path: root/doc/tshark.pod
diff options
authorJeff Morriss <jeff.morriss.ws@gmail.com>2015-05-27 10:40:38 -0400
committerAnders Broman <a.broman58@gmail.com>2015-05-28 04:08:06 +0000
commitd9c13fab517557fd0f4c1f824db0a5e2218c96b1 (patch)
tree86002585f2679d70c358e21c9559bfaa7f70ab26 /doc/tshark.pod
parente08bc0dd6238b593b276609ce4ab78f512bf7c09 (diff)
Document the subnets file in the man pages.
Text adapted from that in the WSUG documentation of the same. Ping-Bug: 1445 Ping-Bug: 11227 Change-Id: I4d07cba437e70324d19c5ae23e44b86c47b749a8 Reviewed-on: https://code.wireshark.org/review/8662 Reviewed-by: Anders Broman <a.broman58@gmail.com>
Diffstat (limited to 'doc/tshark.pod')
1 files changed, 20 insertions, 0 deletions
diff --git a/doc/tshark.pod b/doc/tshark.pod
index f93e8b4576..baa8a468eb 100644
--- a/doc/tshark.pod
+++ b/doc/tshark.pod
@@ -1606,6 +1606,26 @@ Capture filter name resolution is handled by libpcap on UNIX-compatible
systems and WinPcap on Windows. As such the Wireshark personal F<hosts> file
will not be consulted for capture filter name resolution.
+=item Name Resolution (subnets)
+If the an IPv4 address cannot be translated via name resolution (no exact
+match is found) then a partial match is attempted via the F<subnets> file.
+Each line of this file consists of an IPv4 address, a subnet mask length
+separated only by a / and a name separated by whitespace. While the address
+must be a full IPv4 address, any values beyond the mask length are subsequently
+An example is:
+# Comments must be prepended by the # sign!
+ ws_test_network
+A partially matched name will be printed as "subnet-name.remaining-address".
+For example, "" under the subnet above would be printed as
+"ws_test_network.1"; if the mask length above had been 16 rather than 24, the
+printed address would be ``ws_test_network.0.1".
=item Name Resolution (ethers)
The F<ethers> files are consulted to correlate 6-byte hardware addresses to