3787
WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4) NAME wireshark-filter - Wireshark filter syntax and reference SYNOPSYS wireshark [other options] [ -R ‘‘filter expression’’ ] tshark [other options] [ -R ‘‘filter expression’’ ] DESCRIPTION Wireshark and TShark share a powerful filter engine that helps remove the noise from a packet trace and lets you see only the packets that interest you. If a packet meets the requirements expressed in your filter, then it is displayed in the list of packets. Display filters let you compare the fields within a protocol against a specific value, compare fields against fields, and check the existence of specified fields or protocols. Filters are also used by other features such as statistics generation and packet list colorization (the latter is only available to Wireshark). This manual page describes their syntax and provides a comprehensive refer- ence of filter fields. FILTER SYNTAX Check whether a field or protocol exists The simplest filter allows you to check for the existence of a protocol or field. If you want to see all packets which contain the IP protocol, the filter would be ‘‘ip’’ (without the quotation marks). To see all packets that contain a Token-Ring RIF field, use ‘‘tr.rif ’’. Think of a protocol or field in a filter as implicitly having the ‘‘exists’’ operator. Note: all protocol and field names that are available in Wireshark and TShark filters are listed in the com- prehensive FILTER PROTOCOL REFERENCE (see below). Comparison operators Fields can also be compared against values. The comparison operators can be expressed either through English-like abbreviations or through C-like symbols: eq, == Equal ne, != Not Equal gt, > Greater Than lt, < Less Than ge, >= Greater than or Equal to le, <= Less than or Equal to Search and match operators Additional operators exist expressed only in English, not C-like syntax: contains Does the protocol, field or slice contain a value matches Does the protocol or text string match the given Perl regular expression The ‘‘contains’’ operator allows a filter to search for a sequence of characters, expressed as a string (quoted or unquoted), or bytes, expressed as a byte array. For example, to search for a given HTTP URL in a cap- ture, the following filter can be used: http contains "http://www.wireshark.org" The ‘‘contains’’ operator cannot be used on atomic fields, such as numbers or IP addresses. The ‘‘matches’’ operator allows a filter to apply to a specified Perl-compatible regular expression (PCRE). The ‘‘matches’’ operator is only implemented for protocols and for protocol fields with a text string repre- sentation. For example, to search for a given WAP WSP User-Agent, you can write: wsp.user_agent matches "(?i)cldc" This example shows an interesting PCRE feature: pattern match options have to be specified with the 1.0.3 2008-10-01 1

WIRESHARK-FILTER(4) TheWireshark Network Analyzer ...fortega/fall16/cnt5415/labmaterial/reading/wireshark-filter...WIRESHARK-FILTER(4) TheWireshark Network Analyzer WIRESHARK-FILTER(4)

  • Upload
    others

  • View
    60

  • Download
    0

Embed Size (px)

Citation preview

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    NAMEwireshark−filter − Wireshark filter syntax and reference

    SYNOPSYSwireshark [other options] [ −R ‘‘filter expression’’ ]

    tshark [other options] [ −R ‘‘filter expression’’ ]

    DESCRIPTIONWireshark and TShark share a powerful filter engine that helps remove the noise from a packet trace andlets you see only the packets that interest you. If a packet meets the requirements expressed in your filter,then it is displayed in the list of packets. Display filters let you compare the fields within a protocol againsta specific value, compare fields against fields, and check the existence of specified fields or protocols.

    Filters are also used by other features such as statistics generation and packet list colorization (the latter isonly available to Wireshark). This manual page describes their syntax and provides a comprehensive refer-ence of filter fields.

    FILTER SYNTAXCheck whether a field or protocol exists

    The simplest filter allows you to check for the existence of a protocol or field. If you want to see all packetswhich contain the IP protocol, the filter would be ‘‘ip’’ (without the quotation marks). To see all packetsthat contain a Token-Ring RIF field, use ‘‘tr.rif ’’.

    Think of a protocol or field in a filter as implicitly having the ‘‘exists’’ operator.

    Note: all protocol and field names that are available in Wireshark and TShark filters are listed in the com-prehensive FILTER PROT OCOL REFERENCE (see below).

    Comparison operators

    Fields can also be compared against values. The comparison operators can be expressed either throughEnglish-like abbreviations or through C−like symbols:

    eq, == Equalne, != Not Equalgt, > Greater Thanlt, < Less Thange, >= Greater than or Equal tole,

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    (?option) construct. For instance, (?i) performs a case-insensitive pattern match. More information on PCREcan be found in the pcrepattern (3) man page (Perl Regular Expressions are explained in ).

    Note: the ‘‘matches’’ operator is only available if Wireshark or TShark have been compiled with thePCRE library. This can be checked by running:

    wireshark -vtshark -v

    or selecting the ‘‘About Wireshark’’ item from the ‘‘Help’’ menu in Wireshark.

    Functions

    The filter language has the following functions:

    upper(string-field) - converts a string field to uppercaselower(string-field) - converts a string field to lowercase

    upper() and lower() are useful for performing case-insensitive string comparisons. For example:

    upper(ncp.nds_stream_name) contains "MACRO"lower(mount.dump.hostname) == "angel"

    Protocol field types

    Each protocol field is typed. The types are:

    Unsigned integer (8-bit, 16-bit, 24-bit, or 32-bit)Signed integer (8-bit, 16-bit, 24-bit, or 32-bit)BooleanEthernet address (6 bytes)Byte arrayIPv4 addressIPv6 addressIPX network numberText stringDouble-precision floating point number

    An integer may be expressed in decimal, octal, or hexadecimal notation. The following three display filtersare equivalent:

    frame.pkt_len > 10frame.pkt_len > 012frame.pkt_len > 0xa

    Boolean values are either true or false. In a display filter expression testing the value of a Boolean field,‘‘true’’ is expressed as 1 or any other non-zero value, and ‘‘false’’ is expressed as zero. For example, atoken-ring packet’s source route field is Boolean. To find any source-routed packets, a display filter wouldbe:

    tr.sr == 1

    Non source-routed packets can be found with:

    tr.sr == 0

    Ethernet addresses and byte arrays are represented by hex digits. The hex digits may be separated bycolons, periods, or hyphens:

    eth.dst eq ff:ff:ff:ff:ff:ffaim.data == 0.1.0.dfddi.src == aa-aa-aa-aa-aa-aaecho.data == 7a

    1.0.3 2008-10-01 2

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    IPv4 addresses can be represented in either dotted decimal notation or by using the hostname:

    ip.dst eq www.mit.eduip.src == 192.168.1.1

    IPv4 addresses can be compared with the same logical relations as numbers: eq, ne, gt, ge, lt, and le. TheIPv4 address is stored in host order, so you do not have to worry about the endianness of an IPv4 addresswhen using it in a display filter.

    Classless InterDomain Routing (CIDR) notation can be used to test if an IPv4 address is in a certain subnet.For example, this display filter will find all packets in the 129.111 Class-B network:

    ip.addr == 129.111.0.0/16

    Remember, the number after the slash represents the number of bits used to represent the network. CIDRnotation can also be used with hostnames, as in this example of finding IP addresses on the same Class Cnetwork as ’sneezy’:

    ip.addr eq sneezy/24

    The CIDR notation can only be used on IP addresses or hostnames, not in variable names. So, a display fil-ter like ‘‘ip.src/24 == ip.dst/24’’ is not valid (yet).

    IPX networks are represented by unsigned 32−bit integers. Most likely you will be using hexadecimalwhen testing IPX network values:

    ipx.src.net == 0xc0a82c00

    Strings are enclosed in double quotes:

    http.request.method == "POST"

    Inside double quotes, you may use a backslash to embed a double quote or an arbitrary byte represented ineither octal or hexadecimal.

    browser.comment == "An embedded \" double-quote"

    Use of hexadecimal to look for ‘‘HEAD’’:

    http.request.method == "\x48EAD"

    Use of octal to look for ‘‘HEAD’’:

    http.request.method == "\110EAD"

    This means that you must escape backslashes with backslashes inside double quotes.

    smb.path contains "\\\\SERVER\\SHARE"

    looks for \\SERVER\SHARE in ‘‘smb.path’’.

    The slice operator

    You can take a slice of a field if the field is a text string or a byte array. For example, you can filter on thevendor portion of an ethernet address (the first three bytes) like this:

    eth.src[0:3] == 00:00:83

    Another example is:

    http.content_type[0:4] == "text"

    You can use the slice operator on a protocol name, too. The ‘‘frame’’ protocol can be useful, encompassingall the data captured by Wireshark or TShark.

    token[0:5] ne 0.0.0.1.1llc[0] eq aaframe[100-199] contains "wireshark"

    The following syntax governs slices:

    1.0.3 2008-10-01 3

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    [i:j] i = start_offset, j = length[i-j] i = start_offset, j = end_offset, inclusive.[i] i = start_offset, length = 1[:j] start_offset = 0, length = j[i:] start_offset = i, end_offset = end_of_field

    Offsets can be negative, in which case they indicate the offset from the end of the field. The last byte of thefield is at offset −1, the last but one byte is at offset −2, and so on. Here’s how to check the last four bytesof a frame:

    frame[-4:4] == 0.1.2.3

    or

    frame[-4:] == 0.1.2.3

    You can concatenate slices using the comma operator:

    ftp[1,3-5,9:] == 01:03:04:05:09:0a:0b

    This concatenates offset 1, offsets 3−5, and offset 9 to the end of the ftp data.

    Type conversions

    If a field is a text string or a byte array, it can be expressed in whichever way is most convenient.

    So, for instance, the following filters are equivalent:

    http.request.method == "GET"http.request.method == 47.45.54

    A range can also be expressed in either way:

    frame[60:2] gt 50.51frame[60:2] gt "PQ"

    Bit field operations

    It is also possible to define tests with bit field operations. Currently the following bit field operation is sup-ported:

    bitwise_and, & Bitwise AND

    The bitwise AND operation allows testing to see if one or more bits are set. Bitwise AND operates on inte-ger protocol fields and slices.

    When testing for TCP SYN packets, you can write:

    tcp.flags & 0x02

    That expression will match all packets that contain a ‘‘tcp.flags’’ field with the 0x02 bit, i.e. the SYN bit,set.

    Similarly, filtering for all WSP GET and extended GET methods is achieved with:

    wsp.pdu_type & 0x40

    When using slices, the bit mask must be specified as a byte string, and it must have the same number ofbytes as the slice itself, as in:

    ip[42:2] & 40:ff

    Logical expressions

    Tests can be combined using logical expressions. These too are expressable in C−like syntax or withEnglish-like abbreviations:

    1.0.3 2008-10-01 4

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    and, && Logical ANDor, Logical ORnot, ! Logical NOT

    Expressions can be grouped by parentheses as well. The following are all valid display filter expressions:

    tcp.port == 80 and ip.src == 192.168.2.1not llchttp and frame[100-199] contains "wireshark"(ipx.src.net == 0xbad && ipx.src.node == 0.0.0.0.0.1) ip

    Remember that whenever a protocol or field name occurs in an expression, the ‘‘exists’’ operator is implic-itly called. The ‘‘exists’’ operator has the highest priority. This means that the first filter expression must beread as ‘‘show me the packets for which tcp.port exists and equals 80, and ip.src exists and equals192.168.2.1’’. The second filter expression means ‘‘show me the packets where not (llc exists)’’, or in otherwords ‘‘where llc does not exist’’ and hence will match all packets that do not contain the llc protocol. Thethird filter expression includes the constraint that offset 199 in the frame exists, in other words the length ofthe frame is at least 200.

    A special caveat must be given reg arding fields that occur more than once per packet. ‘‘ip.addr’’ occurstwice per IP packet, once for the source address, and once for the destination address. Likewise,‘‘tr.rif.ring’’ fields can occur more than once per packet. The following two expressions are not equivalent:

    ip.addr ne 192.168.4.1not ip.addr eq 192.168.4.1

    The first filter says ‘‘show me packets where an ip.addr exists that does not equal 192.168.4.1’’. That is, aslong as one ip.addr in the packet does not equal 192.168.4.1, the packet passes the display filter. The otherip.addr could equal 192.168.4.1 and the packet would still be displayed. The second filter says ‘‘don’t showme any packets that have an ip.addr field equal to 192.168.4.1’’. If one ip.addr is 192.168.4.1, the packetdoes not pass. If neither ip.addr field is 192.168.4.1, then the packet is displayed.

    It is easy to think of the ’ne’ and ’eq’ operators as having an implict ‘‘exists’’ modifier when dealing withmultiply-recurring fields. ‘‘ip.addr ne 192.168.4.1’’ can be thought of as ‘‘there exists an ip.addr that doesnot equal 192.168.4.1’’. ‘‘not ip.addr eq 192.168.4.1’’ can be thought of as ‘‘there does not exist an ip.addrequal to 192.168.4.1’’.

