preferences 227 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976497749784979498049814982498349844985498649874988498949904991499249934994499549964997499849995000500150025003500450055006500750085009501050115012501350145015501650175018501950205021502250235024502550265027502850295030503150325033503450355036503750385039504050415042504350445045504650475048504950505051505250535054505550565057505850595060506150625063506450655066506750685069507050715072507350745075507650775078507950805081508250835084508550865087508850895090509150925093509450955096509750985099510051015102510351045105510651075108510951105111511251135114511551165117511851195120512151225123512451255126512751285129513051315132513351345135513651375138513951405141514251435144514551465147514851495150515151525153515451555156515751585159516051615162516351645165516651675168516951705171517251735174517551765177517851795180518151825183518451855186518751885189519051915192519351945195519651975198519952005201520252035204520552065207520852095210521152125213521452155216521752185219522052215222522352245225522652275228522952305231523252335234523552365237523852395240524152425243524452455246524752485249525052515252525352545255525652575258525952605261526252635264526552665267526852695270527152725273527452755276527752785279528052815282528352845285528652875288528952905291529252935294529552965297529852995300530153025303530453055306530753085309531053115312531353145315531653175318531953205321532253235324532553265327532853295330533153325333533453355336533753385339534053415342534353445345534653475348534953505351535253535354535553565357535853595360536153625363536453655366536753685369537053715372537353745375537653775378537953805381538253835384538553865387538853895390539153925393539453955396539753985399540054015402540354045405540654075408540954105411541254135414541554165417541854195420542154225423542454255426542754285429543054315432543354345435543654375438543954405441544254435444544554465447544854495450545154525453545454555456545754585459546054615462546354645465546654675468546954705471547254735474547554765477547854795480548154825483548454855486548754885489549054915492549354945495549654975498549955005501550255035504550555065507550855095510551155125513551455155516551755185519552055215522552355245525552655275528552955305531553255335534553555365537553855395540554155425543554455455546554755485549555055515552555355545555555655575558555955605561556255635564556555665567556855695570557155725573557455755576557755785579558055815582558355845585558655875588558955905591559255935594559555965597559855995600560156025603560456055606560756085609561056115612561356145615561656175618561956205621562256235624562556265627562856295630563156325633563456355636563756385639564056415642564356445645564656475648564956505651565256535654565556565657565856595660566156625663566456655666566756685669567056715672567356745675567656775678567956805681568256835684568556865687568856895690569156925693569456955696569756985699570057015702570357045705570657075708570957105711571257135714571557165717571857195720572157225723572457255726572757285729573057315732573357345735573657375738573957405741574257435744
  1. # Configuration file for Wireshark 4.0.5.
  2. #
  3. # This file is regenerated each time preferences are saved within
  4. # Wireshark. Making manual changes should be safe, however.
  5. # Preferences that have been commented out have not been
  6. # changed from their default value.
  7. ####### User Interface ########
  8. # Open a console window (Windows only)
  9. # One of: NEVER, AUTOMATIC, ALWAYS
  10. # (case-insensitive).
  11. #gui.console_open: NEVER
  12. # Restore current display filter after following a stream?
  13. # TRUE or FALSE (case-insensitive)
  14. #gui.restore_filter_after_following_stream: FALSE
  15. # Where to start the File Open dialog box
  16. # One of: LAST_OPENED, SPECIFIED
  17. # (case-insensitive).
  18. #gui.fileopen.style: LAST_OPENED
  19. # The max. number of items in the open recent files list
  20. # A decimal number
  21. #gui.recent_files_count.max: 10
  22. # The max. number of entries in the display filter list
  23. # A decimal number
  24. #gui.recent_display_filter_entries.max: 10
  25. # Directory to start in when opening File Open dialog.
  26. # A path to a directory
  27. #gui.fileopen.dir: C:\Users\Mañana\Documents
  28. # The preview timeout in the File Open dialog
  29. # A decimal number
  30. #gui.fileopen.preview: 3
  31. # Ask to save unsaved capture files?
  32. # TRUE or FALSE (case-insensitive)
  33. #gui.ask_unsaved: TRUE
  34. # Display an autocomplete suggestion for display and capture filter controls
  35. # TRUE or FALSE (case-insensitive)
  36. #gui.autocomplete_filter: TRUE
  37. # Wrap to beginning/end of file during search?
  38. # TRUE or FALSE (case-insensitive)
  39. #gui.find_wrap: TRUE
  40. # Save window position at exit?
  41. # TRUE or FALSE (case-insensitive)
  42. #gui.geometry.save.position: TRUE
  43. # Save window size at exit?
  44. # TRUE or FALSE (case-insensitive)
  45. #gui.geometry.save.size: TRUE
  46. # Save window maximized state at exit?
  47. # TRUE or FALSE (case-insensitive)
  48. #gui.geometry.save.maximized: TRUE
  49. # Main Toolbar style
  50. # One of: ICONS, TEXT, BOTH
  51. # (case-insensitive).
  52. #gui.toolbar_main_style: ICONS
  53. # Check for updates (Windows and macOS only)
  54. # TRUE or FALSE (case-insensitive)
  55. #gui.update.enabled: TRUE
  56. # The type of update to fetch. You should probably leave this set to STABLE.
  57. # One of: DEVELOPMENT, STABLE
  58. # (case-insensitive).
  59. #gui.update.channel: STABLE
  60. # How often to check for software updates in seconds
  61. # A decimal number
  62. #gui.update.interval: 86400
  63. # Custom window title to be appended to the existing title
  64. # %F = file path of the capture file
  65. # %P = profile name
  66. # %S = a conditional separator (" - ") that only shows when surrounded by variables with values or static text
  67. # %V = version info
  68. # A string
  69. #gui.window_title:
  70. # Custom window title to be prepended to the existing title
  71. # %F = file path of the capture file
  72. # %P = profile name
  73. # %S = a conditional separator (" - ") that only shows when surrounded by variables with values or static text
  74. # %V = version info
  75. # A string
  76. #gui.prepend_window_title:
  77. # Custom start page title
  78. # A string
  79. #gui.start_title: The World's Most Popular Network Protocol Analyzer
  80. # Show version in the start page and/or main screen's title bar
  81. # One of: WELCOME, TITLE, BOTH, NEITHER
  82. # (case-insensitive).
  83. #gui.version_placement: BOTH
  84. # The maximum number of objects that can be exported
  85. # A decimal number
  86. #gui.max_export_objects: 1000
  87. # The maximum number of items that can be added to the dissection tree (Increase with caution)
  88. # A decimal number
  89. #gui.max_tree_items: 1000000
  90. # The maximum depth of the dissection tree (Increase with caution)
  91. # A decimal number
  92. #gui.max_tree_depth: 500
  93. # The position of "..." in packet list text.
  94. # One of: LEFT, RIGHT, MIDDLE, NONE
  95. # (case-insensitive).
  96. #gui.packet_list_elide_mode: RIGHT
  97. # Sets the count of decimal places for values of type 1.Type 1 values are defined by authors.Value can be in range 2 to 10.
  98. # A decimal number
  99. #gui.decimal_places1: 2
  100. # Sets the count of decimal places for values of type 2.Type 2 values are defined by authors.Value can be in range 2 to 10.
  101. # A decimal number
  102. #gui.decimal_places2: 4
  103. # Sets the count of decimal places for values of type 3.Type 3 values are defined by authors.Value can be in range 2 to 10.
  104. # A decimal number
  105. #gui.decimal_places3: 6
  106. # If set to true, RTP Player saves temporary data to temp files on disk. If not set, it uses memory.Every stream uses one file therefore you might touch OS limit for count of opened files.When ui.rtp_player_use_disk2 is set to true too, it uses two files per RTP stream together.
  107. # TRUE or FALSE (case-insensitive)
  108. #gui.rtp_player_use_disk1: FALSE
  109. # If set to true, RTP Player saves temporary dictionary to temp files on disk. If not set, it uses memory.Every stream uses one file therefore you might touch OS limit for count of opened files.When ui.rtp_player_use_disk1 is set to true too, it uses two files per RTP stream.
  110. # TRUE or FALSE (case-insensitive)
  111. #gui.rtp_player_use_disk2: FALSE
  112. # To prevent sorting by mistake (which can take some time to calculate), it can be disabled
  113. # TRUE or FALSE (case-insensitive)
  114. #gui.packet_list_is_sortable: TRUE
  115. # Show all interfaces, including interfaces marked as hidden
  116. # TRUE or FALSE (case-insensitive)
  117. #gui.interfaces_show_hidden: FALSE
  118. # Show remote interfaces in the interface selection
  119. # TRUE or FALSE (case-insensitive)
  120. #gui.interfaces_remote_display: TRUE
  121. # Hide the given interface types in the startup list.
  122. # A comma-separated string of interface type values (e.g. 5,9).
  123. # 0 = Wired,
  124. # 1 = AirPCAP,
  125. # 2 = Pipe,
  126. # 3 = STDIN,
  127. # 4 = Bluetooth,
  128. # 5 = Wireless,
  129. # 6 = Dial-Up,
  130. # 7 = USB,
  131. # 8 = External Capture,
  132. # 9 = Virtual
  133. # A string
  134. gui.interfaces_hidden_types: 8,9
  135. # Enables automatic updates for IO Graph
  136. # TRUE or FALSE (case-insensitive)
  137. #gui.io_graph_automatic_update: TRUE
  138. # Show the byte view in the packet details dialog
  139. # TRUE or FALSE (case-insensitive)
  140. #gui.show_byteview_in_dialog: TRUE
  141. ####### User Interface: Colors ########
  142. # Foreground color for an active selected item
  143. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  144. #gui.active_frame.fg: 000000
  145. # Background color for an active selected item
  146. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  147. #gui.active_frame.bg: cbe8ff
  148. # Color style for an active selected item
  149. # One of: DEFAULT, FLAT, GRADIENT
  150. # (case-insensitive).
  151. #gui.active_frame.style: DEFAULT
  152. # Foreground color for an inactive selected item
  153. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  154. #gui.inactive_frame.fg: 000000
  155. # Background color for an inactive selected item
  156. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  157. #gui.inactive_frame.bg: efefef
  158. # Color style for an inactive selected item
  159. # One of: DEFAULT, FLAT, GRADIENT
  160. # (case-insensitive).
  161. #gui.inactive_frame.style: DEFAULT
  162. # Color preferences for a marked frame
  163. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  164. #gui.marked_frame.fg: ffffff
  165. # Color preferences for a marked frame
  166. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  167. #gui.marked_frame.bg: 00202a
  168. # Color preferences for a ignored frame
  169. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  170. #gui.ignored_frame.fg: 7f7f7f
  171. # Color preferences for a ignored frame
  172. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  173. #gui.ignored_frame.bg: ffffff
  174. # TCP stream window color preference
  175. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  176. #gui.stream.client.fg: 7f0000
  177. # TCP stream window color preference
  178. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  179. #gui.stream.client.bg: fbeded
  180. # TCP stream window color preference
  181. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  182. #gui.stream.server.fg: 00007f
  183. # TCP stream window color preference
  184. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  185. #gui.stream.server.bg: ededfb
  186. # Valid color filter background
  187. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  188. #gui.color_filter_bg.valid: afffaf
  189. # Invalid color filter background
  190. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  191. #gui.color_filter_bg.invalid: ffafaf
  192. # Deprecated color filter background
  193. # A six-digit hexadecimal RGB color triplet (e.g. fce94f)
  194. #gui.color_filter_bg.deprecated: ffffaf
  195. ####### User Interface: Columns ########
  196. # Packet list hidden columns
  197. # List all columns to hide in the packet list.
  198. #gui.column.hidden:
  199. # Packet list column format
  200. # Each pair of strings consists of a column title and its format
  201. #gui.column.format:
  202. # "No.", "%m",
  203. # "Time", "%t",
  204. # "Source", "%s",
  205. # "Destination", "%d",
  206. # "Protocol", "%p",
  207. # "Length", "%L",
  208. # "Info", "%i"
  209. ####### User Interface: Font ########
  210. # Font name for packet list, protocol tree, and hex dump panes. (Qt)
  211. # A string
  212. gui.qt.font_name: Consolas,10,-1,5,50,0,0,0,0,0
  213. ####### User Interface: Layout ########
  214. # Layout type (1-6)
  215. # A decimal number
  216. #gui.layout_type: 2
  217. # Layout content of the pane 1
  218. # One of: NONE, PLIST, PDETAILS, PBYTES, PDIAGRAM
  219. # (case-insensitive).
  220. #gui.layout_content_1: PLIST
  221. # Layout content of the pane 2
  222. # One of: NONE, PLIST, PDETAILS, PBYTES, PDIAGRAM
  223. # (case-insensitive).
  224. #gui.layout_content_2: PDETAILS
  225. # Layout content of the pane 3
  226. # One of: NONE, PLIST, PDETAILS, PBYTES, PDIAGRAM
  227. # (case-insensitive).
  228. #gui.layout_content_3: PBYTES
  229. # Enable Packet List Separator
  230. # TRUE or FALSE (case-insensitive)
  231. #gui.packet_list_separator.enabled: FALSE
  232. # Show column definition in packet list header
  233. # TRUE or FALSE (case-insensitive)
  234. #gui.packet_header_column_definition.enabled: TRUE
  235. # Enable Packet List mouse-over colorization
  236. # TRUE or FALSE (case-insensitive)
  237. #gui.packet_list_hover_style.enabled: TRUE
  238. # Show selected packet in the Status Bar
  239. # TRUE or FALSE (case-insensitive)
  240. #gui.show_selected_packet.enabled: FALSE
  241. # Show file load time in the Status Bar
  242. # TRUE or FALSE (case-insensitive)
  243. #gui.show_file_load_time.enabled: FALSE
  244. # Show related packet indicators in the first column
  245. # TRUE or FALSE (case-insensitive)
  246. #gui.packet_list_show_related: TRUE
  247. # Show the intelligent scroll bar (a minimap of packet list colors in the scrollbar)
  248. # TRUE or FALSE (case-insensitive)
  249. #gui.packet_list_show_minimap: TRUE
  250. ####### Capture ########
  251. # Default capture device
  252. # A string
  253. #capture.device:
  254. # Interface link-layer header types (Ex: en0(1),en1(143),...)
  255. # A string
  256. capture.devices_linktypes: \Device\NPF_{D285F8F4-307A-438D-99D1-837800900453}(1),\Device\NPF_{17439885-35C1-4611-902D-C7B804E114C4}(1),\Device\NPF_{2F496A1B-DD3F-4E29-B751-4147D09A3925}(1),\Device\NPF_{6F526FDE-6981-4617-823C-DD08994DAAA8}(1),\Device\NPF_{16C132A6-9618-48EF-B622-924797AA3124}(1),\Device\NPF_{70C3875F-80B7-4A93-897C-6DC5DE9B2B5C}(1),\Device\NPF_{FA706D56-BE18-4B22-9E8B-57FB61E705F3}(1),\Device\NPF_{E0519600-CE97-4528-92B0-1F48B2F46395}(1),\Device\NPF_{19122FBC-2DBE-481F-850E-81B3AF9054FD}(1),\Device\NPF_{EB5F441E-2D7F-4D07-A674-7CB180B5F149}(1),\Device\NPF_{E5D5EAA9-4EC5-434E-9A57-90B3951E6CC5}(1),\Device\NPF_Loopback(0),ciscodump(147),etwdump(290),randpkt(147),sshdump.exe(147),udpdump(252),wifidump.exe(147)
  257. # Interface descriptions (Ex: eth0(eth0 descr),eth1(eth1 descr),...)
  258. # A string
  259. #capture.devices_descr:
  260. # Hide interface? (Ex: eth0,eth3,...)
  261. # A string
  262. #capture.devices_hide:
  263. # By default, capture in monitor mode on interface? (Ex: eth0,eth3,...)
  264. # A string
  265. #capture.devices_monitor_mode:
  266. # Interface buffer size (Ex: en0(1),en1(143),...)
  267. # A string
  268. capture.devices_buffersize: \Device\NPF_{D285F8F4-307A-438D-99D1-837800900453}(2),\Device\NPF_{17439885-35C1-4611-902D-C7B804E114C4}(2),\Device\NPF_{2F496A1B-DD3F-4E29-B751-4147D09A3925}(2),\Device\NPF_{6F526FDE-6981-4617-823C-DD08994DAAA8}(2),\Device\NPF_{16C132A6-9618-48EF-B622-924797AA3124}(2),\Device\NPF_{70C3875F-80B7-4A93-897C-6DC5DE9B2B5C}(2),\Device\NPF_{FA706D56-BE18-4B22-9E8B-57FB61E705F3}(2),\Device\NPF_{E0519600-CE97-4528-92B0-1F48B2F46395}(2),\Device\NPF_{19122FBC-2DBE-481F-850E-81B3AF9054FD}(2),\Device\NPF_{EB5F441E-2D7F-4D07-A674-7CB180B5F149}(2),\Device\NPF_{E5D5EAA9-4EC5-434E-9A57-90B3951E6CC5}(2),\Device\NPF_Loopback(2),ciscodump(2),etwdump(2),randpkt(2),sshdump.exe(2),udpdump(2),wifidump.exe(2)
  269. # Interface snap length (Ex: en0(65535),en1(1430),...)
  270. # A string
  271. capture.devices_snaplen: \Device\NPF_{D285F8F4-307A-438D-99D1-837800900453}:0(262144),\Device\NPF_{17439885-35C1-4611-902D-C7B804E114C4}:0(262144),\Device\NPF_{2F496A1B-DD3F-4E29-B751-4147D09A3925}:0(262144),\Device\NPF_{6F526FDE-6981-4617-823C-DD08994DAAA8}:0(262144),\Device\NPF_{16C132A6-9618-48EF-B622-924797AA3124}:0(262144),\Device\NPF_{70C3875F-80B7-4A93-897C-6DC5DE9B2B5C}:0(262144),\Device\NPF_{FA706D56-BE18-4B22-9E8B-57FB61E705F3}:0(262144),\Device\NPF_{E0519600-CE97-4528-92B0-1F48B2F46395}:0(262144),\Device\NPF_{19122FBC-2DBE-481F-850E-81B3AF9054FD}:0(262144),\Device\NPF_{EB5F441E-2D7F-4D07-A674-7CB180B5F149}:0(262144),\Device\NPF_{E5D5EAA9-4EC5-434E-9A57-90B3951E6CC5}:0(262144),\Device\NPF_Loopback:0(262144),ciscodump:0(262144),etwdump:0(262144),randpkt:0(262144),sshdump.exe:0(262144),udpdump:0(262144),wifidump.exe:0(262144)
  272. # Interface promiscuous mode (Ex: en0(0),en1(1),...)
  273. # A string
  274. capture.devices_pmode: \Device\NPF_{D285F8F4-307A-438D-99D1-837800900453}(1),\Device\NPF_{17439885-35C1-4611-902D-C7B804E114C4}(1),\Device\NPF_{2F496A1B-DD3F-4E29-B751-4147D09A3925}(1),\Device\NPF_{6F526FDE-6981-4617-823C-DD08994DAAA8}(1),\Device\NPF_{16C132A6-9618-48EF-B622-924797AA3124}(1),\Device\NPF_{70C3875F-80B7-4A93-897C-6DC5DE9B2B5C}(1),\Device\NPF_{FA706D56-BE18-4B22-9E8B-57FB61E705F3}(1),\Device\NPF_{E0519600-CE97-4528-92B0-1F48B2F46395}(1),\Device\NPF_{19122FBC-2DBE-481F-850E-81B3AF9054FD}(1),\Device\NPF_{EB5F441E-2D7F-4D07-A674-7CB180B5F149}(1),\Device\NPF_{E5D5EAA9-4EC5-434E-9A57-90B3951E6CC5}(1),\Device\NPF_Loopback(1),ciscodump(1),etwdump(1),randpkt(1),sshdump.exe(1),udpdump(1),wifidump.exe(1)
  275. # Capture in promiscuous mode?
  276. # TRUE or FALSE (case-insensitive)
  277. #capture.prom_mode: TRUE
  278. # Interface capture filter (Ex: en0(tcp),en1(udp),...)
  279. # A string
  280. #capture.devices_filter:
  281. # Capture in pcapng format?
  282. # TRUE or FALSE (case-insensitive)
  283. #capture.pcap_ng: TRUE
  284. # Update packet list in real time during capture?
  285. # TRUE or FALSE (case-insensitive)
  286. #capture.real_time_update: TRUE
  287. # Don't automatically load capture interfaces on startup
  288. # TRUE or FALSE (case-insensitive)
  289. #capture.no_interface_load: FALSE
  290. # Disable external capture modules (extcap)
  291. # TRUE or FALSE (case-insensitive)
  292. #capture.no_extcap: FALSE
  293. # Scroll packet list during capture?
  294. # TRUE or FALSE (case-insensitive)
  295. #capture.auto_scroll: TRUE
  296. # Show capture information dialog while capturing?
  297. # TRUE or FALSE (case-insensitive)
  298. #capture.show_info: FALSE
  299. # Column list
  300. # List of columns to be displayed in the capture options dialog.
  301. # Possible values: INTERFACE, LINK, PMODE, SNAPLEN, MONITOR, BUFFER, FILTER
  302. #
  303. #capture.columns:
  304. # "INTERFACE", "LINK",
  305. # "PMODE", "SNAPLEN",
  306. # "MONITOR", "BUFFER",
  307. # "FILTER"
  308. ####### Console ########
  309. # Look for dissectors that left some bytes undecoded (debug)
  310. # TRUE or FALSE (case-insensitive)
  311. #console.incomplete_dissectors_check_debug: FALSE
  312. ####### Extcap Utilities ########
  313. # Save arguments on start of capture
  314. # TRUE or FALSE (case-insensitive)
  315. #extcap.gui_save_on_start: TRUE
  316. # Remote SSH server address
  317. # A string
  318. #extcap.ciscodump.remotehost:
  319. # Remote SSH server port
  320. # A string
  321. #extcap.ciscodump.remoteport: 22
  322. # Remote SSH server username
  323. # A string
  324. #extcap.ciscodump.remoteusername: Mañana
  325. # Remote SSH server password
  326. # Password (never stored on disk)
  327. #extcap.ciscodump.remotepassword:
  328. # Path to SSH private key
  329. # A string
  330. #extcap.ciscodump.sshkey:
  331. # ProxyCommand
  332. # A string
  333. #extcap.ciscodump.proxycommand:
  334. # Remote interface
  335. # A string
  336. #extcap.ciscodump.remoteinterface:
  337. # Remote capture filter
  338. # A string
  339. #extcap.ciscodump.remotefilter: deny tcp host 172.29.64.1 any eq 22, deny tcp any eq 22 host 172.29.64.1, deny tcp host fe80::2a1:f6e0:d953:7e6e any eq 22, deny tcp any eq 22 host fe80::2a1:f6e0:d953:7e6e, deny tcp host 172.22.144.1 any eq 22, deny tcp any eq 22 host 172.22.144.1, deny tcp host fe80::d4cc:5bb0:17d2:83f9 any eq 22, deny tcp any eq 22 host fe80::d4cc:5bb0:17d2:83f9, deny tcp host 172.31.240.1 any eq 22, deny tcp any eq 22 host 172.31.240.1, deny tcp host fe80::325:72f9:fe6c:e64c any eq 22, deny tcp any eq 22 host fe80::325:72f9:fe6c:e64c, deny tcp host 172.24.0.1 any eq 22, deny tcp any eq 22 host 172.24.0.1, deny tcp host fe80::39c5:1e6e:dce2:791f any eq 22, deny tcp any eq 22 host fe80::39c5:1e6e:dce2:791f, deny tcp host 192.168.78.1 any eq 22, deny tcp any eq 22 host 192.168.78.1, deny tcp host fe80::ead5:ef64:b395:699a any eq 22, deny tcp any eq 22 host fe80::ead5:ef64:b395:699a, deny tcp host 192.168.223.1 any eq 22, deny tcp any eq 22 host 192.168.223.1, deny tcp host fe80::b9cc:8657:af9b:741a any eq 22, deny tcp any eq 22 host fe80::b9cc:8657:af9b:741a, deny tcp host 192.168.56.1 any eq 22, deny tcp any eq 22 host 192.168.56.1, deny tcp host fe80::b6d0:b265:a850:3cca any eq 22, deny tcp any eq 22 host fe80::b6d0:b265:a850:3cca, deny tcp host 10.1.4.20 any eq 22, deny tcp any eq 22 host 10.1.4.20, deny tcp host fe80::ed61:4714:f8d9:3478 any eq 22, deny tcp any eq 22 host fe80::ed61:4714:f8d9:3478, permit ip any any
  340. # Packets to capture
  341. # A string
  342. #extcap.ciscodump.remotecount:
  343. # Set the log level
  344. # A string
  345. #extcap.ciscodump.loglevel:
  346. # Use a file for logging
  347. # A string
  348. #extcap.ciscodump.logfile:
  349. # etl file
  350. # A string
  351. #extcap.etwdump.etlfile:
  352. # filter parmeters
  353. # A string
  354. #extcap.etwdump.params:
  355. # Should undecidable events be included
  356. # A string
  357. #extcap.etwdump.iue: false
  358. # Set the log level
  359. # A string
  360. #extcap.etwdump.loglevel:
  361. # Use a file for logging
  362. # A string
  363. #extcap.etwdump.logfile:
  364. # Max bytes in a packet
  365. # A string
  366. #extcap.randpkt.maxbytes: 5000
  367. # Number of packets
  368. # A string
  369. #extcap.randpkt.count: 1000
  370. # Packet delay (ms)
  371. # A string
  372. #extcap.randpkt.delay: 0
  373. # Random type
  374. # A string
  375. #extcap.randpkt.randomtype: false
  376. # All random packets
  377. # A string
  378. #extcap.randpkt.allrandom: false
  379. # Type of packet
  380. # A string
  381. #extcap.randpkt.type:
  382. # Set the log level
  383. # A string
  384. #extcap.randpkt.loglevel:
  385. # Use a file for logging
  386. # A string
  387. #extcap.randpkt.logfile:
  388. # Remote SSH server address
  389. # A string
  390. #extcap.sshdump_exe.remotehost:
  391. # Remote SSH server port
  392. # A string
  393. #extcap.sshdump_exe.remoteport:
  394. # Remote SSH server username
  395. # A string
  396. #extcap.sshdump_exe.remoteusername:
  397. # Remote SSH server password
  398. # Password (never stored on disk)
  399. #extcap.sshdump_exe.remotepassword:
  400. # Path to SSH private key
  401. # A string
  402. #extcap.sshdump_exe.sshkey:
  403. # SSH key passphrase
  404. # Password (never stored on disk)
  405. #extcap.sshdump_exe.sshkeypassphrase:
  406. # ProxyCommand
  407. # A string
  408. #extcap.sshdump_exe.proxycommand:
  409. # Remote interface
  410. # A string
  411. #extcap.sshdump_exe.remoteinterface:
  412. # Remote capture command selection
  413. # A string
  414. #extcap.sshdump_exe.remotecapturecommandselect:
  415. # Remote capture command
  416. # A string
  417. #extcap.sshdump_exe.remotecapturecommand:
  418. # Use sudo on the remote machine
  419. # A string
  420. #extcap.sshdump_exe.remotesudo:
  421. # No promiscuous mode
  422. # A string
  423. #extcap.sshdump_exe.remotenoprom:
  424. # Remote capture filter
  425. # A string
  426. #extcap.sshdump_exe.remotefilter: not ((host 172.29.64.1 or host fe80::2a1:f6e0:d953:7e6e or host 172.22.144.1 or host fe80::d4cc:5bb0:17d2:83f9 or host 172.31.240.1 or host fe80::325:72f9:fe6c:e64c or host 172.24.0.1 or host fe80::39c5:1e6e:dce2:791f or host 192.168.78.1 or host fe80::ead5:ef64:b395:699a or host 192.168.223.1 or host fe80::b9cc:8657:af9b:741a or host 192.168.56.1 or host fe80::b6d0:b265:a850:3cca or host 10.1.4.20 or host fe80::ed61:4714:f8d9:3478) and port 22)
  427. # Packets to capture
  428. # A string
  429. #extcap.sshdump_exe.remotecount: 0
  430. # Set the log level
  431. # A string
  432. #extcap.sshdump_exe.loglevel:
  433. # Use a file for logging
  434. # A string
  435. #extcap.sshdump_exe.logfile:
  436. # Listen port
  437. # A string
  438. #extcap.udpdump.port: 5555
  439. # Payload type
  440. # A string
  441. #extcap.udpdump.payload: data
  442. # Set the log level
  443. # A string
  444. #extcap.udpdump.loglevel:
  445. # Use a file for logging
  446. # A string
  447. #extcap.udpdump.logfile:
  448. # Remote SSH server address
  449. # A string
  450. #extcap.wifidump_exe.remotehost:
  451. # Remote SSH server port
  452. # A string
  453. #extcap.wifidump_exe.remoteport:
  454. # Remote SSH server username
  455. # A string
  456. #extcap.wifidump_exe.remoteusername:
  457. # Remote SSH server password
  458. # Password (never stored on disk)
  459. #extcap.wifidump_exe.remotepassword:
  460. # Path to SSH private key
  461. # A string
  462. #extcap.wifidump_exe.sshkey:
  463. # SSH key passphrase
  464. # Password (never stored on disk)
  465. #extcap.wifidump_exe.sshkeypassphrase:
  466. # Remote interface
  467. # A string
  468. #extcap.wifidump_exe.remoteinterface: auto
  469. # Remote channel
  470. # A string
  471. #extcap.wifidump_exe.remotechannelfrequency:
  472. # Remote channel width
  473. # A string
  474. #extcap.wifidump_exe.remotechannelwidth:
  475. # Remote capture filter
  476. # A string
  477. #extcap.wifidump_exe.remotefilter:
  478. # Frames to capture
  479. # A string
  480. #extcap.wifidump_exe.remotecount:
  481. # Set the log level
  482. # A string
  483. #extcap.wifidump_exe.loglevel:
  484. # Use a file for logging
  485. # A string
  486. #extcap.wifidump_exe.logfile:
  487. ####### Name Resolution ########
  488. # Resolve Ethernet MAC addresses to host names from the preferences or system's Ethers file, or to a manufacturer based name.
