestamps so
- that each packet's delta time is the absolute value
- of the adjustment specified. A value of -0 will set
- all packets to the timestamp of the first packet.
- -E <error probability> set the probability (between 0.0 and 1.0 incl.) that
- a particular packet byte will be randomly changed.
- -o <change offset> When used in conjuction with -E, skip some bytes from the
- beginning of the packet. This allows to preserve some
- bytes, in order to have some headers untouched.
-
-Output File(s):
- -c <packets per file> split the packet output to different files based on
- uniform packet counts with a maximum of
- <packets per file> each.
- -i <seconds per file> split the packet output to different files based on
- uniform time intervals with a maximum of
- <seconds per file> each.
- -F <capture type> set the output file type; default is pcapng. An empty
- "-F" option will list the file types.
- -T <encap type> set the output file encapsulation type; default is the
- same as the input file. An empty "-T" option will
- list the encapsulation types.
-
-Miscellaneous:
- -h display this help and exit.
- -v verbose output.
- If -v is used with any of the 'Duplicate Packet
- Removal' options (-d, -D or -w) then Packet lengths
- and MD5 hashes are printed to standard-error.
+include::editcap-h.txt[]
----
[[AppToolseditcapEx1]]
.Capture file types available from `editcap -F`
----
-$ editcap -F
-editcap: option requires an argument -- 'F'
-editcap: The available capture file types for the "-F" flag are:
- 5views - InfoVista 5View capture
- btsnoop - Symbian OS btsnoop
- commview - TamoSoft CommView
- dct2000 - Catapult DCT2000 trace (.out format)
- erf - Endace ERF capture
- eyesdn - EyeSDN USB S0/E1 ISDN trace format
- k12text - K12 text file
- lanalyzer - Novell LANalyzer
- logcat - Android Logcat Binary format
- logcat-brief - Android Logcat Brief text format
- logcat-long - Android Logcat Long text format
- logcat-process - Android Logcat Process text format
- logcat-tag - Android Logcat Tag text format
- logcat-thread - Android Logcat Thread text format
- logcat-threadtime - Android Logcat Threadtime text format
- logcat-time - Android Logcat Time text format
- modlibpcap - Modified tcpdump - libpcap
- netmon1 - Microsoft NetMon 1.x
- netmon2 - Microsoft NetMon 2.x
- nettl - HP-UX nettl trace
- ngsniffer - Sniffer (DOS)
- ngwsniffer_1_1 - NetXray, Sniffer (Windows) 1.1
- ngwsniffer_2_0 - Sniffer (Windows) 2.00x
- niobserver - Network Instruments Observer
- nokialibpcap - Nokia tcpdump - libpcap
- nseclibpcap - Wireshark - nanosecond libpcap
- nstrace10 - NetScaler Trace (Version 1.0)
- nstrace20 - NetScaler Trace (Version 2.0)
- nstrace30 - NetScaler Trace (Version 3.0)
- nstrace35 - NetScaler Trace (Version 3.5)
- pcap - Wireshark/tcpdump/... - pcap
- pcapng - Wireshark/... - pcapng
- rf5 - Tektronix K12xx 32-bit .rf5 format
- rh6_1libpcap - RedHat 6.1 tcpdump - libpcap
- snoop - Sun snoop
- suse6_3libpcap - SuSE 6.3 tcpdump - libpcap
- visual - Visual Networks traffic capture
+include::editcap-F.txt[]
----
[[AppToolseditcapEx2]]
-.Encapsulation types available from editcap
+.Encapsulation types available from `editcap -T`
----
-$ editcap -T
-editcap: option requires an argument -- 'T'
-editcap: The available encapsulation types for the "-T" flag are:
- ap1394 - Apple IP-over-IEEE 1394
- arcnet - ARCNET
- arcnet_linux - Linux ARCNET
- ascend - Lucent/Ascend access equipment
- atm-pdus - ATM PDUs
- atm-pdus-untruncated - ATM PDUs - untruncated
- atm-rfc1483 - RFC 1483 ATM
- ax25 - Amateur Radio AX.25
- ax25-kiss - AX.25 with KISS header
- bacnet-ms-tp - BACnet MS/TP
- bacnet-ms-tp-with-direction - BACnet MS/TP with Directional Info
- ber - ASN.1 Basic Encoding Rules
- bluetooth-bredr-bb-rf - Bluetooth BR/EDR Baseband RF
- bluetooth-h4 - Bluetooth H4
- bluetooth-h4-linux - Bluetooth H4 with linux header
- bluetooth-hci - Bluetooth without transport layer
- bluetooth-le-ll - Bluetooth Low Energy Link Layer
- bluetooth-le-ll-rf - Bluetooth Low Energy Link Layer RF
- bluetooth-linux-monitor - Bluetooth Linux Monitor
- can20b - Controller Area Network 2.0B
- chdlc - Cisco HDLC
- chdlc-with-direction - Cisco HDLC with Directional Info
- cosine - CoSine L2 debug log
- dbus - D-Bus
- dct2000 - Catapult DCT2000
- docsis - Data Over Cable Service Interface Specification
- dpnss_link - Digital Private Signalling System No 1 Link Layer
- dvbci - DVB-CI (Common Interface)
- enc - OpenBSD enc(4) encapsulating interface
- epon - Ethernet Passive Optical Network
- erf - Extensible Record Format
- ether - Ethernet
- ether-nettl - Ethernet with nettl headers
- fc2 - Fibre Channel FC-2
- fc2sof - Fibre Channel FC-2 With Frame Delimiter
- fddi - FDDI
- fddi-nettl - FDDI with nettl headers
- fddi-swapped - FDDI with bit-swapped MAC addresses
- flexray - FlexRay
- frelay - Frame Relay
- frelay-with-direction - Frame Relay with Directional Info
- gcom-serial - GCOM Serial
- gcom-tie1 - GCOM TIE1
- gprs-llc - GPRS LLC
- gsm_um - GSM Um Interface
- hhdlc - HiPath HDLC
- i2c - I2C
- ieee-802-11 - IEEE 802.11 Wireless LAN
- ieee-802-11-airopeek - IEEE 802.11 plus AiroPeek radio header
- ieee-802-11-avs - IEEE 802.11 plus AVS radio header
- ieee-802-11-netmon - IEEE 802.11 plus Network Monitor radio header
- ieee-802-11-prism - IEEE 802.11 plus Prism II monitor mode radio header
- ieee-802-11-radio - IEEE 802.11 Wireless LAN with radio information
- ieee-802-11-radiotap - IEEE 802.11 plus radiotap radio header
- ieee-802-16-mac-cps - IEEE 802.16 MAC Common Part Sublayer
- infiniband - InfiniBand
- ios - Cisco IOS internal
- ip-over-fc - RFC 2625 IP-over-Fibre Channel