    Be careful with multiply-recurring fields; they can be confusing.

    Care must also be taken when using the display filter to remove noise from the packet trace. If, for example,you want to filter out all IP multicast packets to address 224.1.2.3, then using:

    ip.dst ne 224.1.2.3

    may be too restrictive. Filtering with ‘‘ip.dst’’ selects only those IP packets that satisfy the rule. Any otherpackets, including all non-IP packets, will not be displayed. To display the non-IP packets as well, you canuse one of the following two expressions:

    not ip or ip.dst ne 224.1.2.3not ip.addr eq 224.1.2.3

    The first filter uses ‘‘not ip’’ to include all non-IP packets and then lets ‘‘ip.dst ne 224.1.2.3’’ filter out theunwanted IP packets. The second filter has already been explained above where filtering with multiplyoccuring fields was discussed.

    FILTER PROT OCOL REFERENCEEach entry below provides an abbreviated protocol or field name. Every one of these fields can be used in adisplay filter. The type of the field is also given.

    1.0.3 2008-10-01 5

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    3Com XNS Encapsulation (3comxns)

    3comxns.type TypeUnsigned 16-bit integer

    3GPP2 A11 (a11)

    a11.ackstat Reply StatusUnsigned 8-bit integerA11 Registration Ack Status.

    a11.auth.auth AuthenticatorByte arrayAuthenticator.

    a11.auth.spi SPIUnsigned 32-bit integerAuthentication Header Security Parameter Index.

    a11.b Broadcast DatagramsBooleanBroadcast Datagrams requested

    a11.coa Care of AddressIPv4 addressCare of Address.

    a11.code Reply CodeUnsigned 8-bit integerA11 Registration Reply code.

    a11.d Co-located Care-of AddressBooleanMN using Co-located Care-of address

    a11.ext.apptype Application TypeUnsigned 8-bit integerApplication Type.

    a11.ext.ase.key GRE KeyUnsigned 32-bit integerGRE Key.

    a11.ext.ase.len Entry LengthUnsigned 8-bit integerEntry Length.

    a11.ext.ase.pcfip PCF IP AddressIPv4 addressPCF IP Address.

    a11.ext.ase.ptype GRE Protocol TypeUnsigned 16-bit integerGRE Protocol Type.

    a11.ext.ase.srid Service Reference ID (SRID)Unsigned 8-bit integerService Reference ID (SRID).

    a11.ext.ase.srvopt Service OptionUnsigned 16-bit integerService Option.

    1.0.3 2008-10-01 6

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    a11.ext.auth.subtype Gen Auth Ext SubTypeUnsigned 8-bit integerMobile IP Auth Extension Sub Type.

    a11.ext.canid CANIDByte arrayCANID

    a11.ext.code Reply CodeUnsigned 8-bit integerPDSN Code.

    a11.ext.dormant All Dormant IndicatorUnsigned 16-bit integerAll Dormant Indicator.

    a11.ext.fqi.dscp Forward DSCPUnsigned 8-bit integerForward Flow DSCP.

    a11.ext.fqi.entrylen Entry LengthUnsigned 8-bit integerForward Entry Length.

    a11.ext.fqi.flags FlagsUnsigned 8-bit integerForward Flow Entry Flags.

    a11.ext.fqi.flowcount Forward Flow CountUnsigned 8-bit integerForward Flow Count.

    a11.ext.fqi.flowid Forward Flow IdUnsigned 8-bit integerForward Flow Id.

    a11.ext.fqi.flowstate Forward Flow StateUnsigned 8-bit integerForward Flow State.

    a11.ext.fqi.graqos Granted QoSByte arrayForward Granted QoS.

    a11.ext.fqi.graqoslen Granted QoS LengthUnsigned 8-bit integerForward Granted QoS Length.

    a11.ext.fqi.length LengthUnsigned 16-bit integer

    a11.ext.fqi.reqqos Requested QoSByte arrayForward Requested QoS.

    a11.ext.fqi.reqqoslen Requested QoS LengthUnsigned 8-bit integerForward Requested QoS Length.

    a11.ext.fqi.srid SRIDUnsigned 8-bit integerForward Flow Entry SRID.

    1.0.3 2008-10-01 7

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    a11.ext.fqui.flowcount Forward QoS Update Flow CountUnsigned 8-bit integerForward QoS Update Flow Count.

    a11.ext.fqui.updatedqos Foward Updated QoS Sub-BlobByte arrayFoward Updated QoS Sub-Blob.

    a11.ext.fqui.updatedqoslen Foward Updated QoS Sub-Blob LengthUnsigned 8-bit integerFoward Updated QoS Sub-Blob Length.

    a11.ext.key KeyUnsigned 32-bit integerSession Key.

    a11.ext.len Extension LengthUnsigned 16-bit integerMobile IP Extension Length.

    a11.ext.mnsrid MNSR-IDUnsigned 16-bit integerMNSR-ID

    a11.ext.msid MSID(BCD)StringMSID(BCD).

    a11.ext.msid_len MSID LengthUnsigned 8-bit integerMSID Length.

    a11.ext.msid_type MSID TypeUnsigned 16-bit integerMSID Type.

    a11.ext.panid PANIDByte arrayPANID

    a11.ext.ppaddr Anchor P-P AddressIPv4 addressAnchor P-P Address.

    a11.ext.ptype Protocol TypeUnsigned 16-bit integerProtocol Type.

    a11.ext.qosmode QoS ModeUnsigned 8-bit integerQoS Mode.

    a11.ext.rqi.entrylen Entry LengthUnsigned 8-bit integerReverse Flow Entry Length.

    a11.ext.rqi.flowcount Reverse Flow CountUnsigned 8-bit integerReverse Flow Count.

    a11.ext.rqi.flowid Reverse Flow IdUnsigned 8-bit integerReverse Flow Id.

    1.0.3 2008-10-01 8

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    a11.ext.rqi.flowstate Flow StateUnsigned 8-bit integerReverse Flow State.

    a11.ext.rqi.graqos Granted QoSByte arrayReverse Granted QoS.

    a11.ext.rqi.graqoslen Granted QoS LengthUnsigned 8-bit integerReverse Granted QoS Length.

    a11.ext.rqi.length LengthUnsigned 16-bit integer

    a11.ext.rqi.reqqos Requested QoSByte arrayReverse Requested QoS.

    a11.ext.rqi.reqqoslen Requested QoS LengthUnsigned 8-bit integerReverse Requested QoS Length.

    a11.ext.rqi.srid SRIDUnsigned 8-bit integerReverse Flow Entry SRID.

    a11.ext.rqui.flowcount Reverse QoS Update Flow CountUnsigned 8-bit integerReverse QoS Update Flow Count.

    a11.ext.rqui.updatedqos Reverse Updated QoS Sub-BlobByte arrayReverse Updated QoS Sub-Blob.

    a11.ext.rqui.updatedqoslen Reverse Updated QoS Sub-Blob LengthUnsigned 8-bit integerReverse Updated QoS Sub-Blob Length.

    a11.ext.sidver Session ID VersionUnsigned 8-bit integerSession ID Version

    a11.ext.sqp.profile Subscriber QoS ProfileByte arraySubscriber QoS Profile.

    a11.ext.sqp.profilelen Subscriber QoS Profile LengthByte arraySubscriber QoS Profile Length.

    a11.ext.srvopt Service OptionUnsigned 16-bit integerService Option.

    a11.ext.type Extension TypeUnsigned 8-bit integerMobile IP Extension Type.

    a11.ext.vid Vendor IDUnsigned 32-bit integerVendor ID.

    1.0.3 2008-10-01 9

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    a11.extension ExtensionByte arrayExtension

    a11.flags FlagsUnsigned 8-bit integer

    a11.g GREBooleanMN wants GRE encapsulation

    a11.haaddr Home AgentIPv4 addressHome agent IP Address.

    a11.homeaddr Home AddressIPv4 addressMobile Node’s home address.

    a11.ident IdentificationByte arrayMN Identification.

    a11.life LifetimeUnsigned 16-bit integerA11 Registration Lifetime.

    a11.m Minimal EncapsulationBooleanMN wants Minimal encapsulation

    a11.nai NAIStringNAI

    a11.s Simultaneous BindingsBooleanSimultaneous Bindings Allowed

    a11.t Reverse TunnelingBooleanReverse tunneling requested

    a11.type Message TypeUnsigned 8-bit integerA11 Message type.

    a11.v Van JacobsonBooleanVan Jacobson

    3com Network Jack (njack)

    njack.getresp.unknown1 Unknown1Unsigned 8-bit integer

    njack.magic MagicString

    njack.set.length SetLengthUnsigned 16-bit integer

    1.0.3 2008-10-01 10

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    njack.set.salt SaltUnsigned 32-bit integer

    njack.setresult SetResultUnsigned 8-bit integer

    njack.tlv.addtagscheme TlvAddTagSchemeUnsigned 8-bit integer

    njack.tlv.authdata AuthdataByte array

    njack.tlv.contermode TlvTypeCountermodeUnsigned 8-bit integer

    njack.tlv.data TlvDataByte array

    njack.tlv.devicemac TlvTypeDeviceMAC6-byte Hardware (MAC) Address

    njack.tlv.dhcpcontrol TlvTypeDhcpControlUnsigned 8-bit integer

    njack.tlv.length TlvLengthUnsigned 8-bit integer

    njack.tlv.maxframesize TlvTypeMaxframesizeUnsigned 8-bit integer

    njack.tlv.portingressmode TlvTypePortingressmodeUnsigned 8-bit integer

    njack.tlv.powerforwarding TlvTypePowerforwardingUnsigned 8-bit integer

    njack.tlv.scheduling TlvTypeSchedulingUnsigned 8-bit integer

    njack.tlv.snmpwrite TlvTypeSnmpwriteUnsigned 8-bit integer

    njack.tlv.type TlvTypeUnsigned 8-bit integer

    njack.tlv.typeip TlvTypeIPIPv4 address

    njack.tlv.typestring TlvTypeStringString

    njack.tlv.version TlvFwVersionIPv4 address

    njack.type TypeUnsigned 8-bit integer

    802.11 radio information (radio)

    802.1Q Virtual LAN (vlan)

    vlan.cfi CFIUnsigned 16-bit integerCanonical Format Identifier

    1.0.3 2008-10-01 11

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    vlan.etype TypeUnsigned 16-bit integerEthertype

    vlan.id IDUnsigned 16-bit integerVLAN ID

    vlan.len LengthUnsigned 16-bit integer

    vlan.priority PriorityUnsigned 16-bit integerUser Priority

    vlan.trailer TrailerByte arrayVLAN Trailer

    802.1X Authentication (eapol)

    eapol.keydes.data WPA KeyByte arrayWPA Key Data

    eapol.keydes.datalen WPA Key LengthUnsigned 16-bit integerWPA Key Data Length

    eapol.keydes.id WPA Key IDByte arrayWPA Key ID(RSN Reserved)

    eapol.keydes.index.indexnum Index NumberUnsigned 8-bit integerKey Index number

    eapol.keydes.index.keytype Key TypeBooleanKey Type (unicast/broadcast)

    eapol.keydes.key KeyByte arrayKey

    eapol.keydes.key_info Key InformationUnsigned 16-bit integerWPA key info

    eapol.keydes.key_info.encr_key_data Encrypted Key Data flagBooleanEncrypted Key Data flag

    eapol.keydes.key_info.error Error flagBooleanError flag

    eapol.keydes.key_info.install Install flagBooleanInstall flag

    1.0.3 2008-10-01 12

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    eapol.keydes.key_info.key_ack Key Ack flagBooleanKey Ack flag

    eapol.keydes.key_info.key_index Key IndexUnsigned 16-bit integerKey Index (0-3) (RSN: Reserved)

    eapol.keydes.key_info.key_mic Key MIC flagBooleanKey MIC flag

    eapol.keydes.key_info.key_type Key TypeBooleanKey Type (Pairwise or Group)

    eapol.keydes.key_info.keydes_ver Key Descriptor VersionUnsigned 16-bit integerKey Descriptor Version Type

    eapol.keydes.key_info.request Request flagBooleanRequest flag

    eapol.keydes.key_info.secure Secure flagBooleanSecure flag

    eapol.keydes.key_iv Key IVByte arrayKey Initialization Vector

    eapol.keydes.key_signature Key SignatureByte arrayKey Signature

    eapol.keydes.keylen Key LengthUnsigned 16-bit integerKey Length

    eapol.keydes.mic WPA Key MICByte arrayWPA Key Message Integrity Check

    eapol.keydes.nonce NonceByte arrayWPA Key Nonce

    eapol.keydes.replay_counter Replay CounterUnsigned 64-bit integerReplay Counter

    eapol.keydes.rsc WPA Key RSCByte arrayWPA Key Receive Sequence Counter

    eapol.keydes.type Descriptor TypeUnsigned 8-bit integerKey Descriptor Type

    eapol.len LengthUnsigned 16-bit integerLength

    1.0.3 2008-10-01 13

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    eapol.type TypeUnsigned 8-bit integer