  489. # TRUE or FALSE (case-insensitive)
  490. #nameres.mac_name: TRUE
  491. # Resolve TCP/UDP ports into service names
  492. # TRUE or FALSE (case-insensitive)
  493. #nameres.transport_name: FALSE
  494. # Resolve IPv4, IPv6, and IPX addresses into host names. The next set of check boxes determines how name resolution should be performed. If no other options are checked name resolution is made from Wireshark's host file and capture file name resolution blocks.
  495. # TRUE or FALSE (case-insensitive)
  496. #nameres.network_name: FALSE
  497. # Use address/name pairs found in captured DNS packets for name resolution.
  498. # TRUE or FALSE (case-insensitive)
  499. #nameres.dns_pkt_addr_resolution: TRUE
  500. # Use your system's configured name resolver (usually DNS) to resolve network names. Only applies when network name resolution is enabled.
  501. # TRUE or FALSE (case-insensitive)
  502. #nameres.use_external_name_resolver: TRUE
  503. # Use a DNS Servers list to resolve network names if TRUE. If FALSE, default information is used
  504. # TRUE or FALSE (case-insensitive)
  505. #nameres.use_custom_dns_servers: FALSE
  506. # The maximum number of DNS requests that may be active at any time. A large value (many thousands) might overload the network or make your DNS server behave badly.
  507. # A decimal number
  508. #nameres.name_resolve_concurrency: 500
  509. # By default "hosts" files will be loaded from multiple sources. Checking this box only loads the "hosts" in the current profile.
  510. # TRUE or FALSE (case-insensitive)
  511. #nameres.hosts_file_handling: FALSE
  512. # Resolve VLAN IDs to network names from the preferences "vlans" file. Format of the file is: "ID<Tab>Name". One line per VLAN, e.g.: 1 Management
  513. # TRUE or FALSE (case-insensitive)
  514. #nameres.vlan_name: FALSE
  515. # Resolve SS7 Point Codes to node names from the profiles "ss7pcs" file. Format of the file is: "Network_Indicator<Dash>PC_Decimal<Tab>Name". One line per Point Code, e.g.: 2-1234 MyPointCode1
  516. # TRUE or FALSE (case-insensitive)
  517. #nameres.ss7_pc_name: FALSE
  518. # Resolve Object IDs to object names from the MIB and PIB modules defined below. You must restart Wireshark for this change to take effect
  519. # TRUE or FALSE (case-insensitive)
  520. #nameres.load_smi_modules: FALSE
  521. # While loading MIB or PIB modules errors may be detected, which are reported. Some errors can be ignored. If unsure, set to false.
  522. # TRUE or FALSE (case-insensitive)
  523. #nameres.suppress_smi_errors: FALSE
  524. ####### Protocols ########
  525. # Display all hidden protocol items in the packet list.
  526. # TRUE or FALSE (case-insensitive)
  527. #protocols.display_hidden_proto_items: FALSE
  528. # Display all byte fields with a space character between each byte in the packet list.
  529. # TRUE or FALSE (case-insensitive)
  530. #protocols.display_byte_fields_with_spaces: FALSE
  531. # Look for dissectors that left some bytes undecoded.
  532. # TRUE or FALSE (case-insensitive)
  533. #protocols.enable_incomplete_dissectors_check: FALSE
  534. # Protocols may use things like VLAN ID or interface ID to narrow the potential for duplicate conversations. Currently ICMP and ICMPv6 use this preference to add VLAN ID to conversation tracking, and IPv4 uses this preference to take VLAN ID into account during reassembly
  535. # TRUE or FALSE (case-insensitive)
  536. #protocols.strict_conversation_tracking_heuristics: FALSE
  537. # Use a registered heuristic sub-dissector to decode the data payload
  538. # TRUE or FALSE (case-insensitive)
  539. #lbmc.use_heuristic_subdissectors: TRUE
  540. # Reassemble data message fragments
  541. # TRUE or FALSE (case-insensitive)
  542. #lbmc.reassemble_fragments: FALSE
  543. # Recognize and dissect payloads containing LBMPDM messages (requires reassembly to be enabled)
  544. # TRUE or FALSE (case-insensitive)
  545. #lbmc.dissect_lbmpdm: FALSE
  546. # Set the low end of the TCP port range
  547. # A decimal number
  548. #lbmpdm_tcp.port_low: 14371
  549. # Set the high end of the port range
  550. # A decimal number
  551. #lbmpdm_tcp.port_high: 14390
  552. # Use table of LBMPDM-TCP tags to decode the packet instead of above values
  553. # TRUE or FALSE (case-insensitive)
  554. #lbmpdm_tcp.use_lbmpdm_tcp_domain: FALSE
  555. # Set the UDP port for incoming multicast topic resolution (context resolver_multicast_incoming_port)
  556. # A decimal number
  557. #lbmr.mc_incoming_port: 12965
  558. # Set the multicast address for incoming multicast topic resolution (context resolver_multicast_incoming_address)
  559. # A string
  560. #lbmr.mc_incoming_address: 224.9.10.11
  561. # Set the UDP port for outgoing multicast topic resolution (context resolver_multicast_outgoing_port)
  562. # A decimal number
  563. #lbmr.mc_outgoing_port: 12965
  564. # Set the multicast address for outgoing multicast topic resolution (context resolver_multicast_outgoing_address)
  565. # A string
  566. #lbmr.mc_outgoing_address: 224.9.10.11
  567. # Set the low UDP port for unicast topic resolution (context resolver_unicast_port_low)
  568. # A decimal number
  569. #lbmr.uc_port_low: 14402
  570. # Set the high UDP port for unicast topic resolution (context resolver_unicast_port_high)
  571. # A decimal number
  572. #lbmr.uc_port_high: 14406
  573. # Set the destination port for unicast topic resolution (context resolver_unicast_destination_port)
  574. # A decimal number
  575. #lbmr.uc_dest_port: 15380
  576. # Set the address of the unicast resolver daemon (context resolver_unicast_address)
  577. # A string
  578. #lbmr.uc_address: 0.0.0.0
  579. # Use table of LBMR tags to decode the packet instead of above values
  580. # TRUE or FALSE (case-insensitive)
  581. #lbmr.use_lbmr_domain: FALSE
  582. # Set the LBMSRS IP Address
  583. # A string
  584. #lbmsrs.source_ip_address: 127.0.0.1
  585. # Set the source TCP port
  586. # A decimal number
  587. #lbmsrs.source_port: 0
  588. # Use table of LBMSRS tags to decode the packet instead of above values
  589. # TRUE or FALSE (case-insensitive)
  590. #lbmsrs.use_lbmsrs_domain: FALSE
  591. # Set the low end of the LBT-RM multicast address range (context transport_lbtrm_multicast_address_low)
  592. # A string
  593. #lbtrm.mc_address_low: 224.10.10.10
  594. # Set the high end of the LBT-RM multicast address range (context transport_lbtrm_multicast_address_high)
  595. # A string
  596. #lbtrm.mc_address_high: 224.10.10.14
  597. # Set the low end of the LBT-RM UDP destination port range (source transport_lbtrm_destination_port)
  598. # A decimal number
  599. #lbtrm.dport_low: 14400
  600. # Set the high end of the LBT-RM UDP destination port range (source transport_lbtrm_destination_port)
  601. # A decimal number
  602. #lbtrm.dport_high: 14400
  603. # Set the low end of the LBT-RM UDP source port range (context transport_lbtrm_source_port_low)
  604. # A decimal number
  605. #lbtrm.sport_low: 14390
  606. # Set the high end of the LBT-RM UDP source port range (context transport_lbtrm_source_port_high)
  607. # A decimal number
  608. #lbtrm.sport_high: 14399
  609. # Set the incoming MIM multicast address (context mim_incoming_address)
  610. # A string
  611. #lbtrm.mim_incoming_address: 224.10.10.21
  612. # Set the outgoing MIM multicast address (context mim_outgoing_address)
  613. # A string
  614. #lbtrm.mim_outgoing_address: 224.10.10.21
  615. # Set the incoming MIM UDP port (context mim_incoming_destination_port)
  616. # A decimal number
  617. #lbtrm.mim_incoming_dport: 14401
  618. # Set the outgoing MIM UDP port (context mim_outgoing_destination_port)
  619. # A decimal number
  620. #lbtrm.mim_outgoing_dport: 14401
  621. # Separate multiple NAKs from a single packet into distinct Expert Info entries
  622. # TRUE or FALSE (case-insensitive)
  623. #lbtrm.expert_separate_naks: FALSE
  624. # Separate multiple NCFs from a single packet into distinct Expert Info entries
  625. # TRUE or FALSE (case-insensitive)
  626. #lbtrm.expert_separate_ncfs: FALSE
  627. # Perform analysis on LBT-RM sequence numbers to determine out-of-order, gaps, loss, etc
  628. # TRUE or FALSE (case-insensitive)
  629. #lbtrm.sequence_analysis: FALSE
  630. # Use table of LBT-RM tags to decode the packet instead of above values
  631. # TRUE or FALSE (case-insensitive)
  632. #lbtrm.use_lbtrm_domain: FALSE
  633. # Set the low end of the LBT-RU source UDP port range (context transport_lbtru_port_low)
  634. # A decimal number
  635. #lbtru.source_port_low: 14380
  636. # Set the high end of the LBT-RU source UDP port range (context transport_lbtru_port_high)
  637. # A decimal number
  638. #lbtru.source_port_high: 14389
  639. # Set the low end of the LBT-RU receiver UDP port range (receiver transport_lbtru_port_low)
  640. # A decimal number
  641. #lbtru.receiver_port_low: 14360
  642. # Set the high end of the LBT-RU receiver UDP port range (receiver transport_lbtru_port_high)
  643. # A decimal number
  644. #lbtru.receiver_port_high: 14379
  645. # Separate multiple NAKs from a single packet into distinct Expert Info entries
  646. # TRUE or FALSE (case-insensitive)
  647. #lbtru.expert_separate_naks: FALSE
  648. # Separate multiple NCFs from a single packet into distinct Expert Info entries
  649. # TRUE or FALSE (case-insensitive)
  650. #lbtru.expert_separate_ncfs: FALSE
  651. # Perform analysis on LBT-RU sequence numbers to determine out-of-order, gaps, loss, etc
  652. # TRUE or FALSE (case-insensitive)
  653. #lbtru.sequence_analysis: FALSE
  654. # Use table of LBT-RU tags to decode the packet instead of above values
  655. # TRUE or FALSE (case-insensitive)
  656. #lbtru.use_lbtru_domain: FALSE
  657. # Set the low end of the LBT-TCP source TCP port range (context transport_tcp_port_low)
  658. # A decimal number
  659. #lbttcp.source_port_low: 14371
  660. # Set the high end of the LBT-TCP source TCP port range (context transport_tcp_port_high)
  661. # A decimal number
  662. #lbttcp.source_port_high: 14390
  663. # Set the low end of the LBT-TCP request TCP port range (context request_tcp_port_low)
  664. # A decimal number
  665. #lbttcp.request_port_low: 14391
  666. # Set the high end of the LBT-TCP request TCP port range (context request_tcp_port_high)
  667. # A decimal number
  668. #lbttcp.request_port_high: 14395
  669. # Set the low end of the LBT-TCP UME Store TCP port range
  670. # A decimal number
  671. #lbttcp.store_port_low: 0
  672. # Set the high end of the LBT-TCP UME Store TCP port range
  673. # A decimal number
  674. #lbttcp.store_port_high: 0
  675. # Use table of LBT-TCP tags to decode the packet instead of above values
  676. # TRUE or FALSE (case-insensitive)
  677. #lbttcp.use_lbttcp_domain: FALSE
  678. # Enable this option to recognise all traffic on RTP dynamic payload type 96 (0x60) as FEC data corresponding to Pro-MPEG Code of Practice #3 release 2
  679. # TRUE or FALSE (case-insensitive)
  680. #2dparityfec.enable: FALSE
  681. # Derive IID from a short 16-bit address according to RFC 4944 (using the PAN ID).
  682. # TRUE or FALSE (case-insensitive)
  683. #6lowpan.rfc4944_short_address_format: FALSE
  684. # Linux kernels before version 4.12 does toggle the Universal/Local bit.
  685. # TRUE or FALSE (case-insensitive)
  686. #6lowpan.iid_has_universal_local_bit: FALSE
  687. # Whether the IPv6 summary line should be shown in the protocol tree
  688. # TRUE or FALSE (case-insensitive)
  689. #6lowpan.summary_in_tree: TRUE
  690. # IPv6 prefix to use for stateful address decompression.
  691. # A string
  692. #6lowpan.context0:
  693. # IPv6 prefix to use for stateful address decompression.
  694. # A string
  695. #6lowpan.context1:
  696. # IPv6 prefix to use for stateful address decompression.
  697. # A string
  698. #6lowpan.context2:
  699. # IPv6 prefix to use for stateful address decompression.
  700. # A string
  701. #6lowpan.context3:
  702. # IPv6 prefix to use for stateful address decompression.
  703. # A string
  704. #6lowpan.context4:
  705. # IPv6 prefix to use for stateful address decompression.
  706. # A string
  707. #6lowpan.context5:
  708. # IPv6 prefix to use for stateful address decompression.
  709. # A string
  710. #6lowpan.context6:
  711. # IPv6 prefix to use for stateful address decompression.
  712. # A string
  713. #6lowpan.context7:
  714. # IPv6 prefix to use for stateful address decompression.
  715. # A string
  716. #6lowpan.context8:
  717. # IPv6 prefix to use for stateful address decompression.
  718. # A string
  719. #6lowpan.context9:
  720. # IPv6 prefix to use for stateful address decompression.
  721. # A string
  722. #6lowpan.context10:
  723. # IPv6 prefix to use for stateful address decompression.
  724. # A string
  725. #6lowpan.context11:
  726. # IPv6 prefix to use for stateful address decompression.
  727. # A string
  728. #6lowpan.context12:
  729. # IPv6 prefix to use for stateful address decompression.
  730. # A string
  731. #6lowpan.context13:
  732. # IPv6 prefix to use for stateful address decompression.
  733. # A string
  734. #6lowpan.context14:
  735. # IPv6 prefix to use for stateful address decompression.
  736. # A string
  737. #6lowpan.context15:
  738. # Some generators incorrectly indicate long preamble when the preamble was actuallyshort. Always assume short preamble when calculating duration.
  739. # TRUE or FALSE (case-insensitive)
  740. #wlan_radio.always_short_preamble: FALSE
  741. # Some generators timestamp the end of the PPDU rather than the start of the (A)MPDU.
  742. # TRUE or FALSE (case-insensitive)
  743. #wlan_radio.tsf_at_end: TRUE
  744. # Enables an additional panel for navigating through packets
  745. # TRUE or FALSE (case-insensitive)
  746. #wlan_radio.timeline: FALSE
  747. # Radiotap has a bit to indicate whether the FCS is still on the frame or not. Some generators (e.g. AirPcap) use a non-standard radiotap flag 14 to put the FCS into the header.
  748. # TRUE or FALSE (case-insensitive)
  749. #radiotap.bit14_fcs_in_header: FALSE
  750. # Some generators use rates with bit 7 set to indicate an MCS, e.g. BSD. others (Linux, AirPcap) do not.
  751. # TRUE or FALSE (case-insensitive)
  752. #radiotap.interpret_high_rates_as_mcs: FALSE
  753. # Whether to use the FCS bit, assume the FCS is always present, or assume the FCS is never present.
  754. # One of: Use the FCS bit, Assume all packets have an FCS at the end, Assume all packets don't have an FCS at the end
  755. # (case-insensitive).
  756. #radiotap.fcs_handling: Use the FCS bit
  757. # Use ipaccess nanoBTS specific definitions for OML
  758. # One of: ETSI/3GPP TS 12.21, Siemens, ip.access, Ericsson OM2000
  759. # (case-insensitive).
  760. #gsm_abis_oml.oml_dialect: ETSI/3GPP TS 12.21
  761. # Enable Streaming DMX extension dissector (ANSI BSR E1.31)
  762. # TRUE or FALSE (case-insensitive)
  763. #acn.dmx_enable: FALSE
  764. # Display format
  765. # One of: Hex , Decimal, Percent
  766. # (case-insensitive).
  767. #acn.dmx_display_view: Hex
  768. # Display zeros instead of dots
  769. # TRUE or FALSE (case-insensitive)
  770. #acn.dmx_display_zeros: FALSE
  771. # Display leading zeros on levels
  772. # TRUE or FALSE (case-insensitive)
  773. #acn.dmx_display_leading_zeros: FALSE
  774. # Display line format
  775. # One of: 20 per line, 16 per line
  776. # (case-insensitive).
  777. #acn.dmx_display_line_format: 20 per line
  778. # Server Port
  779. # A decimal number
  780. #adb_cs.server_port: 5037
  781. # Dissect more detail for framebuffer service
  782. # TRUE or FALSE (case-insensitive)
  783. #adb_service.framebuffer_more_details: FALSE
  784. # Specify if the Data sections of packets should be dissected or not
  785. # TRUE or FALSE (case-insensitive)
  786. #adwin.dissect_data: TRUE
  787. # Include next/previous frame for channel, stream, and term, and other transport sequence analysis.
  788. # TRUE or FALSE (case-insensitive)
  789. #aeron.sequence_analysis: FALSE
  790. # Include stream analysis, tracking publisher and subscriber positions. Requires "Analyze transport sequencing".
  791. # TRUE or FALSE (case-insensitive)
  792. #aeron.stream_analysis: FALSE
  793. # Reassemble fragmented data messages. Requires "Analyze transport sequencing" and "Analyze stream sequencing".
  794. # TRUE or FALSE (case-insensitive)
  795. #aeron.reassemble_fragments: FALSE
  796. # Use a registered heuristic sub-dissector to decode the payload data. Requires "Analyze transport sequencing", "Analyze stream sequencing", and "Reassemble fragmented data".
  797. # TRUE or FALSE (case-insensitive)
  798. #aeron.use_heuristic_subdissectors: FALSE
  799. # Whether fragmented AFS PDUs should be reassembled
  800. # TRUE or FALSE (case-insensitive)
  801. #afs.defragment: FALSE
  802. # Whether the AIM dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  803. # TRUE or FALSE (case-insensitive)
  804. #aim.desegment: TRUE
  805. # Whether the LCT header Codepoint field should be considered the FEC Encoding ID of carried object
  806. # TRUE or FALSE (case-insensitive)
  807. #alc.lct.codepoint_as_fec_id: TRUE
  808. # How to decode LCT header extension 192
  809. # One of: Don't decode, Decode as FLUTE extension (EXT_FDT)
  810. # (case-insensitive).
  811. #alc.lct.ext.192: Decode as FLUTE extension (EXT_FDT)
  812. # How to decode LCT header extension 193
  813. # One of: Don't decode, Decode as FLUTE extension (EXT_CENC)
  814. # (case-insensitive).
  815. #alc.lct.ext.193: Decode as FLUTE extension (EXT_CENC)
  816. # Whether persistent call leg information is to be kept
  817. # TRUE or FALSE (case-insensitive)
  818. #alcap.leg_info: TRUE
  819. # Set the TCP port for AMQP over SSL/TLS(if other than the default of 5671)
  820. # A decimal number
  821. #amqp.tls.port: 5671
  822. # Type of AMR encoding of the payload
  823. # One of: RFC 3267 octet aligned, RFC 3267 BW-efficient, AMR IF1, AMR IF2
  824. # (case-insensitive).
  825. #amr.encoding.version: RFC 3267 octet aligned
  826. # The AMR mode
  827. # One of: Narrowband AMR, Wideband AMR
  828. # (case-insensitive).
  829. #amr.mode: Narrowband AMR
  830. # (if other than the default of IOS 4.0.1)
  831. # One of: IS-634 rev. 0, TSB-80, IS-634-A, IOS 2.x, IOS 3.x, IOS 4.0.1, IOS 5.0.1
  832. # (case-insensitive).
  833. #ansi_a_bsmap.global_variant: IOS 4.0.1
  834. # Whether the mobile ID and service options are displayed in the INFO column
  835. # TRUE or FALSE (case-insensitive)
  836. #ansi_a_bsmap.top_display_mid_so: TRUE
  837. # ANSI MAP SSNs to decode as ANSI MAP
  838. # A string denoting an positive integer range (e.g., "1-20,30-40")
  839. #ansi_map.map.ssn: 5-14
  840. # Type of matching invoke/response, risk of mismatch if loose matching chosen
  841. # One of: Transaction ID only, Transaction ID and Source, Transaction ID Source and Destination
  842. # (case-insensitive).
  843. #ansi_map.transaction.matchtype: Transaction ID and Source
  844. # Type of matching invoke/response, risk of mismatch if loose matching chosen
  845. # One of: Transaction ID only, Transaction ID and Source, Transaction ID Source and Destination
  846. # (case-insensitive).
  847. #ansi_tcap.transaction.matchtype: Transaction ID only
  848. # Whether the AOL dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  849. # TRUE or FALSE (case-insensitive)
  850. #aol.desegment: TRUE
  851. # Attempt to display common APRS protocol violations correctly
  852. # TRUE or FALSE (case-insensitive)
  853. #aprs.showaprslax: FALSE
  854. # Attempt to detect excessive rate of ARP requests
  855. # TRUE or FALSE (case-insensitive)
  856. #arp.detect_request_storms: FALSE
  857. # Number of requests needed within period to indicate a storm
  858. # A decimal number
  859. #arp.detect_storm_number_of_packets: 30
  860. # Period in milliseconds during which a packet storm may be detected
  861. # A decimal number
  862. #arp.detect_storm_period: 100
  863. # Attempt to detect duplicate use of IP addresses
  864. # TRUE or FALSE (case-insensitive)
  865. #arp.detect_duplicate_ips: TRUE
  866. # Try to resolve physical addresses to host names from ARP requests/responses
  867. # TRUE or FALSE (case-insensitive)
  868. #arp.register_network_address_binding: TRUE
  869. # Select the CAT001 version
  870. # One of: Version 1.4 (latest), Version 1.4, Version 1.3, Version 1.2
  871. # (case-insensitive).
  872. #asterix.i001_version: Version 1.4 (latest)
  873. # Select the CAT002 version
  874. # One of: Version 1.1 (latest), Version 1.1, Version 1.0
  875. # (case-insensitive).
  876. #asterix.i002_version: Version 1.1 (latest)
  877. # Select the CAT004 version
  878. # One of: Version 1.12 (latest), Version 1.12
  879. # (case-insensitive).
  880. #asterix.i004_version: Version 1.12 (latest)
  881. # Select the CAT008 version
  882. # One of: Version 1.3 (latest), Version 1.3, Version 1.2
  883. # (case-insensitive).
  884. #asterix.i008_version: Version 1.3 (latest)
  885. # Select the CAT009 version
  886. # One of: Version 2.1 (latest), Version 2.1
  887. # (case-insensitive).
  888. #asterix.i009_version: Version 2.1 (latest)
  889. # Select the CAT010 version
  890. # One of: Version 1.1 (latest), Version 1.1
  891. # (case-insensitive).
  892. #asterix.i010_version: Version 1.1 (latest)
  893. # Select the CAT011 version
  894. # One of: Version 1.3 (latest), Version 1.3, Version 1.2
  895. # (case-insensitive).
  896. #asterix.i011_version: Version 1.3 (latest)
  897. # Select the CAT015 version
  898. # One of: Version 1.1 (latest), Version 1.1, Version 1.0
  899. # (case-insensitive).
  900. #asterix.i015_version: Version 1.1 (latest)
  901. # Select the CAT016 version
  902. # One of: Version 1.0 (latest), Version 1.0
  903. # (case-insensitive).
  904. #asterix.i016_version: Version 1.0 (latest)
  905. # Select the CAT018 version
  906. # One of: Version 1.7 (latest), Version 1.7
  907. # (case-insensitive).
  908. #asterix.i018_version: Version 1.7 (latest)
  909. # Select the CAT019 version
  910. # One of: Version 1.3 (latest), Version 1.3
  911. # (case-insensitive).
  912. #asterix.i019_version: Version 1.3 (latest)
  913. # Select the CAT020 version
  914. # One of: Version 1.10 (latest), Version 1.10, Version 1.9
  915. # (case-insensitive).
  916. #asterix.i020_version: Version 1.10 (latest)
  917. # Select the CAT021 version
  918. # One of: Version 2.6 (latest), Version 2.6, Version 2.5, Version 2.4, Version 0.23
  919. # (case-insensitive).
  920. #asterix.i021_version: Version 2.6 (latest)
  921. # Select the CAT023 version
  922. # One of: Version 1.3 (latest), Version 1.3, Version 1.2
  923. # (case-insensitive).
  924. #asterix.i023_version: Version 1.3 (latest)
  925. # Select the CAT025 version
  926. # One of: Version 1.5 (latest), Version 1.5
  927. # (case-insensitive).
  928. #asterix.i025_version: Version 1.5 (latest)
  929. # Select the CAT032 version
  930. # One of: Version 1.1 (latest), Version 1.1
  931. # (case-insensitive).
  932. #asterix.i032_version: Version 1.1 (latest)
  933. # Select the CAT034 version
  934. # One of: Version 1.29 (latest), Version 1.29, Version 1.28, Version 1.27
  935. # (case-insensitive).
  936. #asterix.i034_version: Version 1.29 (latest)
  937. # Select the CAT048 version
  938. # One of: Version 1.31 (latest), Version 1.31, Version 1.30, Version 1.29, Version 1.28, Version 1.27
  939. # (case-insensitive).
  940. #asterix.i048_version: Version 1.31 (latest)
  941. # Select the CAT062 version
  942. # One of: Version 1.19 (latest), Version 1.19, Version 1.18, Version 1.17
  943. # (case-insensitive).
  944. #asterix.i062_version: Version 1.19 (latest)
  945. # Select the CAT063 version
  946. # One of: Version 1.6 (latest), Version 1.6
  947. # (case-insensitive).
  948. #asterix.i063_version: Version 1.6 (latest)
  949. # Select the CAT065 version
  950. # One of: Version 1.5 (latest), Version 1.5, Version 1.4
  951. # (case-insensitive).
  952. #asterix.i065_version: Version 1.5 (latest)
  953. # Select the CAT240 version
  954. # One of: Version 1.3 (latest), Version 1.3
  955. # (case-insensitive).
  956. #asterix.i240_version: Version 1.3 (latest)
  957. # Select the CAT247 version
  958. # One of: Version 1.3 (latest), Version 1.3, Version 1.2
  959. # (case-insensitive).
  960. #asterix.i247_version: Version 1.3 (latest)
  961. # Force treat packets as DTE (PC) or DCE (Modem) role
  962. # One of: Off, Sent is DTE, Rcvd is DCE, Sent is DCE, Rcvd is DTE
  963. # (case-insensitive).
  964. #at.role: Off
  965. # Autodetection between LANE and SSCOP is hard. As default LANE is preferred
  966. # TRUE or FALSE (case-insensitive)
  967. #atm.dissect_lane_as_sscop: FALSE
  968. # Whether the ATP dissector should reassemble messages spanning multiple DDP packets
  969. # TRUE or FALSE (case-insensitive)
  970. #atp.desegment: TRUE
  971. # Define the standard version that applies to the CBV field
  972. # One of: AUTOSAR 3.0 or 3.1, AUTOSAR 3.2, AUTOSAR 4.0, AUTOSAR 4.1 or newer, AUTOSAR 20-11
  973. # (case-insensitive).