- ip-over-ib - IP over Infiniband
- ipfix - IPFIX
- ipmb - Intelligent Platform Management Bus
- ipmi-trace - IPMI Trace Data Collection
- ipnet - Solaris IPNET
- irda - IrDA
- isdn - ISDN
- ixveriwave - IxVeriWave header and stats block
- jfif - JPEG/JFIF
- json - JavaScript Object Notation
- juniper-atm1 - Juniper ATM1
- juniper-atm2 - Juniper ATM2
- juniper-chdlc - Juniper C-HDLC
- juniper-ether - Juniper Ethernet
- juniper-frelay - Juniper Frame-Relay
- juniper-ggsn - Juniper GGSN
- juniper-mlfr - Juniper MLFR
- juniper-mlppp - Juniper MLPPP
- juniper-ppp - Juniper PPP
- juniper-pppoe - Juniper PPPoE
- juniper-svcs - Juniper Services
- juniper-vp - Juniper Voice PIC
- k12 - K12 protocol analyzer
- lapb - LAPB
- lapd - LAPD
- layer1-event - EyeSDN Layer 1 event
- lin - Local Interconnect Network
- linux-atm-clip - Linux ATM CLIP
- linux-lapd - LAPD with Linux pseudo-header
- linux-sll - Linux cooked-mode capture
- logcat - Android Logcat Binary format
- logcat_brief - Android Logcat Brief text format
- logcat_long - Android Logcat Long text format
- logcat_process - Android Logcat Process text format
- logcat_tag - Android Logcat Tag text format
- logcat_thread - Android Logcat Thread text format
- logcat_threadtime - Android Logcat Threadtime text format
- logcat_time - Android Logcat Time text format
- loop - OpenBSD loopback
- ltalk - Localtalk
- mime - MIME
- most - Media Oriented Systems Transport
- mp2ts - ISO/IEC 13818-1 MPEG2-TS
- mpeg - MPEG
- mtp2 - SS7 MTP2
- mtp2-with-phdr - MTP2 with pseudoheader
- mtp3 - SS7 MTP3
- mux27010 - MUX27010
- netanalyzer - netANALYZER
- netanalyzer-transparent - netANALYZER-Transparent
- netlink - Linux Netlink
- nfc-llcp - NFC LLCP
- nflog - NFLOG
- nstrace10 - NetScaler Encapsulation 1.0 of Ethernet
- nstrace20 - NetScaler Encapsulation 2.0 of Ethernet
- nstrace30 - NetScaler Encapsulation 3.0 of Ethernet
- nstrace35 - NetScaler Encapsulation 3.5 of Ethernet
- null - NULL/Loopback
- packetlogger - PacketLogger
- pflog - OpenBSD PF Firewall logs
- pflog-old - OpenBSD PF Firewall logs, pre-3.4
- pktap - Apple PKTAP
- ppi - Per-Packet Information header
- ppp - PPP
- ppp-with-direction - PPP with Directional Info
- pppoes - PPP-over-Ethernet session
- raw-icmp-nettl - Raw ICMP with nettl headers
- raw-icmpv6-nettl - Raw ICMPv6 with nettl headers
- raw-telnet-nettl - Raw telnet with nettl headers
- rawip - Raw IP
- rawip-nettl - Raw IP with nettl headers
- rawip4 - Raw IPv4
- rawip6 - Raw IPv6
- redback - Redback SmartEdge
- rtac-serial - RTAC serial-line
- s4607 - STANAG 4607
- s5066-dpdu - STANAG 5066 Data Transfer Sublayer PDUs(D_PDU)
- sccp - SS7 SCCP
- sctp - SCTP
- sdh - SDH
- sdlc - SDLC
- sita-wan - SITA WAN packets
- slip - SLIP
- socketcan - SocketCAN
- symantec - Symantec Enterprise Firewall
- tnef - Transport-Neutral Encapsulation Format
- tr - Token Ring
- tr-nettl - Token Ring with nettl headers
- tzsp - Tazmen sniffer protocol
- unknown - Unknown
- unknown-nettl - Unknown link-layer type with nettl headers
- usb - Raw USB packets
- usb-linux - USB packets with Linux header
- usb-linux-mmap - USB packets with Linux header and padding
- usb-usbpcap - USB packets with USBPcap header
- user0 - USER 0
- user1 - USER 1
- user2 - USER 2
- user3 - USER 3
- user4 - USER 4
- user5 - USER 5
- user6 - USER 6
- user7 - USER 7
- user8 - USER 8
- user9 - USER 9
- user10 - USER 10
- user11 - USER 11
- user12 - USER 12
- user13 - USER 13
- user14 - USER 14
- user15 - USER 15
- v5-ef - V5 Envelope Function
- whdlc - Wellfleet HDLC
- wireshark-upper-pdu - Wireshark Upper PDU export
- wpan - IEEE 802.15.4 Wireless PAN
- wpan-nofcs - IEEE 802.15.4 Wireless PAN with FCS not present
- wpan-nonask-phy - IEEE 802.15.4 Wireless PAN non-ASK PHY
- x2e-serial - X2E serial line capture
- x2e-xoraya - X2E Xoraya
- x25-nettl - X.25 with nettl headers
+include::editcap-T.txt[]
----
[[AppToolsmergecap]]
@@ -738,27 +177,9 @@ encapsulation type (for example, it will not translate an Ethernet capture to an
FDDI capture if an Ethernet capture is read and `-T fddi` is specified).
[[AppToolsmergecapEx]]
-.Help information available from mergecap
+.Help information available from `mergecap`
----
-Mergecap (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master)
-Merge two or more capture files into one.
-See https://www.wireshark.org for more information.
-
-Usage: mergecap [options] -w <outfile>|- <infile> [<infile> ...]
-
-Output:
- -a concatenate rather than merge files.
- default is to merge based on frame timestamps.
- -s <snaplen> truncate packets to <snaplen> bytes of data.
- -w <outfile>|- set the output filename to <outfile> or '-' for stdout.
- -F <capture type> set the output file type; default is pcapng.
- an empty "-F" option will list the file types.
- -I <IDB merge mode> set the merge mode for Interface Description Blocks; default is 'all'.
- an empty "-I" option will list the merge modes.
-
-Miscellaneous:
- -h display this help and exit.
- -v verbose output.
+include::mergecap-h.txt[]
----
A simple example merging `dhcp-capture.pcapng` and `imap-1.pcapng` into
@@ -833,85 +254,7 @@ full-packet decoder to handle these dumps.
.Help information available from text2pcap
----
-Text2pcap (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master)
-Generate a capture file from an ASCII hexdump of packets.
-See https://www.wireshark.org for more information.
-
-Usage: text2pcap [options] <infile> <outfile>
-
-where <infile> specifies input filename (use - for standard input)
- <outfile> specifies output filename (use - for standard output)
-
-Input:
- -o hex|oct|dec parse offsets as (h)ex, (o)ctal or (d)ecimal;
- default is hex.