    eapol.version VersionUnsigned 8-bit integer

    AAL type 2 signalling protocol (Q.2630) (alcap)

    alcap.acc.level Congestion LevelUnsigned 8-bit integer

    alcap.alc.bitrate.avg.bw Average Backwards Bit RateUnsigned 16-bit integer

    alcap.alc.bitrate.avg.fw Average Forward Bit RateUnsigned 16-bit integer

    alcap.alc.bitrate.max.bw Maximum Backwards Bit RateUnsigned 16-bit integer

    alcap.alc.bitrate.max.fw Maximum Forward Bit RateUnsigned 16-bit integer

    alcap.alc.sdusize.avg.bw Average Backwards CPS SDU SizeUnsigned 8-bit integer

    alcap.alc.sdusize.avg.fw Average Forward CPS SDU SizeUnsigned 8-bit integer

    alcap.alc.sdusize.max.bw Maximum Backwards CPS SDU SizeUnsigned 8-bit integer

    alcap.alc.sdusize.max.fw Maximum Forward CPS SDU SizeUnsigned 8-bit integer

    alcap.cau.coding Cause CodingUnsigned 8-bit integer

    alcap.cau.diag DiagnosticByte array

    alcap.cau.diag.field_num Field NumberUnsigned 8-bit integer

    alcap.cau.diag.len LengthUnsigned 8-bit integerDiagnostics Length

    alcap.cau.diag.msg Message IdentifierUnsigned 8-bit integer

    alcap.cau.diag.param Parameter IdentifierUnsigned 8-bit integer

    alcap.cau.value Cause Value (ITU)Unsigned 8-bit integer

    alcap.ceid.cid CIDUnsigned 8-bit integer

    alcap.ceid.pathid Path IDUnsigned 32-bit integer

    alcap.compat Message CompatibilityByte array

    1.0.3 2008-10-01 14

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    alcap.compat.general.ii General IIUnsigned 8-bit integerInstruction Indicator

    alcap.compat.general.sni General SNIUnsigned 8-bit integerSend Notificaation Indicator

    alcap.compat.pass.ii Pass-On IIUnsigned 8-bit integerInstruction Indicator

    alcap.compat.pass.sni Pass-On SNIUnsigned 8-bit integerSend Notificaation Indicator

    alcap.cp.level LevelUnsigned 8-bit integer

    alcap.dnsea.addr AddressByte array

    alcap.dsaid DSAIDUnsigned 32-bit integerDestination Service Association ID

    alcap.fbw.bitrate.bw CPS Backwards BitrateUnsigned 24-bit integer

    alcap.fbw.bitrate.fw CPS Forward BitrateUnsigned 24-bit integer

    alcap.fbw.bucket_size.bw Backwards CPS Bucket SizeUnsigned 16-bit integer

    alcap.fbw.bucket_size.fw Forward CPS Bucket SizeUnsigned 16-bit integer

    alcap.fbw.max_size.bw Backwards CPS Packet SizeUnsigned 8-bit integer

    alcap.fbw.max_size.fw Forward CPS Packet SizeUnsigned 8-bit integer

    alcap.hc.codepoint CodepointUnsigned 8-bit integer

    alcap.leg.cause Leg’s cause value in RELUnsigned 8-bit integer

    alcap.leg.cid Leg’s channel idUnsigned 32-bit integer

    alcap.leg.dnsea Leg’s destination NSAPString

    alcap.leg.dsaid Leg’s ECF OSA idUnsigned 32-bit integer

    alcap.leg.msg a message of this legFrame number

    alcap.leg.onsea Leg’s originating NSAPString

    1.0.3 2008-10-01 15

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    alcap.leg.osaid Leg’s ERQ OSA idUnsigned 32-bit integer

    alcap.leg.pathid Leg’s path idUnsigned 32-bit integer

    alcap.leg.sugr Leg’s SUGRUnsigned 32-bit integer

    alcap.msg_type Message TypeUnsigned 8-bit integer

    alcap.onsea.addr AddressByte array

    alcap.osaid OSAIDUnsigned 32-bit integerOriginating Service Association ID

    alcap.param ParameterUnsigned 8-bit integerParameter Id

    alcap.param.len LengthUnsigned 8-bit integerParameter Length

    alcap.pfbw.bitrate.bw CPS Backwards BitrateUnsigned 24-bit integer

    alcap.pfbw.bitrate.fw CPS Forward BitrateUnsigned 24-bit integer

    alcap.pfbw.bucket_size.bw Backwards CPS Bucket SizeUnsigned 16-bit integer

    alcap.pfbw.bucket_size.fw Forward CPS Bucket SizeUnsigned 16-bit integer

    alcap.pfbw.max_size.bw Backwards CPS Packet SizeUnsigned 8-bit integer

    alcap.pfbw.max_size.fw Forward CPS Packet SizeUnsigned 8-bit integer

    alcap.plc.bitrate.avg.bw Average Backwards Bit RateUnsigned 16-bit integer

    alcap.plc.bitrate.avg.fw Average Forward Bit RateUnsigned 16-bit integer

    alcap.plc.bitrate.max.bw Maximum Backwards Bit RateUnsigned 16-bit integer

    alcap.plc.bitrate.max.fw Maximum Forward Bit RateUnsigned 16-bit integer

    alcap.plc.sdusize.max.bw Maximum Backwards CPS SDU SizeUnsigned 8-bit integer

    alcap.plc.sdusize.max.fw Maximum Forward CPS SDU SizeUnsigned 8-bit integer

    alcap.pssiae.cas CASUnsigned 8-bit integerChannel Associated Signalling

    1.0.3 2008-10-01 16

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    alcap.pssiae.cmd Circuit ModeUnsigned 8-bit integer

    alcap.pssiae.dtmf DTMFUnsigned 8-bit integer

    alcap.pssiae.fax FaxUnsigned 8-bit integerFacsimile

    alcap.pssiae.frm Frame ModeUnsigned 8-bit integer

    alcap.pssiae.lb LoopbackUnsigned 8-bit integer

    alcap.pssiae.max_fmdata_len Max Len of FM DataUnsigned 16-bit integer

    alcap.pssiae.mfr1 Multi-Frequency R1Unsigned 8-bit integer

    alcap.pssiae.mfr2 Multi-Frequency R2Unsigned 8-bit integer

    alcap.pssiae.oui OUIByte arrayOrganizational Unique Identifier

    alcap.pssiae.pcm PCM ModeUnsigned 8-bit integer

    alcap.pssiae.profile.id Profile IdUnsigned 8-bit integer

    alcap.pssiae.profile.type Profile TypeUnsigned 8-bit integerI.366.2 Profile Type

    alcap.pssiae.rc Rate ConctrolUnsigned 8-bit integer

    alcap.pssiae.syn SyncronizationUnsigned 8-bit integerTransport of synchronization of change in SSCS operation

    alcap.pssime.frm Frame ModeUnsigned 8-bit integer

    alcap.pssime.lb LoopbackUnsigned 8-bit integer

    alcap.pssime.max Max LenUnsigned 16-bit integer

    alcap.pssime.mult MultiplierUnsigned 8-bit integer

    alcap.pt.codepoint QoS CodepointUnsigned 8-bit integer

    alcap.pvbws.bitrate.bw Peak CPS Backwards BitrateUnsigned 24-bit integer

    alcap.pvbws.bitrate.fw Peak CPS Forward BitrateUnsigned 24-bit integer

    1.0.3 2008-10-01 17

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    alcap.pvbws.bucket_size.bw Peak Backwards CPS Bucket SizeUnsigned 16-bit integer

    alcap.pvbws.bucket_size.fw Peak Forward CPS Bucket SizeUnsigned 16-bit integer

    alcap.pvbws.max_size.bw Backwards CPS Packet SizeUnsigned 8-bit integer

    alcap.pvbws.max_size.fw Forward CPS Packet SizeUnsigned 8-bit integer

    alcap.pvbws.stt Source Traffic TypeUnsigned 8-bit integer

    alcap.pvbwt.bitrate.bw Peak CPS Backwards BitrateUnsigned 24-bit integer

    alcap.pvbwt.bitrate.fw Peak CPS Forward BitrateUnsigned 24-bit integer

    alcap.pvbwt.bucket_size.bw Peak Backwards CPS Bucket SizeUnsigned 16-bit integer

    alcap.pvbwt.bucket_size.fw Peak Forward CPS Bucket SizeUnsigned 16-bit integer

    alcap.pvbwt.max_size.bw Backwards CPS Packet SizeUnsigned 8-bit integer

    alcap.pvbwt.max_size.fw Forward CPS Packet SizeUnsigned 8-bit integer

    alcap.ssia.cas CASUnsigned 8-bit integerChannel Associated Signalling

    alcap.ssia.cmd Circuit ModeUnsigned 8-bit integer

    alcap.ssia.dtmf DTMFUnsigned 8-bit integer

    alcap.ssia.fax FaxUnsigned 8-bit integerFacsimile

    alcap.ssia.frm Frame ModeUnsigned 8-bit integer

    alcap.ssia.max_fmdata_len Max Len of FM DataUnsigned 16-bit integer

    alcap.ssia.mfr1 Multi-Frequency R1Unsigned 8-bit integer

    alcap.ssia.mfr2 Multi-Frequency R2Unsigned 8-bit integer

    alcap.ssia.oui OUIByte arrayOrganizational Unique Identifier

    alcap.ssia.pcm PCM ModeUnsigned 8-bit integer

    1.0.3 2008-10-01 18

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    alcap.ssia.profile.id Profile IdUnsigned 8-bit integer

    alcap.ssia.profile.type Profile TypeUnsigned 8-bit integerI.366.2 Profile Type

    alcap.ssiae.cas CASUnsigned 8-bit integerChannel Associated Signalling

    alcap.ssiae.cmd Circuit ModeUnsigned 8-bit integer

    alcap.ssiae.dtmf DTMFUnsigned 8-bit integer

    alcap.ssiae.fax FaxUnsigned 8-bit integerFacsimile

    alcap.ssiae.frm Frame ModeUnsigned 8-bit integer

    alcap.ssiae.lb LoopbackUnsigned 8-bit integer

    alcap.ssiae.max_fmdata_len Max Len of FM DataUnsigned 16-bit integer

    alcap.ssiae.mfr1 Multi-Frequency R1Unsigned 8-bit integer

    alcap.ssiae.mfr2 Multi-Frequency R2Unsigned 8-bit integer

    alcap.ssiae.oui OUIByte arrayOrganizational Unique Identifier

    alcap.ssiae.pcm PCM ModeUnsigned 8-bit integer

    alcap.ssiae.profile.id Profile IdUnsigned 8-bit integer

    alcap.ssiae.profile.type Profile TypeUnsigned 8-bit integerI.366.2 Profile Type

    alcap.ssiae.rc Rate ConctrolUnsigned 8-bit integer

    alcap.ssiae.syn SyncronizationUnsigned 8-bit integerTransport of synchronization of change in SSCS operation

    alcap.ssim.frm Frame ModeUnsigned 8-bit integer

    alcap.ssim.max Max LenUnsigned 16-bit integer

    alcap.ssim.mult MultiplierUnsigned 8-bit integer

    1.0.3 2008-10-01 19

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    alcap.ssime.frm Frame ModeUnsigned 8-bit integer

    alcap.ssime.lb LoopbackUnsigned 8-bit integer

    alcap.ssime.max Max LenUnsigned 16-bit integer

    alcap.ssime.mult MultiplierUnsigned 8-bit integer

    alcap.ssisa.sscop.max_sdu_len.bw Maximum Len of SSSAR-SDU BackwardsUnsigned 16-bit integer

    alcap.ssisa.sscop.max_sdu_len.fw Maximum Len of SSSAR-SDU ForwardUnsigned 16-bit integer

    alcap.ssisa.sscop.max_uu_len.bw Maximum Len of SSSAR-SDU BackwardsUnsigned 16-bit integer

    alcap.ssisa.sscop.max_uu_len.fw Maximum Len of SSSAR-SDU ForwardUnsigned 16-bit integer

    alcap.ssisa.sssar.max_len.fw Maximum Len of SSSAR-SDU ForwardUnsigned 24-bit integer

    alcap.ssisu.sssar.max_len.fw Maximum Len of SSSAR-SDU ForwardUnsigned 24-bit integer