  974. #autosar-nm.cbv_version: AUTOSAR 4.1 or newer
  975. # Make the NM dissector interpret this byte as Control Bit Vector (CBV)
  976. # One of: Byte Position 0, Byte Position 1, Turned off
  977. # (case-insensitive).
  978. #autosar-nm.cbv_position: Byte Position 0
  979. # Make the NM dissector interpret this byte as Source Node Identifier (SNI)
  980. # One of: Byte Position 0, Byte Position 1, Turned off
  981. # (case-insensitive).
  982. #autosar-nm.sni_position: Byte Position 1
  983. # Identifier that is used to filter packets that should be dissected. Set bit 31 when defining an extended id. (works with the mask defined below)
  984. # A hexadecimal number
  985. #autosar-nm.can_id: 0
  986. # Mask applied to CAN identifiers when decoding whether a packet should dissected. Use 0xFFFFFFFF mask to require exact match.
  987. # A hexadecimal number
  988. #autosar-nm.can_id_mask: 0xffffffff
  989. # PDU Transport IDs.
  990. # A string denoting an positive integer range (e.g., "1-20,30-40")
  991. #autosar-nm.pdu_transport.ids:
  992. # I-PDU Multiplexer PDU IDs.
  993. # A string denoting an positive integer range (e.g., "1-20,30-40")
  994. #autosar-nm.ipdum.pdu.id:
  995. # Enable checksum calculation.
  996. # TRUE or FALSE (case-insensitive)
  997. #ax25_kiss.showcksum: FALSE
  998. # Enable decoding of the payload as APRS.
  999. # TRUE or FALSE (case-insensitive)
  1000. #ax25_nol3.showaprs: FALSE
  1001. # Enable decoding of the payload as DX cluster info.
  1002. # TRUE or FALSE (case-insensitive)
  1003. #ax25_nol3.showcluster: FALSE
  1004. # Ethertype used to indicate B.A.T.M.A.N. packet.
  1005. # A hexadecimal number
  1006. #batadv.batmanadv.ethertype: 0x4305
  1007. # Whether the Bazaar dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1008. # TRUE or FALSE (case-insensitive)
  1009. #bzr.desegment: TRUE
  1010. # Specifies that BEEP requires CRLF as a terminator, and not just CR or LF
  1011. # TRUE or FALSE (case-insensitive)
  1012. #beep.strict_header_terminator: TRUE
  1013. # Whether the dissector should also display internal ASN.1 BER details such as Identifier and Length fields
  1014. # TRUE or FALSE (case-insensitive)
  1015. #ber.show_internals: FALSE
  1016. # Whether the dissector should decode unexpected tags as ASN.1 BER encoded data
  1017. # TRUE or FALSE (case-insensitive)
  1018. #ber.decode_unexpected: FALSE
  1019. # Whether the dissector should try decoding OCTET STRINGs as constructed ASN.1 BER encoded data
  1020. # TRUE or FALSE (case-insensitive)
  1021. #ber.decode_octetstring: FALSE
  1022. # Whether the dissector should try decoding unknown primitive as constructed ASN.1 BER encoded data
  1023. # TRUE or FALSE (case-insensitive)
  1024. #ber.decode_primitive: FALSE
  1025. # Whether the dissector should warn if excessive leading zero (0) bits
  1026. # TRUE or FALSE (case-insensitive)
  1027. #ber.warn_too_many_bytes: FALSE
  1028. # Whether the BGP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1029. # TRUE or FALSE (case-insensitive)
  1030. #bgp.desegment: TRUE
  1031. # BGP dissector detect the length of the AS number in AS_PATH attributes automatically or manually (NOTE: Automatic detection is not 100% accurate)
  1032. # One of: Auto-detect, 2 octet, 4 octet
  1033. # (case-insensitive).
  1034. #bgp.asn_len: Auto-detect
  1035. # Whether the Bitcoin dissector should desegment all messages spanning multiple TCP segments
  1036. # TRUE or FALSE (case-insensitive)
  1037. #bitcoin.desegment: TRUE
  1038. # Whether the BitTorrent dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1039. # TRUE or FALSE (case-insensitive)
  1040. #bittorrent.desegment: TRUE
  1041. # Enabling this will tell which BitTorrent client that produced the handshake message
  1042. # TRUE or FALSE (case-insensitive)
  1043. #bittorrent.decode_client: FALSE
  1044. # The maximum size of the buffer for uncompressed messages. If a message is larger than this, then the packet containing the message, as well as subsequent packets, will fail to decompress
  1045. # A decimal number
  1046. #blip.max_uncompressed_size: 64
  1047. # Force decoding stream as A2DP with Content Protection SCMS-T
  1048. # TRUE or FALSE (case-insensitive)
  1049. #bta2dp.a2dp.content_protection.scms_t: FALSE
  1050. # Force decoding stream as A2DP with specified codec
  1051. # One of: Default, SBC, MPEG12 AUDIO, MPEG24 AAC, aptX, aptX HD, LDAC
  1052. # (case-insensitive).
  1053. #bta2dp.a2dp.codec: Default
  1054. # Dissecting the top protocols
  1055. # TRUE or FALSE (case-insensitive)
  1056. #btbnep.bnep.top_dissect: TRUE
  1057. # If "yes" localhost will be treat as Client, "no" as Server
  1058. # One of: Default, Yes, No
  1059. # (case-insensitive).
  1060. #bthcrp.hcrp.force_client: Default
  1061. # L2CAP PSM for Control
  1062. # A decimal number
  1063. #bthcrp.hcrp.control.psm: 0
  1064. # L2CAP PSM for Data
  1065. # A decimal number
  1066. #bthcrp.hcrp.data.psm: 0
  1067. # L2CAP PSM for Notification
  1068. # A decimal number
  1069. #bthcrp.hcrp.notification.psm: 0
  1070. # Force treat packets as AG or HS role
  1071. # One of: Off, Sent is AG, Rcvd is HS, Sent is HS, Rcvd is AG
  1072. # (case-insensitive).
  1073. #bthfp.hfp.hfp_role: Off
  1074. # Show what is deprecated in HID 1.1
  1075. # TRUE or FALSE (case-insensitive)
  1076. #bthid.hid.deprecated: FALSE
  1077. # Force treat packets as AG or HS role
  1078. # One of: Off, Sent is AG, Rcvd is HS, Sent is HS, Rcvd is AG
  1079. # (case-insensitive).
  1080. #bthsp.hsp.hsp_role: Off
  1081. # Detect retransmission based on SN (Sequence Number)
  1082. # TRUE or FALSE (case-insensitive)
  1083. #btle.detect_retransmit: TRUE
  1084. # Turn on/off decode by next rules
  1085. # TRUE or FALSE (case-insensitive)
  1086. #btrfcomm.rfcomm.decode_by.enabled: FALSE
  1087. # Dissecting the top protocols
  1088. # One of: off, Put higher dissectors under this one, On top
  1089. # (case-insensitive).
  1090. #btsap.sap.top_dissect: Put higher dissectors under this one
  1091. # Force decoding stream as VDP with Content Protection SCMS-T
  1092. # TRUE or FALSE (case-insensitive)
  1093. #btvdp.vdp.content_protection.scms_t: FALSE
  1094. # Force decoding stream as VDP with specified codec
  1095. # One of: H263, MPEG4 VSP
  1096. # (case-insensitive).
  1097. #btvdp.vdp.codec: H263
  1098. # Whether the ACL dissector should reassemble fragmented PDUs
  1099. # TRUE or FALSE (case-insensitive)
  1100. #bthci_acl.hci_acl_reassembly: TRUE
  1101. # Whether the ISO dissector should reassemble fragmented PDUs
  1102. # TRUE or FALSE (case-insensitive)
  1103. #bthci_iso.hci_iso_reassembly: TRUE
  1104. # Whether the BMP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1105. # TRUE or FALSE (case-insensitive)
  1106. #bmp.desegment: TRUE
  1107. # If enabled, the blocks will have CRC checks performed.
  1108. # TRUE or FALSE (case-insensitive)
  1109. #bpv7.bp_compute_crc: TRUE
  1110. # Whether the dissector should reassemble fragmented bundle payloads.
  1111. # TRUE or FALSE (case-insensitive)
  1112. #bpv7.bp_reassemble_payload: TRUE
  1113. # When dissecting block type-specific data and payload and no destination matches, attempt heuristic dissection.
  1114. # TRUE or FALSE (case-insensitive)
  1115. #bpv7.bp_payload_try_heur: FALSE
  1116. # The default protocol assumed by the heuristic dissector,which does not easily distinguish between BSSAP (on the GSM A interface between the BSC and the MSC), BSSAP-LE (on the GSM Lb interface between the BSC and the SMLC), and BSAP (on the CDMA2000 A interface between the BS and MSC).
  1117. # One of: BSSAP (GSM A-I/F), BSAP (CDMA2000 A-I/F), BSSAP-LE (GSM Lb-I/F)
  1118. # (case-insensitive).
  1119. #bssap.default_protocol: BSSAP (GSM A-I/F)
  1120. # Make the uTP dissector analyze uTP sequence numbers. Currently this just means that it tries to find the correct start offset of a PDU if it detected that previous in-order packets spanned multiple frames.
  1121. # TRUE or FALSE (case-insensitive)
  1122. #bt-utp.analyze_sequence_numbers: TRUE
  1123. # Whether the dissector should attempt to dissect packets with the obsolete format (version 0) that predates BEP 29 (22-Jun-2009)
  1124. # TRUE or FALSE (case-insensitive)
  1125. #bt-utp.enable_version0: FALSE
  1126. # Maximum receive window size allowed by the dissector. Early clients (and a few modern ones) set this value to 0x380000 (the default), later ones use smaller values like 0x100000 and 0x40000. A higher value can detect nonstandard packets, but at the cost of false positives.
  1127. # A hexadecimal number
  1128. #bt-utp.max_window_size: 0x380000
  1129. # Dissect next layer
  1130. # TRUE or FALSE (case-insensitive)
  1131. #btsnoop.dissect_next_layer: FALSE
  1132. # Whether the C12.22 dissector should reassemble all messages spanning multiple TCP segments
  1133. # TRUE or FALSE (case-insensitive)
  1134. #c1222.desegment: TRUE
  1135. # Base object identifier for use in resolving relative object identifiers
  1136. # A string
  1137. #c1222.baseoid:
  1138. # Whether the C12.22 dissector should verify the crypto for all relevant messages
  1139. # TRUE or FALSE (case-insensitive)
  1140. #c1222.decrypt: TRUE
  1141. # Whether the C12.22 dissector should interpret procedure numbers as big-endian
  1142. # TRUE or FALSE (case-insensitive)
  1143. #c1222.big_endian: FALSE
  1144. # The date format: (DD/MM) or (MM/DD)
  1145. # One of: DD/MM/YYYY, MM/DD/YYYY
  1146. # (case-insensitive).
  1147. #camel.date.format: DD/MM/YYYY
  1148. # TCAP Subsystem numbers used for Camel
  1149. # A string denoting an positive integer range (e.g., "1-20,30-40")
  1150. #camel.tcap.ssn: 146
  1151. # Statistics for Response Time
  1152. # TRUE or FALSE (case-insensitive)
  1153. #camel.persistentsrt: FALSE
  1154. # Whether the CAN ID/flags field should be byte-swapped
  1155. # TRUE or FALSE (case-insensitive)
  1156. #can.byte_swap: FALSE
  1157. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to "decode as"
  1158. # TRUE or FALSE (case-insensitive)
  1159. #can.try_heuristic_first: FALSE
  1160. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to "decode as"
  1161. # TRUE or FALSE (case-insensitive)
  1162. #acf-can.try_heuristic_first: FALSE
  1163. # Enable support of Cisco Wireless Controller (based on old 8 draft revision).
  1164. # TRUE or FALSE (case-insensitive)
  1165. #capwap.draft_8_cisco: FALSE
  1166. # Reassemble fragmented CAPWAP packets.
  1167. # TRUE or FALSE (case-insensitive)
  1168. #capwap.reassemble: TRUE
  1169. # Swap frame control bytes (needed for some APs).
  1170. # TRUE or FALSE (case-insensitive)
  1171. #capwap.swap_fc: TRUE
  1172. # Whether the CAST dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1173. # TRUE or FALSE (case-insensitive)
  1174. #cast.reassembly: TRUE
  1175. # Whether the checksum of all messages should be validated or not
  1176. # TRUE or FALSE (case-insensitive)
  1177. #cattp.checksum: TRUE
  1178. # Specify how the dissector should handle the CCSDS checkword
  1179. # One of: Use header flag, Override header flag to be false, Override header flag to be true
  1180. # (case-insensitive).
  1181. #ccsds.global_pref_checkword: Use header flag
  1182. # Whether or not the RTP header is present in the CES payload.
  1183. # TRUE or FALSE (case-insensitive)
  1184. #cesoeth.rtp_header: FALSE
  1185. # Heuristically determine if an RTP header is present in the CES payload.
  1186. # TRUE or FALSE (case-insensitive)
  1187. #cesoeth.rtp_header_heuristic: TRUE
  1188. # Set the port(s) for NetFlow messages (default: 2055,9996)
  1189. # A string denoting an positive integer range (e.g., "1-20,30-40")
  1190. #cflow.netflow.ports: 2055,9996
  1191. # Set the port(s) for IPFIX messages (default: 4739)
  1192. # A string denoting an positive integer range (e.g., "1-20,30-40")
  1193. #cflow.ipfix.ports: 4739
  1194. # Set the number of fields allowed in a template. Use 0 (zero) for unlimited. (default: 60)
  1195. # A decimal number
  1196. #cflow.max_template_fields: 60
  1197. # Whether the Netflow/Ipfix dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1198. # TRUE or FALSE (case-insensitive)
  1199. #cflow.desegment: TRUE
  1200. # Whether to validate the Frame Check Sequence
  1201. # TRUE or FALSE (case-insensitive)
  1202. #cfp.check_fcs: FALSE
  1203. # The type of CHDLC frame checksum (none, 16-bit, 32-bit)
  1204. # One of: None, 16-Bit, 32-Bit
  1205. # (case-insensitive).
  1206. #chdlc.fcs_type: None
  1207. # The version of CIGI with which to dissect packets
  1208. # One of: From Packet, CIGI 2, CIGI 3
  1209. # (case-insensitive).
  1210. #cigi.version: From Packet
  1211. # The byte order with which to dissect CIGI packets (CIGI3)
  1212. # One of: From Packet, Big-Endian, Little-Endian
  1213. # (case-insensitive).
  1214. #cigi.byte_order: From Packet
  1215. # IPv4 address or hostname of the host
  1216. # A string
  1217. #cigi.host:
  1218. # IPv4 address or hostname of the image generator
  1219. # A string
  1220. #cigi.ig:
  1221. # Whether the CIP dissector should display enhanced/verbose data in the Info column for CIP explicit messages
  1222. # TRUE or FALSE (case-insensitive)
  1223. #cip.enhanced_info_column: TRUE
  1224. # Whether the CIP Motion dissector always display the full raw attribute data bytes
  1225. # TRUE or FALSE (case-insensitive)
  1226. #cipm.display_full_attribute_data: FALSE
  1227. # NSAP selector for Transport Protocol (last byte in hex)
  1228. # A hexadecimal number
  1229. #clnp.tp_nsap_selector: 0x21
  1230. # Always try to decode NSDU as transport PDUs
  1231. # TRUE or FALSE (case-insensitive)
  1232. #clnp.always_decode_transport: FALSE
  1233. # Whether segmented CLNP datagrams should be reassembled
  1234. # TRUE or FALSE (case-insensitive)
  1235. #clnp.reassemble: TRUE
  1236. # Whether ATN security label should be decoded
  1237. # TRUE or FALSE (case-insensitive)
  1238. #clnp.decode_atn_options: FALSE
  1239. # Whether the CMP-over-TCP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1240. # TRUE or FALSE (case-insensitive)
  1241. #cmp.desegment: TRUE
  1242. # Decode this TCP port's traffic as CMP-over-HTTP. Set to "0" to disable. Use this if the Content-Type is not set correctly.
  1243. # A decimal number
  1244. #cmp.http_alternate_port: 0
  1245. # Decode this TCP port's traffic as TCP-transport-style CMP-over-HTTP. Set to "0" to disable. Use this if the Content-Type is not set correctly.
  1246. # A decimal number
  1247. #cmp.tcp_style_http_alternate_port: 0
  1248. # Whether to base64-encode the Community ID hash value
  1249. # TRUE or FALSE (case-insensitive)
  1250. #communityid.do_base64: TRUE
  1251. # A 16-bit seed value to add to the hashed data
  1252. # A decimal number
  1253. #communityid.seed: 0
  1254. # Whether the COPS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1255. # TRUE or FALSE (case-insensitive)
  1256. #cops.desegment: TRUE
  1257. # Decode the COPS messages using PacketCable clients. (Select port 2126)
  1258. # TRUE or FALSE (case-insensitive)
  1259. #cops.packetcable: TRUE
  1260. # Semicolon-separated list of keys for decryption(e.g. key1;key2;...
  1261. # A string
  1262. #corosync_totemnet.private_keys:
  1263. # Whether segmented COTP datagrams should be reassembled. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1264. # TRUE or FALSE (case-insensitive)
  1265. #cotp.reassemble: TRUE
  1266. # How TSAPs should be displayed
  1267. # One of: As strings if printable, As strings, As bytes
  1268. # (case-insensitive).
  1269. #cotp.tsap_display: As strings if printable
  1270. # Whether to decode OSI TPDUs with ATN (Aeronautical Telecommunications Network) extensions. To use this option, you must also enable "Always try to decode NSDU as transport PDUs" in the CLNP protocol settings.
  1271. # TRUE or FALSE (case-insensitive)
  1272. #cotp.decode_atn: FALSE
  1273. # Whether the Couchbase dissector should reassemble PDUs spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1274. # TRUE or FALSE (case-insensitive)
  1275. #couchbase.desegment_pdus: TRUE
  1276. # The port used for communicating with the data service via SSL/TLS
  1277. # A decimal number
  1278. #couchbase.tls.port: 11207
  1279. # Whether the SEL Protocol dissector should automatically pre-process Telnet data to remove IAC bytes
  1280. # TRUE or FALSE (case-insensitive)
  1281. #cp2179.telnetclean: TRUE
  1282. # Set the port for InstanceToInstance messages (if other than the default of 5001)
  1283. # A decimal number
  1284. #cpfi.udp.port2: 5001
  1285. # Control the way the '-->' is displayed. When enabled, keeps the 'lowest valued' endpoint of the src-dest pair on the left, and the arrow moves to distinguish source from dest. When disabled, keeps the arrow pointing right so the source of the frame is always on the left.
  1286. # TRUE or FALSE (case-insensitive)
  1287. #cpfi.arrow_ctl: TRUE
  1288. # Show not dissected data on new Packet Bytes pane
  1289. # TRUE or FALSE (case-insensitive)
  1290. #data.datapref.newpane: FALSE
  1291. # Try to uncompress zlib compressed data and show as uncompressed if successful
  1292. # TRUE or FALSE (case-insensitive)
  1293. #data.uncompress_data: FALSE
  1294. # Show data as text in the Packet Details pane
  1295. # TRUE or FALSE (case-insensitive)
  1296. #data.show_as_text: FALSE
  1297. # Whether or not MD5 hashes should be generated and shown for each payload.
  1298. # TRUE or FALSE (case-insensitive)
  1299. #data.md5_hash: FALSE
  1300. # Whether the LAN sync dissector should reassemble PDUs spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1301. # TRUE or FALSE (case-insensitive)
  1302. #db-lsp.desegment_pdus: TRUE
  1303. # Try to decode the payload using an heuristic sub-dissector
  1304. # TRUE or FALSE (case-insensitive)
  1305. #db-lsp.try_heuristic: TRUE
  1306. # Whether the DCCP summary line should be shown in the protocol tree
  1307. # TRUE or FALSE (case-insensitive)
  1308. #dccp.summary_in_tree: TRUE
  1309. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port
  1310. # TRUE or FALSE (case-insensitive)
  1311. #dccp.try_heuristic_first: FALSE
  1312. # Whether to check the validity of the DCCP checksum
  1313. # TRUE or FALSE (case-insensitive)
  1314. #dccp.check_checksum: TRUE
  1315. # Make the DCCP dissector use relative sequence numbers instead of absolute ones.
  1316. # TRUE or FALSE (case-insensitive)
  1317. #dccp.relative_sequence_numbers: TRUE
  1318. # Whether the DCE/RPC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1319. # TRUE or FALSE (case-insensitive)
  1320. #dcerpc.desegment_dcerpc: TRUE
  1321. # Whether the DCE/RPC dissector should reassemble fragmented DCE/RPC PDUs
  1322. # TRUE or FALSE (case-insensitive)
  1323. #dcerpc.reassemble_dcerpc: TRUE
  1324. # Display some DCOM unmarshalled fields usually hidden
  1325. # TRUE or FALSE (case-insensitive)
  1326. #dcom.display_unmarshalling_details: FALSE
  1327. # If a payload looks like it's embedded in an IP primitive message, and there is a Wireshark dissector matching the DCT2000 protocol name, try parsing the payload using that dissector
  1328. # TRUE or FALSE (case-insensitive)
  1329. #dct2000.ipprim_heuristic: TRUE
  1330. # If a payload looks like it's embedded in an SCTP primitive message, and there is a Wireshark dissector matching the DCT2000 protocol name, try parsing the payload using that dissector
  1331. # TRUE or FALSE (case-insensitive)
  1332. #dct2000.sctpprim_heuristic: TRUE
  1333. # When set, attempt to decode LTE RRC frames. Note that this won't affect other protocols that also call the LTE RRC dissector
  1334. # TRUE or FALSE (case-insensitive)
  1335. #dct2000.decode_lte_rrc: TRUE
  1336. # When set, look for formatted messages indicating specific events. This may be quite slow, so should be disabled if LTE MAC is not being analysed
  1337. # TRUE or FALSE (case-insensitive)
  1338. #dct2000.decode_mac_lte_oob_messages: TRUE
  1339. # When set, look for some older protocol names so thatthey may be matched with wireshark dissectors.
  1340. # TRUE or FALSE (case-insensitive)
  1341. #dct2000.convert_old_protocol_names: FALSE
  1342. # When set, if there is a Wireshark dissector matching the protocol name, it will parse the PDU using that dissector. This may be slow, so should be disabled unless you are using this feature.
  1343. # TRUE or FALSE (case-insensitive)
  1344. #dct2000.use_protocol_name_as_dissector_name: FALSE
  1345. # Novell Servers option 85 can be configured as a string instead of address
  1346. # TRUE or FALSE (case-insensitive)
  1347. #dhcp.novellserverstring: FALSE
  1348. # The PacketCable CCC protocol version
  1349. # One of: PKT-SP-PROV-I05-021127, IETF Draft 5, RFC 3495
  1350. # (case-insensitive).
  1351. #dhcp.pkt.ccc.protocol_version: RFC 3495
  1352. # Option Number for PacketCable CableLabs Client Configuration
  1353. # A decimal number
  1354. #dhcp.pkt.ccc.option: 122
  1355. # Endianness applied to UUID fields
  1356. # One of: Little Endian, Big Endian
  1357. # (case-insensitive).
  1358. #dhcp.uuid.endian: Little Endian
  1359. # Whether the DHCP failover dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1360. # TRUE or FALSE (case-insensitive)
  1361. #dhcpfo.desegment: TRUE
  1362. # Whether Option 18 is dissected as CableLab or RFC 3315
  1363. # TRUE or FALSE (case-insensitive)
  1364. #dhcpv6.cablelabs_interface_id: FALSE
  1365. # Whether the Bulk Leasequery dissector should desegment all messages spanning multiple TCP segments
  1366. # TRUE or FALSE (case-insensitive)
  1367. #dhcpv6.bulk_leasequery.desegment: TRUE
  1368. # Whether the Diameter dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1369. # TRUE or FALSE (case-insensitive)
  1370. #diameter.desegment: TRUE
  1371. # Create DICOM File Meta Header according to PS 3.10 on export for PDUs. If the captured PDV does not contain a SOP Class UID and SOP Instance UID (e.g. for command PDVs), wireshark specific ones will be created.
  1372. # TRUE or FALSE (case-insensitive)
  1373. #dicom.export_header: TRUE
  1374. # Do not show items below this size in the export list. Set it to 0, to see DICOM commands and responses in the list. Set it higher, to just export DICOM IODs (i.e. CT Images, RT Structures).
  1375. # A decimal number
  1376. #dicom.export_minsize: 4096
  1377. # Create a node for sequences and items, and show children in a hierarchy. De-select this option, if you prefer a flat display or e.g. when using TShark to create a text output.
  1378. # TRUE or FALSE (case-insensitive)
  1379. #dicom.seq_tree: TRUE
  1380. # Create a node for a tag and show tag details as single elements. This can be useful to debug a tag and to allow display filters on these attributes. When using TShark to create a text output, it's better to have it disabled.
  1381. # TRUE or FALSE (case-insensitive)
  1382. #dicom.tag_tree: FALSE
  1383. # Show message ID and number of completed, remaining, warned or failed operations in header and info column.
  1384. # TRUE or FALSE (case-insensitive)
  1385. #dicom.cmd_details: TRUE
  1386. # Decode all DICOM tags in the last PDV. This will ensure the proper reassembly. De-select, to troubleshoot PDU length issues, or to understand PDV fragmentation. When not set, the decoding may fail and the exports may become corrupt.
  1387. # TRUE or FALSE (case-insensitive)
  1388. #dicom.pdv_reassemble: TRUE
  1389. # Whether the DISTCC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1390. # TRUE or FALSE (case-insensitive)
  1391. #distcc.desegment_distcc_over_tcp: TRUE
  1392. # Whether DJIUAV should reassemble messages spanning multiple TCP segments (required to get useful results)
  1393. # TRUE or FALSE (case-insensitive)
  1394. #djiuav.desegment: TRUE
  1395. # Whether the DLEP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1396. # TRUE or FALSE (case-insensitive)
  1397. #dlep.desegment: TRUE
  1398. # Select the type of decoding for nationally-defined values
  1399. # One of: None (raw data), As for regular, Thales XOmail
  1400. # (case-insensitive).
  1401. #dmp.national_decode: As for regular
  1402. # Select the nation of sending server. This is used when presenting security classification values in messages with security policy set to National (nation of local server)
  1403. # One of: None, Albania, Armenia, Austria, Azerbaijan, Belarus, Belgium, Bosnia and Hercegowina, Bulgaria, Canada, Croatia, Czech Republic, Denmark, Estonia, Euro-Atlantic Partnership Council (EAPC), European Union (EU), Finland, Former Yugoslav Republic of Macedonia, France, Georgia, Germany, Greece, Hungary, Iceland, International Security Assistance Force (ISAF), Ireland, Italy, Kazakhstan, Kyrgyztan, Latvia, Lithuania, Luxembourg, Malta, Moldova, Montenegro, Netherlands, Norway, Partnership for Peace (PfP), Poland, Portugal, Romania, Russian Federation, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Tajikistan, Turkey, Turkmenistan, United Kingdom, United States, Ukraine, Uzbekistan, Western European Union (WEU)
  1404. # (case-insensitive).
  1405. #dmp.local_nation: None
  1406. # Calculate sequence/acknowledgement analysis
  1407. # TRUE or FALSE (case-insensitive)
  1408. #dmp.seq_ack_analysis: TRUE
  1409. # Align identifiers in info list (does not align when retransmission or duplicate acknowledgement indication)
  1410. # TRUE or FALSE (case-insensitive)
  1411. #dmp.align_ids: FALSE
  1412. # The way DMX values are displayed
  1413. # One of: Percent, Hexadecimal, Decimal
  1414. # (case-insensitive).
  1415. #dmx_chan.dmx_disp_chan_val_type: Percent
  1416. # The way DMX channel numbers are displayed
  1417. # One of: Hexadecimal, Decimal
  1418. # (case-insensitive).
  1419. #dmx_chan.dmx_disp_chan_nr_type: Hexadecimal
  1420. # The number of columns for the DMX display
  1421. # One of: 6, 10, 12, 16, 24
  1422. # (case-insensitive).
  1423. #dmx_chan.dmx_disp_col_count: 16
  1424. # Whether the DNP3 dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1425. # TRUE or FALSE (case-insensitive)
  1426. #dnp3.desegment: TRUE
  1427. # Whether the DNS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1428. # TRUE or FALSE (case-insensitive)
  1429. #dns.desegment_dns_messages: TRUE
  1430. # Number of seconds allowed between DNS requests with the same transaction ID to consider it a retransmission. Otherwise its considered a new request.