- -t <timefmt> treat the text before the packet as a date/time code;
- the specified argument is a format string of the sort
- supported by strptime.
- Example: The time "10:15:14.5476" has the format code
- "%H:%M:%S."
- NOTE: The subsecond component delimiter, '.', must be
- given, but no pattern is required; the remaining
- number is assumed to be fractions of a second.
- NOTE: Date/time fields from the current date/time are
- used as the default for unspecified fields.
- -D the text before the packet starts with an I or an O,
- indicating that the packet is inbound or outbound.
- This is only stored if the output format is PCAP-NG.
- -a enable ASCII text dump identification.
- The start of the ASCII text dump can be identified
- and excluded from the packet data, even if it looks
- like a HEX dump.
- NOTE: Do not enable it if the input file does not
- contain the ASCII text dump.
-
-Output:
- -l <typenum> link-layer type number; default is 1 (Ethernet). See
- http://www.tcpdump.org/linktypes.html for a list of
- numbers. Use this option if your dump is a complete
- hex dump of an encapsulated packet and you wish to
- specify the exact type of encapsulation.
- Example: -l 7 for ARCNet packets.
- -m <max-packet> max packet length in output; default is 262144
-
-Prepend dummy header:
- -e <l3pid> prepend dummy Ethernet II header with specified L3PID
- (in HEX).
- Example: -e 0x806 to specify an ARP packet.
- -i <proto> prepend dummy IP header with specified IP protocol
- (in DECIMAL).
- Automatically prepends Ethernet header as well.
- Example: -i 46
- -4 <srcip>,<destip> prepend dummy IPv4 header with specified
- dest and source address.
- Example: -4 10.0.0.1,10.0.0.2
- -6 <srcip>,<destip> replace IPv6 header with specified
- dest and source address.
- Example: -6 fe80:0:0:0:202:b3ff:fe1e:8329,2001:0db8:85a3:0000:0000:8a2e:0370:7334
- -u <srcp>,<destp> prepend dummy UDP header with specified
- source and destination ports (in DECIMAL).
- Automatically prepends Ethernet & IP headers as well.
- Example: -u 1000,69 to make the packets look like
- TFTP/UDP packets.
- -T <srcp>,<destp> prepend dummy TCP header with specified
- source and destination ports (in DECIMAL).
- Automatically prepends Ethernet & IP headers as well.
- Example: -T 50,60
- -s <srcp>,<dstp>,<tag> prepend dummy SCTP header with specified
- source/dest ports and verification tag (in DECIMAL).
- Automatically prepends Ethernet & IP headers as well.
- Example: -s 30,40,34
- -S <srcp>,<dstp>,<ppi> prepend dummy SCTP header with specified
- source/dest ports and verification tag 0.
- Automatically prepends a dummy SCTP DATA
- chunk header with payload protocol identifier ppi.
- Example: -S 30,40,34
-
-Miscellaneous:
- -h display this help and exit.
- -d show detailed debug of parser states.
- -q generate no output at all (automatically disables -d).
- -n use PCAP-NG instead of PCAP as output format.
+include::mergecap-h.txt[]
----
[[AppToolsreordercap]]
@@ -923,15 +266,7 @@ Miscellaneous:
[[AppToolsreordercapEx]]
.Help information available from reordercap
----
-Reordercap (Wireshark) 2.1.0 (v2.1.0rc0-502-g328fbc0 from master)
-Reorder timestamps of input file frames into output file.
-See https://www.wireshark.org for more information.
-
-Usage: reordercap [options] <infile> <outfile>
-
-Options:
- -n don't write to output file if the input file is ordered.
- -h display this help and exit.
+include::reordercap-h.txt[]
----
++++++++++++++++++++++++++++++++++++++
diff --git a/docbook/wsug_src/capinfos-h.txt b/docbook/wsug_src/capinfos-h.txt
new file mode 100644
index 0000000..122fbbf
--- /dev/null
+++ b/docbook/wsug_src/capinfos-h.txt
@@ -0,0 +1,61 @@
+Capinfos (Wireshark) 2.5.0 (v2.5.0rc0-1171-g33c00a67)
+Print various information (infos) about capture files.
+See https://www.wireshark.org for more information.
+
+Usage: capinfos [options] <infile> ...
+
+General infos:
+ -t display the capture file type
+ -E display the capture file encapsulation
+ -I display the capture file interface information
+ -F display additional capture file information
+ -H display the SHA1, RMD160, and MD5 hashes of the file
+ -k display the capture comment
+
+Size infos:
+ -c display the number of packets
+ -s display the size of the file (in bytes)
+ -d display the total length of all packets (in bytes)
+ -l display the packet size limit (snapshot length)
+
+Time infos:
+ -u display the capture duration (in seconds)
+ -a display the capture start time
+ -e display the capture end time
+ -o display the capture file chronological status (True/False)
+ -S display start and end times as seconds
+
+Statistic infos:
+ -y display average data rate (in bytes/sec)
+ -i display average data rate (in bits/sec)
+ -z display average packet size (in bytes)
+ -x display average packet rate (in packets/sec)
+
+Output format:
+ -L generate long report (default)
+ -T generate table report
+ -M display machine-readable values in long reports
+
+Table report options:
+ -R generate header record (default)
+ -r do not generate header record
+
+ -B separate infos with TAB character (default)
+ -m separate infos with comma (,) character
+ -b separate infos with SPACE character
+
+ -N do not quote infos (default)
+ -q quote infos with single quotes (')
+ -Q quote infos with double quotes (")
+
+Miscellaneous:
+ -h display this help and exit
+ -C cancel processing if file open fails (default is to continue)
+ -A generate all infos (default)
+ -K disable displaying the capture comment
+
+Options are processed from left to right order with later options superceding
+or adding to earlier options.
+
+If no options are given the default is to display all infos in long report
+output format.
diff --git a/docbook/wsug_src/dumpcap-h.txt b/docbook/wsug_src/dumpcap-h.txt
new file mode 100644
index 0000000..7b12048
--- /dev/null
+++ b/docbook/wsug_src/dumpcap-h.txt
@@ -0,0 +1,58 @@
+Dumpcap (Wireshark) 2.5.0 (v2.5.0rc0-1171-g33c00a67)
+Capture network packets and dump them into a pcapng or pcap file.
+See https://www.wireshark.org for more information.
+
+Usage: dumpcap [options] ...
