|author||Jeff Morriss <email@example.com>||2015-05-27 10:40:38 -0400|
|committer||Anders Broman <firstname.lastname@example.org>||2015-05-28 04:08:06 +0000|
Document the subnets file in the man pages.
Text adapted from that in the WSUG documentation of the same. Ping-Bug: 1445 Ping-Bug: 11227 Change-Id: I4d07cba437e70324d19c5ae23e44b86c47b749a8 Reviewed-on: https://code.wireshark.org/review/8662 Reviewed-by: Anders Broman <email@example.com>
Diffstat (limited to 'doc/tshark.pod')
1 files changed, 20 insertions, 0 deletions
diff --git a/doc/tshark.pod b/doc/tshark.pod
index f93e8b4576..baa8a468eb 100644
@@ -1606,6 +1606,26 @@ Capture filter name resolution is handled by libpcap on UNIX-compatible
systems and WinPcap on Windows. As such the Wireshark personal F<hosts> file
will not be consulted for capture filter name resolution.
+=item Name Resolution (subnets)
+If the an IPv4 address cannot be translated via name resolution (no exact
+match is found) then a partial match is attempted via the F<subnets> file.
+Each line of this file consists of an IPv4 address, a subnet mask length
+separated only by a / and a name separated by whitespace. While the address
+must be a full IPv4 address, any values beyond the mask length are subsequently
+An example is:
+# Comments must be prepended by the # sign!
+A partially matched name will be printed as "subnet-name.remaining-address".
+For example, "192.168.0.1" under the subnet above would be printed as
+"ws_test_network.1"; if the mask length above had been 16 rather than 24, the
+printed address would be ``ws_test_network.0.1".
=item Name Resolution (ethers)
The F<ethers> files are consulted to correlate 6-byte hardware addresses to