  1431. # A decimal number
  1432. #dns.retransmission_timer: 5
  1433. # Whether or not to validate the Header Check Sequence
  1434. # TRUE or FALSE (case-insensitive)
  1435. #docsis.check_fcs: TRUE
  1436. # Whether or not to attempt to dissect encrypted DOCSIS payload
  1437. # TRUE or FALSE (case-insensitive)
  1438. #docsis.dissect_encrypted_frames: FALSE
  1439. # Specifies that decryption should be attempted on all packets, even if the session initialization wasn't captured.
  1440. # TRUE or FALSE (case-insensitive)
  1441. #dof.custom_dof_decrypt_all: FALSE
  1442. # Specifies that operations should be tracked across multiple packets, providing summary lists. This takes time and memory.
  1443. # TRUE or FALSE (case-insensitive)
  1444. #dof.custom_dof_track_operations: FALSE
  1445. # Limits the number of operations shown before and after the current operations
  1446. # A decimal number
  1447. #dof.custom_dof_track_operations_window: 5
  1448. # Should the dissector hide the names for addresses?
  1449. # TRUE or FALSE (case-insensitive)
  1450. #doip.hide_address_name_entries: TRUE
  1451. # Whether the DRDA dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1452. # TRUE or FALSE (case-insensitive)
  1453. #drda.desegment: TRUE
  1454. # Whether the DSI dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1455. # TRUE or FALSE (case-insensitive)
  1456. #dsi.desegment: TRUE
  1457. # redirect dtls debug to file name; leave empty to disable debug, use "-" to redirect output to stderr
  1458. #
  1459. # A path to a file
  1460. #dtls.debug_file:
  1461. # Default client Connection ID length used when the Client Handshake message is missing
  1462. # A decimal number
  1463. #dtls.client_cid_length: 0
  1464. # Default server Connection ID length used when the Server Handshake message is missing
  1465. # A decimal number
  1466. #dtls.server_cid_length: 0
  1467. # Pre-Shared Key as HEX string. Should be 0 to 16 bytes.
  1468. # A string
  1469. #dtls.psk:
  1470. # SAC Encryption Key (16 hex bytes)
  1471. # A string
  1472. #dvb-ci.sek:
  1473. # SAC Init Vector (16 hex bytes)
  1474. # A string
  1475. #dvb-ci.siv:
  1476. # Dissect the content of messages transmitted on the Low-Speed Communication resource. This requires a dissector for the protocol and target port contained in the connection descriptor.
  1477. # TRUE or FALSE (case-insensitive)
  1478. #dvb-ci.dissect_lsc_msg: FALSE
  1479. # Check this to enable full protocol dissection of data above BBHeader
  1480. # TRUE or FALSE (case-insensitive)
  1481. #dvb-s2_modeadapt.decode_df: FALSE
  1482. # Check this to enable full protocol dissection of data above GSE Layer
  1483. # TRUE or FALSE (case-insensitive)
  1484. #dvb-s2_modeadapt.full_decode: FALSE
  1485. # The preferred Mode Adaptation Interface
  1486. # One of: L.1 (0 bytes), L.2 (2 bytes including sync), L.3 (4 bytes including sync), L.4 (3 bytes)
  1487. # (case-insensitive).
  1488. #dvb-s2_modeadapt.default_modeadapt: L.3 (4 bytes including sync)
  1489. # Try all supported Mode Adaptation Interface Types, using the preferred value in the case of ambiguity; if unset, only look for Base Band Frames with the preferred type
  1490. # TRUE or FALSE (case-insensitive)
  1491. #dvb-s2_modeadapt.try_all_modeadapt: TRUE
  1492. # defines the RCS protocol version used in table dissection
  1493. # One of: RCS protocol, RCS2 protocol
  1494. # (case-insensitive).
  1495. #dvb-s2_table.rcs_protocol: RCS2 protocol
  1496. # Allow only packets with Major=0x03//Minor=0xFF as DVMRP V3 packets
  1497. # TRUE or FALSE (case-insensitive)
  1498. #dvmrp.strict_v3: FALSE
  1499. # Decode the Message Types according to eCPRI Specification V1.2
  1500. # TRUE or FALSE (case-insensitive)
  1501. #ecpri.ecpripref.msg.decoding: TRUE
  1502. # Whether the eDonkey dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1503. # TRUE or FALSE (case-insensitive)
  1504. #edonkey.desegment: TRUE
  1505. # Whether the EtherNet/IP dissector should desegment all messages spanning multiple TCP segments
  1506. # TRUE or FALSE (case-insensitive)
  1507. #enip.desegment: TRUE
  1508. # Determines whether all I/O connections will assume a 32-bit header in the O->T direction
  1509. # TRUE or FALSE (case-insensitive)
  1510. #enip.o2t_run_idle: TRUE
  1511. # Determines whether all I/O connections will assume a 32-bit header in the T->O direction
  1512. # TRUE or FALSE (case-insensitive)
  1513. #enip.t2o_run_idle: FALSE
  1514. # The way DMX values are displayed
  1515. # One of: Percent, Hexadecimal, Decimal
  1516. # (case-insensitive).
  1517. #enttec.dmx_disp_chan_val_type: Percent
  1518. # The way DMX channel numbers are displayed
  1519. # One of: Hexadecimal, Decimal
  1520. # (case-insensitive).
  1521. #enttec.dmx_disp_chan_nr_type: Hexadecimal
  1522. # The number of columns for the DMX display
  1523. # One of: 6, 10, 12, 16, 24
  1524. # (case-insensitive).
  1525. #enttec.dmx_disp_col_count: 16
  1526. # If you are capturing in networks with multiplexed or slow nodes, this can be useful
  1527. # TRUE or FALSE (case-insensitive)
  1528. #epl.show_soc_flags: FALSE
  1529. # For analysis purposes one might want to show the command layer even if the dissector assumes a duplicated frame
  1530. # TRUE or FALSE (case-insensitive)
  1531. #epl.show_duplicated_command_layer: FALSE
  1532. # For analysis purposes one might want to see how long the current mapping has been active for and what OD write caused it
  1533. # TRUE or FALSE (case-insensitive)
  1534. #epl.show_pdo_meta_info: FALSE
  1535. # Partition PDOs according to ObjectMappings sent via SDO
  1536. # TRUE or FALSE (case-insensitive)
  1537. #epl.use_sdo_mappings: TRUE
  1538. # If you want to parse the defaultValue (XDD) and actualValue (XDC) attributes for ObjectMappings in order to detect default PDO mappings, which may not be sent over SDO
  1539. # TRUE or FALSE (case-insensitive)
  1540. #epl.use_xdc_mappings: TRUE
  1541. # If a data field has untyped data under 8 byte long, interpret it as unsigned little endian integer and show decimal and hexadecimal representation thereof. Otherwise use stock data dissector
  1542. # TRUE or FALSE (case-insensitive)
  1543. #epl.interpret_untyped_as_le: TRUE
  1544. # If you have a capture without IdentResponse and many nodes, it's easier to set a default profile here than to add entries for all MAC address or Node IDs
  1545. # A path to a file
  1546. #epl.default_profile:
  1547. # Protocol encapsulated in HDLC records
  1548. # One of: Cisco HDLC, PPP serial, Frame Relay, SS7 MTP2, Attempt to guess
  1549. # (case-insensitive).
  1550. #erf.hdlc_type: Attempt to guess
  1551. # Whether raw ATM cells should be treated as the first cell of an AAL5 PDU
  1552. # TRUE or FALSE (case-insensitive)
  1553. #erf.rawcell_first: FALSE
  1554. # Protocol encapsulated in ATM AAL5 packets
  1555. # One of: Attempt to guess, LLC multiplexed, Unspecified
  1556. # (case-insensitive).
  1557. #erf.aal5_type: Attempt to guess
  1558. # The packets contain the optional Incremental Redundancy (IR) fields
  1559. # TRUE or FALSE (case-insensitive)
  1560. #gsm_abis_pgsl.ir: FALSE
  1561. # This is done only if the Decoding is not SET or the packet does not belong to a SA. Tries ICV lengths of 12, 16, 24, and 32 bytes, checks for valid padding, and attempts to decode based on the derived Next Header field. Does not detect ENCR_NULL_AUTH_AES_GMAC (i.e. assumes 0 length IV)
  1562. # TRUE or FALSE (case-insensitive)
  1563. #esp.enable_null_encryption_decode_heuristic: FALSE
  1564. # Check that successive frames increase sequence number by 1 within an SPI. This should work OK when only one host is sending frames on an SPI
  1565. # TRUE or FALSE (case-insensitive)
  1566. #esp.do_esp_sequence_analysis: TRUE
  1567. # Attempt to decode based on the SAD described hereafter.
  1568. # TRUE or FALSE (case-insensitive)
  1569. #esp.enable_encryption_decode: FALSE
  1570. # Attempt to Check ESP Authentication based on the SAD described hereafter.
  1571. # TRUE or FALSE (case-insensitive)
  1572. #esp.enable_authentication_check: FALSE
  1573. # Whether the E-Tag summary line should be shown in the protocol tree
  1574. # TRUE or FALSE (case-insensitive)
  1575. #etag.summary_in_tree: TRUE
  1576. # Place the hash/symbol files (generated by the Apache Etch compiler) ending with .ewh here
  1577. # A path to a directory
  1578. #etch.file:
  1579. # Some devices add trailing data to frames. Depending on where this device exists in the network, padding could be added to short frames before the additional trailer. This option determines how that padding will be detected.
  1580. #
  1581. # Never - Don't detect any padding. Any bytes after the ethernet payload will be considered trailer.
  1582. # Zeros (default) - Consecutive bytes of zeros up to the minimum ethernet frame size will be treated as padding. Additional bytes will be considered trailer.
  1583. # Any - Any bytes after the payload up to the minimum ethernet frame size will be treated as padding. Additional bytes will be considered trailer.
  1584. # One of: Never, Zeros, Any
  1585. # (case-insensitive).
  1586. #eth.padding: Zeros
  1587. # Some TAPs add a fixed length ethernet trailer at the end of the frame, but before the (optional) FCS. Make sure it gets interpreted correctly.
  1588. # A decimal number
  1589. #eth.trailer_length: 0
  1590. # Some Ethernet adapters and drivers include the FCS at the end of a packet, others do not. Some capture file formats and protocols do not indicate whether or not the FCS is included. The Ethernet dissector then attempts to guess whether a captured packet has an FCS, but it cannot always guess correctly. This option can override that heuristic and assume that the FCS is either never or always present in such cases.
  1591. # One of: According to heuristic, Never, Always
  1592. # (case-insensitive).
  1593. #eth.fcs: According to heuristic
  1594. # Whether to validate the Frame Check Sequence
  1595. # TRUE or FALSE (case-insensitive)
  1596. #eth.check_fcs: FALSE
  1597. # Whether packets should be interpreted as coming from CheckPoint FireWall-1 monitor file if they look as if they do
  1598. # TRUE or FALSE (case-insensitive)
  1599. #eth.interpret_as_fw1_monitor: FALSE
  1600. # When capturing on a Cisco FEX some frames start with an extra destination mac
  1601. # TRUE or FALSE (case-insensitive)
  1602. #eth.deduplicate_dmac: FALSE
  1603. # Set the condition that must be true for the CCSDS dissector to be called
  1604. # TRUE or FALSE (case-insensitive)
  1605. #eth.ccsds_heuristic_length: FALSE
  1606. # Set the condition that must be true for the CCSDS dissector to be called
  1607. # TRUE or FALSE (case-insensitive)
  1608. #eth.ccsds_heuristic_version: FALSE
  1609. # Set the condition that must be true for the CCSDS dissector to be called
  1610. # TRUE or FALSE (case-insensitive)
  1611. #eth.ccsds_heuristic_header: FALSE
  1612. # Set the condition that must be true for the CCSDS dissector to be called
  1613. # TRUE or FALSE (case-insensitive)
  1614. #eth.ccsds_heuristic_bit: FALSE
  1615. # Whether the EVRC dissector should process payload type 60 as legacy EVRC packets
  1616. # TRUE or FALSE (case-insensitive)
  1617. #evrc.legacy_pt_60: FALSE
  1618. # Decode payload assuming that Header-Full format only is used
  1619. # TRUE or FALSE (case-insensitive)
  1620. #evs.hf_only: FALSE
  1621. # Controls the display of the session's username in the info column. This is only displayed if the packet containing it was seen during this capture session.
  1622. # TRUE or FALSE (case-insensitive)
  1623. #exec.info_show_username: TRUE
  1624. # Controls the display of the command being run on the server by this session in the info column. This is only displayed if the packet containing it was seen during this capture session.
  1625. # TRUE or FALSE (case-insensitive)
  1626. #exec.info_show_command: FALSE
  1627. # In a few cases a short ethernet frame will be padded with non-zerobytes. If this happens, an f5ethtrailer will not be found.Enabling this will step through each byte of the ethernet trailerto try and find the start of an f5ethtrailer
  1628. # TRUE or FALSE (case-insensitive)
  1629. #f5ethtrailer.pref_walk_trailer: FALSE
  1630. # Disable this if you do not want this dissector to populate well-known fields in other dissectors (i.e. ip.addr, ipv6.addr, tcp.port and udp.port). Enabling this will allow filters that reference those fields to also find data in the trailers but will reduce performance. After disabling, you should restart Wireshark to get performance back.
  1631. # TRUE or FALSE (case-insensitive)
  1632. #f5ethtrailer.pref_pop_other_fields: FALSE
  1633. # Enabling this will perform analysis of the trailer data. It will enable taps on other protocols and slow down Wireshark.
  1634. # TRUE or FALSE (case-insensitive)
  1635. #f5ethtrailer.perform_analysis: FALSE
  1636. # In/out only removes slot/tmm information. Brief shortens the string to >S/T (for in) or <S/T (for out). See "Brief in/out characters" below.
  1637. # One of: None, Full, In/out only, Brief, Brief in/out only
  1638. # (case-insensitive).
  1639. #f5ethtrailer.info_type: Full
  1640. # A string specifying the characters to use to represent "in" and "out" in the brief summary. The default is "><" ('>' for in and '<' for out). If this is not set or is less than two characters, the default is used. If it is longer than two characters, the extra characters are ignored.
  1641. # A string
  1642. #f5ethtrailer.brief_inout_chars:
  1643. # If the platform in the F5 FILEINFO packet matches the provided regex, slot information will be displayed in the info column; otherwise, it will not. A reasonable value is "^(A.*|Z101)$". If the regex is empty or there is no platform information in the capture, slot information is always displayed.
  1644. # A string
  1645. #f5ethtrailer.slots_regex:
  1646. # If present, include the RST cause text from the trailer in the "info" column of the packet list pane.
  1647. # TRUE or FALSE (case-insensitive)
  1648. #f5ethtrailer.rstcause_in_info: TRUE
  1649. # If enabled, KEYLOG entries will be added to the TLS decode in the f5ethtrailer protocol tree. It will populate the f5ethtrailer.tls.keylog field.
  1650. # TRUE or FALSE (case-insensitive)
  1651. #f5ethtrailer.generate_keylog: TRUE
  1652. # If enabled, reassembly of multi-frame sequences is done
  1653. # TRUE or FALSE (case-insensitive)
  1654. #fc.reassemble: TRUE
  1655. # This is the size of non-last frames in a multi-frame sequence
  1656. # A decimal number
  1657. #fc.max_frame_size: 1024
  1658. # Whether the FDDI dissector should add 3-byte padding to all captured FDDI packets (useful with e.g. Tru64 UNIX tcpdump)
  1659. # TRUE or FALSE (case-insensitive)
  1660. #fddi.padding: FALSE
  1661. # Whether the FCIP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1662. # TRUE or FALSE (case-insensitive)
  1663. #fcip.desegment: TRUE
  1664. # Port number used for FCIP
  1665. # A decimal number
  1666. #fcip.target_port: 3225
  1667. # Dissect next layer
  1668. # TRUE or FALSE (case-insensitive)
  1669. #file-pcap.dissect_next_layer: FALSE
  1670. # Dissect next layer
  1671. # TRUE or FALSE (case-insensitive)
  1672. #file-pcapng.dissect_next_layer: FALSE
  1673. # Whether the FIX dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1674. # TRUE or FALSE (case-insensitive)
  1675. #fix.desegment: TRUE
  1676. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to "decode as"
  1677. # TRUE or FALSE (case-insensitive)
  1678. #flexray.try_heuristic_first: FALSE
  1679. # With this option display filters for fmp fhandle a RPC call, even if the actual fhandle is only present in one of the packets
  1680. # TRUE or FALSE (case-insensitive)
  1681. #fmp.fhandle_find_both_reqrep: FALSE
  1682. # Decode packets on this sctp port as ForCES
  1683. # A decimal number
  1684. #forces.sctp_high_prio_port: 0
  1685. # Decode packets on this sctp port as ForCES
  1686. # A decimal number
  1687. #forces.sctp_med_prio_port: 0
  1688. # Decode packets on this sctp port as ForCES
  1689. # A decimal number
  1690. #forces.sctp_low_prio_port: 0
  1691. # Show reported release info
  1692. # TRUE or FALSE (case-insensitive)
  1693. #fp.show_release_info: TRUE
  1694. # Call MAC dissector for payloads
  1695. # TRUE or FALSE (case-insensitive)
  1696. #fp.call_mac: TRUE
  1697. # Validate FP payload checksums
  1698. # TRUE or FALSE (case-insensitive)
  1699. #fp.payload_checksum: TRUE
  1700. # Validate FP header checksums
  1701. # TRUE or FALSE (case-insensitive)
  1702. #fp.header_checksum: TRUE
  1703. # For each PCH data frame, Try to show the paging indications bitmap found in the previous frame
  1704. # TRUE or FALSE (case-insensitive)
  1705. #fp.track_paging_indications: TRUE
  1706. # Whether the UID value should be appended in the protocol tree
  1707. # TRUE or FALSE (case-insensitive)
  1708. #fp_mux.uid_in_tree: TRUE
  1709. # Whether to try heuristic FP dissectors for the muxed payloads
  1710. # TRUE or FALSE (case-insensitive)
  1711. #fp_mux.call_heur_fp: TRUE
  1712. # Encapsulation
  1713. # One of: FRF 3.2/Cisco HDLC, GPRS Network Service, Raw Ethernet, LAPB (T1.617a-1994 Annex G)
  1714. # (case-insensitive).
  1715. #fr.encap: FRF 3.2/Cisco HDLC
  1716. # Show offset of frame in capture file
  1717. # TRUE or FALSE (case-insensitive)
  1718. #frame.show_file_off: FALSE
  1719. # Treat all frames as DOCSIS Frames
  1720. # TRUE or FALSE (case-insensitive)
  1721. #frame.force_docsis_encap: FALSE
  1722. # Whether or not MD5 hashes should be generated for each frame, useful for finding duplicate frames.
  1723. # TRUE or FALSE (case-insensitive)
  1724. #frame.generate_md5_hash: FALSE
  1725. # Whether or not an Epoch time entry should be generated for each frame.
  1726. # TRUE or FALSE (case-insensitive)
  1727. #frame.generate_epoch_time: TRUE
  1728. # Whether or not the number of bits in the frame should be shown.
  1729. # TRUE or FALSE (case-insensitive)
  1730. #frame.generate_bits_field: TRUE
  1731. # Whether or not 'packet size limited during capture' message in shown in Info column.
  1732. # TRUE or FALSE (case-insensitive)
  1733. #frame.disable_packet_size_limited_in_summary: FALSE
  1734. # Maximum file size (in megabytes) for export objects (use 0 for unlimited).
  1735. # A decimal number
  1736. #ftp-data.export.maxsize: 0
  1737. # Whether the FireWall-1 summary line should be shown in the protocol tree
  1738. # TRUE or FALSE (case-insensitive)
  1739. #fw1.summary_in_tree: TRUE
  1740. # Whether the Firewall-1 monitor file includes UUID information
  1741. # TRUE or FALSE (case-insensitive)
  1742. #fw1.with_uuid: FALSE
  1743. # Whether the interface list includes the chain position
  1744. # TRUE or FALSE (case-insensitive)
  1745. #fw1.iflist_with_chain: FALSE
  1746. # Whether the Gadu-Gadu dissector should reassemble messages spanning multiple TCP segments.To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1747. # TRUE or FALSE (case-insensitive)
  1748. #gadu-gadu.desegment: TRUE
  1749. # Whether the Gearman dissector should desegment all messages spanning multiple TCP segments
  1750. # TRUE or FALSE (case-insensitive)
  1751. #gearman.desegment: TRUE
  1752. # Whether the GED125 dissector should desegment all messages spanning multiple TCP segments
  1753. # TRUE or FALSE (case-insensitive)
  1754. #ged125.desegment_body: TRUE
  1755. # Whether the GIOP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1756. # TRUE or FALSE (case-insensitive)
  1757. #giop.desegment_giop_messages: TRUE
  1758. # Whether fragmented GIOP messages should be reassembled
  1759. # TRUE or FALSE (case-insensitive)
  1760. #giop.reassemble: TRUE
  1761. # Maximum allowed message size in bytes (default=10485760)
  1762. # A decimal number
  1763. #giop.max_message_size: 10485760
  1764. # File containing stringified IORs, one per line.
  1765. # A path to a file
  1766. #giop.ior_txt: IOR.txt
  1767. # Whether the GIT dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1768. # TRUE or FALSE (case-insensitive)
  1769. #git.desegment: TRUE
  1770. # Whether the Gigamon header summary line should be shown in the protocol tree
  1771. # TRUE or FALSE (case-insensitive)
  1772. #gmhdr.summary_in_tree: TRUE
  1773. # Whether the Gigamon Trailer summary line should be shown in the protocol tree
  1774. # TRUE or FALSE (case-insensitive)
  1775. #gmtrailer.summary_in_tree: TRUE
  1776. # Whether the Gigamon trailer containing HW timestamp, source id and original CRC should be decoded
  1777. # TRUE or FALSE (case-insensitive)
  1778. #gmtrailer.decode_trailer_timestamp: TRUE
  1779. # Make the GeoNetworking dissector analyze GeoNetworking sequence numbers to find and flag duplicate packet (Annex A)
  1780. # TRUE or FALSE (case-insensitive)
  1781. #gnw.analyze_sequence_numbers: TRUE
  1782. # Whether to autodetect the cipher bit (because it might be set on unciphered data)
  1783. # TRUE or FALSE (case-insensitive)
  1784. #llcgprs.autodetect_cipher_bit: FALSE
  1785. # Help for debug...
  1786. # TRUE or FALSE (case-insensitive)
  1787. #gquic.debug.quic: FALSE
  1788. # Normally application/grpc message is protobuf, but sometime the true message is json. If this option in on, we always check whether the message is JSON (body starts with '{' and ends with '}') regardless of grpc_message_type_subdissector_table settings (which dissect grpc message according to content-type).
  1789. # TRUE or FALSE (case-insensitive)
  1790. #grpc.detect_json_automatically: TRUE
  1791. # Embed gRPC messages under HTTP2 (or other) protocol tree items.
  1792. # TRUE or FALSE (case-insensitive)
  1793. #grpc.embedded_under_http2: FALSE
  1794. # Whether the Gryphon dissector should desegment all messages spanning multiple TCP segments
  1795. # TRUE or FALSE (case-insensitive)
  1796. #gryphon.desegment: TRUE
  1797. # No description
  1798. # TRUE or FALSE (case-insensitive)
  1799. #gsm_ipa.hsl_debug_in_root_tree: FALSE
  1800. # No description
  1801. # TRUE or FALSE (case-insensitive)
  1802. #gsm_ipa.hsl_debug_in_info: FALSE
  1803. # Whether to decode NRI in TLLI. NRI is not used if length is zero
  1804. # A decimal number
  1805. #gsm_a.rr.nri_length: 0
  1806. # Whether the dissector should reassemble SMS spanning multiple packets
  1807. # TRUE or FALSE (case-insensitive)
  1808. #gsm_sms.reassemble: TRUE
  1809. # Whether the dissector should take into account info coming from lower layers (like GSM-MAP) to perform SMS reassembly
  1810. # TRUE or FALSE (case-insensitive)
  1811. #gsm_sms.reassemble_with_lower_layers_info: TRUE
  1812. # Always decode a GSM Short Message as Connectionless WSP if a Port Number Information Element is present in the SMS User Data Header.
  1813. # TRUE or FALSE (case-insensitive)
  1814. #gsm_sms_ud.port_number_udh_means_wsp: FALSE
  1815. # Always try subdissection of the 1st fragment of a fragmented GSM Short Message. If reassembly is possible, the Short Message may be dissected twice (once as a short frame, once in its entirety).
  1816. # TRUE or FALSE (case-insensitive)
  1817. #gsm_sms_ud.try_dissect_1st_fragment: FALSE
  1818. # Prevent sub-dissectors from replacing column data with their own. Eg. Prevent WSP dissector overwriting SMPP information.
  1819. # TRUE or FALSE (case-insensitive)
  1820. #gsm_sms_ud.prevent_dissectors_chg_cols: FALSE
  1821. # Treat ARFCN 512-810 as DCS 1800 rather than PCS 1900
  1822. # TRUE or FALSE (case-insensitive)
  1823. #gsm_um.dcs1800: TRUE
  1824. # Dissect Q.931 User-To-User information
  1825. # TRUE or FALSE (case-insensitive)
  1826. #gsm-r-uus1.dissect_q931_u2u: FALSE
  1827. # Dissect GSM-A User-To-User information
  1828. # TRUE or FALSE (case-insensitive)
  1829. #gsm-r-uus1.dissect_gsm_a_u2u: TRUE
  1830. # TCAP Subsystem numbers used for GSM MAP
  1831. # A string denoting an positive integer range (e.g., "1-20,30-40")
  1832. #gsm_map.tcap.ssn: 6-9,145,148-150
  1833. # How to treat Application context
  1834. # One of: Use application context from the trace, Treat as AC 1, Treat as AC 2, Treat as AC 3
  1835. # (case-insensitive).
  1836. #gsm_map.application.context.version: Use application context from the trace
  1837. # When enabled, dissector will use the non 3GPP standard extensions from Ericsson (that can override the standard ones)
  1838. # TRUE or FALSE (case-insensitive)
  1839. #gsm_map.ericsson.proprietary.extensions: FALSE
  1840. # Whether or not to try reassembling GSSAPI blobs spanning multiple (SMB/SessionSetup) PDUs
  1841. # TRUE or FALSE (case-insensitive)
  1842. #gss-api.gssapi_reassembly: TRUE
  1843. # Show GSUP Source/Destination names as text in the Packet Details pane
  1844. # TRUE or FALSE (case-insensitive)
  1845. #gsup.show_name_as_text: TRUE
  1846. # GTPv0 and GTP' port (default 3386)
  1847. # A decimal number
  1848. #gtp.v0_port: 3386
  1849. # GTPv1 and GTPv2 control plane port (default 2123)
  1850. # A decimal number
  1851. #gtp.v1c_port: 2123
  1852. # GTPv1 user plane port (default 2152)
  1853. # A decimal number
  1854. #gtp.v1u_port: 2152
  1855. # Dissect T-PDU as
  1856. # One of: None, TPDU Heuristic, PDCP-LTE, PDCP-NR, SYNC, ETHERNET, Custom
  1857. # (case-insensitive).
  1858. #gtp.dissect_tpdu_as: TPDU Heuristic
  1859. # Request/reply pair matches only if their timestamps are closer than that value, in ms (default 0, i.e. don't use timestamps)
  1860. # A decimal number
  1861. #gtp.pair_max_interval: 0
  1862. # GTP ETSI order
  1863. # TRUE or FALSE (case-insensitive)
  1864. #gtp.check_etsi: FALSE
  1865. # Dissect GTP over TCP
  1866. # TRUE or FALSE (case-insensitive)
  1867. #gtp.dissect_gtp_over_tcp: TRUE
  1868. # Track GTP session
  1869. # TRUE or FALSE (case-insensitive)
  1870. #gtp.track_gtp_session: FALSE
  1871. # Use this setting to decode the Transparent Containers in the SRVCC PS-to-CS messages.
  1872. # This is needed until there's a reliable way to determine the contents of the transparent containers.
  1873. # One of: Don't decode, Assume UTRAN target
  1874. # (case-insensitive).