+
+Capture interface:
+ -i <interface> name or idx of interface (def: first non-loopback),
+ or for remote capturing, use one of these formats:
+ rpcap://<host>/<interface>
+ TCP@<host>:<port>
+ -f <capture filter> packet filter in libpcap filter syntax
+ -s <snaplen> packet snapshot length (def: appropriate maximum)
+ -p don't capture in promiscuous mode
+ -I capture in monitor mode, if available
+ -B <buffer size> size of kernel buffer in MiB (def: 2MiB)
+ -y <link type> link layer type (def: first appropriate)
+ --time-stamp-type <type> timestamp method for interface
+ -D print list of interfaces and exit
+ -L print list of link-layer types of iface and exit
+ --list-time-stamp-types print list of timestamp types for iface and exit
+ -d print generated BPF code for capture filter
+ -k set channel on wifi interface:
+ <freq>,[<type>],[<center_freq1>],[<center_freq2>]
+ -S print statistics for each interface once per second
+ -M for -D, -L, and -S, produce machine-readable output
+
+Stop conditions:
+ -c <packet count> stop after n packets (def: infinite)
+ -a <autostop cond.> ... duration:NUM - stop after NUM seconds
+ filesize:NUM - stop this file after NUM KB
+ files:NUM - stop after NUM files
+Output (files):
+ -w <filename> name of file to save (def: tempfile)
+ -g enable group read access on the output file(s)
+ -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
+ interval:NUM - create time intervals of NUM secs
+ filesize:NUM - switch to next file after NUM KB
+ files:NUM - ringbuffer: replace after NUM files
+ -n use pcapng format instead of pcap (default)
+ -P use libpcap format instead of pcapng
+ --capture-comment <comment>
+ add a capture comment to the output file
+ (only for pcapng)
+
+Miscellaneous:
+ -N <packet_limit> maximum number of packets buffered within dumpcap
+ -C <byte_limit> maximum number of bytes used for buffering packets
+ within dumpcap
+ -t use a separate thread per interface
+ -q don't report packet capture counts
+ -v print version information and exit
+ -h display this help and exit
+
+Example: dumpcap -i eth0 -a duration:60 -w output.pcapng
+"Capture packets from interface eth0 until 60s passed into output.pcapng"
+
+Use Ctrl-C to stop capturing at any time.
diff --git a/docbook/wsug_src/editcap-F.txt b/docbook/wsug_src/editcap-F.txt
new file mode 100644
index 0000000..9432529
--- /dev/null
+++ b/docbook/wsug_src/editcap-F.txt
@@ -0,0 +1,39 @@
+editcap: option requires an argument -- F
+editcap: The available capture file types for the "-F" flag are:
+ 5views - InfoVista 5View capture
+ btsnoop - Symbian OS btsnoop
+ commview - TamoSoft CommView
+ dct2000 - Catapult DCT2000 trace (.out format)
+ erf - Endace ERF capture
+ eyesdn - EyeSDN USB S0/E1 ISDN trace format
+ k12text - K12 text file
+ lanalyzer - Novell LANalyzer
+ logcat - Android Logcat Binary format
+ logcat-brief - Android Logcat Brief text format
+ logcat-long - Android Logcat Long text format
+ logcat-process - Android Logcat Process text format
+ logcat-tag - Android Logcat Tag text format
+ logcat-thread - Android Logcat Thread text format
+ logcat-threadtime - Android Logcat Threadtime text format
+ logcat-time - Android Logcat Time text format
+ modpcap - Modified tcpdump - pcap
+ netmon1 - Microsoft NetMon 1.x
+ netmon2 - Microsoft NetMon 2.x
+ nettl - HP-UX nettl trace
+ ngsniffer - Sniffer (DOS)
+ ngwsniffer_1_1 - NetXray, Sniffer (Windows) 1.1
+ ngwsniffer_2_0 - Sniffer (Windows) 2.00x
+ niobserver - Network Instruments Observer
+ nokiapcap - Nokia tcpdump - pcap
+ nsecpcap - Wireshark/tcpdump/... - nanosecond pcap
+ nstrace10 - NetScaler Trace (Version 1.0)
+ nstrace20 - NetScaler Trace (Version 2.0)
+ nstrace30 - NetScaler Trace (Version 3.0)
+ nstrace35 - NetScaler Trace (Version 3.5)
+ pcap - Wireshark/tcpdump/... - pcap
+ pcapng - Wireshark/... - pcapng
+ rf5 - Tektronix K12xx 32-bit .rf5 format
+ rh6_1pcap - RedHat 6.1 tcpdump - pcap
+ snoop - Sun snoop
+ suse6_3pcap - SuSE 6.3 tcpdump - pcap
+ visual - Visual Networks traffic capture
diff --git a/docbook/wsug_src/editcap-T.txt b/docbook/wsug_src/editcap-T.txt
new file mode 100644
index 0000000..da0d254
--- /dev/null
+++ b/docbook/wsug_src/editcap-T.txt
@@ -0,0 +1,199 @@
+editcap: option requires an argument -- T
+editcap: The available encapsulation types for the "-T" flag are:
+ ap1394 - Apple IP-over-IEEE 1394
+ arcnet - ARCNET
+ arcnet_linux - Linux ARCNET
+ ascend - Lucent/Ascend access equipment
+ atm-pdus - ATM PDUs
+ atm-pdus-untruncated - ATM PDUs - untruncated
+ atm-rfc1483 - RFC 1483 ATM
+ ax25 - Amateur Radio AX.25
+ ax25-kiss - AX.25 with KISS header
+ bacnet-ms-tp - BACnet MS/TP
+ bacnet-ms-tp-with-direction - BACnet MS/TP with Directional Info
+ ber - ASN.1 Basic Encoding Rules
+ bluetooth-bredr-bb-rf - Bluetooth BR/EDR Baseband RF
+ bluetooth-h4 - Bluetooth H4
+ bluetooth-h4-linux - Bluetooth H4 with linux header
+ bluetooth-hci - Bluetooth without transport layer
+ bluetooth-le-ll - Bluetooth Low Energy Link Layer
+ bluetooth-le-ll-rf - Bluetooth Low Energy Link Layer RF
+ bluetooth-linux-monitor - Bluetooth Linux Monitor
+ can20b - Controller Area Network 2.0B
+ chdlc - Cisco HDLC
+ chdlc-with-direction - Cisco HDLC with Directional Info
+ cosine - CoSine L2 debug log
+ dbus - D-Bus
+ dct2000 - Catapult DCT2000
+ docsis - Data Over Cable Service Interface Specification
+ dpnss_link - Digital Private Signalling System No 1 Link Layer
+ dvbci - DVB-CI (Common Interface)
+ enc - OpenBSD enc(4) encapsulating interface
+ epon - Ethernet Passive Optical Network
+ erf - Extensible Record Format
+ ether - Ethernet
+ ether-nettl - Ethernet with nettl headers
+ fc2 - Fibre Channel FC-2
+ fc2sof - Fibre Channel FC-2 With Frame Delimiter
+ fddi - FDDI
+ fddi-nettl - FDDI with nettl headers
+ fddi-swapped - FDDI with bit-swapped MAC addresses
+ flexray - FlexRay
+ frelay - Frame Relay