    alcap.ssisu.ted Transmission Error DetectionUnsigned 8-bit integer

    alcap.suci SUCIUnsigned 8-bit integerServed User Correlation Id

    alcap.sugr SUGRByte arrayServed User Generated Reference

    alcap.sut.sut_len SUT LengthUnsigned 8-bit integer

    alcap.sut.transport SUTByte arrayServed User Transport

    alcap.unknown.field Unknown Field DataByte array

    alcap.vbws.bitrate.bw CPS Backwards BitrateUnsigned 24-bit integer

    alcap.vbws.bitrate.fw CPS Forward BitrateUnsigned 24-bit integer

    alcap.vbws.bucket_size.bw Backwards CPS Bucket SizeUnsigned 16-bit integer

    alcap.vbws.bucket_size.fw Forward CPS Bucket SizeUnsigned 16-bit integer

    alcap.vbws.max_size.bw Backwards CPS Packet SizeUnsigned 8-bit integer

    1.0.3 2008-10-01 20

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    alcap.vbws.max_size.fw Forward CPS Packet SizeUnsigned 8-bit integer

    alcap.vbws.stt Source Traffic TypeUnsigned 8-bit integer

    alcap.vbwt.bitrate.bw Peak CPS Backwards BitrateUnsigned 24-bit integer

    alcap.vbwt.bitrate.fw Peak CPS Forward BitrateUnsigned 24-bit integer

    alcap.vbwt.bucket_size.bw Peak Backwards CPS Bucket SizeUnsigned 16-bit integer

    alcap.vbwt.bucket_size.fw Peak Forward CPS Bucket SizeUnsigned 16-bit integer

    alcap.vbwt.max_size.bw Backwards CPS Packet SizeUnsigned 8-bit integer

    alcap.vbwt.max_size.fw Forward CPS Packet SizeUnsigned 8-bit integer

    ACP133 Attribute Syntaxes (acp133)

    acp133.ACPLegacyFormat ACPLegacyFormatSigned 32-bit integeracp133.ACPLegacyFormat

    acp133.ACPPreferredDelivery ACPPreferredDeliveryUnsigned 32-bit integeracp133.ACPPreferredDelivery

    acp133.ALType ALTypeSigned 32-bit integeracp133.ALType

    acp133.AddressCapabilities AddressCapabilitiesNo valueacp133.AddressCapabilities

    acp133.Addressees AddresseesUnsigned 32-bit integeracp133.Addressees

    acp133.Addressees_item ItemStringacp133.PrintableString_SIZE_1_55

    acp133.Capability CapabilityNo valueacp133.Capability

    acp133.Classification ClassificationUnsigned 32-bit integeracp133.Classification

    acp133.Community CommunityUnsigned 32-bit integeracp133.Community

    1.0.3 2008-10-01 21

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    acp133.DLPolicy DLPolicyNo valueacp133.DLPolicy

    acp133.DLSubmitPermission DLSubmitPermissionUnsigned 32-bit integeracp133.DLSubmitPermission

    acp133.DistributionCode DistributionCodeStringacp133.DistributionCode

    acp133.JPEG JPEGByte arrayacp133.JPEG

    acp133.Kmid KmidByte arrayacp133.Kmid

    acp133.MLReceiptPolicy MLReceiptPolicyUnsigned 32-bit integeracp133.MLReceiptPolicy

    acp133.MonthlyUKMs MonthlyUKMsNo valueacp133.MonthlyUKMs

    acp133.OnSupported OnSupportedByte arrayacp133.OnSupported

    acp133.RIParameters RIParametersNo valueacp133.RIParameters

    acp133.Remarks RemarksUnsigned 32-bit integeracp133.Remarks

    acp133.Remarks_item ItemStringacp133.PrintableString

    acp133.acp127-nn acp127-nnBoolean

    acp133.acp127-pn acp127-pnBoolean

    acp133.acp127-tn acp127-tnBoolean

    acp133.address addressNo valuex411.ORAddress

    acp133.algorithm_identifier algorithm-identifierNo valuex509af.AlgorithmIdentifier

    1.0.3 2008-10-01 22

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    acp133.capabilities capabilitiesUnsigned 32-bit integeracp133.SET_OF_Capability

    acp133.capabilities_item ItemNo valueacp133.Capability

    acp133.classification classificationUnsigned 32-bit integeracp133.Classification

    acp133.content_types content-typesUnsigned 32-bit integeracp133.SET_OF_ExtendedContentType

    acp133.content_types_item Item

    x411.ExtendedContentType

    acp133.conversion_with_loss_prohibited conversion-with-loss-prohibitedUnsigned 32-bit integeracp133.T_conversion_with_loss_prohibited

    acp133.date dateStringacp133.UTCTime

    acp133.description descriptionStringacp133.GeneralString

    acp133.disclosure_of_other_recipients disclosure-of-other-recipientsUnsigned 32-bit integeracp133.T_disclosure_of_other_recipients

    acp133.edition editionSigned 32-bit integeracp133.INTEGER

    acp133.encoded_information_types_constraints encoded-information-types-constraintsNo valuex411.EncodedInformationTypesConstraints

    acp133.encrypted encryptedByte arrayacp133.BIT_STRING

    acp133.further_dl_expansion_allowed further-dl-expansion-allowedBooleanacp133.BOOLEAN

    acp133.implicit_conversion_prohibited implicit-conversion-prohibitedUnsigned 32-bit integeracp133.T_implicit_conversion_prohibited

    acp133.inAdditionTo inAdditionToUnsigned 32-bit integeracp133.SEQUENCE_OF_GeneralNames

    acp133.inAdditionTo_item ItemUnsigned 32-bit integerx509ce.GeneralNames

    1.0.3 2008-10-01 23

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    acp133.individual individualNo valuex411.ORName

    acp133.insteadOf insteadOfUnsigned 32-bit integeracp133.SEQUENCE_OF_GeneralNames

    acp133.insteadOf_item ItemUnsigned 32-bit integerx509ce.GeneralNames

    acp133.kmid kmidByte arrayacp133.Kmid

    acp133.maximum_content_length maximum-content-lengthUnsigned 32-bit integerx411.ContentLength

    acp133.member_of_dl member-of-dlNo valuex411.ORName

    acp133.member_of_group member-of-groupUnsigned 32-bit integerx509if.Name

    acp133.minimize minimizeBooleanacp133.BOOLEAN

    acp133.none noneNo valueacp133.NULL

    acp133.originating_MTA_report originating-MTA-reportSigned 32-bit integeracp133.T_originating_MTA_report

    acp133.originator_certificate_selector originator-certificate-selectorNo valuex509ce.CertificateAssertion

    acp133.originator_report originator-reportSigned 32-bit integeracp133.T_originator_report

    acp133.originator_requested_alternate_recipient_removed originator-requested-alternate-recipient-removedBooleanacp133.BOOLEAN

    acp133.pattern_match pattern-matchNo valueacp133.ORNamePattern

    acp133.priority prioritySigned 32-bit integeracp133.T_priority

    acp133.proof_of_delivery proof-of-deliverySigned 32-bit integeracp133.T_proof_of_delivery

    1.0.3 2008-10-01 24

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    acp133.rI rIStringacp133.PrintableString

    acp133.rIType rITypeUnsigned 32-bit integeracp133.T_rIType

    acp133.recipient_certificate_selector recipient-certificate-selectorNo valuex509ce.CertificateAssertion

    acp133.removed removedNo valueacp133.NULL

    acp133.replaced replacedUnsigned 32-bit integerx411.RequestedDeliveryMethod

    acp133.report_from_dl report-from-dlSigned 32-bit integeracp133.T_report_from_dl

    acp133.report_propagation report-propagationSigned 32-bit integeracp133.T_report_propagation

    acp133.requested_delivery_method requested-delivery-methodUnsigned 32-bit integeracp133.T_requested_delivery_method

    acp133.return_of_content return-of-contentUnsigned 32-bit integeracp133.T_return_of_content

    acp133.sHD sHDStringacp133.PrintableString

    acp133.security_labels security-labelsUnsigned 32-bit integerx411.SecurityContext

    acp133.tag tagNo valueacp133.PairwiseTag

    acp133.token_encryption_algorithm_preference token-encryption-algorithm-preferenceUnsigned 32-bit integeracp133.SEQUENCE_OF_AlgorithmInformation

    acp133.token_encryption_algorithm_preference_item ItemNo valueacp133.AlgorithmInformation

    acp133.token_signature_algorithm_preference token-signature-algorithm-preferenceUnsigned 32-bit integeracp133.SEQUENCE_OF_AlgorithmInformation

    acp133.token_signature_algorithm_preference_item ItemNo valueacp133.AlgorithmInformation

    1.0.3 2008-10-01 25

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    acp133.ukm ukmByte arrayacp133.OCTET_STRING

    acp133.ukm_entries ukm-entriesUnsigned 32-bit integeracp133.SEQUENCE_OF_UKMEntry

    acp133.ukm_entries_item ItemNo valueacp133.UKMEntry

    acp133.unchanged unchangedNo valueacp133.NULL

    AIM Administrative (aim_admin)

    aim_admin.acctinfo.code Account Information Request CodeUnsigned 16-bit integer

    aim_admin.acctinfo.permissions Account PermissionsUnsigned 16-bit integer

    aim_admin.confirm_status Confirmation statusUnsigned 16-bit integer

    AIM Advertisements (aim_adverts)

    AIM Buddylist Service (aim_buddylist)

    aim_buddylist.userinfo.warninglevel Warning LevelUnsigned 16-bit integer

    AIM Chat Navigation (aim_chatnav)

    AIM Chat Service (aim_chat)

    AIM Directory Search (aim_dir)

    AIM E−mail (aim_email)

    AIM Generic Service (aim_generic)

    aim_generic.client_verification.hash Client Verification MD5 HashByte array

    aim_generic.client_verification.length Client Verification Request LengthUnsigned 32-bit integer

    aim_generic.client_verification.offset Client Verification Request OffsetUnsigned 32-bit integer

    aim_generic.evil.new_warn_level New warning levelUnsigned 16-bit integer

    aim_generic.ext_status.data Extended Status DataByte array

    1.0.3 2008-10-01 26

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    aim_generic.ext_status.flags Extended Status FlagsUnsigned 8-bit integer

    aim_generic.ext_status.length Extended Status LengthUnsigned 8-bit integer

    aim_generic.ext_status.type Extended Status TypeUnsigned 16-bit integer

    aim_generic.idle_time Idle time (seconds)Unsigned 32-bit integer

    aim_generic.migrate.numfams Number of families to migrateUnsigned 16-bit integer

    aim_generic.motd.motdtype MOTD TypeUnsigned 16-bit integer

    aim_generic.privilege_flags Privilege flagsUnsigned 32-bit integer

    aim_generic.privilege_flags.allow_idle Allow other users to see idle timeBoolean

    aim_generic.privilege_flags.allow_member Allow other users to see how long account has been a memberBoolean

    aim_generic.ratechange.msg Rate Change MessageUnsigned 16-bit integer

    aim_generic.rateinfo.class.alertlevel Alert LevelUnsigned 32-bit integer

    aim_generic.rateinfo.class.clearlevel Clear LevelUnsigned 32-bit integer

    aim_generic.rateinfo.class.currentlevel Current LevelUnsigned 32-bit integer

    aim_generic.rateinfo.class.curstate Current StateUnsigned 8-bit integer

    aim_generic.rateinfo.class.disconnectlevel Disconnect LevelUnsigned 32-bit integer

    aim_generic.rateinfo.class.id Class IDUnsigned 16-bit integer

    aim_generic.rateinfo.class.lasttime Last TimeUnsigned 32-bit integer

    aim_generic.rateinfo.class.limitlevel Limit LevelUnsigned 32-bit integer

    aim_generic.rateinfo.class.maxlevel Max LevelUnsigned 32-bit integer

    aim_generic.rateinfo.class.numpairs Number of Family/Subtype pairsUnsigned 16-bit integer

    aim_generic.rateinfo.class.window_size Window SizeUnsigned 32-bit integer

    aim_generic.rateinfo.numclasses Number of Rateinfo ClassesUnsigned 16-bit integer

    1.0.3 2008-10-01 27

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    aim_generic.rateinfoack.class Acknowledged Rate ClassUnsigned 16-bit integer

    aim_generic.selfinfo.warn_level Warning levelUnsigned 16-bit integer

    aim_generic.servicereq.service Requested ServiceUnsigned 16-bit integer

    AIM ICQ (aim_icq)

    aim_icq.chunk_size Data chunk sizeUnsigned 16-bit integer

    aim_icq.offline_msgs.dropped_flag Dropped messages flagUnsigned 8-bit integer

    aim_icq.owner_uid Owner UIDUnsigned 32-bit integer

    aim_icq.request_seq_number Request Sequence NumberUnsigned 16-bit integer

    aim_icq.request_type Request TypeUnsigned 16-bit integer

    aim_icq.subtype Meta Request SubtypeUnsigned 16-bit integer

    AIM Invitation Service (aim_invitation)