  1875. #gtpv2.decode_srvcc_p2c_trans_cont_target: Don't decode
  1876. # Request/reply pair matches only if their timestamps are closer than that value, in ms (default 0, i.e. don't use timestamps)
  1877. # A decimal number
  1878. #gtpv2.pair_max_interval: 0
  1879. # H.225 Server TLS Port
  1880. # A decimal number
  1881. #h225.tls.port: 1300
  1882. # Whether the H.225 dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1883. # TRUE or FALSE (case-insensitive)
  1884. #h225.reassembly: TRUE
  1885. # ON - display tunnelled H.245 inside H.225.0 tree, OFF - display tunnelled H.245 in root tree after H.225.0
  1886. # TRUE or FALSE (case-insensitive)
  1887. #h225.h245_in_tree: TRUE
  1888. # ON - display tunnelled protocols inside H.225.0 tree, OFF - display tunnelled protocols in root tree after H.225.0
  1889. # TRUE or FALSE (case-insensitive)
  1890. #h225.tp_in_tree: TRUE
  1891. # Whether the H.245 dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1892. # TRUE or FALSE (case-insensitive)
  1893. #h245.reassembly: TRUE
  1894. # Whether the dissector should show short names or the long names from the standard
  1895. # TRUE or FALSE (case-insensitive)
  1896. #h245.shorttypes: FALSE
  1897. # Whether the dissector should print items of h245 Info column in reversed order
  1898. # TRUE or FALSE (case-insensitive)
  1899. #h245.prepand: FALSE
  1900. # Maintain relationships between transactions and contexts and display an extra tree showing context data
  1901. # TRUE or FALSE (case-insensitive)
  1902. #h248.ctx_info: FALSE
  1903. # Desegment H.248 messages that span more TCP segments
  1904. # TRUE or FALSE (case-insensitive)
  1905. #h248.desegment: TRUE
  1906. # Desegment H.501 messages that span more TCP segments
  1907. # TRUE or FALSE (case-insensitive)
  1908. #h501.desegment: TRUE
  1909. # Whether the HART-IP dissector should desegment all messages spanning multiple TCP segments
  1910. # TRUE or FALSE (case-insensitive)
  1911. #hart_ip.desegment: TRUE
  1912. # Whether the hazel dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1913. # TRUE or FALSE (case-insensitive)
  1914. #hzlcst.desegment: TRUE
  1915. # The ethernet type used for L2 communications
  1916. # A decimal number
  1917. #hcrt.dissector_ethertype: 61522
  1918. # Specifies that the raw text of the HL7 message should be displayed in addition to the dissection tree
  1919. # TRUE or FALSE (case-insensitive)
  1920. #hl7.display_raw: FALSE
  1921. # Specifies that the LLP session information should be displayed (Start/End Of Block) in addition to the dissection tree
  1922. # TRUE or FALSE (case-insensitive)
  1923. #hl7.display_llp: FALSE
  1924. # Whether the HPFEEDS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1925. # TRUE or FALSE (case-insensitive)
  1926. #hpfeeds.desegment_hpfeeds_messages: TRUE
  1927. # Try to decode the payload using an heuristic sub-dissector
  1928. # TRUE or FALSE (case-insensitive)
  1929. #hpfeeds.try_heuristic: TRUE
  1930. # Whether the HTTP dissector should reassemble headers of a request spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1931. # TRUE or FALSE (case-insensitive)
  1932. #http.desegment_headers: TRUE
  1933. # Whether the HTTP dissector should use the "Content-length:" value, if present, to reassemble the body of a request spanning multiple TCP segments, and reassemble chunked data spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  1934. # TRUE or FALSE (case-insensitive)
  1935. #http.desegment_body: TRUE
  1936. # Whether to reassemble bodies of entities that are transferred using the "Transfer-Encoding: chunked" method
  1937. # TRUE or FALSE (case-insensitive)
  1938. #http.dechunk_body: TRUE
  1939. # Whether to uncompress entity bodies that are compressed using "Content-Encoding: "
  1940. # TRUE or FALSE (case-insensitive)
  1941. #http.decompress_body: TRUE
  1942. # SSL/TLS Ports range
  1943. # A string denoting an positive integer range (e.g., "1-20,30-40")
  1944. #http.tls.port: 443
  1945. # The UDP port for RROCE messages (default 4791)
  1946. # A decimal number
  1947. #infiniband.rroce.port: 4791
  1948. # Try to decode a packet using an heuristic sub-dissector before using Decode As
  1949. # TRUE or FALSE (case-insensitive)
  1950. #infiniband.try_heuristic_first: TRUE
  1951. # Maximum number of batch requests allowed
  1952. # A decimal number
  1953. #icep.max_batch_requests: 64
  1954. # Maximum length allowed of an ICEP string
  1955. # A decimal number
  1956. #icep.max_ice_string_len: 512
  1957. # Maximum number of context pairs allowed
  1958. # A decimal number
  1959. #icep.max_ice_context_pairs: 64
  1960. # Whether the 128th and following bytes of the ICMP payload should be decoded as MPLS extensions or as a portion of the original packet
  1961. # TRUE or FALSE (case-insensitive)
  1962. #icmp.favor_icmp_mpls: FALSE
  1963. # Length of the Link Address Field, configurable in '101 and absent in '104
  1964. # One of: 0 octet, 1 octet, 2 octet
  1965. # (case-insensitive).
  1966. #iec60870_101.linkaddr_len: 1 octet
  1967. # Length of the Cause of Transmission Field, configurable in '101 and fixed at 2 octets with '104
  1968. # One of: 1 octet, 2 octet
  1969. # (case-insensitive).
  1970. #iec60870_101.cot_len: 1 octet
  1971. # Length of the Common ASDU Address Field, configurable in '101 and fixed at 2 octets with '104
  1972. # One of: 1 octet, 2 octet
  1973. # (case-insensitive).
  1974. #iec60870_101.asdu_addr_len: 1 octet
  1975. # Length of the Information Object Address Field, configurable in '101 and fixed at 3 octets with '104
  1976. # One of: 1 octet, 2 octet, 3 octet
  1977. # (case-insensitive).
  1978. #iec60870_101.asdu_ioa_len: 2 octet
  1979. # Whether fragmented 802.11 datagrams should be reassembled
  1980. # TRUE or FALSE (case-insensitive)
  1981. #wlan.defragment: TRUE
  1982. # Don't dissect 802.11n draft HT elements (which might contain duplicate information).
  1983. # TRUE or FALSE (case-insensitive)
  1984. #wlan.ignore_draft_ht: FALSE
  1985. # Whether retransmitted 802.11 frames should be subdissected
  1986. # TRUE or FALSE (case-insensitive)
  1987. #wlan.retransmitted: TRUE
  1988. # Some 802.11 cards include the FCS at the end of a packet, others do not.
  1989. # TRUE or FALSE (case-insensitive)
  1990. #wlan.check_fcs: FALSE
  1991. # Whether to validate the FCS checksum or not.
  1992. # TRUE or FALSE (case-insensitive)
  1993. #wlan.check_checksum: FALSE
  1994. # Some 802.11 cards leave the Protection bit set even though the packet is decrypted, and some also leave the IV (initialization vector).
  1995. # One of: No, Yes - without IV, Yes - with IV
  1996. # (case-insensitive).
  1997. #wlan.ignore_wep: No
  1998. # Whether to enable MIC Length override or not.
  1999. # TRUE or FALSE (case-insensitive)
  2000. #wlan.wpa_key_mic_len_enable: FALSE
  2001. # Some Key MIC lengths are greater than 16 bytes, so set the length you require
  2002. # A decimal number
  2003. #wlan.wpa_key_mic_len: 0
  2004. # Treat all WiFi packets as S1G
  2005. # TRUE or FALSE (case-insensitive)
  2006. #wlan.treat_as_s1g: FALSE
  2007. # Enable WEP and WPA/WPA2 decryption
  2008. # TRUE or FALSE (case-insensitive)
  2009. #wlan.enable_decryption: TRUE
  2010. # (Hexadecimal) Ethertype used to indicate IEEE 802.15.4 frame.
  2011. # A hexadecimal number
  2012. #wpan.802154_ethertype: 0x809a
  2013. # The FCS format in the captured payload
  2014. # One of: TI CC24xx metadata, ITU-T CRC-16, ITU-T CRC-32
  2015. # (case-insensitive).
  2016. #wpan.fcs_format: ITU-T CRC-16
  2017. # Dissect payload only if FCS is valid.
  2018. # TRUE or FALSE (case-insensitive)
  2019. #wpan.802154_fcs_ok: TRUE
  2020. # Match frames with ACK request to ACK packets
  2021. # TRUE or FALSE (case-insensitive)
  2022. #wpan.802154_ack_tracking: FALSE
  2023. # Parse assuming 802.15.4e quirks for compatibility
  2024. # TRUE or FALSE (case-insensitive)
  2025. #wpan.802154e_compatibility: FALSE
  2026. # Specifies the security suite to use for 802.15.4-2003 secured frames (only supported suites are listed). Option ignored for 802.15.4-2006 and unsecured frames.
  2027. # One of: AES-128 Encryption, 128-bit Integrity Protection, AES-128 Encryption, 64-bit Integrity Protection, AES-128 Encryption, 32-bit Integrity Protection
  2028. # (case-insensitive).
  2029. #wpan.802154_sec_suite: AES-128 Encryption, 64-bit Integrity Protection
  2030. # Set if the manufacturer extends the authentication data with the security header. Option ignored for 802.15.4-2006 and unsecured frames.
  2031. # TRUE or FALSE (case-insensitive)
  2032. #wpan.802154_extend_auth: TRUE
  2033. # (Hexadecimal) Ethertype used to indicate IEEE 802.1ah tag.
  2034. # A hexadecimal number
  2035. #ieee8021ah.8021ah_ethertype: 0x88e7
  2036. # Whether the iFCP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2037. # TRUE or FALSE (case-insensitive)
  2038. #ifcp.desegment: TRUE
  2039. # Whether the ILP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2040. # TRUE or FALSE (case-insensitive)
  2041. #ilp.desegment_ilp_messages: TRUE
  2042. # Whether to use heuristics for post-STARTTLS detection of encrypted IMAP conversations
  2043. # TRUE or FALSE (case-insensitive)
  2044. #imap.ssl_heuristic: TRUE
  2045. # TCAP Subsystem numbers used for INAP
  2046. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2047. #inap.ssn: 106,241
  2048. # Whether the IPDC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2049. # TRUE or FALSE (case-insensitive)
  2050. #ipdc.desegment_ipdc_messages: TRUE
  2051. # Range of session IDs to be decoded as SAMIS-TYPE-1 records
  2052. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2053. #ipdr.sessions.samis_type_1:
  2054. # Dissect IPMB commands
  2055. # TRUE or FALSE (case-insensitive)
  2056. #ipmi.dissect_bus_commands: FALSE
  2057. # FRU Language Code is English; strings are ASCII+LATIN1 (vs. Unicode)
  2058. # TRUE or FALSE (case-insensitive)
  2059. #ipmi.fru_langcode_is_english: TRUE
  2060. # Do not search for responses coming after this timeout (milliseconds)
  2061. # A decimal number
  2062. #ipmi.response_after_req: 5000
  2063. # Allow for responses before requests (milliseconds)
  2064. # A decimal number
  2065. #ipmi.response_before_req: 0
  2066. # Format of messages embedded into Send/Get/Forward Message
  2067. # One of: None, IPMB, Session-based (LAN, ...), Use heuristics
  2068. # (case-insensitive).
  2069. #ipmi.msgfmt: Use heuristics
  2070. # Selects which OEM format is used for commands that IPMI does not define
  2071. # One of: None, Pigeon Point Systems
  2072. # (case-insensitive).
  2073. #ipmi.selected_oem: None
  2074. # No description
  2075. # TRUE or FALSE (case-insensitive)
  2076. #ippusb.attempt_reassembly: TRUE
  2077. # Whether the IPv4 type-of-service field should be decoded as a Differentiated Services field (see RFC2474/RFC2475)
  2078. # TRUE or FALSE (case-insensitive)
  2079. #ip.decode_tos_as_diffserv: TRUE
  2080. # Whether fragmented IPv4 datagrams should be reassembled
  2081. # TRUE or FALSE (case-insensitive)
  2082. #ip.defragment: TRUE
  2083. # Whether the IPv4 summary line should be shown in the protocol tree
  2084. # TRUE or FALSE (case-insensitive)
  2085. #ip.summary_in_tree: TRUE
  2086. # Whether to validate the IPv4 checksum
  2087. # TRUE or FALSE (case-insensitive)
  2088. #ip.check_checksum: FALSE
  2089. # Whether to correct for TSO-enabled (TCP segmentation offload) hardware captures, such as spoofing the IP packet length
  2090. # TRUE or FALSE (case-insensitive)
  2091. #ip.tso_support: TRUE
  2092. # Whether to look up IP addresses in each MaxMind database we have loaded
  2093. # TRUE or FALSE (case-insensitive)
  2094. #ip.use_geoip: TRUE
  2095. # Whether to interpret the originally reserved flag as security flag
  2096. # TRUE or FALSE (case-insensitive)
  2097. #ip.security_flag: FALSE
  2098. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port
  2099. # TRUE or FALSE (case-insensitive)
  2100. #ip.try_heuristic_first: FALSE
  2101. # Whether fragmented IPv6 datagrams should be reassembled
  2102. # TRUE or FALSE (case-insensitive)
  2103. #ipv6.defragment: TRUE
  2104. # Whether the IPv6 summary line should be shown in the protocol tree
  2105. # TRUE or FALSE (case-insensitive)
  2106. #ipv6.summary_in_tree: TRUE
  2107. # Whether to look up IPv6 addresses in each MaxMind database we have loaded
  2108. # TRUE or FALSE (case-insensitive)
  2109. #ipv6.use_geoip: TRUE
  2110. # Check that all RPL Source Routed packets conform to RFC 6554 and do not visit a node more than once
  2111. # TRUE or FALSE (case-insensitive)
  2112. #ipv6.perform_strict_rpl_srh_rfc_checking: FALSE
  2113. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port
  2114. # TRUE or FALSE (case-insensitive)
  2115. #ipv6.try_heuristic_first: FALSE
  2116. # Whether to display IPv6 extension headers as a separate protocol or a sub-protocol of the IPv6 packet
  2117. # TRUE or FALSE (case-insensitive)
  2118. #ipv6.exthdr_under_root_protocol_tree: FALSE
  2119. # If enabled the Length field in octets will be hidden
  2120. # TRUE or FALSE (case-insensitive)
  2121. #ipv6.exthdr_hide_len_oct_field: FALSE
  2122. # Whether to correct for TSO-enabled (TCP segmentation offload) hardware captures, such as spoofing the IPv6 packet length
  2123. # TRUE or FALSE (case-insensitive)
  2124. #ipv6.tso_support: FALSE
  2125. # The iSCSI protocol version
  2126. # One of: Draft 08, Draft 09, Draft 11, Draft 12, Draft 13
  2127. # (case-insensitive).
  2128. #iscsi.protocol_version: Draft 13
  2129. # Whether the iSCSI dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2130. # TRUE or FALSE (case-insensitive)
  2131. #iscsi.desegment_iscsi_messages: TRUE
  2132. # When enabled, packets that appear bogus are ignored
  2133. # TRUE or FALSE (case-insensitive)
  2134. #iscsi.bogus_pdu_filter: TRUE
  2135. # Ignore packets that haven't set the F bit when they should have
  2136. # TRUE or FALSE (case-insensitive)
  2137. #iscsi.demand_good_f_bit: FALSE
  2138. # Treat packets whose data segment length is greater than this value as bogus
  2139. # A decimal number
  2140. #iscsi.bogus_pdu_max_data_len: 262144
  2141. # Range of iSCSI target ports(default 3260)
  2142. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2143. #iscsi.target_ports: 3260
  2144. # System port number of iSCSI target
  2145. # A decimal number
  2146. #iscsi.target_system_port: 860
  2147. # The protocol running on the D channel
  2148. # One of: LAPD, DPNSS
  2149. # (case-insensitive).
  2150. #isdn.dchannel_protocol: LAPD
  2151. # Range of iSER target ports(default 3260)
  2152. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2153. #iser.target_ports: 3260
  2154. # ISMACryp version
  2155. # One of: ISMACryp v1.1, ISMACryp v2.0
  2156. # (case-insensitive).
  2157. #ismacryp.version: ISMACryp v1.1
  2158. # Indicates whether or not the ISMACryp version deduced from RTP payload type, if present, is used or whether the version above is used
  2159. # TRUE or FALSE (case-insensitive)
  2160. #ismacryp.override_rtp_pt: FALSE
  2161. # Set the length of the IV in the ISMACryp AU Header in bytes
  2162. # A decimal number
  2163. #ismacryp.iv_length: 4
  2164. # Set the length of the Delta IV in the ISMACryp AU Header in bytes
  2165. # A decimal number
  2166. #ismacryp.delta_iv_length: 0
  2167. # Set the length of the Key Indicator in the ISMACryp AU Header in bytes
  2168. # A decimal number
  2169. #ismacryp.key_indicator_length: 0
  2170. # Indicates whether or not the Key Indicator is present in all AU Headers (T/F)
  2171. # TRUE or FALSE (case-insensitive)
  2172. #ismacryp.key_indicator_per_au_flag: FALSE
  2173. # Indicates whether or not selective encryption is enabled (T/F)
  2174. # TRUE or FALSE (case-insensitive)
  2175. #ismacryp.selective_encryption: TRUE
  2176. # Indicates whether or not slice start / end is present (T/F)
  2177. # TRUE or FALSE (case-insensitive)
  2178. #ismacryp.slice_indication: FALSE
  2179. # Indicates whether or not padding information is present (T/F)
  2180. # TRUE or FALSE (case-insensitive)
  2181. #ismacryp.padding_indication: FALSE
  2182. # RFC3640 mode
  2183. # One of: aac-hbr, mpeg4-video, avc-video
  2184. # (case-insensitive).
  2185. #ismacryp.rfc3640_mode: avc-video
  2186. # Indicates use of user mode instead of RFC3640 modes (T/F)
  2187. # TRUE or FALSE (case-insensitive)
  2188. #ismacryp.user_mode: FALSE
  2189. # Set the length of the AU size in the AU Header in bits
  2190. # A decimal number
  2191. #ismacryp.au_size_length: 0
  2192. # Set the length of the AU index in the AU Header in bits
  2193. # A decimal number
  2194. #ismacryp.au_index_length: 0
  2195. # Set the length of the AU delta index in the AU Header in bits
  2196. # A decimal number
  2197. #ismacryp.au_index_delta_length: 0
  2198. # Set the length of the CTS delta field in the AU Header in bits
  2199. # A decimal number
  2200. #ismacryp.cts_delta_length: 0
  2201. # Set the length of the DTS delta field in the AU Header in bits
  2202. # A decimal number
  2203. #ismacryp.dts_delta_length: 0
  2204. # Indicates whether or not the RAP field is present in the AU Header (T/F)
  2205. # TRUE or FALSE (case-insensitive)
  2206. #ismacryp.random_access_indication: FALSE
  2207. # Indicates the number of bits on which the stream state field is encoded in the AU Header (bits)
  2208. # A decimal number
  2209. #ismacryp.stream_state_indication: 0
  2210. # Whether the iSNS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2211. # TRUE or FALSE (case-insensitive)
  2212. #isns.desegment: TRUE
  2213. # FlexRay IDs (combined) - 4bit Bus-ID (0 any), 4bit Channel, 16bit Frame-ID, 8bit Cycle (0xff any)
  2214. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2215. #iso10681.flexray.flexrayids:
  2216. # TP frames are spread over multiple cycles. Cycle is ignored for matching.
  2217. # TRUE or FALSE (case-insensitive)
  2218. #iso10681.spread_over_cycles: TRUE
  2219. # Addressing of ISO 15765. Normal or Extended
  2220. # One of: Normal addressing, Extended addressing
  2221. # (case-insensitive).
  2222. #iso15765.addressing: Normal addressing
  2223. # Window of ISO 15765 fragments
  2224. # A decimal number
  2225. #iso15765.window: 8
  2226. # ISO15765 bound standard CAN IDs
  2227. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2228. #iso15765.can.ids:
  2229. # ISO15765 bound extended CAN IDs
  2230. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2231. #iso15765.can.extended_ids:
  2232. # Handle LIN Diagnostic Frames
  2233. # TRUE or FALSE (case-insensitive)
  2234. #iso15765.lin_diag: TRUE
  2235. # Addressing of FlexRay TP. 1 Byte or 2 Byte
  2236. # One of: 1 byte addressing, 2 byte addressing
  2237. # (case-insensitive).
  2238. #iso15765.flexray_addressing: 1 byte addressing
  2239. # Segment Size Limit for first and consecutive frames of FlexRay (bytes after addresses)
  2240. # A decimal number
  2241. #iso15765.flexray_segment_size_limit: 0
  2242. # I-PduM PDU-IDs
  2243. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2244. #iso15765.ipdum.pdu.id:
  2245. # Addressing of I-PduM TP. 0, 1, or 2 Bytes
  2246. # One of: 0 byte addressing, 1 byte addressing, 2 byte addressing
  2247. # (case-insensitive).
  2248. #iso15765.ipdum_addressing: 0 byte addressing
  2249. # Endian of the length field. Big endian or Little endian
  2250. # One of: Big endian, Little endian
  2251. # (case-insensitive).
  2252. #iso8583.len_endian: Little endian
  2253. # charset for numbers
  2254. # One of: Digits represented as ASCII Characters, Digits represented in nibbles
  2255. # (case-insensitive).
  2256. #iso8583.charset: Digits represented as ASCII Characters
  2257. # binary data representation
  2258. # One of: Bin data represented as Hex Ascii characters, Bin data not encoded
  2259. # (case-insensitive).
  2260. #iso8583.binencode: Bin data represented as Hex Ascii characters
  2261. # File containing a translation from object ID to string
  2262. # A path to a file
  2263. #isobus.vt.object_ids:
  2264. # Note national variants may not be fully supported
  2265. # One of: ITU Standard, French National Standard, Israeli National Standard, Russian National Standard, Japan National Standard, Japan National Standard (TTC)
  2266. # (case-insensitive).
  2267. #isup.variant: ITU Standard
  2268. # Show the CIC value (in addition to the message type) in the Info column
  2269. # TRUE or FALSE (case-insensitive)
  2270. #isup.show_cic_in_info: TRUE
  2271. # Whether APM messages datagrams should be reassembled
  2272. # TRUE or FALSE (case-insensitive)
  2273. #isup.defragment_apm: TRUE
  2274. # The MPLS label (aka Flow Bundle ID) used by ITDM traffic.
  2275. # A hexadecimal number
  2276. #itdm.mpls_label: 0x99887
  2277. # Flow Number used by I-TDM Control Protocol traffic.
  2278. # A decimal number
  2279. #itdm.ctl_flowno: 0
  2280. # Support Implementers Guide (version 01)
  2281. # TRUE or FALSE (case-insensitive)
  2282. #iua.support_ig: FALSE
  2283. # Use SAPI values as specified in TS 48 056
  2284. # TRUE or FALSE (case-insensitive)
  2285. #iua.use_gsm_sapi_values: TRUE
  2286. # Whether IuUP Payload bits should be dissected
  2287. # TRUE or FALSE (case-insensitive)
  2288. #iuup.dissect_payload: FALSE
  2289. # The payload contains a two byte pseudoheader indicating direction and circuit_id
  2290. # TRUE or FALSE (case-insensitive)
  2291. #iuup.two_byte_pseudoheader: FALSE
  2292. # Whether the iWarp RDMA dissector should reassemble Send fragmented payloads
  2293. # TRUE or FALSE (case-insensitive)
  2294. #iwarp_ddp_rdmap.reassemble_iwarp_rdma_send: TRUE
  2295. # Whether the trailer summary line should be shown in the protocol tree
  2296. # TRUE or FALSE (case-insensitive)
  2297. #ixiatrailer.summary_in_tree: TRUE
  2298. # Display JSON like in browsers devtool
  2299. # TRUE or FALSE (case-insensitive)
  2300. #json.compact_form: FALSE
  2301. # Leading bytes will be ignored until first '[' or '{' is found.
  2302. # TRUE or FALSE (case-insensitive)
  2303. #json.ignore_leading_bytes: FALSE
  2304. # Hide extended path based filtering
  2305. # TRUE or FALSE (case-insensitive)
  2306. #json.hide_extended_path_based_filtering: FALSE
  2307. # Enable to have correctly typed MIME media dissected as JXTA Messages.
  2308. # TRUE or FALSE (case-insensitive)
  2309. #jxta.msg.mediatype: TRUE
  2310. # Whether the JXTA dissector should reassemble messages spanning multiple UDP/TCP/SCTP segments. To use this option you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings and enable "Reassemble fragmented IP datagrams" in the IP protocol settings.
  2311. # TRUE or FALSE (case-insensitive)
  2312. #jxta.desegment: TRUE
  2313. # No description
  2314. # TRUE or FALSE (case-insensitive)
  2315. #kafka.show_string_bytes_lengths: FALSE
  2316. # Keyring.XML file (exported from ETS)
  2317. # A path to a file
  2318. #kip.key_file:
  2319. # Keyring password
  2320. # A string
  2321. #kip.key_file_pwd:
  2322. # Output file (- for stdout) for keys extracted from key file
  2323. # A path to a file
  2324. #kip.key_info_file:
  2325. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2326. # A string
  2327. #kip.key_1:
  2328. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2329. # A string
  2330. #kip.key_2:
  2331. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2332. # A string
  2333. #kip.key_3:
  2334. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2335. # A string
  2336. #kip.key_4:
  2337. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2338. # A string
  2339. #kip.key_5:
  2340. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2341. # A string
  2342. #kip.key_6:
  2343. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2344. # A string
  2345. #kip.key_7:
  2346. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2347. # A string
  2348. #kip.key_8:
  2349. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2350. # A string
  2351. #kip.key_9:
  2352. # KNX decryption key (format: 16 bytes as hex; example: A0 A1 A2 A3 A4 A5 A6 A7 A8 A9 AA AB AC AD AE AF)
  2353. # A string
  2354. #kip.key_10:
  2355. # Whether the KNX/IP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2356. # TRUE or FALSE (case-insensitive)
  2357. #kip.desegment: TRUE
  2358. # Whether the Kpasswd dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2359. # TRUE or FALSE (case-insensitive)
  2360. #kpasswd.desegment: TRUE
  2361. # Whether the Kerberos dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2362. # TRUE or FALSE (case-insensitive)
  2363. #kerberos.desegment: TRUE
  2364. # Whether the dissector should try to decrypt encrypted Kerberos blobs. This requires that the proper keytab file is installed as well.
  2365. # TRUE or FALSE (case-insensitive)
  2366. #kerberos.decrypt: FALSE
  2367. # The keytab file containing all the secrets
  2368. # A path to a file
  2369. #kerberos.file:
  2370. # KT allows binary values in keys and values. Attempt to show an ASCII representation anyway (which might be prematurely terminated by a NULL!
  2371. # TRUE or FALSE (case-insensitive)
  2372. #kt.present_key_val_as_ascii: FALSE
  2373. # Whether the L&G 8979 dissector should desegment all messages spanning multiple TCP segments
  2374. # TRUE or FALSE (case-insensitive)
  2375. #lg8979.desegment: TRUE
  2376. # L2TPv3 Cookie Size
  2377. # One of: Detect, None, 4 Byte Cookie, 8 Byte Cookie
  2378. # (case-insensitive).
  2379. #l2tp.cookie_size: Detect
  2380. # L2TPv3 L2-Specific Sublayer
  2381. # One of: Detect, None, Default L2-Specific, ATM-Specific, LAPD-Specific, DOCSIS DMPT-Specific
  2382. # (case-insensitive).
  2383. #l2tp.l2_specific: Detect
  2384. # Shared secret used for control message digest authentication
  2385. # A string
  2386. #l2tp.shared_secret:
  2387. # Use SAPI values as specified in TS 48 056
  2388. # TRUE or FALSE (case-insensitive)
  2389. #lapd.use_gsm_sapi_values: FALSE
  2390. # Whether the dissector should defragment LAPDm messages spanning multiple packets.
  2391. # TRUE or FALSE (case-insensitive)
  2392. #lapdm.reassemble: TRUE
  2393. # Whether the Laplink dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2394. # TRUE or FALSE (case-insensitive)
  2395. #laplink.desegment_laplink_over_tcp: TRUE
  2396. # Whether the LDAP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2397. # TRUE or FALSE (case-insensitive)
  2398. #ldap.desegment_ldap_messages: TRUE
  2399. # Set the port for LDAP operations over TLS
  2400. # A decimal number
  2401. #ldap.tls.port: 636
  2402. # Whether the LDP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2403. # TRUE or FALSE (case-insensitive)
  2404. #ldp.desegment_ldp_messages: TRUE
  2405. # Which Information will be showed at Column Information is decided by the selection
  2406. # One of: Default Column Info, PROFINET Special Column Info
  2407. # (case-insensitive).
  2408. #lldp.column_info_selection: Default Column Info
  2409. # Dissect this ethertype as LLT traffic in addition to the default, 0xCAFE.
  2410. # A hexadecimal number
  2411. #llt.alternate_ethertype: 0
  2412. # Whether LMP contains a checksum which can be checked
  2413. # TRUE or FALSE (case-insensitive)
  2414. #lmp.checksum: FALSE
  2415. # There might be plugins corresponding to different version of the specification If they are present they should be listed here.
  2416. # One of: FD1, Rel8 dec 2008
  2417. # (case-insensitive).