+ frelay-with-direction - Frame Relay with Directional Info
+ gcom-serial - GCOM Serial
+ gcom-tie1 - GCOM TIE1
+ gfp-f - ITU-T G.7041/Y.1303 Generic Framing Procedure Frame-mapped mode
+ gfp-t - ITU-T G.7041/Y.1303 Generic Framing Procedure Transparent mode
+ gprs-llc - GPRS LLC
+ gsm_um - GSM Um Interface
+ hhdlc - HiPath HDLC
+ i2c - I2C
+ ieee-802-11 - IEEE 802.11 Wireless LAN
+ ieee-802-11-avs - IEEE 802.11 plus AVS radio header
+ ieee-802-11-netmon - IEEE 802.11 plus Network Monitor radio header
+ ieee-802-11-prism - IEEE 802.11 plus Prism II monitor mode radio header
+ ieee-802-11-radio - IEEE 802.11 Wireless LAN with radio information
+ ieee-802-11-radiotap - IEEE 802.11 plus radiotap radio header
+ ieee-802-16-mac-cps - IEEE 802.16 MAC Common Part Sublayer
+ infiniband - InfiniBand
+ ios - Cisco IOS internal
+ ip-ib - IP over IB
+ ip-over-fc - RFC 2625 IP-over-Fibre Channel
+ ip-over-ib - IP over Infiniband
+ ipfix - IPFIX
+ ipmb - Intelligent Platform Management Bus
+ ipmi-trace - IPMI Trace Data Collection
+ ipnet - Solaris IPNET
+ irda - IrDA
+ isdn - ISDN
+ iso14443 - ISO 14443 contactless smartcard standards
+ ixveriwave - IxVeriWave header and stats block
+ jfif - JPEG/JFIF
+ json - JavaScript Object Notation
+ juniper-atm1 - Juniper ATM1
+ juniper-atm2 - Juniper ATM2
+ juniper-chdlc - Juniper C-HDLC
+ juniper-ether - Juniper Ethernet
+ juniper-frelay - Juniper Frame-Relay
+ juniper-ggsn - Juniper GGSN
+ juniper-mlfr - Juniper MLFR
+ juniper-mlppp - Juniper MLPPP
+ juniper-ppp - Juniper PPP
+ juniper-pppoe - Juniper PPPoE
+ juniper-svcs - Juniper Services
+ juniper-vn - Juniper VN
+ juniper-vp - Juniper Voice PIC
+ k12 - K12 protocol analyzer
+ lapb - LAPB
+ lapd - LAPD
+ layer1-event - EyeSDN Layer 1 event
+ lin - Local Interconnect Network
+ linux-atm-clip - Linux ATM CLIP
+ linux-lapd - LAPD with Linux pseudo-header
+ linux-sll - Linux cooked-mode capture
+ logcat - Android Logcat Binary format
+ logcat_brief - Android Logcat Brief text format
+ logcat_long - Android Logcat Long text format
+ logcat_process - Android Logcat Process text format
+ logcat_tag - Android Logcat Tag text format
+ logcat_thread - Android Logcat Thread text format
+ logcat_threadtime - Android Logcat Threadtime text format
+ logcat_time - Android Logcat Time text format
+ loop - OpenBSD loopback
+ loratap - LoRaTap
+ ltalk - Localtalk
+ message_analyzer_wfp_capture2_v4 - Message Analyzer WFP Capture2 v4
+ message_analyzer_wfp_capture2_v6 - Message Analyzer WFP Capture2 v6
+ message_analyzer_wfp_capture_auth_v4 - Message Analyzer WFP Capture Auth v4
+ message_analyzer_wfp_capture_auth_v6 - Message Analyzer WFP Capture Auth v6
+ message_analyzer_wfp_capture_v4 - Message Analyzer WFP Capture v4
+ message_analyzer_wfp_capture_v6 - Message Analyzer WFP Capture v6
+ mime - MIME
+ most - Media Oriented Systems Transport
+ mp2ts - ISO/IEC 13818-1 MPEG2-TS
+ mpeg - MPEG
+ mtp2 - SS7 MTP2
+ mtp2-with-phdr - MTP2 with pseudoheader
+ mtp3 - SS7 MTP3
+ mux27010 - MUX27010
+ netanalyzer - netANALYZER
+ netanalyzer-transparent - netANALYZER-Transparent
+ netlink - Linux Netlink
+ netmon_event - Network Monitor Network Event
+ netmon_filter - Network Monitor Filter
+ netmon_header - Network Monitor Header
+ netmon_network_info - Network Monitor Network Info
+ nfc-llcp - NFC LLCP
+ nflog - NFLOG
+ nordic_ble - Nordic BLE Sniffer
+ nstrace10 - NetScaler Encapsulation 1.0 of Ethernet
+ nstrace20 - NetScaler Encapsulation 2.0 of Ethernet
+ nstrace30 - NetScaler Encapsulation 3.0 of Ethernet
+ nstrace35 - NetScaler Encapsulation 3.5 of Ethernet
+ null - NULL/Loopback
+ packetlogger - PacketLogger
+ pflog - OpenBSD PF Firewall logs
+ pflog-old - OpenBSD PF Firewall logs, pre-3.4
+ pktap - Apple PKTAP
+ ppi - Per-Packet Information header
+ ppp - PPP
+ ppp-with-direction - PPP with Directional Info
+ pppoes - PPP-over-Ethernet session
+ raw-icmp-nettl - Raw ICMP with nettl headers
+ raw-icmpv6-nettl - Raw ICMPv6 with nettl headers
+ raw-telnet-nettl - Raw telnet with nettl headers
+ rawip - Raw IP
+ rawip-nettl - Raw IP with nettl headers
+ rawip4 - Raw IPv4
+ rawip6 - Raw IPv6
+ redback - Redback SmartEdge
+ rtac-serial - RTAC serial-line
+ s4607 - STANAG 4607
+ s5066-dpdu - STANAG 5066 Data Transfer Sublayer PDUs(D_PDU)
+ sccp - SS7 SCCP
+ sctp - SCTP
+ sdh - SDH
+ sdlc - SDLC
+ sita-wan - SITA WAN packets
+ slip - SLIP
+ socketcan - SocketCAN
+ symantec - Symantec Enterprise Firewall
+ tnef - Transport-Neutral Encapsulation Format
+ tr - Token Ring
+ tr-nettl - Token Ring with nettl headers
+ tzsp - Tazmen sniffer protocol
+ unknown - Unknown
+ unknown-nettl - Unknown link-layer type with nettl headers
+ usb-darwin - USB packets with Darwin (macOS, etc.) headers
+ usb-freebsd - USB packets with FreeBSD header
+ usb-linux - USB packets with Linux header
+ usb-linux-mmap - USB packets with Linux header and padding
+ usb-usbpcap - USB packets with USBPcap header
+ user0 - USER 0
+ user1 - USER 1
+ user2 - USER 2
+ user3 - USER 3
+ user4 - USER 4
+ user5 - USER 5
+ user6 - USER 6
+ user7 - USER 7
+ user8 - USER 8
+ user9 - USER 9
+ user10 - USER 10
+ user11 - USER 11
+ user12 - USER 12
+ user13 - USER 13
+ user14 - USER 14
+ user15 - USER 15
+ v5-ef - V5 Envelope Function
+ vsock - Linux vsock
+ whdlc - Wellfleet HDLC
+ wireshark-upper-pdu - Wireshark Upper PDU export
+ wpan - IEEE 802.15.4 Wireless PAN
+ wpan-nofcs - IEEE 802.15.4 Wireless PAN with FCS not present
+ wpan-nonask-phy - IEEE 802.15.4 Wireless PAN non-ASK PHY
+ x2e-serial - X2E serial line capture
+ x2e-xoraya - X2E Xoraya
+ x25-nettl - X.25 with nettl headers
+ xeth - Xerox 3MB Ethernet
diff --git a/docbook/wsug_src/editcap-h.txt b/docbook/wsug_src/editcap-h.txt
new file mode 100644
index 0000000..bc9fd2b
--- /dev/null
+++ b/docbook/wsug_src/editcap-h.txt
@@ -0,0 +1,91 @@
+Editcap (Wireshark) 2.5.0 (v2.5.0rc0-1171-g33c00a67)
+Edit and/or translate the format of capture files.