    AIM Location (aim_location)

    aim_location.buddyname Buddy NameString

    aim_location.buddynamelen Buddyname lenUnsigned 8-bit integer

    aim_location.snac.request_user_info.infotype InfotypeUnsigned 16-bit integer

    aim_location.userinfo.warninglevel Warning LevelUnsigned 16-bit integer

    AIM Messaging (aim_messaging)

    aim_messaging.channelid Message Channel IDUnsigned 16-bit integer

    aim_messaging.clientautoresp.client_caps_flags Client Capabilities FlagsUnsigned 32-bit integer

    aim_messaging.clientautoresp.protocol_version VersionUnsigned 16-bit integer

    aim_messaging.clientautoresp.reason ReasonUnsigned 16-bit integer

    aim_messaging.evil.new_warn_level New warning levelUnsigned 16-bit integer

    aim_messaging.evil.warn_level Old warning levelUnsigned 16-bit integer

    1.0.3 2008-10-01 28

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    aim_messaging.evilreq.origin Send Evil Bit AsUnsigned 16-bit integer

    aim_messaging.icbm.channel Channel to setupUnsigned 16-bit integer

    aim_messaging.icbm.extended_data.message.flags Message FlagsUnsigned 8-bit integer

    aim_messaging.icbm.extended_data.message.flags.auto Auto MessageBoolean

    aim_messaging.icbm.extended_data.message.flags.normal Normal MessageBoolean

    aim_messaging.icbm.extended_data.message.priority_code Priority CodeUnsigned 16-bit integer

    aim_messaging.icbm.extended_data.message.status_code Status CodeUnsigned 16-bit integer

    aim_messaging.icbm.extended_data.message.text TextString

    aim_messaging.icbm.extended_data.message.text_length Text LengthUnsigned 16-bit integer

    aim_messaging.icbm.extended_data.message.type Message TypeUnsigned 8-bit integer

    aim_messaging.icbm.flags Message FlagsUnsigned 32-bit integer

    aim_messaging.icbm.max_receiver_warnlevel max receiver warn levelUnsigned 16-bit integer

    aim_messaging.icbm.max_sender_warn-level Max sender warn levelUnsigned 16-bit integer

    aim_messaging.icbm.max_snac Max SNAC SizeUnsigned 16-bit integer

    aim_messaging.icbm.min_msg_interval Minimum message interval (seconds)Unsigned 16-bit integer

    aim_messaging.icbm.rendezvous.extended_data.message.flags.multi Multiple Recipients MessageBoolean

    aim_messaging.icbm.unknown Unknown parameterUnsigned 16-bit integer

    aim_messaging.icbmcookie ICBM CookieByte array

    aim_messaging.notification.channel Notification ChannelUnsigned 16-bit integer

    aim_messaging.notification.cookie Notification CookieByte array

    aim_messaging.notification.type Notification TypeUnsigned 16-bit integer

    aim_messaging.rendezvous.msg_type Message TypeUnsigned 16-bit integer

    1.0.3 2008-10-01 29

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    AIM OFT (aim_oft)

    AIM Popup (aim_popup)

    AIM Privacy Management Service (aim_bos)

    aim_bos.data DataByte array

    aim_bos.userclass User classUnsigned 32-bit integer

    AIM Server Side Info (aim_ssi)

    aim_ssi.fnac.bid SSI Buddy IDUnsigned 16-bit integer

    aim_ssi.fnac.buddyname Buddy NameString

    aim_ssi.fnac.buddyname_len SSI Buddy Name lengthUnsigned 16-bit integer

    aim_ssi.fnac.data SSI Buddy DataUnsigned 16-bit integer

    aim_ssi.fnac.gid SSI Buddy Group IDUnsigned 16-bit integer

    aim_ssi.fnac.last_change_time SSI Last Change TimeUnsigned 32-bit integer

    aim_ssi.fnac.numitems SSI Object countUnsigned 16-bit integer

    aim_ssi.fnac.tlvlen SSI TLV LenUnsigned 16-bit integer

    aim_ssi.fnac.type SSI Buddy typeUnsigned 16-bit integer

    aim_ssi.fnac.version SSI VersionUnsigned 8-bit integer

    AIM Server Side Themes (aim_sst)

    aim_sst.icon IconByte array

    aim_sst.icon_size Icon SizeUnsigned 16-bit integer

    aim_sst.md5 MD5 HashByte array

    aim_sst.md5.size MD5 Hash SizeUnsigned 8-bit integer

    aim_sst.ref_num Reference NumberUnsigned 16-bit integer

    aim_sst.unknown Unknown DataByte array

    1.0.3 2008-10-01 30

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    AIM Signon (aim_signon)

    aim_signon.challenge Signon challengeString

    aim_signon.challengelen Signon challenge lengthUnsigned 16-bit integer

    aim_signon.infotype InfotypeUnsigned 16-bit integer

    AIM Statistics (aim_stats)

    AIM Translate (aim_translate)

    AIM User Lookup (aim_lookup)

    aim_lookup.email Email address looked forStringEmail address

    AMS (ams)

    ams.ads_adddn_req ADS Add Device Notification RequestNo value

    ams.ads_adddn_res ADS Add Device Notification ResponseNo value

    ams.ads_cblength CbLengthUnsigned 32-bit integer

    ams.ads_cbreadlength CBReadLengthUnsigned 32-bit integer

    ams.ads_cbwritelength CBWriteLengthUnsigned 32-bit integer

    ams.ads_cmpmax Cmp MadNo value

    ams.ads_cmpmin Cmp MinNo value

    ams.ads_cycletime Cycle TimeUnsigned 32-bit integer

    ams.ads_data DataNo value

    ams.ads_deldn_req ADS Delete Device Notification RequestNo value

    ams.ads_deldn_res ADS Delete Device Notification ResponseNo value

    ams.ads_devicename Device NameString

    ams.ads_devicestate DeviceStateUnsigned 16-bit integer

    ams.ads_dn_req ADS Device Notification RequestNo value

    1.0.3 2008-10-01 31

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ams.ads_dn_res ADS Device Notification ResponseNo value

    ams.ads_indexgroup IndexGroupUnsigned 32-bit integer

    ams.ads_indexoffset IndexOffsetUnsigned 32-bit integer

    ams.ads_invokeid InvokeIdUnsigned 32-bit integer

    ams.ads_maxdelay Max DelayUnsigned 32-bit integer

    ams.ads_noteattrib InvokeIdNo value

    ams.ads_noteblocks InvokeIdNo value

    ams.ads_noteblockssample Notification SampleNo value

    ams.ads_noteblocksstamp Notification StampNo value

    ams.ads_noteblocksstamps Count of StampsUnsigned 32-bit integer

    ams.ads_notificationhandle NotificationHandleUnsigned 32-bit integer

    ams.ads_read_req ADS Read RequestNo value

    ams.ads_read_res ADS Read ResponeNo value

    ams.ads_readdinfo_req ADS Read Device Info RequestNo value

    ams.ads_readdinfo_res ADS Read Device Info ResponseNo value

    ams.ads_readstate_req ADS Read State RequestNo value

    ams.ads_readstate_res ADS Read State ResponseNo value

    ams.ads_readwrite_req ADS ReadWrite RequestNo value

    ams.ads_readwrite_res ADS ReadWrite ResponseNo value

    ams.ads_samplecnt Count of StampsUnsigned 32-bit integer

    ams.ads_state AdsStateUnsigned 16-bit integer

    ams.ads_timestamp Time StampUnsigned 64-bit integer

    1.0.3 2008-10-01 32

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ams.ads_transmode Trans ModeUnsigned 32-bit integer

    ams.ads_version ADS VersionUnsigned 32-bit integer

    ams.ads_versionbuild ADS Version BuildUnsigned 16-bit integer

    ams.ads_versionrevision ADS Minor VersionUnsigned 8-bit integer

    ams.ads_versionversion ADS Major VersionUnsigned 8-bit integer

    ams.ads_write_req ADS Write RequestNo value

    ams.ads_write_res ADS Write ResponseNo value

    ams.ads_writectrl_req ADS Write Ctrl RequestNo value

    ams.ads_writectrl_res ADS Write Ctrl ResponseNo value

    ams.adsresult ResultUnsigned 32-bit integer

    ams.cbdata cbDataUnsigned 32-bit integer

    ams.cmdid CmdIdUnsigned 16-bit integer

    ams.data DataNo value

    ams.errorcode ErrorCodeUnsigned 32-bit integer

    ams.invokeid InvokeIdUnsigned 32-bit integer

    ams.sendernetid AMS Sender Net IdString

    ams.senderport AMS Sender portUnsigned 16-bit integer

    ams.state_adscmd ADS COMMANDBoolean

    ams.state_broadcast BROADCASTBoolean

    ams.state_highprio HIGH PRIORITY COMMANDBoolean

    ams.state_initcmd INIT COMMANDBoolean

    ams.state_noreturn NO RETURNBoolean

    1.0.3 2008-10-01 33

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ams.state_response RESPONSEBoolean

    ams.state_syscmd SYSTEM COMMANDBoolean

    ams.state_timestampadded TIMESTAMP ADDEDBoolean

    ams.state_udp UDP COMMANDBoolean

    ams.stateflags StateFlagsUnsigned 16-bit integer

    ams.targetnetid AMS Target Net IdString

    ams.targetport AMS Target portUnsigned 16-bit integer

    ANSI A−I/F BSMAP (ansi_a_bsmap)

    ansi_a_bsmap.a2p_bearer_ipv4_addr A2p Bearer IP AddressIPv4 address

    ansi_a_bsmap.a2p_bearer_ipv6_addr A2p Bearer IP AddressIPv6 address

    ansi_a_bsmap.a2p_bearer_udp_port A2p Bearer UDP PortUnsigned 16-bit integer

    ansi_a_bsmap.anchor_pdsn_ip_addr Anchor PDSN AddressIPv4 addressIP Address

    ansi_a_bsmap.anchor_pp_ip_addr Anchor P-P AddressIPv4 addressIP Address

    ansi_a_bsmap.cell_ci Cell CIUnsigned 16-bit integer

    ansi_a_bsmap.cell_lac Cell LACUnsigned 16-bit integer

    ansi_a_bsmap.cell_mscid Cell MSCIDUnsigned 24-bit integer

    ansi_a_bsmap.cld_party_ascii_num Called Party ASCII NumberString

    ansi_a_bsmap.cld_party_bcd_num Called Party BCD NumberString

    ansi_a_bsmap.clg_party_ascii_num Calling Party ASCII NumberString

    ansi_a_bsmap.clg_party_bcd_num Calling Party BCD NumberString

    ansi_a_bsmap.dtap_msgtype DTAP Message TypeUnsigned 8-bit integer

    ansi_a_bsmap.elem_id Element IDUnsigned 8-bit integer

    1.0.3 2008-10-01 34

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_a_bsmap.esn ESNUnsigned 32-bit integer

    ansi_a_bsmap.imsi IMSIString

    ansi_a_bsmap.len LengthUnsigned 8-bit integer

    ansi_a_bsmap.meid MEIDString

    ansi_a_bsmap.min MINString

    ansi_a_bsmap.msgtype BSMAP Message TypeUnsigned 8-bit integer

    ansi_a_bsmap.none Sub treeNo value

    ansi_a_bsmap.pdsn_ip_addr PDSN IP AddressIPv4 addressIP Address

    ansi_a_bsmap.s_pdsn_ip_addr Source PDSN AddressIPv4 addressIP Address

    ANSI A−I/F DTAP (ansi_a_dtap)