  2418. #log3gpp.rrc_release_version: Rel8 dec 2008
  2419. # There might be plugins corresponding to different version of the specification If they are present they should be listed here.
  2420. # One of: FD1, Rel8 dec 2008
  2421. # (case-insensitive).
  2422. #log3gpp.nas_eps_release_version: Rel8 dec 2008
  2423. # Use oneline info column by replace all new line characters by spaces
  2424. # TRUE or FALSE (case-insensitive)
  2425. #logcat.oneline_info_column: TRUE
  2426. # Whether the NAS PDU should be shown in the root packet details tree
  2427. # TRUE or FALSE (case-insensitive)
  2428. #lte_rrc.nas_in_root_tree: FALSE
  2429. # Swap frame control bytes (needed for some APs).
  2430. # TRUE or FALSE (case-insensitive)
  2431. #lwapp.swap_fc: FALSE
  2432. # Whether to validate the LWL4 crc when crc bit is not set
  2433. # TRUE or FALSE (case-insensitive)
  2434. #lwl4.check_crc: TRUE
  2435. # 128-bit decryption key in hexadecimal format
  2436. # A string
  2437. #lwm.lwmes_key:
  2438. # Version used by Wireshark
  2439. # One of: Internet Draft version 2, Internet Draft version 8, RFC 4165
  2440. # (case-insensitive).
  2441. #m2pa.version: RFC 4165
  2442. # The value of the parameter tag for protocol data 1
  2443. # One of: 0x000e (Draft 7), 0x0300 (RFC3331)
  2444. # (case-insensitive).
  2445. #m2ua.protocol_data_1_tag: 0x0300 (RFC3331)
  2446. # Version used by Wireshark
  2447. # One of: Internet Draft version 5, Internet Draft version 6, Internet Draft version 7, RFC 4666
  2448. # (case-insensitive).
  2449. #m3ua.version: RFC 4666
  2450. # TSN size in bits, either 6 or 14 bit
  2451. # One of: 6 bits, 14 bits
  2452. # (case-insensitive).
  2453. #mac.tsn_size: 6 bits
  2454. # Number of Re-Transmits before expert warning triggered
  2455. # A decimal number
  2456. #mac-lte.retx_count_warn: 3
  2457. # Attempt to decode BCH, PCH and CCCH data using LTE RRC dissector
  2458. # TRUE or FALSE (case-insensitive)
  2459. #mac-lte.attempt_rrc_decode: TRUE
  2460. # Attempt to dissect frames that have failed CRC check
  2461. # TRUE or FALSE (case-insensitive)
  2462. #mac-lte.attempt_to_dissect_crc_failures: FALSE
  2463. # Will call LTE RLC dissector with standard settings as per RRC spec
  2464. # TRUE or FALSE (case-insensitive)
  2465. #mac-lte.attempt_to_dissect_srb_sdus: TRUE
  2466. # Will call LTE RLC dissector for MCH LCID 0
  2467. # TRUE or FALSE (case-insensitive)
  2468. #mac-lte.attempt_to_dissect_mcch: FALSE
  2469. # Call RLC dissector MTCH LCIDs
  2470. # TRUE or FALSE (case-insensitive)
  2471. #mac-lte.call_rlc_for_mtch: FALSE
  2472. # Set whether LCID -> drb Table is taken from static table (below) or from info learned from control protocol (e.g. RRC)
  2473. # One of: From static table, From configuration protocol
  2474. # (case-insensitive).
  2475. #mac-lte.lcid_to_drb_mapping_source: From static table
  2476. # If any BSR report is >= this number, an expert warning will be added
  2477. # A decimal number
  2478. #mac-lte.bsr_warn_threshold: 50
  2479. # Track status of SRs, providing links between requests, failure indications and grants
  2480. # TRUE or FALSE (case-insensitive)
  2481. #mac-lte.track_sr: TRUE
  2482. # Can show PHY, MAC or RLC layer info in Info column
  2483. # One of: PHY Info, MAC Info, RLC Info
  2484. # (case-insensitive).
  2485. #mac-lte.layer_to_show: RLC Info
  2486. # Attempt to decode 6 bytes of Contention Resolution body as an UL CCCH PDU
  2487. # TRUE or FALSE (case-insensitive)
  2488. #mac-lte.decode_cr_body: FALSE
  2489. # Apply DRX config and show DRX state within each UE
  2490. # TRUE or FALSE (case-insensitive)
  2491. #mac-lte.show_drx: FALSE
  2492. # Add as a generated field the middle of the range indicated by the BSR index
  2493. # TRUE or FALSE (case-insensitive)
  2494. #mac-lte.show_bsr_median: FALSE
  2495. # Attempt to decode BCCH, PCCH and CCCH data using NR RRC dissector
  2496. # TRUE or FALSE (case-insensitive)
  2497. #mac-nr.attempt_rrc_decode: TRUE
  2498. # Will call NR RLC dissector with standard settings as per RRC spec
  2499. # TRUE or FALSE (case-insensitive)
  2500. #mac-nr.attempt_to_dissect_srb_sdus: TRUE
  2501. # Set whether LCID -> drb Table is taken from static table (below) or from info learned from control protocol (i.e. RRC)
  2502. # One of: From static table, From configuration protocol
  2503. # (case-insensitive).
  2504. #mac-nr.lcid_to_drb_mapping_source: From static table
  2505. # The name of the file containing the mate module's configuration
  2506. # A path to a file
  2507. #mate.config:
  2508. # Decode control data received on "usb.control" with an unknown interface class as MBIM
  2509. # TRUE or FALSE (case-insensitive)
  2510. #mbim.control_decode_unknown_itf: FALSE
  2511. # Format used for SMS PDU decoding
  2512. # One of: Automatic, 3GPP, 3GPP2
  2513. # (case-insensitive).
  2514. #mbim.sms_pdu_format: Automatic
  2515. # No description
  2516. # One of: 1.0, 2.0, 3.0, 4.0
  2517. # (case-insensitive).
  2518. #mbim.extended_version: 1.0
  2519. # Set the UDP port for the MCPE Server
  2520. # A decimal number
  2521. #mcpe.udp.port: 19132
  2522. # A frame is considered for decoding as MDSHDR if either ethertype is 0xFCFC or zero. Turn this flag off if you don't want ethertype zero to be decoded as MDSHDR. This might be useful to avoid problems with test frames.
  2523. # TRUE or FALSE (case-insensitive)
  2524. #mdshdr.decode_if_etype_zero: FALSE
  2525. # Specifies that the raw text of the MEGACO message should be displayed instead of (or in addition to) the dissection tree
  2526. # TRUE or FALSE (case-insensitive)
  2527. #megaco.display_raw_text: TRUE
  2528. # Specifies that the dissection tree of the MEGACO message should be displayed instead of (or in addition to) the raw text
  2529. # TRUE or FALSE (case-insensitive)
  2530. #megaco.display_dissect_tree: TRUE
  2531. # Maintain relationships between transactions and contexts and display an extra tree showing context data
  2532. # TRUE or FALSE (case-insensitive)
  2533. #megaco.ctx_info: FALSE
  2534. # Whether the MEMCACHE dissector should reassemble headers of a request spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2535. # TRUE or FALSE (case-insensitive)
  2536. #memcache.desegment_headers: TRUE
  2537. # Whether the memcache dissector should reassemble PDUs spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2538. # TRUE or FALSE (case-insensitive)
  2539. #memcache.desegment_pdus: TRUE
  2540. # Set the UDP port for gateway messages (if other than the default of 2427)
  2541. # A decimal number
  2542. #mgcp.tcp.gateway_port: 2427
  2543. # Set the TCP port for gateway messages (if other than the default of 2427)
  2544. # A decimal number
  2545. #mgcp.udp.gateway_port: 2427
  2546. # Set the TCP port for callagent messages (if other than the default of 2727)
  2547. # A decimal number
  2548. #mgcp.tcp.callagent_port: 2727
  2549. # Set the UDP port for callagent messages (if other than the default of 2727)
  2550. # A decimal number
  2551. #mgcp.udp.callagent_port: 2727
  2552. # Specifies that the raw text of the MGCP message should be displayed instead of (or in addition to) the dissection tree
  2553. # TRUE or FALSE (case-insensitive)
  2554. #mgcp.display_raw_text: FALSE
  2555. # Display the number of MGCP messages found in a packet in the protocol column.
  2556. # TRUE or FALSE (case-insensitive)
  2557. #mgcp.display_mgcp_message_count: FALSE
  2558. # Display multipart bodies with no media type dissector as raw text (may cause problems with binary data).
  2559. # TRUE or FALSE (case-insensitive)
  2560. #mime_multipart.display_unknown_body_as_text: FALSE
  2561. # Remove any base64 content-transfer encoding from bodies. This supports export of the body and its further dissection.
  2562. # TRUE or FALSE (case-insensitive)
  2563. #mime_multipart.remove_base64_encoding: FALSE
  2564. # Uncompress parts which are compressed. GZIP for example. This supports export of the body and its further dissection.
  2565. # TRUE or FALSE (case-insensitive)
  2566. #mime_multipart.uncompress_data: TRUE
  2567. # Dissect payload only if MIC is valid.
  2568. # TRUE or FALSE (case-insensitive)
  2569. #mle.meshlink_mic_ok: FALSE
  2570. # Register Format
  2571. # One of: UINT16 , INT16 , UINT32 , INT32 , IEEE FLT , MODICON FLT
  2572. # (case-insensitive).
  2573. #modbus.mbus_register_format: UINT16
  2574. # Whether the Modbus RTU dissector should desegment all messages spanning multiple TCP segments
  2575. # TRUE or FALSE (case-insensitive)
  2576. #mbrtu.desegment: TRUE
  2577. # Whether to validate the CRC
  2578. # TRUE or FALSE (case-insensitive)
  2579. #mbrtu.crc_verification: FALSE
  2580. # Whether the Modbus RTU dissector should desegment all messages spanning multiple TCP segments
  2581. # TRUE or FALSE (case-insensitive)
  2582. #mbtcp.desegment: TRUE
  2583. # Whether the section dissector should verify the CRC or checksum
  2584. # TRUE or FALSE (case-insensitive)
  2585. #mpeg_dsmcc.verify_crc: FALSE
  2586. # Whether the section dissector should verify the CRC
  2587. # TRUE or FALSE (case-insensitive)
  2588. #mpeg_sect.verify_crc: FALSE
  2589. # Lowest label is used to segregate flows inside a pseudowire
  2590. # TRUE or FALSE (case-insensitive)
  2591. #mpls.flowlabel_in_mpls_header: FALSE
  2592. # Enable to allow non-zero Length in Control Word. This may be needed to correctly decode traffic from some legacy devices which generate non-zero Length even if there is no padding in the packet. Note that Length should have proper value (dissector checks this anyway).
  2593. #
  2594. # Disable to blame all packets with CW.Length <> 0. This conforms to RFC4717.
  2595. # TRUE or FALSE (case-insensitive)
  2596. #mplspwatmaal5sdu.allow_cw_length_nonzero_aal5: FALSE
  2597. # Enable to use reserved bits (8..9) of Control Word as an extension of CW.Length. This may be needed to correctly decode traffic from some legacy devices which uses reserved bits as extension of Length
  2598. #
  2599. # Disable to blame all packets with CW.Reserved <> 0. This conforms to RFC4717.
  2600. # TRUE or FALSE (case-insensitive)
  2601. #mplspwatmaal5sdu.extend_cw_length_with_rsvd_aal5: FALSE
  2602. # Enable to allow non-zero Length in Control Word. This may be needed to correctly decode traffic from some legacy devices which generate non-zero Length even if there is no padding in the packet. Note that Length should have proper value (dissector checks this anyway).
  2603. #
  2604. # Disable to blame all packets with CW.Length <> 0. This conforms to RFC4717.
  2605. # TRUE or FALSE (case-insensitive)
  2606. #mplspwatmn1cw.allow_cw_length_nonzero: FALSE
  2607. # Enable to use reserved bits (8..9) of Control Word as an extension of CW.Length. This may be needed to correctly decode traffic from some legacy devices which uses reserved bits as extension of Length
  2608. #
  2609. # Disable to blame all packets with CW.Reserved <> 0. This conforms to RFC4717.
  2610. # TRUE or FALSE (case-insensitive)
  2611. #mplspwatmn1cw.extend_cw_length_with_rsvd: FALSE
  2612. # To use this option you must also enable "Analyze TCP sequence numbers".
  2613. # TRUE or FALSE (case-insensitive)
  2614. #mptcp.analyze_mptcp: TRUE
  2615. # In case you don't capture the key, it will use the first DSN seen
  2616. # TRUE or FALSE (case-insensitive)
  2617. #mptcp.relative_sequence_numbers: TRUE
  2618. # Scales logarithmically with the number of packetsYou need to capture the handshake for this to work."Map TCP subflows to their respective MPTCP connections"
  2619. # TRUE or FALSE (case-insensitive)
  2620. #mptcp.analyze_mappings: FALSE
  2621. # (Greedy algorithm: Scales linearly with number of subflows and logarithmic scaling with number of packets)You need to enable DSS mapping analysis for this option to work
  2622. # TRUE or FALSE (case-insensitive)
  2623. #mptcp.intersubflows_retransmission: FALSE
  2624. # Whether the MQ dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2625. # TRUE or FALSE (case-insensitive)
  2626. #mq.desegment: TRUE
  2627. # Whether the MQ dissector should reassemble MQ messages spanning multiple TSH segments
  2628. # TRUE or FALSE (case-insensitive)
  2629. #mq.reassembly: TRUE
  2630. # When dissecting PCF there can be a lot of parameters. You can limit the number of parameter decoded, before it continue with the next PCF.
  2631. # A decimal number
  2632. #mqpcf.maxprm: 999
  2633. # When dissecting a parameter of a PCFm, if it is a StringList, IntegerList or Integer64 List, You can limit the number of elements displayed, before it continues with the next Parameter.
  2634. # A decimal number
  2635. #mqpcf.maxlst: 20000
  2636. # Select the MQTT version to use as protocol version if the CONNECT packet is not captured
  2637. # One of: None, MQTT v3.1, MQTT v3.1.1, MQTT v5.0
  2638. # (case-insensitive).
  2639. #mqtt.default_version: None
  2640. # Show Publish Message as text
  2641. # TRUE or FALSE (case-insensitive)
  2642. #mqtt.show_msg_as_text: FALSE
  2643. # Specifies that the raw text of the MSRP message should be displayed in addition to the dissection tree
  2644. # TRUE or FALSE (case-insensitive)
  2645. #msrp.display_raw_text: TRUE
  2646. # Where available, show which protocol and frame caused this MSRP stream to be created
  2647. # TRUE or FALSE (case-insensitive)
  2648. #msrp.show_setup_info: TRUE
  2649. # Whether the MTP2 dissector should use extended sequence numbers as described in Q.703, Annex A as a default.
  2650. # TRUE or FALSE (case-insensitive)
  2651. #mtp2.use_extended_sequence_numbers: FALSE
  2652. # Some SS7 capture hardware includes the FCS at the end of the packet, others do not.
  2653. # TRUE or FALSE (case-insensitive)
  2654. #mtp2.capture_contains_frame_check_sequence: FALSE
  2655. # Reverse the bit order inside bytes specified in Q.703.
  2656. # TRUE or FALSE (case-insensitive)
  2657. #mtp2.reverse_bit_order_mtp2: FALSE
  2658. # This only works for SCCP traffic for now
  2659. # TRUE or FALSE (case-insensitive)
  2660. #mtp3.heuristic_standard: FALSE
  2661. # The SS7 standard used in MTP3 packets
  2662. # One of: ITU, ANSI, Chinese ITU, Japan
  2663. # (case-insensitive).
  2664. #mtp3.standard: ITU
  2665. # The structure of the pointcodes in ITU networks
  2666. # One of: Unstructured, 3-8-3, 4-3-4-3
  2667. # (case-insensitive).
  2668. #mtp3.itu_pc_structure: Unstructured
  2669. # The structure of the pointcodes in Japan networks
  2670. # One of: Unstructured, 7-4-5, 3-4-4-5
  2671. # (case-insensitive).
  2672. #mtp3.japan_pc_structure: Unstructured
  2673. # Use 5-bit (instead of 8-bit) SLS in ANSI MTP3 packets
  2674. # TRUE or FALSE (case-insensitive)
  2675. #mtp3.ansi_5_bit_sls: FALSE
  2676. # Use 5-bit (instead of 4-bit) SLS in Japan MTP3 packets
  2677. # TRUE or FALSE (case-insensitive)
  2678. #mtp3.japan_5_bit_sls: FALSE
  2679. # Format for point code in the address columns
  2680. # One of: Decimal, Hexadecimal, NI-Decimal, NI-Hexadecimal, Dashed
  2681. # (case-insensitive).
  2682. #mtp3.addr_format: Dashed
  2683. # Decode the spare bits of the SIO as the MSU priority (a national option in ITU)
  2684. # TRUE or FALSE (case-insensitive)
  2685. #mtp3.itu_priority: FALSE
  2686. # Whether the MySQL dissector should reassemble MySQL buffers spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2687. # TRUE or FALSE (case-insensitive)
  2688. #mysql.desegment_buffers: TRUE
  2689. # Whether the MySQL dissector should display the SQL query string in the INFO column.
  2690. # TRUE or FALSE (case-insensitive)
  2691. #mysql.show_sql_query: FALSE
  2692. # This should work when the NAS ciphering algorithm is NULL (5G-EEA0)
  2693. # TRUE or FALSE (case-insensitive)
  2694. #nas-5gs.null_decipher: FALSE
  2695. # No description
  2696. # One of: None, IP, Non IP, Ethernet
  2697. # (case-insensitive).
  2698. #nas-5gs.decode_user_data_container_as: None
  2699. # No description
  2700. # A string
  2701. #nas-5gs.non_ip_data_dissector:
  2702. # Always dissect NAS EPS messages as plain
  2703. # TRUE or FALSE (case-insensitive)
  2704. #nas-eps.dissect_plain: FALSE
  2705. # This should work when the NAS ciphering algorithm is NULL (128-EEA0)
  2706. # TRUE or FALSE (case-insensitive)
  2707. #nas-eps.null_decipher: TRUE
  2708. # No description
  2709. # One of: None, IP, Non IP, Ethernet
  2710. # (case-insensitive).
  2711. #nas-eps.decode_user_data_container_as: None
  2712. # No description
  2713. # A string
  2714. #nas-eps.non_ip_data_dissector:
  2715. # Whether the Nasdaq ITCH dissector should decode Chi X extensions.
  2716. # TRUE or FALSE (case-insensitive)
  2717. #nasdaq_itch.chi_x: TRUE
  2718. # Whether the Nasdaq-SoupTCP dissector should reassemble messages spanning multiple TCP segments.
  2719. # TRUE or FALSE (case-insensitive)
  2720. #nasdaq_soup.desegment: TRUE
  2721. # foo
  2722. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2723. # (case-insensitive).
  2724. #nbap.lch1_content: MAC_CONTENT_DCCH
  2725. # foo
  2726. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2727. # (case-insensitive).
  2728. #nbap.lch2_content: MAC_CONTENT_DCCH
  2729. # foo
  2730. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2731. # (case-insensitive).
  2732. #nbap.lch3_content: MAC_CONTENT_DCCH
  2733. # foo
  2734. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2735. # (case-insensitive).
  2736. #nbap.lch4_content: MAC_CONTENT_DCCH
  2737. # foo
  2738. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2739. # (case-insensitive).
  2740. #nbap.lch5_content: MAC_CONTENT_CS_DTCH
  2741. # foo
  2742. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2743. # (case-insensitive).
  2744. #nbap.lch6_content: MAC_CONTENT_CS_DTCH
  2745. # foo
  2746. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2747. # (case-insensitive).
  2748. #nbap.lch7_content: MAC_CONTENT_CS_DTCH
  2749. # foo
  2750. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2751. # (case-insensitive).
  2752. #nbap.lch8_content: MAC_CONTENT_DCCH
  2753. # foo
  2754. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2755. # (case-insensitive).
  2756. #nbap.lch9_content: MAC_CONTENT_PS_DTCH
  2757. # foo
  2758. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2759. # (case-insensitive).
  2760. #nbap.lch10_content: MAC_CONTENT_UNKNOWN
  2761. # foo
  2762. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2763. # (case-insensitive).
  2764. #nbap.lch11_content: MAC_CONTENT_PS_DTCH
  2765. # foo
  2766. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2767. # (case-insensitive).
  2768. #nbap.lch12_content: MAC_CONTENT_PS_DTCH
  2769. # foo
  2770. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2771. # (case-insensitive).
  2772. #nbap.lch13_content: MAC_CONTENT_CS_DTCH
  2773. # foo
  2774. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2775. # (case-insensitive).
  2776. #nbap.lch14_content: MAC_CONTENT_PS_DTCH
  2777. # foo
  2778. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2779. # (case-insensitive).
  2780. #nbap.lch15_content: MAC_CONTENT_CCCH
  2781. # foo
  2782. # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH
  2783. # (case-insensitive).
  2784. #nbap.lch16_content: MAC_CONTENT_DCCH
  2785. # Encoding used for the IB-SG-DATA element carrying segments of information blocks
  2786. # One of: Encoding Variant 1 (TS 25.433 Annex D.2), Encoding Variant 2 (TS 25.433 Annex D.3)
  2787. # (case-insensitive).
  2788. #nbap.ib_sg_data_encoding: Encoding Variant 1 (TS 25.433 Annex D.2)
  2789. # Whether the NBD dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings
  2790. # TRUE or FALSE (case-insensitive)
  2791. #nbd.desegment_nbd_messages: TRUE
  2792. # Whether the NBSS dissector should reassemble packets spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2793. # TRUE or FALSE (case-insensitive)
  2794. #nbss.desegment_nbss_commands: TRUE
  2795. # Whether the NCP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2796. # TRUE or FALSE (case-insensitive)
  2797. #ncp.desegment: TRUE
  2798. # Whether the NCP dissector should defragment NDS messages spanning multiple reply packets.
  2799. # TRUE or FALSE (case-insensitive)
  2800. #ncp.defragment_nds: TRUE
  2801. # Dissect the NetWare Information Structure as NetWare 5.x or higher or as older NetWare 3.x.
  2802. # TRUE or FALSE (case-insensitive)
  2803. #ncp.newstyle: TRUE
  2804. # Whether the NCP dissector should echo the NDS Entry ID to name resolves to the expert table.
  2805. # TRUE or FALSE (case-insensitive)
  2806. #ncp.eid_2_expert: TRUE
  2807. # Whether the NCP dissector should echo NCP connection information to the expert table.
  2808. # TRUE or FALSE (case-insensitive)
  2809. #ncp.connection_2_expert: FALSE
  2810. # Whether the NCP dissector should echo protocol errors to the expert table.
  2811. # TRUE or FALSE (case-insensitive)
  2812. #ncp.error_2_expert: TRUE
  2813. # Whether the NCP dissector should echo server information to the expert table.
  2814. # TRUE or FALSE (case-insensitive)
  2815. #ncp.server_2_expert: TRUE
  2816. # Whether the NCP dissector should echo file open/close/oplock information to the expert table.
  2817. # TRUE or FALSE (case-insensitive)
  2818. #ncp.file_2_expert: FALSE
  2819. # Version of the NDMP protocol to assume if the version can not be automatically detected from the capture
  2820. # One of: Version 2, Version 3, Version 4, Version 5
  2821. # (case-insensitive).
  2822. #ndmp.default_protocol_version: Version 4
  2823. # Whether the NDMP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2824. # TRUE or FALSE (case-insensitive)
  2825. #ndmp.desegment: TRUE
  2826. # Whether the dissector should defragment NDMP messages spanning multiple packets.
  2827. # TRUE or FALSE (case-insensitive)
  2828. #ndmp.defragment: TRUE
  2829. # Whether the NDPS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2830. # TRUE or FALSE (case-insensitive)
  2831. #ndps.desegment_tcp: TRUE
  2832. # Whether the NDPS dissector should reassemble fragmented NDPS messages spanning multiple SPX packets
  2833. # TRUE or FALSE (case-insensitive)
  2834. #ndps.desegment_spx: TRUE
  2835. # Whether or not the NDPS dissector should show object id's and other details
  2836. # TRUE or FALSE (case-insensitive)
  2837. #ndps.show_oid: FALSE
  2838. # Whether the NetBIOS dissector should defragment messages spanning multiple frames
  2839. # TRUE or FALSE (case-insensitive)
  2840. #netbios.defragment: TRUE
  2841. # Whether the Netsync dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2842. # TRUE or FALSE (case-insensitive)
  2843. #netsync.desegment_netsync_messages: TRUE
  2844. # Whether the dissector should snoop the FH to filename mappings by looking inside certain packets
  2845. # TRUE or FALSE (case-insensitive)
  2846. #nfs.file_name_snooping: FALSE
  2847. # Whether the dissector should snoop the full pathname for files for matching FH's
  2848. # TRUE or FALSE (case-insensitive)
  2849. #nfs.file_full_name_snooping: FALSE
  2850. # With this option display filters for nfs fhandles (nfs.fh.{name|full_name|hash}) will find both the request and response packets for a RPC call, even if the actual fhandle is only present in one of the packets
  2851. # TRUE or FALSE (case-insensitive)
  2852. #nfs.fhandle_find_both_reqrep: FALSE
  2853. # When enabled, this option will print the NFSv4 tag (if one exists) in the Info column in the Summary pane
  2854. # TRUE or FALSE (case-insensitive)
  2855. #nfs.display_nfsv4_tag: TRUE
  2856. # When enabled, shows only the significant NFSv4 Operations in the info column. Others (like GETFH, PUTFH, etc) are not displayed
  2857. # TRUE or FALSE (case-insensitive)
  2858. #nfs.display_major_nfsv4_ops: TRUE
  2859. # Dissect TransparentContainers that are opaque to NGAP
  2860. # TRUE or FALSE (case-insensitive)
  2861. #ngap.dissect_container: TRUE
  2862. # Select whether target NG-RAN container should be decoded automatically (based on NG Setup procedure) or manually
  2863. # One of: automatic, gNB, ng-eNB
  2864. # (case-insensitive).
  2865. #ngap.dissect_target_ng_ran_container_as: automatic
  2866. # Select whether LTE container should be dissected as NB-IOT or legacy LTE
  2867. # One of: Automatic, Legacy LTE, NB-IoT
  2868. # (case-insensitive).
  2869. #ngap.dissect_lte_container_as: Automatic
  2870. # Whether the Authentication Extension data contains the source address. Some Cisco IOS implementations forgo this part of RFC2332.
  2871. # TRUE or FALSE (case-insensitive)
  2872. #nhrp.auth_ext_has_addr: TRUE
  2873. # Whether the dissector will track and match MSG and RES calls for asynchronous NLM
  2874. # TRUE or FALSE (case-insensitive)
  2875. #nlm.msg_res_matching: FALSE
  2876. # Whether the NAS PDU should be shown in the root packet details tree
  2877. # TRUE or FALSE (case-insensitive)
  2878. #nr-rrc.nas_in_root_tree: FALSE
  2879. # NT Password (used to decrypt payloads)
  2880. # A string
  2881. #ntlmssp.nt_password:
  2882. # Range of NVMe Subsystem ports(default 4420)
  2883. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2884. #nvme-rdma.subsystem_ports: 4420
  2885. # Range of NVMe Subsystem ports(default 4420)
  2886. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2887. #nvme-tcp.subsystem_ports: 4420
  2888. # Whether to validate the PDU header digest or not.
  2889. # TRUE or FALSE (case-insensitive)
  2890. #nvme-tcp.check_hdgst: FALSE
  2891. # Whether to validate the PDU data digest or not.
  2892. # TRUE or FALSE (case-insensitive)
  2893. #nvme-tcp.check_ddgst: FALSE
  2894. # The bit width of DU Port ID, sum of a,b,c&d must be 16
  2895. # A decimal number
  2896. #oran_fh_cus.oran.du_port_id_bits: 2
  2897. # The bit width of BandSector ID, sum of a,b,c&d must be 16
  2898. # A decimal number
  2899. #oran_fh_cus.oran.bandsector_id_bits: 6
  2900. # The bit width of CC ID, sum of a,b,c&d must be 16
  2901. # A decimal number
  2902. #oran_fh_cus.oran.cc_id_bits: 4
  2903. # The bit width of RU Port ID, sum of a,b,c&d must be 16
  2904. # A decimal number
  2905. #oran_fh_cus.oran.ru_port_id_bits: 4
  2906. # The bit width of a sample in the Uplink
  2907. # A decimal number
  2908. #oran_fh_cus.oran.iq_bitwidth_up: 14
  2909. # Uplink User Data Compression
  2910. # One of: No Compression, Block Floating Point Compression, Block Scaling Compression, u-Law Compression, Modulation Compression, BFP + selective RE sending, mod-compr + selective RE sending
  2911. # (case-insensitive).