+See https://www.wireshark.org for more information.
+
+Usage: editcap [options] ... <infile> <outfile> [ <packet#>[-<packet#>] ... ]
+
+<infile> and <outfile> must both be present.
+A single packet or a range of packets can be selected.
+
+Packet selection:
+ -r keep the selected packets; default is to delete them.
+ -A <start time> only output packets whose timestamp is after (or equal
+ to) the given time (format as YYYY-MM-DD hh:mm:ss).
+ -B <stop time> only output packets whose timestamp is before the
+ given time (format as YYYY-MM-DD hh:mm:ss).
+
+Duplicate packet removal:
+ --novlan remove vlan info from packets before checking for duplicates.
+ -d remove packet if duplicate (window == 5).
+ -D <dup window> remove packet if duplicate; configurable <dup window>.
+ Valid <dup window> values are 0 to 1000000.
+ NOTE: A <dup window> of 0 with -v (verbose option) is
+ useful to print MD5 hashes.
+ -w <dup time window> remove packet if duplicate packet is found EQUAL TO OR
+ LESS THAN <dup time window> prior to current packet.
+ A <dup time window> is specified in relative seconds
+ (e.g. 0.000001).
+ -a <framenum>:<comment> Add or replace comment for given frame number
+
+ -I <bytes to ignore> ignore the specified number of bytes at the beginning
+ of the frame during MD5 hash calculation, unless the
+ frame is too short, then the full frame is used.
+ Useful to remove duplicated packets taken on
+ several routers (different mac addresses for
+ example).
+ e.g. -I 26 in case of Ether/IP will ignore
+ ether(14) and IP header(20 - 4(src ip) - 4(dst ip)).
+
+ NOTE: The use of the 'Duplicate packet removal' options with
+ other editcap options except -v may not always work as expected.
+ Specifically the -r, -t or -S options will very likely NOT have the
+ desired effect if combined with the -d, -D or -w.
+
+Packet manipulation:
+ -s <snaplen> truncate each packet to max. <snaplen> bytes of data.
+ -C [offset:]<choplen> chop each packet by <choplen> bytes. Positive values
+ chop at the packet beginning, negative values at the
+ packet end. If an optional offset precedes the length,
+ then the bytes chopped will be offset from that value.
+ Positive offsets are from the packet beginning,
+ negative offsets are from the packet end. You can use
+ this option more than once, allowing up to 2 chopping
+ regions within a packet provided that at least 1
+ choplen is positive and at least 1 is negative.
+ -L adjust the frame (i.e. reported) length when chopping
+ and/or snapping.
+ -t <time adjustment> adjust the timestamp of each packet.
+ <time adjustment> is in relative seconds (e.g. -0.5).
+ -S <strict adjustment> adjust timestamp of packets if necessary to ensure
+ strict chronological increasing order. The <strict
+ adjustment> is specified in relative seconds with
+ values of 0 or 0.000001 being the most reasonable.
+ A negative adjustment value will modify timestamps so
+ that each packet's delta time is the absolute value
+ of the adjustment specified. A value of -0 will set
+ all packets to the timestamp of the first packet.
+ -E <error probability> set the probability (between 0.0 and 1.0 incl.) that
+ a particular packet byte will be randomly changed.
+ -o <change offset> When used in conjunction with -E, skip some bytes from the
+ beginning of the packet. This allows one to preserve some
+ bytes, in order to have some headers untouched.
+
+Output File(s):
+ -c <packets per file> split the packet output to different files based on
+ uniform packet counts with a maximum of
+ <packets per file> each.
+ -i <seconds per file> split the packet output to different files based on
+ uniform time intervals with a maximum of
+ <seconds per file> each.
+ -F <capture type> set the output file type; default is pcapng. An empty
+ "-F" option will list the file types.
+ -T <encap type> set the output file encapsulation type; default is the
+ same as the input file. An empty "-T" option will
+ list the encapsulation types.
+
+Miscellaneous:
+ -h display this help and exit.
+ -v verbose output.
+ If -v is used with any of the 'Duplicate Packet
+ Removal' options (-d, -D or -w) then Packet lengths
+ and MD5 hashes are printed to standard-error.
diff --git a/docbook/wsug_src/mergecap-h.txt b/docbook/wsug_src/mergecap-h.txt
new file mode 100644
index 0000000..21c9812
--- /dev/null
+++ b/docbook/wsug_src/mergecap-h.txt
@@ -0,0 +1,19 @@
+Mergecap (Wireshark) 2.5.0 (v2.5.0rc0-1171-g33c00a67)
+Merge two or more capture files into one.
+See https://www.wireshark.org for more information.
+
+Usage: mergecap [options] -w <outfile>|- <infile> [<infile> ...]
+
+Output:
+ -a concatenate rather than merge files.
+ default is to merge based on frame timestamps.
+ -s <snaplen> truncate packets to <snaplen> bytes of data.
+ -w <outfile>|- set the output filename to <outfile> or '-' for stdout.
+ -F <capture type> set the output file type; default is pcapng.
+ an empty "-F" option will list the file types.
+ -I <IDB merge mode> set the merge mode for Interface Description Blocks; default is 'all'.
+ an empty "-I" option will list the merge modes.
+
+Miscellaneous:
+ -h display this help and exit.