    ANSI IS−637−A (SMS) Teleservice Layer (ansi_637_tele)

    ansi_637_tele.len LengthUnsigned 8-bit integer

    ansi_637_tele.msg_id Message IDUnsigned 24-bit integer

    ansi_637_tele.msg_rsvd ReservedUnsigned 24-bit integer

    ansi_637_tele.msg_type Message TypeUnsigned 24-bit integer

    ansi_637_tele.subparam_id Teleservice Subparam IDUnsigned 8-bit integer

    ANSI IS−637−A (SMS) Transport Layer (ansi_637_trans)

    ansi_637_trans.bin_addr Binary AddressByte array

    ansi_637_trans.len LengthUnsigned 8-bit integer

    ansi_637_trans.msg_type Message TypeUnsigned 24-bit integer

    ansi_637_trans.param_id Transport Param IDUnsigned 8-bit integer

    1.0.3 2008-10-01 35

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ANSI IS−683−A (OTA (Mobile)) (ansi_683)

    ansi_683.for_msg_type Forward Link Message TypeUnsigned 8-bit integer

    ansi_683.len LengthUnsigned 8-bit integer

    ansi_683.none Sub treeNo value

    ansi_683.rev_msg_type Reverse Link Message TypeUnsigned 8-bit integer

    ANSI IS−801 (Location Services (PLD)) (ansi_801)

    ansi_801.for_req_type Forward Request TypeUnsigned 8-bit integer

    ansi_801.for_rsp_type Forward Response TypeUnsigned 8-bit integer

    ansi_801.for_sess_tag Forward Session TagUnsigned 8-bit integer

    ansi_801.rev_req_type Reverse Request TypeUnsigned 8-bit integer

    ansi_801.rev_rsp_type Reverse Response TypeUnsigned 8-bit integer

    ansi_801.rev_sess_tag Reverse Session TagUnsigned 8-bit integer

    ansi_801.sess_tag Session TagUnsigned 8-bit integer

    ANSI Mobile Application Part (ansi_map)

    ansi_map.CDMABandClassList_item ItemNo valueansi_map.CDMABandClassInformation

    ansi_map.CDMAChannelNumberList_item ItemNo valueansi_map.CDMAChannelNumberList_item

    ansi_map.CDMACodeChannelList_item ItemNo valueansi_map.CDMACodeChannelInformation

    ansi_map.CDMAConnectionReferenceList_item ItemNo valueansi_map.CDMAConnectionReferenceList_item

    ansi_map.CDMAPSMMList_item ItemNo valueansi_map.CDMAPSMMList_item

    ansi_map.CDMAServiceOptionList_item ItemByte arrayansi_map.CDMAServiceOption

    1.0.3 2008-10-01 36

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.CDMATargetMAHOList_item ItemNo valueansi_map.CDMATargetMAHOInformation

    ansi_map.CDMATargetMeasurementList_item ItemNo valueansi_map.CDMATargetMeasurementInformation

    ansi_map.CallRecoveryIDList_item ItemNo valueansi_map.CallRecoveryID

    ansi_map.DataAccessElementList_item ItemNo valueansi_map.DataAccessElementList_item

    ansi_map.DataUpdateResultList_item ItemNo valueansi_map.DataUpdateResult

    ansi_map.ModificationRequestList_item ItemNo valueansi_map.ModificationRequest

    ansi_map.ModificationResultList_item ItemUnsigned 32-bit integeransi_map.ModificationResult

    ansi_map.PACA_Level PACA LevelUnsigned 8-bit integerPACA Level

    ansi_map.ServiceDataAccessElementList_item ItemNo valueansi_map.ServiceDataAccessElement

    ansi_map.ServiceDataResultList_item ItemNo valueansi_map.ServiceDataResult

    ansi_map.TargetMeasurementList_item ItemNo valueansi_map.TargetMeasurementInformation

    ansi_map.TerminationList_item ItemUnsigned 32-bit integeransi_map.TerminationList_item

    ansi_map.aCGDirective aCGDirectiveNo valueansi_map.ACGDirective

    ansi_map.aKeyProtocolVersion aKeyProtocolVersionByte arrayansi_map.AKeyProtocolVersion

    ansi_map.accessDeniedReason accessDeniedReasonUnsigned 32-bit integeransi_map.AccessDeniedReason

    ansi_map.acgencountered acgencounteredByte arrayansi_map.ACGEncountered

    1.0.3 2008-10-01 37

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.actionCode actionCodeUnsigned 8-bit integeransi_map.ActionCode

    ansi_map.addService addServiceNo valueansi_map.AddService

    ansi_map.addServiceRes addServiceResNo valueansi_map.AddServiceRes

    ansi_map.alertCode alertCodeByte arrayansi_map.AlertCode

    ansi_map.alertResult alertResultUnsigned 8-bit integeransi_map.AlertResult

    ansi_map.alertcode.alertaction Alert ActionUnsigned 8-bit integerAlert Action

    ansi_map.alertcode.cadence CadenceUnsigned 8-bit integerCadence

    ansi_map.alertcode.pitch PitchUnsigned 8-bit integerPitch

    ansi_map.allOrNone allOrNoneUnsigned 32-bit integeransi_map.AllOrNone

    ansi_map.analogRedirectInfo analogRedirectInfoByte arrayansi_map.AnalogRedirectInfo

    ansi_map.analogRedirectRecord analogRedirectRecordNo valueansi_map.AnalogRedirectRecord

    ansi_map.analyzedInformation analyzedInformationNo valueansi_map.AnalyzedInformation

    ansi_map.analyzedInformationRes analyzedInformationResNo valueansi_map.AnalyzedInformationRes

    ansi_map.announcementCode1 announcementCode1Byte arrayansi_map.AnnouncementCode

    ansi_map.announcementCode2 announcementCode2Byte arrayansi_map.AnnouncementCode

    ansi_map.announcementList announcementListNo valueansi_map.AnnouncementList

    1.0.3 2008-10-01 38

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.announcementcode.class ToneUnsigned 8-bit integerTone

    ansi_map.announcementcode.cust_ann Custom AnnouncementUnsigned 8-bit integerCustom Announcement

    ansi_map.announcementcode.std_ann Standard AnnouncementUnsigned 8-bit integerStandard Announcement

    ansi_map.announcementcode.tone ToneUnsigned 8-bit integerTone

    ansi_map.authenticationAlgorithmVersion authenticationAlgorithmVersionByte arrayansi_map.AuthenticationAlgorithmVersion

    ansi_map.authenticationCapability authenticationCapabilityUnsigned 8-bit integeransi_map.AuthenticationCapability

    ansi_map.authenticationData authenticationDataByte arrayansi_map.AuthenticationData

    ansi_map.authenticationDirective authenticationDirectiveNo valueansi_map.AuthenticationDirective

    ansi_map.authenticationDirectiveForward authenticationDirectiveForwardNo valueansi_map.AuthenticationDirectiveForward

    ansi_map.authenticationDirectiveForwardRes authenticationDirectiveForwardResNo valueansi_map.AuthenticationDirectiveForwardRes

    ansi_map.authenticationDirectiveRes authenticationDirectiveResNo valueansi_map.AuthenticationDirectiveRes

    ansi_map.authenticationFailureReport authenticationFailureReportNo valueansi_map.AuthenticationFailureReport

    ansi_map.authenticationFailureReportRes authenticationFailureReportResNo valueansi_map.AuthenticationFailureReportRes

    ansi_map.authenticationRequest authenticationRequestNo valueansi_map.AuthenticationRequest

    ansi_map.authenticationRequestRes authenticationRequestResNo valueansi_map.AuthenticationRequestRes

    ansi_map.authenticationResponse authenticationResponseByte arrayansi_map.AuthenticationResponse

    1.0.3 2008-10-01 39

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.authenticationResponseBaseStation authenticationResponseBaseStationByte arrayansi_map.AuthenticationResponseBaseStation

    ansi_map.authenticationResponseReauthentication authenticationResponseReauthenticationByte arrayansi_map.AuthenticationResponseReauthentication

    ansi_map.authenticationResponseUniqueChallenge authenticationResponseUniqueChallengeByte arrayansi_map.AuthenticationResponseUniqueChallenge

    ansi_map.authenticationStatusReport authenticationStatusReportNo valueansi_map.AuthenticationStatusReport

    ansi_map.authenticationStatusReportRes authenticationStatusReportResNo valueansi_map.AuthenticationStatusReportRes

    ansi_map.authorizationDenied authorizationDeniedUnsigned 32-bit integeransi_map.AuthorizationDenied

    ansi_map.authorizationPeriod authorizationPeriodByte arrayansi_map.AuthorizationPeriod

    ansi_map.authorizationperiod.period PeriodUnsigned 8-bit integerPeriod

    ansi_map.availabilityType availabilityTypeUnsigned 8-bit integeransi_map.AvailabilityType

    ansi_map.baseStationChallenge baseStationChallengeNo valueansi_map.BaseStationChallenge

    ansi_map.baseStationChallengeRes baseStationChallengeResNo valueansi_map.BaseStationChallengeRes

    ansi_map.baseStationManufacturerCode baseStationManufacturerCodeByte arrayansi_map.BaseStationManufacturerCode

    ansi_map.baseStationPartialKey baseStationPartialKeyByte arrayansi_map.BaseStationPartialKey

    ansi_map.bcd_digits BCD digitsStringBCD digits

    ansi_map.billingID billingIDByte arrayansi_map.BillingID

    ansi_map.blocking blockingNo valueansi_map.Blocking

    1.0.3 2008-10-01 40

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.borderCellAccess borderCellAccessUnsigned 32-bit integeransi_map.BorderCellAccess

    ansi_map.bsmcstatus bsmcstatusUnsigned 8-bit integeransi_map.BSMCStatus

    ansi_map.bulkDeregistration bulkDeregistrationNo valueansi_map.BulkDeregistration

    ansi_map.bulkDisconnection bulkDisconnectionNo valueansi_map.BulkDisconnection

    ansi_map.callControlDirective callControlDirectiveNo valueansi_map.CallControlDirective

    ansi_map.callControlDirectiveRes callControlDirectiveResNo valueansi_map.CallControlDirectiveRes

    ansi_map.callHistoryCount callHistoryCountUnsigned 32-bit integeransi_map.CallHistoryCount

    ansi_map.callHistoryCountExpected callHistoryCountExpectedUnsigned 32-bit integeransi_map.CallHistoryCountExpected

    ansi_map.callRecoveryIDList callRecoveryIDListUnsigned 32-bit integeransi_map.CallRecoveryIDList

    ansi_map.callRecoveryReport callRecoveryReportNo valueansi_map.CallRecoveryReport

    ansi_map.callStatus callStatusUnsigned 32-bit integeransi_map.CallStatus

    ansi_map.callTerminationReport callTerminationReportNo valueansi_map.CallTerminationReport

    ansi_map.callingFeaturesIndicator callingFeaturesIndicatorByte arrayansi_map.CallingFeaturesIndicator

    ansi_map.callingPartyCategory callingPartyCategoryByte arrayansi_map.CallingPartyCategory

    ansi_map.callingPartyName callingPartyNameByte arrayansi_map.CallingPartyName

    ansi_map.callingPartyNumberDigits1 callingPartyNumberDigits1Byte arrayansi_map.CallingPartyNumberDigits1

    1.0.3 2008-10-01 41

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.callingPartyNumberDigits2 callingPartyNumberDigits2Byte arrayansi_map.CallingPartyNumberDigits2

    ansi_map.callingPartyNumberString1 callingPartyNumberString1No valueansi_map.CallingPartyNumberString1

    ansi_map.callingPartyNumberString2 callingPartyNumberString2No valueansi_map.CallingPartyNumberString2

    ansi_map.callingPartySubaddress callingPartySubaddressByte arrayansi_map.CallingPartySubaddress

    ansi_map.callingfeaturesindicator.3wcfa Three-Way Calling FeatureActivity, 3WC-FAUnsigned 8-bit integerThree-Way Calling FeatureActivity, 3WC-FA

    ansi_map.callingfeaturesindicator.ahfa Answer Hold: FeatureActivity AH-FAUnsigned 8-bit integerAnswer Hold: FeatureActivity AH-FA

    ansi_map.callingfeaturesindicator.ccsfa CDMA-Concurrent Service:FeatureActivity. CCS-FAUnsigned 8-bit integerCDMA-Concurrent Service:FeatureActivity. CCS-FA

    ansi_map.callingfeaturesindicator.cdfa Call Delivery: FeatureActivity, CD-FAUnsigned 8-bit integerCall Delivery: FeatureActivity, CD-FA

    ansi_map.callingfeaturesindicator.cfbafa Call Forwarding Busy FeatureActivity, CFB-FAUnsigned 8-bit integerCall Forwarding Busy FeatureActivity, CFB-FA

    ansi_map.callingfeaturesindicator.cfnafa Call Forwarding No Answer FeatureActivity, CFNA-FAUnsigned 8-bit integerCall Forwarding No Answer FeatureActivity, CFNA-FA

    ansi_map.callingfeaturesindicator.cfufa Call Forwarding Unconditional FeatureActivity, CFU-FAUnsigned 8-bit integerCall Forwarding Unconditional FeatureActivity, CFU-FA

    ansi_map.callingfeaturesindicator.cnip1fa One number (network-provided only) Calling Number Identification Presentation: FeatureActivity CNIP1-FAUnsigned 8-bit integerOne number (network-provided only) Calling Number Identification Presentation: FeatureActivity CNIP1-FA

    ansi_map.callingfeaturesindicator.cnip2fa Two number (network-provided and user-provided) Calling Number Identification Presentation: FeatureActivity CNIP2-FAUnsigned 8-bit integerTwo number (network-provided and user-provided) Calling Number Identification Presentation: FeatureActivity CNIP2-FA

    ansi_map.callingfeaturesindicator.cnirfa Calling Number Identification Restriction: FeatureActivity CNIR-FAUnsigned 8-bit integerCalling Number Identification Restriction: FeatureActivity CNIR-FA

    ansi_map.callingfeaturesindicator.cniroverfa Calling Number Identification Restriction Override FeatureActivity CNIROver-FAUnsigned 8-bit integer

    ansi_map.callingfeaturesindicator.cpdfa CDMA-Packet Data Service: FeatureActivity. CPDS-FAUnsigned 8-bit integerCDMA-Packet Data Service: FeatureActivity. CPDS-FA