  2912. #oran_fh_cus.oran.ud_comp_up: Block Floating Point Compression
  2913. # The udCompHdr field in U-Plane messages may or may not be present, depending on the configuration of the O-RU. This preference instructs the dissector to expect this field to be present in uplink messages.
  2914. # TRUE or FALSE (case-insensitive)
  2915. #oran_fh_cus.oran.ud_comp_hdr_up: FALSE
  2916. # The bit width of a sample in the Downlink
  2917. # A decimal number
  2918. #oran_fh_cus.oran.iq_bitwidth_down: 14
  2919. # Downlink User Data Compression
  2920. # One of: No Compression, Block Floating Point Compression, Block Scaling Compression, u-Law Compression, Modulation Compression, BFP + selective RE sending, mod-compr + selective RE sending
  2921. # (case-insensitive).
  2922. #oran_fh_cus.oran.ud_comp_down: Block Floating Point Compression
  2923. # The udCompHdr field in U-Plane messages may or may not be present, depending on the configuration of the O-RU. This preference instructs the dissector to expect this field to be present in downlink messages.
  2924. # TRUE or FALSE (case-insensitive)
  2925. #oran_fh_cus.oran.ud_comp_hdr_down: FALSE
  2926. # This is used if numPrbu is signalled as 0
  2927. # A decimal number
  2928. #oran_fh_cus.oran.rbs_in_uplane_section: 273
  2929. # Used in decoding of section extension type 11 (Flexible BF weights)
  2930. # A decimal number
  2931. #oran_fh_cus.oran.num_weights_per_bundle: 32
  2932. # Number of BF Antennas (used for C section type 6)
  2933. # A decimal number
  2934. #oran_fh_cus.oran.num_bf_antennas: 32
  2935. # When enabled, for U-Plane frames show each I and Q value in PRB.
  2936. # TRUE or FALSE (case-insensitive)
  2937. #oran_fh_cus.oran.show_iq_samples: TRUE
  2938. # Whether the dissector should put the internal OER data in the tree or if it should hide it
  2939. # TRUE or FALSE (case-insensitive)
  2940. #oer.display_internal_oer_fields: FALSE
  2941. # Dissect custom olsr.org message types (compatible with rfc routing agents)
  2942. # TRUE or FALSE (case-insensitive)
  2943. #olsr.ff_olsrorg: TRUE
  2944. # Dissect custom nrlolsr tc message (incompatible with rfc routing agents)
  2945. # TRUE or FALSE (case-insensitive)
  2946. #olsr.nrlolsr: TRUE
  2947. # SSL/TLS Ports range
  2948. # A string denoting an positive integer range (e.g., "1-20,30-40")
  2949. #opa.fe.tls.port: 3249-3252
  2950. # Attempt to parse mad payload even when MAD.Status is non-zero
  2951. # TRUE or FALSE (case-insensitive)
  2952. #opa.mad.parse_mad_error: FALSE
  2953. # Attempt to reassemble the mad payload of RMPP segments
  2954. # TRUE or FALSE (case-insensitive)
  2955. #opa.mad.reassemble_rmpp: TRUE
  2956. # Whether the OpenFlow dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  2957. # TRUE or FALSE (case-insensitive)
  2958. #openflow.desegment: TRUE
  2959. # To be able to fully dissect SSDO and SPDO packages, a valid UDID for the SCM has to be provided
  2960. # A string
  2961. #opensafety.scm_udid: 00:00:00:00:00:00
  2962. # Automatically assign a detected SCM UDID (by reading SNMT->SNTM_assign_UDID_SCM) and set it for the file
  2963. # TRUE or FALSE (case-insensitive)
  2964. #opensafety.scm_udid_autoset: TRUE
  2965. # A comma-separated list of nodes to be filtered during dissection
  2966. # A string
  2967. #opensafety.filter_nodes:
  2968. # If set to true, only nodes in the list will be shown, otherwise they will be hidden
  2969. # TRUE or FALSE (case-insensitive)
  2970. #opensafety.filter_show_nodes_in_filterlist: TRUE
  2971. # Port used by any UDP demo implementation to transport data
  2972. # A decimal number
  2973. #opensafety.network_udp_port: 9877
  2974. # UDP port used by SercosIII to transport data
  2975. # A decimal number
  2976. #opensafety.network_udp_port_sercosiii: 8755
  2977. # In an SercosIII/UDP transport stream, openSAFETY frame 2 will be expected before frame 1
  2978. # TRUE or FALSE (case-insensitive)
  2979. #opensafety.network_udp_frame_first_sercosiii: FALSE
  2980. # In the transport stream, openSAFETY frame 2 will be expected before frame 1
  2981. # TRUE or FALSE (case-insensitive)
  2982. #opensafety.network_udp_frame_first: FALSE
  2983. # Modbus/TCP words can be transcoded either big- or little endian. Default will be little endian
  2984. # TRUE or FALSE (case-insensitive)
  2985. #opensafety.mbtcp_big_endian: FALSE
  2986. # Enables additional information in the dissection for better debugging an openSAFETY trace
  2987. # TRUE or FALSE (case-insensitive)
  2988. #opensafety.debug_verbose: FALSE
  2989. # Enable heuristic dissection for openSAFETY over UDP encoded traffic
  2990. # TRUE or FALSE (case-insensitive)
  2991. #opensafety.enable_udp: TRUE
  2992. # Enable heuristic dissection for Modbus/TCP
  2993. # TRUE or FALSE (case-insensitive)
  2994. #opensafety.enable_mbtcp: TRUE
  2995. # Display the data between openSAFETY packets
  2996. # TRUE or FALSE (case-insensitive)
  2997. #opensafety.display_intergap_data: FALSE
  2998. # SPDOs may only be found in cyclic data, SSDOs/SNMTS only in acyclic data
  2999. # TRUE or FALSE (case-insensitive)
  3000. #opensafety.classify_transport: TRUE
  3001. # Port used by the openSAFETY over UDP data transport
  3002. # A decimal number
  3003. #opensafety_udp.network_udp_port: 9877
  3004. # If tls-auth detection fails, you can choose to override detection and set tls-auth yourself
  3005. # TRUE or FALSE (case-insensitive)
  3006. #openvpn.tls_auth_detection_override: FALSE
  3007. # Assume the connection uses tls-crypt
  3008. # TRUE or FALSE (case-insensitive)
  3009. #openvpn.tls_crypt: FALSE
  3010. # If the parameter --tls-auth is used, the following preferences must also be defined.
  3011. # TRUE or FALSE (case-insensitive)
  3012. #openvpn.tls_auth: FALSE
  3013. # If the parameter --tls-auth is used, a HMAC header is being inserted.
  3014. # The default HMAC algorithm is SHA-1 which generates a 160 bit HMAC, therefore 20 bytes should be ok.
  3015. # The value must be between 20 (160 bits) and 64 (512 bits).
  3016. # A decimal number
  3017. #openvpn.tls_auth_hmac_size: 20
  3018. # If the parameter --tls-auth is used, an additional packet-id for replay protection is inserted after the HMAC signature. This field can either be 4 bytes or 8 bytes including an optional time_t timestamp long.
  3019. # This option is only evaluated if tls_auth_hmac_size > 0.
  3020. # The default value is TRUE.
  3021. # TRUE or FALSE (case-insensitive)
  3022. #openvpn.long_format: TRUE
  3023. # Whether the Openwire dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3024. # TRUE or FALSE (case-insensitive)
  3025. #openwire.desegment: TRUE
  3026. # Whether verbose type and length information are displayed in the protocol tree
  3027. # TRUE or FALSE (case-insensitive)
  3028. #openwire.verbose_type: FALSE
  3029. # Whether the OPSI dissector should desegment all messages spanning multiple TCP segments
  3030. # TRUE or FALSE (case-insensitive)
  3031. #opsi.desegment_opsi_messages: TRUE
  3032. # Select the option of the network to interpret the Quality Level for
  3033. # One of: Option I network, Option II network
  3034. # (case-insensitive).
  3035. #ossp.option_network: Option I network
  3036. # Whether segmented TPKT datagrams should be reassembled
  3037. # TRUE or FALSE (case-insensitive)
  3038. #osi.tpkt_reassemble: FALSE
  3039. # Whether segmented RTSE datagrams should be reassembled. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3040. # TRUE or FALSE (case-insensitive)
  3041. #rtse.reassemble: TRUE
  3042. # Whether the IDMP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3043. # TRUE or FALSE (case-insensitive)
  3044. #idmp.desegment_idmp_messages: TRUE
  3045. # Whether segmented IDMP datagrams should be reassembled. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3046. # TRUE or FALSE (case-insensitive)
  3047. #idmp.reassemble: TRUE
  3048. # Reassemble fragmented P_Mul packets
  3049. # TRUE or FALSE (case-insensitive)
  3050. #p_mul.reassemble: TRUE
  3051. # Make the P_Mul dissector use relative message id number instead of absolute ones
  3052. # TRUE or FALSE (case-insensitive)
  3053. #p_mul.relative_msgid: TRUE
  3054. # Calculate sequence/acknowledgement analysis
  3055. # TRUE or FALSE (case-insensitive)
  3056. #p_mul.seq_ack_analysis: TRUE
  3057. # Type of content in Data_PDU
  3058. # One of: No decoding, BER encoded ASN.1, Compressed Data Type
  3059. # (case-insensitive).
  3060. #p_mul.decode: No decoding
  3061. # Attempt to decode parts of the message that aren't fully understood yet
  3062. # TRUE or FALSE (case-insensitive)
  3063. #papi.experimental_decode: FALSE
  3064. # Whether the PCLI summary line should be shown in the protocol tree
  3065. # TRUE or FALSE (case-insensitive)
  3066. #pcli.summary_in_tree: TRUE
  3067. # Show uncompressed User-Plane data as IP
  3068. # TRUE or FALSE (case-insensitive)
  3069. #pdcp-lte.show_user_plane_as_ip: TRUE
  3070. # Show unciphered Signalling-Plane data as RRC
  3071. # TRUE or FALSE (case-insensitive)
  3072. #pdcp-lte.show_signalling_plane_as_rrc: TRUE
  3073. # Do sequence number analysis
  3074. # One of: No-Analysis, Only-RLC-frames, Only-PDCP-frames
  3075. # (case-insensitive).
  3076. #pdcp-lte.check_sequence_numbers: Only-RLC-frames
  3077. # Attempt to decode ROHC data
  3078. # TRUE or FALSE (case-insensitive)
  3079. #pdcp-lte.dissect_rohc: FALSE
  3080. # Can show RLC, PDCP or Traffic layer info in Info column
  3081. # One of: RLC Info, PDCP Info, Traffic Info
  3082. # (case-insensitive).
  3083. #pdcp-lte.layer_to_show: RLC Info
  3084. # If RRC Security Info not seen, e.g. in Handover
  3085. # One of: EEA0 (NULL), EEA1 (SNOW3G), EEA2 (AES), EEA3 (ZUC)
  3086. # (case-insensitive).
  3087. #pdcp-lte.default_ciphering_algorithm: EEA0 (NULL)
  3088. # If RRC Security Info not seen, e.g. in Handover
  3089. # One of: EIA0 (NULL), EIA1 (SNOW3G), EIA2 (AES), EIA3 (ZUC)
  3090. # (case-insensitive).
  3091. #pdcp-lte.default_integrity_algorithm: EIA0 (NULL)
  3092. # N.B. only possible if build with algorithm support, and have key available and configured
  3093. # TRUE or FALSE (case-insensitive)
  3094. #pdcp-lte.decipher_signalling: TRUE
  3095. # N.B. only possible if build with algorithm support, and have key available and configured
  3096. # TRUE or FALSE (case-insensitive)
  3097. #pdcp-lte.decipher_userplane: FALSE
  3098. # N.B. only possible if build with algorithm support, and have key available and configured
  3099. # TRUE or FALSE (case-insensitive)
  3100. #pdcp-lte.verify_integrity: TRUE
  3101. # Ignore the LTE RRC security algorithm configuration, to be used when PDCP is already deciphered in the capture
  3102. # TRUE or FALSE (case-insensitive)
  3103. #pdcp-lte.ignore_rrc_sec_params: FALSE
  3104. # Show uncompressed User-Plane data as IP
  3105. # TRUE or FALSE (case-insensitive)
  3106. #pdcp-nr.show_user_plane_as_ip: TRUE
  3107. # Show unciphered Signalling-Plane data as RRC
  3108. # TRUE or FALSE (case-insensitive)
  3109. #pdcp-nr.show_signalling_plane_as_rrc: TRUE
  3110. # Do sequence number analysis
  3111. # One of: No-Analysis, Only-RLC-frames, Only-PDCP-frames
  3112. # (case-insensitive).
  3113. #pdcp-nr.check_sequence_numbers: Only-RLC-frames
  3114. # Attempt to decode ROHC data
  3115. # TRUE or FALSE (case-insensitive)
  3116. #pdcp-nr.dissect_rohc: FALSE
  3117. # Can show RLC, PDCP or Traffic layer info in Info column
  3118. # One of: RLC Info, PDCP Info, Traffic Info
  3119. # (case-insensitive).
  3120. #pdcp-nr.layer_to_show: RLC Info
  3121. # If RRC Security Info not seen, e.g. in Handover
  3122. # One of: NEA0 (NULL), NEA1 (SNOW3G), NEA2 (AES), NEA3 (ZUC)
  3123. # (case-insensitive).
  3124. #pdcp-nr.default_ciphering_algorithm: NEA0 (NULL)
  3125. # If RRC Security Info not seen, e.g. in Handover
  3126. # One of: NIA0 (NULL), NIA1 (SNOW3G), NIA2 (AES), NIA3 (ZUC)
  3127. # (case-insensitive).
  3128. #pdcp-nr.default_integrity_algorithm: NIA0 (NULL)
  3129. # N.B. only possible if build with algorithm support, and have key available and configured
  3130. # TRUE or FALSE (case-insensitive)
  3131. #pdcp-nr.decipher_signalling: TRUE
  3132. # N.B. only possible if build with algorithm support, and have key available and configured
  3133. # TRUE or FALSE (case-insensitive)
  3134. #pdcp-nr.decipher_userplane: FALSE
  3135. # N.B. only possible if build with algorithm support, and have key available and configured
  3136. # TRUE or FALSE (case-insensitive)
  3137. #pdcp-nr.verify_integrity: TRUE
  3138. # Ignore the NR RRC security algorithm configuration, to be used when PDCP is already deciphered in the capture
  3139. # TRUE or FALSE (case-insensitive)
  3140. #pdcp-nr.ignore_rrc_sec_params: FALSE
  3141. # Whether the dissector should put the internal PER data in the tree or if it should hide it
  3142. # TRUE or FALSE (case-insensitive)
  3143. #per.display_internal_per_fields: FALSE
  3144. # Track PFCP session
  3145. # TRUE or FALSE (case-insensitive)
  3146. #pfcp.track_pfcp_session: FALSE
  3147. # Whether or not UID and PID fields are dissected in host, big, or little endian byte order
  3148. # One of: Host-endian, Big-endian, Little-endian
  3149. # (case-insensitive).
  3150. #pflog.id_endian: Host-endian
  3151. # Whether to check the validity of the PGM checksum
  3152. # TRUE or FALSE (case-insensitive)
  3153. #pgm.check_checksum: TRUE
  3154. # Whether the PIM payload is shown off of the main tree or encapsulated within the PIM options
  3155. # TRUE or FALSE (case-insensitive)
  3156. #pim.payload_tree: TRUE
  3157. # The password to used to decrypt the encrypted elements within the PKCS#12 file
  3158. # A string
  3159. #pkcs12.password:
  3160. # Whether to try and decrypt the encrypted data within the PKCS#12 with a NULL password
  3161. # TRUE or FALSE (case-insensitive)
  3162. #pkcs12.try_null_password: FALSE
  3163. # Whether the PN-RT summary line should be shown in the protocol tree
  3164. # TRUE or FALSE (case-insensitive)
  3165. #pn_rt.summary_in_tree: TRUE
  3166. # Reassemble PNIO Fragments and get them decoded
  3167. # TRUE or FALSE (case-insensitive)
  3168. #pn_rt.desegment: TRUE
  3169. # Protocol payload type
  3170. # One of: Data, Sony FeliCa, NXP MiFare, ISO 7816
  3171. # (case-insensitive).
  3172. #pn532.prtype532: Data
  3173. # Whether the PNIO dissector is allowed to use detailed PROFIsafe dissection of cyclic data frames
  3174. # TRUE or FALSE (case-insensitive)
  3175. #pn_io.pnio_ps_selection: TRUE
  3176. # Select your Networkpath to your GSD-Files.
  3177. # A path to a directory
  3178. #pn_io.pnio_ps_networkpath:
  3179. # Whether the POP dissector should reassemble RETR and TOP responses and spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3180. # TRUE or FALSE (case-insensitive)
  3181. #pop.desegment_data: TRUE
  3182. # Whether fragmented 802.11 aggregated MPDUs should be reassembled
  3183. # TRUE or FALSE (case-insensitive)
  3184. #ppi.reassemble: TRUE
  3185. # The type of PPP frame checksum (none, 16-bit, 32-bit)
  3186. # One of: None, 16-Bit, 32-Bit
  3187. # (case-insensitive).
  3188. #ppp.fcs_type: None
  3189. # Default Protocol ID to be used for PPPMuxCP
  3190. # A hexadecimal number
  3191. #ppp.default_proto_id: 0
  3192. # Whether PPP Multilink frames use 12-bit sequence numbers
  3193. # TRUE or FALSE (case-insensitive)
  3194. #mp.short_seqno: FALSE
  3195. # Maximum number of PPP Multilink fragments to try to reassemble into one frame
  3196. # A decimal number
  3197. #mp.max_fragments: 6
  3198. # Age off unreassembled fragments after this many packets
  3199. # A decimal number
  3200. #mp.fragment_aging: 4000
  3201. # Show values of tags and lengths of data fields
  3202. # TRUE or FALSE (case-insensitive)
  3203. #pppoed.show_tags_and_lengths: FALSE
  3204. # Load .proto files when Wireshark starts. By default, the .proto files are loaded only when the Protobuf dissector is called for the first time.
  3205. # TRUE or FALSE (case-insensitive)
  3206. #protobuf.preload_protos: FALSE
  3207. # If Protobuf messages and fields are defined in loaded .proto files, they will be dissected as wireshark fields if this option is turned on. The names of all these wireshark fields will be prefixed with "pbf." (for fields) or "pbm." (for messages) followed by their full names in the .proto files.
  3208. # TRUE or FALSE (case-insensitive)
  3209. #protobuf.pbf_as_hf: FALSE
  3210. # Show the names of message, field, enum and enum_value. Show the wire type and field number format of field. Show value nodes of field and enum_value.
  3211. # TRUE or FALSE (case-insensitive)
  3212. #protobuf.show_details: FALSE
  3213. # Show all fields of bytes type as string. For example ETCD string
  3214. # TRUE or FALSE (case-insensitive)
  3215. #protobuf.bytes_as_string: FALSE
  3216. # Make Protobuf fields that are not serialized on the wire to be displayed with default values.
  3217. # The default value will be one of the following:
  3218. # 1) The value of the 'default' option of an optional field defined in 'proto2' file. (explicitly-declared)
  3219. # 2) False for bools.
  3220. # 3) First defined enum value for enums.
  3221. # 4) Zero for numeric types.
  3222. # There are no default values for fields 'repeated' or 'bytes' and 'string' without default value declared.
  3223. # If the missing field is 'required' in a 'proto2' file, a warning item will be added to the tree.
  3224. # One of: None, Only Explicitly-Declared (proto2), Explicitly-Declared, ENUM and BOOL, All
  3225. # (case-insensitive).
  3226. #protobuf.add_default_value: None
  3227. # Specifies that the JSON text of the Protobuf message should be displayed in addition to the dissection tree
  3228. # TRUE or FALSE (case-insensitive)
  3229. #protobuf.display_json_mapping: FALSE
  3230. # Display timestamp in UTC format
  3231. # TRUE or FALSE (case-insensitive)
  3232. #protobuf.use_utc: FALSE
  3233. # Try to dissect all undefined length-delimited fields as string.
  3234. # TRUE or FALSE (case-insensitive)
  3235. #protobuf.try_dissect_as_string: FALSE
  3236. # Try to show all possible field types for each undefined field according to wire type.
  3237. # TRUE or FALSE (case-insensitive)
  3238. #protobuf.show_all_types: FALSE
  3239. # Make the PTP dissector analyze PTP messages. Accurate Capture Timestamps required!
  3240. # TRUE or FALSE (case-insensitive)
  3241. #ptp.analyze_ptp_messages: FALSE
  3242. # Properly translates vendor specific opcodes
  3243. # One of: Unknown vendor, Eastman Kodak, Canon, Nikon, Casio EX-F1, Microsoft / MTP, Olympus E series
  3244. # (case-insensitive).
  3245. #ptpip.vendor: Unknown vendor
  3246. # Whether the PVFS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3247. # TRUE or FALSE (case-insensitive)
  3248. #pvfs.desegment: TRUE
  3249. # Whether the Q.931 dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3250. # TRUE or FALSE (case-insensitive)
  3251. #q931.desegment_h323_messages: TRUE
  3252. # Reassemble segmented Q.931 messages (Q.931 - Annex H)
  3253. # TRUE or FALSE (case-insensitive)
  3254. #q931.reassembly: TRUE
  3255. # Decode ISO/IEC cause coding standard as ITU-T
  3256. # TRUE or FALSE (case-insensitive)
  3257. #q931.iso_iec_cause_coding: FALSE
  3258. # Type of Facility encoding
  3259. # One of: Dissect facility as QSIG, Dissect facility as ETSI
  3260. # (case-insensitive).
  3261. #q932.facility_encoding: Dissect facility as QSIG
  3262. # Set the UDP base port for the Quake III Arena Server
  3263. # A decimal number
  3264. #quake3.udp.arena_port: 27960
  3265. # Set the UDP base port for the Quake III Arena Master Server
  3266. # A decimal number
  3267. #quake3.udp.master_port: 27950
  3268. # Whether out-of-order CRYPTO frames should be buffered and reordered before passing them to the TLS handshake dissector.
  3269. # TRUE or FALSE (case-insensitive)
  3270. #quic.reassemble_crypto_out_of_order: TRUE
  3271. # Shared secret used to decode User Passwords and validate Accounting Request and Response Authenticators
  3272. # A string
  3273. #radius.shared_secret:
  3274. # Whether to check or not if Accounting Request and Response Authenticator are correct. You need to define shared secret for this to work.
  3275. # TRUE or FALSE (case-insensitive)
  3276. #radius.validate_authenticator: FALSE
  3277. # Whether to add or not to the tree the AVP's payload length
  3278. # TRUE or FALSE (case-insensitive)
  3279. #radius.show_length: FALSE
  3280. # Whether to interpret 241-246 as extended attributes according to RFC 6929
  3281. # TRUE or FALSE (case-insensitive)
  3282. #radius.disable_extended_attributes: FALSE
  3283. # Attempt to dissect RRC message embedded in RRC-Container IE
  3284. # TRUE or FALSE (case-insensitive)
  3285. #ranap.dissect_rrc_container: FALSE
  3286. # Where available, show which protocol and frame caused this RDT stream to be created
  3287. # TRUE or FALSE (case-insensitive)
  3288. #rdt.show_setup_info: TRUE
  3289. # Whether fragmented RELOAD datagrams should be reassembled
  3290. # TRUE or FALSE (case-insensitive)
  3291. #reload.defragment: TRUE
  3292. # Length of the NodeId as defined in the overlay.
  3293. # A decimal number
  3294. #reload.nodeid_length: 16
  3295. # topology plugin defined in the overlay
  3296. # A string
  3297. #reload.topology_plugin: CHORD-RELOAD
  3298. # Whether the RESP dissector should reassemble command and response lines spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3299. # TRUE or FALSE (case-insensitive)
  3300. #resp.desegment_data: TRUE
  3301. # Display the third and forth bytes of the RIPv2 header as the Routing Domain field (introduced in RFC 1388 [January 1993] and obsolete as of RFC 1723 [November 1994])
  3302. # TRUE or FALSE (case-insensitive)
  3303. #rip.display_routing_domain: FALSE
  3304. # When enabled, try to reassemble SDUs from the various PDUs received
  3305. # TRUE or FALSE (case-insensitive)
  3306. #rlc.perform_reassembly: TRUE
  3307. # When enabled, if data is not present, don't report as an error, but instead add expert info to indicate that headers were omitted
  3308. # TRUE or FALSE (case-insensitive)
  3309. #rlc.header_only_mode: FALSE
  3310. # When enabled, RLC will ignore sequence numbers reported in 'Security Mode Command'/'Security Mode Complete' (RRC) messages when checking if frames are ciphered
  3311. # TRUE or FALSE (case-insensitive)
  3312. #rlc.ignore_rrc_cipher_indication: FALSE
  3313. # When enabled, RLC will assume all payloads in RLC frames are ciphered
  3314. # TRUE or FALSE (case-insensitive)
  3315. #rlc.ciphered_data: FALSE
  3316. # LI size in bits, either 7 or 15 bit
  3317. # One of: 7 bits, 15 bits, Let upper layers decide
  3318. # (case-insensitive).
  3319. #rlc.li_size: Let upper layers decide
  3320. # Attempt to keep track of PDUs for AM channels, and point out problems
  3321. # One of: No-Analysis, Only-MAC-frames, Only-RLC-frames
  3322. # (case-insensitive).
  3323. #rlc-lte.do_sequence_analysis_am: Only-MAC-frames
  3324. # Attempt to keep track of PDUs for UM channels, and point out problems
  3325. # One of: No-Analysis, Only-MAC-frames, Only-RLC-frames
  3326. # (case-insensitive).
  3327. #rlc-lte.do_sequence_analysis: Only-MAC-frames
  3328. # Call PDCP dissector for signalling PDUs. Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC)
  3329. # TRUE or FALSE (case-insensitive)
  3330. #rlc-lte.call_pdcp_for_srb: TRUE
  3331. # Call PDCP dissector for user-plane PDUs. Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC)
  3332. # One of: Off, 7-bit SN, 12-bit SN, 15-bit SN, 18-bit SN, Use signalled value
  3333. # (case-insensitive).
  3334. #rlc-lte.call_pdcp_for_drb: Use signalled value
  3335. # Call RRC dissector for CCCH PDUs
  3336. # TRUE or FALSE (case-insensitive)
  3337. #rlc-lte.call_rrc_for_ccch: TRUE
  3338. # Call RRC dissector for MCCH PDUs Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC)
  3339. # TRUE or FALSE (case-insensitive)
  3340. #rlc-lte.call_rrc_for_mcch: FALSE
  3341. # Call ip dissector for MTCH PDUs Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC)
  3342. # TRUE or FALSE (case-insensitive)
  3343. #rlc-lte.call_ip_for_mtch: FALSE
  3344. # When enabled, if data is not present, don't report as an error, but instead add expert info to indicate that headers were omitted
  3345. # TRUE or FALSE (case-insensitive)
  3346. #rlc-lte.header_only_mode: FALSE
  3347. # When enabled, attempts to re-assemble upper-layer SDUs that are split over more than one RLC PDU. Note: does not currently support out-of-order or re-segmentation. N.B. sequence analysis must also be turned on in order for reassembly to work
  3348. # TRUE or FALSE (case-insensitive)
  3349. #rlc-lte.reassembly: TRUE
  3350. # Call PDCP dissector for signalling PDUs. Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC)
  3351. # TRUE or FALSE (case-insensitive)
  3352. #rlc-nr.call_pdcp_for_srb: TRUE
  3353. # Call PDCP dissector for UL user-plane PDUs. Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC)
  3354. # One of: Off, 12-bit SN, 18-bit SN, Use signalled value
  3355. # (case-insensitive).
  3356. #rlc-nr.call_pdcp_for_ul_drb: Off
  3357. # Call PDCP dissector for DL user-plane PDUs. Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC)
  3358. # One of: Off, 12-bit SN, 18-bit SN, Use signalled value
  3359. # (case-insensitive).
  3360. #rlc-nr.call_pdcp_for_dl_drb: Off
  3361. # Call RRC dissector for CCCH PDUs
  3362. # TRUE or FALSE (case-insensitive)
  3363. #rlc-nr.call_rrc_for_ccch: TRUE
  3364. # When enabled, if data is not present, don't report as an error, but instead add expert info to indicate that headers were omitted
  3365. # TRUE or FALSE (case-insensitive)
  3366. #rlc-nr.header_only_mode: FALSE
  3367. # N.B. This should be considered experimental/incomplete, in that it doesn't try to discard reassembled state when reestablishment happens, or in certain packet-loss cases
  3368. # TRUE or FALSE (case-insensitive)
  3369. #rlc-nr.reassemble_am_frames: TRUE
  3370. # N.B. This should be considered experimental/incomplete, in that it doesn't try to discard reassembled state when reestablishment happens, or in certain packet-loss cases
  3371. # TRUE or FALSE (case-insensitive)
  3372. #rlc-nr.reassemble_um_frames: FALSE
  3373. # Whether the RPC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3374. # TRUE or FALSE (case-insensitive)
  3375. #rpc.desegment_rpc_over_tcp: TRUE
  3376. # Whether the RPC dissector should defragment RPC-over-TCP messages.