+ -v verbose output.
diff --git a/docbook/wsug_src/rawshark-h.txt b/docbook/wsug_src/rawshark-h.txt
new file mode 100644
index 0000000..8285e71
--- /dev/null
+++ b/docbook/wsug_src/rawshark-h.txt
@@ -0,0 +1,31 @@
+Rawshark (Wireshark) 2.5.0 (v2.5.0rc0-1171-g33c00a67)
+Dump and analyze network traffic.
+See https://www.wireshark.org for more information.
+
+Usage: rawshark [options] ...
+
+Input file:
+ -r <infile> set the pipe or file name to read from
+
+Processing:
+ -d <encap:linktype>|<proto:protoname>
+ packet encapsulation or protocol
+ -F <field> field to display
+ -m virtual memory limit, in bytes
+ -n disable all name resolution (def: all enabled)
+ -N <name resolve flags> enable specific name resolution(s): "mnNtd"
+ -p use the system's packet header format
+ (which may have 64-bit timestamps)
+ -R <read filter> packet filter in Wireshark display filter syntax
+ -s skip PCAP header on input
+
+Output:
+ -l flush output after each packet
+ -S format string for fields
+ (%D - name, %S - stringval, %N numval)
+ -t ad|a|r|d|dd|e output format of time stamps (def: r: rel. to first)
+
+Miscellaneous:
+ -h display this help and exit
+ -o <name>:<value> ... override preference setting
+ -v display version info and exit
diff --git a/docbook/wsug_src/reordercap-h.txt b/docbook/wsug_src/reordercap-h.txt
new file mode 100644
index 0000000..74905c1
--- /dev/null
+++ b/docbook/wsug_src/reordercap-h.txt
@@ -0,0 +1,9 @@
+Reordercap (Wireshark) 2.5.0 (v2.5.0rc0-1171-g33c00a67)
+Reorder timestamps of input file frames into output file.
+See https://www.wireshark.org for more information.
+
+Usage: reordercap [options] <infile> <outfile>
+
+Options:
+ -n don't write to output file if the input file is ordered.
+ -h display this help and exit.
diff --git a/docbook/wsug_src/text2pcap-h.txt b/docbook/wsug_src/text2pcap-h.txt
new file mode 100644
index 0000000..4ea9c5d
--- /dev/null
+++ b/docbook/wsug_src/text2pcap-h.txt
@@ -0,0 +1,79 @@
+Text2pcap (Wireshark) 2.5.0 (v2.5.0rc0-1171-g33c00a67)
+Generate a capture file from an ASCII hexdump of packets.
+See https://www.wireshark.org for more information.
+
+Usage: text2pcap [options] <infile> <outfile>
+
+where <infile> specifies input filename (use - for standard input)
+ <outfile> specifies output filename (use - for standard output)
+
+Input:
+ -o hex|oct|dec parse offsets as (h)ex, (o)ctal or (d)ecimal;
+ default is hex.
+ -t <timefmt> treat the text before the packet as a date/time code;
+ the specified argument is a format string of the sort
+ supported by strptime.
+ Example: The time "10:15:14.5476" has the format code
+ "%H:%M:%S."
+ NOTE: The subsecond component delimiter, '.', must be
+ given, but no pattern is required; the remaining
+ number is assumed to be fractions of a second.
+ NOTE: Date/time fields from the current date/time are
+ used as the default for unspecified fields.
+ -D the text before the packet starts with an I or an O,
+ indicating that the packet is inbound or outbound.
+ This is only stored if the output format is PCAP-NG.
+ -a enable ASCII text dump identification.
+ The start of the ASCII text dump can be identified
+ and excluded from the packet data, even if it looks
+ like a HEX dump.
+ NOTE: Do not enable it if the input file does not
+ contain the ASCII text dump.
+
+Output:
+ -l <typenum> link-layer type number; default is 1 (Ethernet). See
+ http://www.tcpdump.org/linktypes.html for a list of
+ numbers. Use this option if your dump is a complete
+ hex dump of an encapsulated packet and you wish to
+ specify the exact type of encapsulation.
+ Example: -l 7 for ARCNet packets.
+ -m <max-packet> max packet length in output; default is 262144
+
+Prepend dummy header:
+ -e <l3pid> prepend dummy Ethernet II header with specified L3PID
+ (in HEX).
+ Example: -e 0x806 to specify an ARP packet.
+ -i <proto> prepend dummy IP header with specified IP protocol
+ (in DECIMAL).
+ Automatically prepends Ethernet header as well.
+ Example: -i 46
+ -4 <srcip>,<destip> prepend dummy IPv4 header with specified
+ dest and source address.
+ Example: -4 10.0.0.1,10.0.0.2
+ -6 <srcip>,<destip> replace IPv6 header with specified
+ dest and source address.
+ Example: -6 fe80:0:0:0:202:b3ff:fe1e:8329,2001:0db8:85a3:0000:0000:8a2e:0370:7334
+ -u <srcp>,<destp> prepend dummy UDP header with specified
+ source and destination ports (in DECIMAL).
+ Automatically prepends Ethernet & IP headers as well.
+ Example: -u 1000,69 to make the packets look like
+ TFTP/UDP packets.
+ -T <srcp>,<destp> prepend dummy TCP header with specified
+ source and destination ports (in DECIMAL).
+ Automatically prepends Ethernet & IP headers as well.
+ Example: -T 50,60
+ -s <srcp>,<dstp>,<tag> prepend dummy SCTP header with specified
+ source/dest ports and verification tag (in DECIMAL).
+ Automatically prepends Ethernet & IP headers as well.
+ Example: -s 30,40,34
+ -S <srcp>,<dstp>,<ppi> prepend dummy SCTP header with specified
+ source/dest ports and verification tag 0.
+ Automatically prepends a dummy SCTP DATA
+ chunk header with payload protocol identifier ppi.
+ Example: -S 30,40,34
+
+Miscellaneous:
+ -h display this help and exit.
+ -d show detailed debug of parser states.
+ -q generate no output at all (automatically disables -d).
+ -n use PCAP-NG instead of PCAP as output format.
diff --git a/docbook/wsug_src/tshark-h.txt b/docbook/wsug_src/tshark-h.txt
new file mode 100644
index 0000000..308e5b9
--- /dev/null
+++ b/docbook/wsug_src/tshark-h.txt
@@ -0,0 +1,115 @@
+TShark (Wireshark) 2.5.0 (v2.5.0rc0-1171-g33c00a67)
+Dump and analyze network traffic.
+See https://www.wireshark.org for more information.
+
+Usage: tshark [options] ...