    1.0.3 2008-10-01 42

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.callingfeaturesindicator.ctfa Call Transfer: FeatureActivity, CT-FAUnsigned 8-bit integerCall Transfer: FeatureActivity, CT-FA

    ansi_map.callingfeaturesindicator.cwfa Call Waiting: FeatureActivity, CW-FAUnsigned 8-bit integerCall Waiting: FeatureActivity, CW-FA

    ansi_map.callingfeaturesindicator.dpfa Data Privacy Feature Activity DP-FAUnsigned 8-bit integerData Privacy Feature Activity DP-FA

    ansi_map.callingfeaturesindicator.epefa TDMA Enhanced Privacy and Encryption:FeatureActivity.TDMA EPE-FAUnsigned 8-bit integerTDMA Enhanced Privacy and Encryption:FeatureActivity.TDMA EPE-FA

    ansi_map.callingfeaturesindicator.pcwfa Priority Call Waiting FeatureActivity PCW-FAUnsigned 8-bit integerPriority Call Waiting FeatureActivity PCW-FA

    ansi_map.callingfeaturesindicator.uscfmsfa USCF divert to mobile station provided DN:FeatureActivity.USCFms-FAUnsigned 8-bit integerUSCF divert to mobile station provided DN:FeatureActivity.USCFms-FA

    ansi_map.callingfeaturesindicator.uscfvmfa USCF divert to voice mail: FeatureActivity USCFvm-FAUnsigned 8-bit integerUSCF divert to voice mail: FeatureActivity USCFvm-FA

    ansi_map.callingfeaturesindicator.vpfa Voice Privacy FeatureActivity, VP-FAUnsigned 8-bit integerVoice Privacy FeatureActivity, VP-FA

    ansi_map.cancellationDenied cancellationDeniedUnsigned 32-bit integeransi_map.CancellationDenied

    ansi_map.cancellationType cancellationTypeUnsigned 8-bit integeransi_map.CancellationType

    ansi_map.carrierDigits carrierDigitsByte arrayansi_map.CarrierDigits

    ansi_map.cdma2000HandoffInvokeIOSData cdma2000HandoffInvokeIOSDataByte arrayansi_map.CDMA2000HandoffInvokeIOSData

    ansi_map.cdma2000HandoffResponseIOSData cdma2000HandoffResponseIOSDataByte arrayansi_map.CDMA2000HandoffResponseIOSData

    ansi_map.cdmaBandClass cdmaBandClassByte arrayansi_map.CDMABandClass

    ansi_map.cdmaBandClassList cdmaBandClassListUnsigned 32-bit integeransi_map.CDMABandClassList

    ansi_map.cdmaCallMode cdmaCallModeByte arrayansi_map.CDMACallMode

    1.0.3 2008-10-01 43

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.cdmaChannelData cdmaChannelDataByte arrayansi_map.CDMAChannelData

    ansi_map.cdmaChannelNumber cdmaChannelNumberByte arrayansi_map.CDMAChannelNumber

    ansi_map.cdmaChannelNumber2 cdmaChannelNumber2Byte arrayansi_map.CDMAChannelNumber

    ansi_map.cdmaChannelNumberList cdmaChannelNumberListUnsigned 32-bit integeransi_map.CDMAChannelNumberList

    ansi_map.cdmaCodeChannel cdmaCodeChannelByte arrayansi_map.CDMACodeChannel

    ansi_map.cdmaCodeChannelList cdmaCodeChannelListUnsigned 32-bit integeransi_map.CDMACodeChannelList

    ansi_map.cdmaConnectionReference cdmaConnectionReferenceByte arrayansi_map.CDMAConnectionReference

    ansi_map.cdmaConnectionReferenceInformation cdmaConnectionReferenceInformationNo valueansi_map.CDMAConnectionReferenceInformation

    ansi_map.cdmaConnectionReferenceInformation2 cdmaConnectionReferenceInformation2No valueansi_map.CDMAConnectionReferenceInformation

    ansi_map.cdmaConnectionReferenceList cdmaConnectionReferenceListUnsigned 32-bit integeransi_map.CDMAConnectionReferenceList

    ansi_map.cdmaMSMeasuredChannelIdentity cdmaMSMeasuredChannelIdentityByte arrayansi_map.CDMAMSMeasuredChannelIdentity

    ansi_map.cdmaMobileCapabilities cdmaMobileCapabilitiesByte arrayansi_map.CDMAMobileCapabilities

    ansi_map.cdmaMobileProtocolRevision cdmaMobileProtocolRevisionByte arrayansi_map.CDMAMobileProtocolRevision

    ansi_map.cdmaNetworkIdentification cdmaNetworkIdentificationByte arrayansi_map.CDMANetworkIdentification

    ansi_map.cdmaPSMMCount cdmaPSMMCountByte arrayansi_map.CDMAPSMMCount

    ansi_map.cdmaPSMMList cdmaPSMMListUnsigned 32-bit integeransi_map.CDMAPSMMList

    1.0.3 2008-10-01 44

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.cdmaPilotPN cdmaPilotPNByte arrayansi_map.CDMAPilotPN

    ansi_map.cdmaPilotStrength cdmaPilotStrengthByte arrayansi_map.CDMAPilotStrength

    ansi_map.cdmaPowerCombinedIndicator cdmaPowerCombinedIndicatorByte arrayansi_map.CDMAPowerCombinedIndicator

    ansi_map.cdmaPrivateLongCodeMask cdmaPrivateLongCodeMaskByte arrayansi_map.CDMAPrivateLongCodeMask

    ansi_map.cdmaRedirectRecord cdmaRedirectRecordNo valueansi_map.CDMARedirectRecord

    ansi_map.cdmaSearchParameters cdmaSearchParametersByte arrayansi_map.CDMASearchParameters

    ansi_map.cdmaSearchWindow cdmaSearchWindowByte arrayansi_map.CDMASearchWindow

    ansi_map.cdmaServiceConfigurationRecord cdmaServiceConfigurationRecordByte arrayansi_map.CDMAServiceConfigurationRecord

    ansi_map.cdmaServiceOption cdmaServiceOptionByte arrayansi_map.CDMAServiceOption

    ansi_map.cdmaServiceOptionConnectionIdentifier cdmaServiceOptionConnectionIdentifierByte arrayansi_map.CDMAServiceOptionConnectionIdentifier

    ansi_map.cdmaServiceOptionList cdmaServiceOptionListUnsigned 32-bit integeransi_map.CDMAServiceOptionList

    ansi_map.cdmaServingOneWayDelay cdmaServingOneWayDelayByte arrayansi_map.CDMAServingOneWayDelay

    ansi_map.cdmaServingOneWayDelay2 cdmaServingOneWayDelay2Byte arrayansi_map.CDMAServingOneWayDelay2

    ansi_map.cdmaSignalQuality cdmaSignalQualityByte arrayansi_map.CDMASignalQuality

    ansi_map.cdmaSlotCycleIndex cdmaSlotCycleIndexByte arrayansi_map.CDMASlotCycleIndex

    ansi_map.cdmaState cdmaStateByte arrayansi_map.CDMAState

    1.0.3 2008-10-01 45

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.cdmaStationClassMark cdmaStationClassMarkByte arrayansi_map.CDMAStationClassMark

    ansi_map.cdmaStationClassMark2 cdmaStationClassMark2Byte arrayansi_map.CDMAStationClassMark2

    ansi_map.cdmaTargetMAHOList cdmaTargetMAHOListUnsigned 32-bit integeransi_map.CDMATargetMAHOList

    ansi_map.cdmaTargetMAHOList2 cdmaTargetMAHOList2Unsigned 32-bit integeransi_map.CDMATargetMAHOList

    ansi_map.cdmaTargetMeasurementList cdmaTargetMeasurementListUnsigned 32-bit integeransi_map.CDMATargetMeasurementList

    ansi_map.cdmaTargetOneWayDelay cdmaTargetOneWayDelayByte arrayansi_map.CDMATargetOneWayDelay

    ansi_map.cdmacallmode.cdma Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls1 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls10 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls2 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls3 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls4 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls5 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls6 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls7 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.cls8 Call ModeBooleanCall Mode

    1.0.3 2008-10-01 46

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.cdmacallmode.cls9 Call ModeBooleanCall Mode

    ansi_map.cdmacallmode.namps Call ModeBooleanCall Mode

    ansi_map.cdmachanneldata.band_cls Band ClassUnsigned 8-bit integerBand Class

    ansi_map.cdmachanneldata.cdma_ch_no CDMA Channel NumberUnsigned 16-bit integerCDMA Channel Number

    ansi_map.cdmachanneldata.frameoffset Frame OffsetUnsigned 8-bit integerFrame Offset

    ansi_map.cdmachanneldata.lc_mask_b1 Long Code Mask LSB(byte 1)Unsigned 8-bit integerLong Code Mask (byte 1)LSB

    ansi_map.cdmachanneldata.lc_mask_b2 Long Code Mask (byte 2)Unsigned 8-bit integerLong Code Mask (byte 2)

    ansi_map.cdmachanneldata.lc_mask_b3 Long Code Mask (byte 3)Unsigned 8-bit integerLong Code Mask (byte 3)

    ansi_map.cdmachanneldata.lc_mask_b4 Long Code Mask (byte 4)Unsigned 8-bit integerLong Code Mask (byte 4)

    ansi_map.cdmachanneldata.lc_mask_b5 Long Code Mask (byte 5)Unsigned 8-bit integerLong Code Mask (byte 5)

    ansi_map.cdmachanneldata.lc_mask_b6 Long Code Mask (byte 6) MSBUnsigned 8-bit integerLong Code Mask MSB (byte 6)

    ansi_map.cdmachanneldata.nominal_pwr Nominal PowerUnsigned 8-bit integerNominal Power

    ansi_map.cdmachanneldata.np_ext NP EXTBooleanNP EXT

    ansi_map.cdmachanneldata.nr_preamble Number PreambleUnsigned 8-bit integerNumber Preamble

    ansi_map.cdmaserviceoption CDMAServiceOptionUnsigned 16-bit integerCDMAServiceOption

    ansi_map.cdmastationclassmark.dmi Dual-mode Indicator(DMI)BooleanDual-mode Indicator(DMI)

    1.0.3 2008-10-01 47

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.cdmastationclassmark.dtx Analog Transmission: (DTX)BooleanAnalog Transmission: (DTX)

    ansi_map.cdmastationclassmark.pc Power Class(PC)Unsigned 8-bit integerPower Class(PC)

    ansi_map.cdmastationclassmark.smi Slotted Mode Indicator: (SMI)BooleanSlotted Mode Indicator: (SMI)

    ansi_map.change changeUnsigned 32-bit integeransi_map.Change

    ansi_map.changeFacilities changeFacilitiesNo valueansi_map.ChangeFacilities

    ansi_map.changeFacilitiesRes changeFacilitiesResNo valueansi_map.ChangeFacilitiesRes

    ansi_map.changeService changeServiceNo valueansi_map.ChangeService

    ansi_map.changeServiceAttributes changeServiceAttributesByte arrayansi_map.ChangeServiceAttributes

    ansi_map.changeServiceRes changeServiceResNo valueansi_map.ChangeServiceRes

    ansi_map.channelData channelDataByte arrayansi_map.ChannelData

    ansi_map.channeldata.chno Channel Number (CHNO)Unsigned 16-bit integerChannel Number (CHNO)

    ansi_map.channeldata.dtx Discontinuous Transmission Mode (DTX)Unsigned 8-bit integerDiscontinuous Transmission Mode (DTX)

    ansi_map.channeldata.scc SAT Color Code (SCC)Unsigned 8-bit integerSAT Color Code (SCC)

    ansi_map.channeldata.vmac Voice Mobile Attenuation Code (VMAC)Unsigned 8-bit integerVoice Mobile Attenuation Code (VMAC)

    ansi_map.checkMEID checkMEIDNo valueansi_map.CheckMEID

    ansi_map.checkMEIDRes checkMEIDResNo valueansi_map.CheckMEIDRes

    1.0.3 2008-10-01 48

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.conditionallyDeniedReason conditionallyDeniedReasonUnsigned 32-bit integeransi_map.ConditionallyDeniedReason

    ansi_map.conferenceCallingIndicator conferenceCallingIndicatorByte arrayansi_map.ConferenceCallingIndicator

    ansi_map.confidentialityModes confidentialityModesByte arrayansi_map.ConfidentialityModes

    ansi_map.confidentialitymodes.dp DataPrivacy (DP) Confidentiality StatusBooleanDataPrivacy (DP) Confidentiality Status

    ansi_map.confidentialitymodes.se Signaling Message Encryption (SE) Confidentiality StatusBooleanSignaling Message Encryption (SE) Confidentiality Status

    ansi_map.confidentialitymodes.vp Voice Privacy (VP) Confidentiality StatusBooleanVoice Privacy (VP) Confidentiality Status

    ansi_map.connectResource connectResourceNo valueansi_map.ConnectResource

    ansi_map.connectionFailureReport connectionFailureReportNo valueansi_map.ConnectionFailureReport

    ansi_map.controlChannelData controlChannelDataByte arrayansi_map.ControlChannelData

    ansi_map.controlChannelMode controlChannelModeUnsigned 8-bit integeransi_map.ControlChannelMode

    ansi_map.controlNetworkID controlNetworkIDByte arrayansi_map.ControlNetworkID

    ansi_map.controlType controlTypeByte arrayansi_map.ControlType

    ansi_map.controlchanneldata.cmac Control Mobile Attenuation Code (CMAC)Unsigned 8-bit integerControl Mobile Attenuation Code (CMAC)

    ansi_map.controlchanneldata.dcc Digital Color Code (DCC)Unsigned 8-bit integerDigital Color Code (DCC)

    ansi_map.controlchanneldata.ssdc1 Supplementary Digital Color Codes (SDCC1)Unsigned 8-bit integerSupplementary Digital Color Codes (SDCC1)

    ansi_map.controlchanneldata.ssdc2 Supplementary Digital Color Codes (SDCC2)Unsigned 8-bit integerSupplementary Digital Color Codes (SDCC2)

    1.0.3 2008-10-01 49

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.countRequest countRequestNo valueansi_map.CountRequest

    ansi_map.countRequestRes countRequestResNo valueansi_map.CountRequestRes

    ansi_map.countUpdateReport countUpdateReportUnsigned 8-bit integeransi_map.CountUpdateReport

    ansi_map.dataAccessElement1 dataAccessElement1No valueansi_map.DataAccessElement

    ansi_map.dataAccessElement2 dataAccessElement2No valueansi_map.DataAccessElement

    ansi_map.dataAccessElementList dataAccessElementListUnsigned 32-bit integeransi_map.DataAccessElementList

    ansi_map.dataID dataIDByte arrayansi_map.DataID

    ansi_map.dataKey dataKeyByte arrayansi_map.DataKey

    ansi_map.dataPrivacyParameters dataPrivacyParametersByte arrayansi_map.DataPrivacyParameters

    ansi_map.dataResult dataResultUnsigned 32-bit integeransi_map.DataResult

    ansi_map.dataUpdateResultList dataUpdateResultListUnsigned 32-bit integeransi_map.DataUpdateResultList

    ansi_map.dataValue dataValueByte arrayansi_map.DataValue

    ansi_map.databaseKey databaseKeyByte arrayansi_map.DatabaseKey

    ansi_map.deniedAuthorizationPeriod deniedAuthorizationPeriodByte arrayansi_map.DeniedAuthorizationPeriod

    ansi_map.deniedauthorizationperiod.period PeriodUnsigned 8-bit integerPeriod

    ansi_map.denyAccess denyAccessUnsigned 32-bit integeransi_map.DenyAccess

    1.0.3 2008-10-01 50

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.deregistrationType deregistrationTypeUnsigned 32-bit integeransi_map.DeregistrationType

    ansi_map.destinationAddress destinationAddressUnsigned 32-bit integeransi_map.DestinationAddress

    ansi_map.destinationDigits destinationDigitsByte arrayansi_map.DestinationDigits

    ansi_map.digitCollectionControl digitCollectionControlByte arrayansi_map.DigitCollectionControl

    ansi_map.digits digitsNo valueansi_map.Digits

    ansi_map.digits_Carrier digits-CarrierNo valueansi_map.Digits

    ansi_map.digits_Destination digits-DestinationNo valueansi_map.Digits

    ansi_map.digits_carrier digits-carrierNo valueansi_map.Digits

    ansi_map.digits_dest digits-destNo valueansi_map.Digits

    ansi_map.displayText displayTextByte arrayansi_map.DisplayText

    ansi_map.displayText2 displayText2Byte arrayansi_map.DisplayText2

    ansi_map.dmd_BillingIndicator dmd-BillingIndicatorUnsigned 32-bit integeransi_map.DMH_BillingIndicator

    ansi_map.dmh_AccountCodeDigits dmh-AccountCodeDigitsByte arrayansi_map.DMH_AccountCodeDigits

    ansi_map.dmh_AlternateBillingDigits dmh-AlternateBillingDigitsByte arrayansi_map.DMH_AlternateBillingDigits

    ansi_map.dmh_BillingDigits dmh-BillingDigitsByte arrayansi_map.DMH_BillingDigits

    ansi_map.dmh_ChargeInformation dmh-ChargeInformationByte arrayansi_map.DMH_ChargeInformation

    1.0.3 2008-10-01 51

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.dmh_RedirectionIndicator dmh-RedirectionIndicatorUnsigned 32-bit integeransi_map.DMH_RedirectionIndicator

    ansi_map.dmh_ServiceID dmh-ServiceIDByte arrayansi_map.DMH_ServiceID

    ansi_map.dropService dropServiceNo valueansi_map.DropService

    ansi_map.dropServiceRes dropServiceResNo valueansi_map.DropServiceRes

    ansi_map.dtxIndication dtxIndicationByte arrayansi_map.DTXIndication

    ansi_map.edirectingSubaddress edirectingSubaddressByte arrayansi_map.RedirectingSubaddress

    ansi_map.electronicSerialNumber electronicSerialNumberByte arrayansi_map.ElectronicSerialNumber

    ansi_map.emergencyServicesRoutingDigits emergencyServicesRoutingDigitsByte arrayansi_map.EmergencyServicesRoutingDigits

    ansi_map.enc EncodingUnsigned 8-bit integerEncoding

    ansi_map.executeScript executeScriptNo valueansi_map.ExecuteScript

    ansi_map.extendedMSCID extendedMSCIDByte arrayansi_map.ExtendedMSCID

    ansi_map.extendedSystemMyTypeCode extendedSystemMyTypeCodeByte arrayansi_map.ExtendedSystemMyTypeCode

    ansi_map.extendedmscid.type TypeUnsigned 8-bit integerType

    ansi_map.facilitiesDirective facilitiesDirectiveNo valueansi_map.FacilitiesDirective

    ansi_map.facilitiesDirective2 facilitiesDirective2No valueansi_map.FacilitiesDirective2

    ansi_map.facilitiesDirective2Res facilitiesDirective2ResNo valueansi_map.FacilitiesDirective2Res

    1.0.3 2008-10-01 52

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.facilitiesDirectiveRes facilitiesDirectiveResNo valueansi_map.FacilitiesDirectiveRes

    ansi_map.facilitiesRelease facilitiesReleaseNo valueansi_map.FacilitiesRelease

    ansi_map.facilitiesReleaseRes facilitiesReleaseResNo valueansi_map.FacilitiesReleaseRes

    ansi_map.facilitySelectedAndAvailable facilitySelectedAndAvailableNo valueansi_map.FacilitySelectedAndAvailable

    ansi_map.facilitySelectedAndAvailableRes facilitySelectedAndAvailableResNo valueansi_map.FacilitySelectedAndAvailableRes

    ansi_map.failureCause failureCauseByte arrayansi_map.FailureCause

    ansi_map.failureType failureTypeUnsigned 32-bit integeransi_map.FailureType

    ansi_map.featureIndicator featureIndicatorUnsigned 32-bit integeransi_map.FeatureIndicator

    ansi_map.featureRequest featureRequestNo valueansi_map.FeatureRequest

    ansi_map.featureRequestRes featureRequestResNo valueansi_map.FeatureRequestRes

    ansi_map.featureResult featureResultUnsigned 32-bit integeransi_map.FeatureResult

    ansi_map.flashRequest flashRequestNo valueansi_map.FlashRequest

    ansi_map.gapDuration gapDurationUnsigned 32-bit integeransi_map.GapDuration

    ansi_map.gapInterval gapIntervalUnsigned 32-bit integeransi_map.GapInterval

    ansi_map.generalizedTime generalizedTimeStringansi_map.GeneralizedTime

    ansi_map.geoPositionRequest geoPositionRequestNo valueansi_map.GeoPositionRequest

    1.0.3 2008-10-01 53

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.geographicAuthorization geographicAuthorizationUnsigned 8-bit integeransi_map.GeographicAuthorization

    ansi_map.geographicPosition geographicPositionByte arrayansi_map.GeographicPosition

    ansi_map.globalTitle globalTitleByte arrayansi_map.GlobalTitle

    ansi_map.groupInformation groupInformationByte arrayansi_map.GroupInformation

    ansi_map.handoffBack handoffBackNo valueansi_map.HandoffBack

    ansi_map.handoffBack2 handoffBack2No valueansi_map.HandoffBack2

    ansi_map.handoffBack2Res handoffBack2ResNo valueansi_map.HandoffBack2Res

    ansi_map.handoffBackRes handoffBackResNo valueansi_map.HandoffBackRes

    ansi_map.handoffMeasurementRequest handoffMeasurementRequestNo valueansi_map.HandoffMeasurementRequest

    ansi_map.handoffMeasurementRequest2 handoffMeasurementRequest2No valueansi_map.HandoffMeasurementRequest2

    ansi_map.handoffMeasurementRequest2Res handoffMeasurementRequest2ResNo valueansi_map.HandoffMeasurementRequest2Res

    ansi_map.handoffMeasurementRequestRes handoffMeasurementRequestResNo valueansi_map.HandoffMeasurementRequestRes

    ansi_map.handoffReason handoffReasonUnsigned 32-bit integeransi_map.HandoffReason

    ansi_map.handoffState handoffStateByte arrayansi_map.HandoffState

    ansi_map.handoffToThird handoffToThirdNo valueansi_map.HandoffToThird

    ansi_map.handoffToThird2 handoffToThird2No valueansi_map.HandoffToThird2

    1.0.3 2008-10-01 54

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.handoffToThird2Res handoffToThird2ResNo valueansi_map.HandoffToThird2Res

    ansi_map.handoffToThirdRes handoffToThirdResNo valueansi_map.HandoffToThirdRes

    ansi_map.handoffstate.pi Party Involved (PI)BooleanParty Involved (PI)

    ansi_map.horizontal_Velocity horizontal-VelocityByte arrayansi_map.Horizontal_Velocity

    ansi_map.ia5_digits IA5 digitsStringIA5 digits

    ansi_map.idno ID NumberUnsigned 32-bit integerID Number

    ansi_map.ilspInformation ilspInformationUnsigned 8-bit integeransi_map.ISLPInformation

    ansi_map.imsi imsiByte arraygsm_map.IMSI

    ansi_map.informationDirective informationDirectiveNo valueansi_map.InformationDirective

    ansi_map.informationDirectiveRes informationDirectiveResNo valueansi_map.InformationDirectiveRes

    ansi_map.informationForward informationForwardNo valueansi_map.InformationForward

    ansi_map.informationForwardRes informationForwardResNo valueansi_map.InformationForwardRes

    ansi_map.information_Record information-RecordByte arrayansi_map.Information_Record

    ansi_map.interMSCCircuitID interMSCCircuitIDNo valueansi_map.InterMSCCircuitID

    ansi_map.interMessageTime interMessageTimeByte arrayansi_map.InterMessageTime

    ansi_map.interSwitchCount interSwitchCountUnsigned 32-bit integeransi_map.InterSwitchCount

    1.0.3 2008-10-01 55

  • WIRESHARK-FILTER(4) The Wireshark Network Analyzer WIRESHARK-FILTER(4)

    ansi_map.interSystemAnswer interSystemAnswerNo valueansi_map.InterSystemAnswer

    ansi_map.interSystemPage interSystemPageNo valueansi_map.InterSystemPage

    ansi_map.interSystemPage2 interSystemPage2No valueansi_map.InterSystemPage2

    ansi_map.interSystemPage2Res interSystemPage2ResNo valueansi_map.InterSystemPage2Res

    ansi_map.interSystemPageRes interSystemPageResNo valueansi_map.InterSystemPageRes

    ansi_map.interSystemPositionRequest interSystemPositionRequestNo valueansi_map.InterSystemPositionRequest

    ansi_map.interSystemPositionRequestForward interSystemPositionRequestForwardNo valueansi_map.InterSyste