+
+Capture interface:
+ -i <interface> name or idx of interface (def: first non-loopback)
+ -f <capture filter> packet filter in libpcap filter syntax
+ -s <snaplen> packet snapshot length (def: appropriate maximum)
+ -p don't capture in promiscuous mode
+ -I capture in monitor mode, if available
+ -B <buffer size> size of kernel buffer (def: 2MB)
+ -y <link type> link layer type (def: first appropriate)
+ --time-stamp-type <type> timestamp method for interface
+ -D print list of interfaces and exit
+ -L print list of link-layer types of iface and exit
+ --list-time-stamp-types print list of timestamp types for iface and exit
+
+Capture stop conditions:
+ -c <packet count> stop after n packets (def: infinite)
+ -a <autostop cond.> ... duration:NUM - stop after NUM seconds
+ filesize:NUM - stop this file after NUM KB
+ files:NUM - stop after NUM files
+Capture output:
+ -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
+ interval:NUM - create time intervals of NUM secs
+ filesize:NUM - switch to next file after NUM KB
+ files:NUM - ringbuffer: replace after NUM files
+Input file:
+ -r <infile> set the filename to read from (- to read from stdin)
+
+Processing:
+ -2 perform a two-pass analysis
+ -M <packet count> perform session auto reset
+ -R <read filter> packet Read filter in Wireshark display filter syntax
+ (requires -2)
+ -Y <display filter> packet displaY filter in Wireshark display filter
+ syntax
+ -n disable all name resolutions (def: all enabled)
+ -N <name resolve flags> enable specific name resolution(s): "mnNtCd"
+ -d <layer_type>==<selector>,<decode_as_protocol> ...
+ "Decode As", see the man page for details
+ Example: tcp.port==8888,http
+ -H <hosts file> read a list of entries from a hosts file, which will
+ then be written to a capture file. (Implies -W n)
+ --enable-protocol <proto_name>
+ enable dissection of proto_name
+ --disable-protocol <proto_name>
+ disable dissection of proto_name
+ --enable-heuristic <short_name>
+ enable dissection of heuristic protocol
+ --disable-heuristic <short_name>
+ disable dissection of heuristic protocol
+Output:
+ -w <outfile|-> write packets to a pcap-format file named "outfile"
+ (or to the standard output for "-")
+ -C <config profile> start with specified configuration profile
+ -F <output file type> set the output file type, default is pcapng
+ an empty "-F" option will list the file types
+ -V add output of packet tree (Packet Details)
+ -O <protocols> Only show packet details of these protocols, comma
+ separated
+ -P print packet summary even when writing to a file
+ -S <separator> the line separator to print between packets
+ -x add output of hex and ASCII dump (Packet Bytes)
+ -T pdml|ps|psml|json|jsonraw|ek|tabs|text|fields|?
+ format of text output (def: text)
+ -j <protocolfilter> protocols layers filter if -T ek|pdml|json selected
+ (e.g. "ip ip.flags text", filter does not expand child
+ nodes, unless child is specified also in the filter)
+ -J <protocolfilter> top level protocol filter if -T ek|pdml|json selected
+ (e.g. "http tcp", filter which expands all child nodes)
+ -e <field> field to print if -Tfields selected (e.g. tcp.port,
+ _ws.col.Info)
+ this option can be repeated to print multiple fields
+ -E<fieldsoption>=<value> set options for output when -Tfields selected:
+ bom=y|n print a UTF-8 BOM
+ header=y|n switch headers on and off
+ separator=/t|/s|<char> select tab, space, printable character as separator
+ occurrence=f|l|a print first, last or all occurrences of each field
+ aggregator=,|/s|<char> select comma, space, printable character as
+ aggregator
+ quote=d|s|n select double, single, no quotes for values
+ -t a|ad|d|dd|e|r|u|ud|? output format of time stamps (def: r: rel. to first)
+ -u s|hms output format of seconds (def: s: seconds)
+ -l flush standard output after each packet
+ -q be more quiet on stdout (e.g. when using statistics)
+ -Q only log true errors to stderr (quieter than -q)
+ -g enable group read access on the output file(s)
+ -W n Save extra information in the file, if supported.
+ n = write network address resolution information
+ -X <key>:<value> eXtension options, see the man page for details
+ -U tap_name PDUs export mode, see the man page for details
+ -z <statistics> various statistics, see the man page for details
+ --capture-comment <comment>
+ add a capture comment to the newly created
+ output file (only for pcapng)
+ --export-objects <protocol>,<destdir> save exported objects for a protocol to
+ a directory named "destdir"
+ --color color output text similarly to the Wireshark GUI,
+ requires a terminal with 24-bit color support
+ Also supplies color attributes to pdml and psml formats
+ (Note that attributes are nonstandard)
+ --no-duplicate-keys If -T json is specified, merge duplicate keys in an object
+ into a single key with as value a json array containing all
+ values
+Miscellaneous:
+ -h display this help and exit
+ -v display version info and exit
+ -o <name>:<value> ... override preference setting
+ -K <keytab> keytab file to use for kerberos decryption
+ -G [report] dump one of several available reports and exit
+ default report="fields"
+ use "-G ?" for more help
diff --git a/editcap.c b/editcap.c
index b4d4dee..7ea2b34 100644
--- a/editcap.c
+++ b/editcap.c
@@ -830,7 +830,6 @@ print_usage(FILE *output)
fprintf(output, " If -v is used with any of the 'Duplicate Packet\n");
fprintf(output, " Removal' options (-d, -D or -w) then Packet lengths\n");
fprintf(output, " and MD5 hashes are printed to standard-error.\n");
- fprintf(output, "\n");
}
struct string_elem {
diff --git a/rawshark.c b/rawshark.c
index 7612207..6a9dacc 100644
--- a/rawshark.c
+++ b/rawshark.c
@@ -205,7 +205,7 @@ print_usage(FILE *output)
fprintf(output, " packet encapsulation or protocol\n");
fprintf(output, " -F <field> field to display\n");
#ifndef _WIN32
- fprintf(output, " -m virtual memory limit, in bytes \n");
+ fprintf(output, " -m virtual memory limit, in bytes\n");
#endif
fprintf(output, " -n disable all name resolution (def: all enabled)\n");
fprintf(output, " -N <name resolve flags> enable specific name resolution(s): \"mnNtd\"\n");
diff --git a/wiretap/file_access.c b/wiretap/file_access.c
index dc16efd..ce9195f 100644
--- a/wiretap/file_access.c
+++ b/wiretap/file_access.c
@@ -1241,7 +1241,7 @@ static const struct file_type_subtype_info dump_open_table_base[] = {
libpcap_dump_can_write_encap, libpcap_dump_open, NULL },
/* WTAP_FILE_TYPE_SUBTYPE_PCAP_NOKIA */
- { "Nokia tcpdump - pcap ", "nokiapcap", "pcap", "cap;dmp",
+ { "Nokia tcpdump - pcap", "nokiapcap", "pcap", "cap;dmp",
FALSE, FALSE, 0,
libpcap_dump_can_write_encap, libpcap_dump_open, NULL },