  3377. # TRUE or FALSE (case-insensitive)
  3378. #rpc.defragment_rpc_over_tcp: TRUE
  3379. # Set the maximum size of RPCoverTCP PDUs. If the size field of the record marker is larger than this value it will not be considered a valid RPC PDU.
  3380. # A decimal number
  3381. #rpc.max_tcp_pdu_size: 4194304
  3382. # Whether the RPC dissector should attempt to dissect RPC PDUs containing programs that are not known to Wireshark. This will make the heuristics significantly weaker and elevate the risk for falsely identifying and misdissecting packets significantly.
  3383. # TRUE or FALSE (case-insensitive)
  3384. #rpc.dissect_unknown_programs: FALSE
  3385. # Whether the RPC dissector should attempt to locate RPC PDU boundaries when initial fragment alignment is not known. This may cause false positives, or slow operation.
  3386. # TRUE or FALSE (case-insensitive)
  3387. #rpc.find_fragment_start: FALSE
  3388. # Whether the RPCAP dissector should reassemble PDUs spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3389. # TRUE or FALSE (case-insensitive)
  3390. #rpcap.desegment_pdus: TRUE
  3391. # Whether the packets should be decoded according to the link-layer type.
  3392. # TRUE or FALSE (case-insensitive)
  3393. #rpcap.decode_content: TRUE
  3394. # Default link-layer type to use if an Open Reply packet has not been captured.
  3395. # A decimal number
  3396. #rpcap.linktype: 4294967295
  3397. # RPKI-Router Protocol TCP TLS port if other than the default
  3398. # A decimal number
  3399. #rpkirtr.tcp.rpkirtr_tls.port: 324
  3400. # Whether the NAS PDU should be shown in the root packet details tree
  3401. # TRUE or FALSE (case-insensitive)
  3402. #rrc.nas_in_root_tree: FALSE
  3403. # Controls the display of the session's client username in the info column. This is only displayed if the packet containing it was seen during this capture session.
  3404. # TRUE or FALSE (case-insensitive)
  3405. #rsh.info_show_client_username: FALSE
  3406. # Controls the display of the session's server username in the info column. This is only displayed if the packet containing it was seen during this capture session.
  3407. # TRUE or FALSE (case-insensitive)
  3408. #rsh.info_show_server_username: TRUE
  3409. # Controls the display of the command being run on the server by this session in the info column. This is only displayed if the packet containing it was seen during this capture session.
  3410. # TRUE or FALSE (case-insensitive)
  3411. #rsh.info_show_command: FALSE
  3412. # Use ipaccess nanoBTS specific definitions for RSL
  3413. # TRUE or FALSE (case-insensitive)
  3414. #gsm_abis_rsl.use_ipaccess_rsl: FALSE
  3415. # Use Osmocom specific definitions for RSL
  3416. # TRUE or FALSE (case-insensitive)
  3417. #gsm_abis_rsl.use_osmocom_rsl: FALSE
  3418. # The Physical Context Information field is not specified This information should be not be analysed by BSC, but merely forwarded from one TRX/channel to another.
  3419. # TRUE or FALSE (case-insensitive)
  3420. #gsm_abis_rsl.dissect_phy_ctx_inf: TRUE
  3421. # Specifies whether Wireshark should decode and display sub-messages within BUNDLE messages
  3422. # TRUE or FALSE (case-insensitive)
  3423. #rsvp.process_bundle: TRUE
  3424. # Specifies how Wireshark should dissect generalized labels
  3425. # One of: data (no interpretation), SONET/SDH ("S, U, K, L, M" scheme), Wavelength Label (fixed or flexi grid), ODUk Label
  3426. # (case-insensitive).
  3427. #rsvp.generalized_label_options: data (no interpretation)
  3428. # Whether the RSYNC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3429. # TRUE or FALSE (case-insensitive)
  3430. #rsync.desegment: TRUE
  3431. # The default protocol assumed by the heuristic dissector, which does not easily distinguish between RTCP and SRTCP.
  3432. # One of: RTCP, SRTCP
  3433. # (case-insensitive).
  3434. #rtcp.default_protocol: RTCP
  3435. # Where available, show which protocol and frame caused this RTCP stream to be created
  3436. # TRUE or FALSE (case-insensitive)
  3437. #rtcp.show_setup_info: TRUE
  3438. # Try to work out network delay by comparing time between packets as captured and delays as seen by endpoint
  3439. # TRUE or FALSE (case-insensitive)
  3440. #rtcp.show_roundtrip_calculation: FALSE
  3441. # Minimum (absolute) calculated roundtrip delay time in milliseconds that should be reported
  3442. # A decimal number
  3443. #rtcp.roundtrip_min_threshhold: 10
  3444. # Whether the RTMPT dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3445. # TRUE or FALSE (case-insensitive)
  3446. #rtmpt.desegment: TRUE
  3447. # The largest acceptable packet size for reassembly
  3448. # A decimal number
  3449. #rtmpt.max_packet_size: 32768
  3450. # Where available, show which protocol and frame caused this RTP stream to be created
  3451. # TRUE or FALSE (case-insensitive)
  3452. #rtp.show_setup_info: TRUE
  3453. # Whether subdissector can request RTP streams to be reassembled
  3454. # TRUE or FALSE (case-insensitive)
  3455. #rtp.desegment_rtp_streams: TRUE
  3456. # If an RTP version 0 packet is encountered, it can be treated as an invalid or ZRTP packet, a CLASSIC-STUN packet, or a T.38 packet
  3457. # One of: Invalid or ZRTP packets, STUN packets, CLASSIC-STUN packets, T.38 packets, SPRT packets
  3458. # (case-insensitive).
  3459. #rtp.version0_type: Invalid or ZRTP packets
  3460. # Specifies that RTP/RTCP/T.38/MSRP/etc streams are decoded based upon port numbers found in RTPproxy answers
  3461. # TRUE or FALSE (case-insensitive)
  3462. #rtpproxy.establish_conversation: TRUE
  3463. # Maximum timeout value in waiting for reply from RTPProxy (in milliseconds).
  3464. # A decimal number
  3465. #rtpproxy.reply.timeout: 1000
  3466. # Specifies the maximum number of samples dissected in a DATA_BATCH submessage. Increasing this value may affect performances if the trace has a lot of big batched samples.
  3467. # A decimal number
  3468. #rtps.max_batch_samples_dissected: 16
  3469. # Enabling this option may affect performance if the trace has messages with large Data Types.
  3470. # TRUE or FALSE (case-insensitive)
  3471. #rtps.enable_max_dissection_info_elements: TRUE
  3472. # Specifies the maximum number of Data Type elements dissected. Increasing this value may affect performance if the trace has messages with large Data Types.
  3473. # A decimal number
  3474. #rtps.max_dissection_info_elements: 100
  3475. # Disabling this option may affect performance if the trace has messages with large arrays or sequences.
  3476. # TRUE or FALSE (case-insensitive)
  3477. #rtps.enable_max_dissection_array_elements: TRUE
  3478. # Specifies the maximum number of Data Type elements dissected in arrays or sequences. Increasing this value may affect performance if the trace has messages with large Data Types.
  3479. # A decimal number
  3480. #rtps.max_dissection_array_elements: 100
  3481. # Shows the Topic Name and Type Name of the samples. Note: this can considerably increase the dissection time
  3482. # TRUE or FALSE (case-insensitive)
  3483. #rtps.enable_topic_info: TRUE
  3484. # Dissects the user data if the Type Object is propagated in Discovery.
  3485. # TRUE or FALSE (case-insensitive)
  3486. #rtps.enable_user_data_dissection: FALSE
  3487. # Enables the reassembly of DATA_FRAG submessages.
  3488. # TRUE or FALSE (case-insensitive)
  3489. #rtps.enable_rtps_reassembly: FALSE
  3490. # Whether the RTSP dissector should reassemble headers of a request spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3491. # TRUE or FALSE (case-insensitive)
  3492. #rtsp.desegment_headers: TRUE
  3493. # Whether the RTSP dissector should use the "Content-length:" value to desegment the body of a request spanning multiple TCP segments
  3494. # TRUE or FALSE (case-insensitive)
  3495. #rtsp.desegment_body: TRUE
  3496. # Dissect TransparentContainers that are opaque to S1AP
  3497. # TRUE or FALSE (case-insensitive)
  3498. #s1ap.dissect_container: TRUE
  3499. # Select whether LTE TransparentContainer should be dissected as NB-IOT or legacy LTE
  3500. # One of: Automatic, Legacy LTE, NB-IoT
  3501. # (case-insensitive).
  3502. #s1ap.dissect_lte_container_as: Automatic
  3503. # Show length of text field
  3504. # TRUE or FALSE (case-insensitive)
  3505. #sametime.show_length: FALSE
  3506. # reassemble packets
  3507. # TRUE or FALSE (case-insensitive)
  3508. #sametime.reassemble: TRUE
  3509. # Whether the SASP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3510. # TRUE or FALSE (case-insensitive)
  3511. #sasp.desegment_sasp_messages: TRUE
  3512. # The source point code (usually MSC) (to determine whether message is uplink or downlink)
  3513. # A hexadecimal number
  3514. #sccp.source_pc: 0
  3515. # Show parameter length in the protocol tree
  3516. # TRUE or FALSE (case-insensitive)
  3517. #sccp.show_length: FALSE
  3518. # Whether SCCP messages should be reassembled
  3519. # TRUE or FALSE (case-insensitive)
  3520. #sccp.defragment_xudt: TRUE
  3521. # Whether to keep information about messages and their associations
  3522. # TRUE or FALSE (case-insensitive)
  3523. #sccp.trace_sccp: FALSE
  3524. # Show SLR, DLR, and CAUSE Parameters in the Information Column of the Summary
  3525. # TRUE or FALSE (case-insensitive)
  3526. #sccp.show_more_info: FALSE
  3527. # Set the source and destination addresses to the GT digits (if present). This may affect TCAP's ability to recognize which messages belong to which TCAP session.
  3528. # TRUE or FALSE (case-insensitive)
  3529. #sccp.set_addresses: FALSE
  3530. # The protocol which should be used to dissect the payload if nothing else has claimed it
  3531. # A string
  3532. #sccp.default_payload:
  3533. # Use all bytes for data payload. Overcome 255 bytes limit of SCCP standard. (Some tracing tools externally reassemble segmented data.)
  3534. # TRUE or FALSE (case-insensitive)
  3535. #sccp.dt1_ignore_length: FALSE
  3536. # When Target Cannot Be Identified, Decode SCSI Messages As
  3537. # One of: Block Device, Sequential Device, Object Based Storage Device, Medium Changer Device, Multimedia Device
  3538. # (case-insensitive).
  3539. #scsi.decode_scsi_messages_as: Block Device
  3540. # Whether fragmented SCSI DATA IN/OUT transfers should be reassembled
  3541. # TRUE or FALSE (case-insensitive)
  3542. #scsi.defragment: FALSE
  3543. # Show source and destination port numbers in the protocol tree
  3544. # TRUE or FALSE (case-insensitive)
  3545. #sctp.show_port_numbers_in_tree: TRUE
  3546. # Use relative TSNs instead of absolute ones
  3547. # TRUE or FALSE (case-insensitive)
  3548. #sctp.relative_tsns: TRUE
  3549. # The type of checksum used in SCTP packets
  3550. # One of: None, Adler 32, CRC 32c, Automatic
  3551. # (case-insensitive).
  3552. #sctp.checksum: None
  3553. # Show always SCTP control chunks in the Info column
  3554. # TRUE or FALSE (case-insensitive)
  3555. #sctp.show_always_control_chunks: TRUE
  3556. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port or PPI
  3557. # TRUE or FALSE (case-insensitive)
  3558. #sctp.try_heuristic_first: FALSE
  3559. # Whether fragmented SCTP user messages should be reassembled
  3560. # TRUE or FALSE (case-insensitive)
  3561. #sctp.reassembly: TRUE
  3562. # Match TSNs and their SACKs
  3563. # TRUE or FALSE (case-insensitive)
  3564. #sctp.tsn_analysis: TRUE
  3565. # Match verification tags (CPU intense)
  3566. # TRUE or FALSE (case-insensitive)
  3567. #sctp.association_index: FALSE
  3568. # Dissect upper layer protocols
  3569. # TRUE or FALSE (case-insensitive)
  3570. #sctp.ulp_dissection: TRUE
  3571. # Whether Scylla dissector should desegment all messages spanning multiple TCP segments
  3572. # TRUE or FALSE (case-insensitive)
  3573. #scylla.desegment: TRUE
  3574. # Data rate
  3575. # One of: Attempt to guess, OC-3, OC-12, OC-24, OC-48
  3576. # (case-insensitive).
  3577. #sdh.data.rate: OC-3
  3578. # Specifies that RTP/RTCP/T.38/MSRP/etc streams are decoded based upon port numbers found in SDP payload
  3579. # TRUE or FALSE (case-insensitive)
  3580. #sdp.establish_conversation: TRUE
  3581. # Whether the SEL Protocol dissector should desegment all messages spanning multiple TCP segments
  3582. # TRUE or FALSE (case-insensitive)
  3583. #selfm.desegment: TRUE
  3584. # Whether the SEL Protocol dissector should automatically pre-process Telnet data to remove duplicate 0xFF IAC bytes
  3585. # TRUE or FALSE (case-insensitive)
  3586. #selfm.telnetclean: TRUE
  3587. # Perform CRC16 validation on Fast Messages
  3588. # TRUE or FALSE (case-insensitive)
  3589. #selfm.crc_verification: FALSE
  3590. # List of word bits contained in SER equations (Comma-separated, no Quotes or Checksums)
  3591. # A string
  3592. #selfm.ser_list:
  3593. # Whether the session dissector should reassemble messages spanning multiple SES segments
  3594. # TRUE or FALSE (case-insensitive)
  3595. #ses.desegment: TRUE
  3596. # Enabling dissection makes it easy to view protocol details in each of the sampled headers. Disabling dissection may reduce noise caused when display filters match the contents of any sampled header(s).
  3597. # TRUE or FALSE (case-insensitive)
  3598. #sflow.enable_dissection: TRUE
  3599. # This option only makes sense if dissection of sampled headers is enabled and probably not even then.
  3600. # TRUE or FALSE (case-insensitive)
  3601. #sflow.enable_analysis: FALSE
  3602. # Preference whether to Dissect the UDVM code or not
  3603. # TRUE or FALSE (case-insensitive)
  3604. #sigcomp.display.udvm.code: FALSE
  3605. # preference whether to display the bytecode in UDVM operands or not
  3606. # TRUE or FALSE (case-insensitive)
  3607. #sigcomp.display.bytecode: FALSE
  3608. # preference whether to decompress message or not
  3609. # TRUE or FALSE (case-insensitive)
  3610. #sigcomp.decomp.msg: FALSE
  3611. # preference whether to display the decompressed message as raw text or not
  3612. # TRUE or FALSE (case-insensitive)
  3613. #sigcomp.display.decomp.msg.as.txt: FALSE
  3614. # 'No-Printout' = UDVM executes silently, then increasing detail about execution of UDVM instructions; Warning! CPU intense at high detail
  3615. # One of: No-Printout, Low-detail, Medium-detail, High-detail
  3616. # (case-insensitive).
  3617. #sigcomp.show.udvm.execution: No-Printout
  3618. # Should the payload dissector be active?
  3619. # TRUE or FALSE (case-insensitive)
  3620. #signal_pdu.payload_dissector_activated: TRUE
  3621. # Should the payload dissector show entries marked as hidden in the configuration?
  3622. # TRUE or FALSE (case-insensitive)
  3623. #signal_pdu.payload_dissector_show_hidden: FALSE
  3624. # Should the payload dissector hide raw values?
  3625. # TRUE or FALSE (case-insensitive)
  3626. #signal_pdu.payload_dissector_hide_raw_values: TRUE
  3627. # Set the CA_system_ID used to decode ECM datagram as MIKEY
  3628. # A hexadecimal number
  3629. #simulcrypt.ca_system_id_mikey: 0x9999
  3630. # SIP Server TLS Port
  3631. # A decimal number
  3632. #sip.tls.port: 5061
  3633. # Specifies that the raw text of the SIP message should be displayed in addition to the dissection tree
  3634. # TRUE or FALSE (case-insensitive)
  3635. #sip.display_raw_text: FALSE
  3636. # If the raw text of the SIP message is displayed, the trailing carriage return and line feed are not shown
  3637. # TRUE or FALSE (case-insensitive)
  3638. #sip.display_raw_text_without_crlf: FALSE
  3639. # If enabled, only SIP/2.0 traffic will be dissected as SIP. Disable it to allow SIP traffic with a different version to be dissected as SIP.
  3640. # TRUE or FALSE (case-insensitive)
  3641. #sip.strict_sip_version: TRUE
  3642. # Whether the SIP dissector should reassemble headers of a request spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3643. # TRUE or FALSE (case-insensitive)
  3644. #sip.desegment_headers: TRUE
  3645. # Whether the SIP dissector should use the "Content-length:" value, if present, to reassemble the body of a request spanning multiple TCP segments, and reassemble chunked data spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3646. # TRUE or FALSE (case-insensitive)
  3647. #sip.desegment_body: TRUE
  3648. # Whether retransmissions are detected coming from the same source port only.
  3649. # TRUE or FALSE (case-insensitive)
  3650. #sip.retrans_the_same_sport: TRUE
  3651. # Whether SIP should delay tracking the media (e.g., RTP/RTCP) until an SDP offer is answered. If enabled, mid-dialog changes to SDP and media state only take effect if and when an SDP offer is successfully answered; however enabling this prevents tracking media in early-media call scenarios
  3652. # TRUE or FALSE (case-insensitive)
  3653. #sip.delay_sdp_changes: FALSE
  3654. # Whether the generated call id should be hidden(not displayed) in the tree or not.
  3655. # TRUE or FALSE (case-insensitive)
  3656. #sip.hide_generatd_call_id: FALSE
  3657. # Validate SIP authorizations with known credentials
  3658. # TRUE or FALSE (case-insensitive)
  3659. #sip.validate_authorization: FALSE
  3660. # Whether the SKINNY dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3661. # TRUE or FALSE (case-insensitive)
  3662. #skinny.desegment: TRUE
  3663. # Whether the dissector should reassemble the payload of SMB Transaction commands spanning multiple SMB PDUs
  3664. # TRUE or FALSE (case-insensitive)
  3665. #smb.trans_reassembly: TRUE
  3666. # Whether the dissector should reassemble DCERPC over SMB commands
  3667. # TRUE or FALSE (case-insensitive)
  3668. #smb.dcerpc_reassembly: TRUE
  3669. # Whether the dissector should snoop SMB and related CIFS protocols to discover and display Names associated with SIDs
  3670. # TRUE or FALSE (case-insensitive)
  3671. #smb.sid_name_snooping: FALSE
  3672. # Whether the dissector should display SIDs and RIDs in hexadecimal rather than decimal
  3673. # TRUE or FALSE (case-insensitive)
  3674. #smb.sid_display_hex: FALSE
  3675. # Whether the export object functionality will take the full path file name as file identifier
  3676. # TRUE or FALSE (case-insensitive)
  3677. #smb.eosmb_take_name_as_fid: FALSE
  3678. # Whether the export object functionality will take the full path file name as file identifier
  3679. # TRUE or FALSE (case-insensitive)
  3680. #smb2.eosmb2_take_name_as_fid: FALSE
  3681. # Whether the dissector should reassemble Named Pipes over SMB2 commands
  3682. # TRUE or FALSE (case-insensitive)
  3683. #smb2.pipe_reassembly: TRUE
  3684. # Whether the dissector should try to verify SMB2 signatures
  3685. # TRUE or FALSE (case-insensitive)
  3686. #smb2.verify_signatures: FALSE
  3687. # Whether the SMB Direct dissector should reassemble fragmented payloads
  3688. # TRUE or FALSE (case-insensitive)
  3689. #smb_direct.reassemble_smb_direct: TRUE
  3690. # Enable reassembling (default is enabled)
  3691. # TRUE or FALSE (case-insensitive)
  3692. #sml.reassemble: TRUE
  3693. # Enable crc (default is disabled)
  3694. # TRUE or FALSE (case-insensitive)
  3695. #sml.crc: FALSE
  3696. # Whether the SMP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3697. # TRUE or FALSE (case-insensitive)
  3698. #smp.desegment: TRUE
  3699. # Whether the SMPP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3700. # TRUE or FALSE (case-insensitive)
  3701. #smpp.reassemble_smpp_over_tcp: TRUE
  3702. # Whether to decode the SMS contents when DCS is equal to 0 (zero).
  3703. # One of: None, ASCII, GSM 7-bit, GSM 7-bit (packed), ISO-8859-1, ISO-8859-5, ISO-8859-8, UCS2, KS C 5601 (Korean)
  3704. # (case-insensitive).
  3705. #smpp.decode_sms_over_smpp: None
  3706. # When the DCS indicates that the encoding is the GSM 7-bit alphabet, whether to decode it as unpacked (one character per octet) instead of packed.
  3707. # TRUE or FALSE (case-insensitive)
  3708. #smpp.gsm7_unpacked: TRUE
  3709. # Whether the SMTP dissector should reassemble command and response lines spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3710. # TRUE or FALSE (case-insensitive)
  3711. #smtp.desegment_lines: TRUE
  3712. # Whether the SMTP dissector should reassemble DATA command and lines spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3713. # TRUE or FALSE (case-insensitive)
  3714. #smtp.desegment_data: TRUE
  3715. # Whether the SMTP dissector should decode Base64 encoded AUTH parameters
  3716. # TRUE or FALSE (case-insensitive)
  3717. #smtp.decryption: FALSE
  3718. # Whether fragmented BIUs should be reassembled
  3719. # TRUE or FALSE (case-insensitive)
  3720. #sna.defragment: TRUE
  3721. # Whether the SNMP OID should be shown in the info column
  3722. # TRUE or FALSE (case-insensitive)
  3723. #snmp.display_oid: TRUE
  3724. # Whether the SNMP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3725. # TRUE or FALSE (case-insensitive)
  3726. #snmp.desegment: TRUE
  3727. # ON - display dissected variables inside SNMP tree, OFF - display dissected variables in root tree after SNMP
  3728. # TRUE or FALSE (case-insensitive)
  3729. #snmp.var_in_tree: TRUE
  3730. # Set whether dissector should run Snort and pass frames into it, or read alerts from user packet comments
  3731. # One of: Not looking for Snort alerts, From running Snort, From user packet comments
  3732. # (case-insensitive).
  3733. #snort.alerts_source: Not looking for Snort alerts
  3734. # The name of the snort binary file to run
  3735. # A path to a file
  3736. #snort.binary: C:\Snort\bin\snort.exe
  3737. # The name of the file containing the snort IDS configuration. Typically snort.conf
  3738. # A path to a file
  3739. #snort.config: C:\Snort\etc\snort.conf
  3740. # Whether or not information about the rule set and detected alerts should be shown in the tree of every snort PDU tree
  3741. # TRUE or FALSE (case-insensitive)
  3742. #snort.show_rule_set_stats: FALSE
  3743. # Whether or not expert info should be used to highlight fired alerts
  3744. # TRUE or FALSE (case-insensitive)
  3745. #snort.show_alert_expert_info: FALSE
  3746. # Attempt to show alert in reassembled frame where possible. Note that this won't work during live capture
  3747. # TRUE or FALSE (case-insensitive)
  3748. #snort.show_alert_in_reassembled_frame: FALSE
  3749. # When enabled, will run Snort with '-k none'
  3750. # TRUE or FALSE (case-insensitive)
  3751. #snort.ignore_checksum_errors: TRUE
  3752. # Show unidentified fields ("padding") in packet dissections
  3753. # TRUE or FALSE (case-insensitive)
  3754. #solaredge.unknown: TRUE
  3755. # Inverter system encryption key
  3756. # A string
  3757. #solaredge.system_encryption_key:
  3758. # Reassemble SOME/IP-TP segments
  3759. # TRUE or FALSE (case-insensitive)
  3760. #someip.reassemble_tp: TRUE
  3761. # Should the SOME/IP Dissector use the payload dissector?
  3762. # TRUE or FALSE (case-insensitive)
  3763. #someip.payload_dissector_activated: TRUE
  3764. # Should the SOME/IP Dissector use the payload dissector with the experimental WTLV encoding for unconfigured messages?
  3765. # TRUE or FALSE (case-insensitive)
  3766. #someip.payload_dissector_wtlv_default: FALSE
  3767. # SOME/IP Ignore Port Ranges UDP. These ports are not automatically added by the SOME/IP-SD.
  3768. # A string denoting an positive integer range (e.g., "1-20,30-40")
  3769. #someipsd.ports.udp.ignore:
  3770. # SOME/IP Ignore Port Ranges TCP. These ports are not automatically added by the SOME/IP-SD.
  3771. # A string denoting an positive integer range (e.g., "1-20,30-40")
  3772. #someipsd.ports.tcp.ignore:
  3773. # Whether the SoulSeek dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3774. # TRUE or FALSE (case-insensitive)
  3775. #slsk.desegment: TRUE
  3776. # Whether the SoulSeek dissector should decompress all zlib compressed packets inside messages
  3777. # TRUE or FALSE (case-insensitive)
  3778. #slsk.decompress: TRUE
  3779. # Whether the SoupBinTCP dissector should reassemble messages spanning multiple TCP segments.
  3780. # TRUE or FALSE (case-insensitive)
  3781. #soupbintcp.desegment: TRUE
  3782. # Whether the SPDY dissector should reassemble multiple data frames into an entity body.
  3783. # TRUE or FALSE (case-insensitive)
  3784. #spdy.assemble_data_frames: TRUE
  3785. # Whether to uncompress SPDY headers.
  3786. # TRUE or FALSE (case-insensitive)
  3787. #spdy.decompress_headers: TRUE
  3788. # Whether to uncompress entity bodies that are compressed using "Content-Encoding: "
  3789. # TRUE or FALSE (case-insensitive)
  3790. #spdy.decompress_body: TRUE
  3791. # Where available, show which protocol and frame caused this SPRT stream to be created
  3792. # TRUE or FALSE (case-insensitive)
  3793. #sprt.show_setup_info: TRUE
  3794. # Show the DLCI field in I_OCTET messages as well as the frame that enabled/disabled the DLCI
  3795. # TRUE or FALSE (case-insensitive)
  3796. #sprt.show_dlci_info: TRUE
  3797. # Decode the subtype as this application
  3798. # One of: None, MCPT
  3799. # (case-insensitive).
  3800. #srtcp.decode_application_subtype: None
  3801. # Whether the SRVLOC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3802. # TRUE or FALSE (case-insensitive)
  3803. #srvloc.desegment_tcp: TRUE
  3804. # SSCOP payload (dissector to call on SSCOP payload)
  3805. # One of: Data (no further dissection), Q.2931, SSCF-NNI (MTP3-b), ALCAP, NBAP
  3806. # (case-insensitive).
  3807. #sscop.payload: Q.2931
  3808. # Whether the SSH dissector should reassemble SSH buffers spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3809. # TRUE or FALSE (case-insensitive)
  3810. #ssh.desegment_buffers: TRUE
  3811. # The path to the file which contains a list of key exchange secrets in the following format:
  3812. # "<hex-encoded-cookie> <hex-encoded-key>" (without quotes or leading spaces).
  3813. #
  3814. # A path to a file
  3815. #ssh.keylog_file:
  3816. # Redirect SSH debug to the file specified. Leave empty to disable debugging or use "-" to redirect output to stderr.
  3817. # A path to a file
  3818. #ssh.debug_file:
  3819. # MOSH_KEY AES key (from mosh-{client,server} environment variable)
  3820. # A string
  3821. #ssyncp.key:
  3822. # Whether the STANAG 5066 DTS Layer dissector should reassemble DPDUs spanning multiple TCP segments
  3823. # TRUE or FALSE (case-insensitive)
  3824. #s5066dts.proto_desegment: TRUE
  3825. # Whether the S5066 SIS dissector should reassemble PDUs spanning multiple TCP segments. The default is to use reassembly.
  3826. # TRUE or FALSE (case-insensitive)
  3827. #s5066sis.desegment_pdus: TRUE
  3828. # Whether the S5066 SIS dissector should dissect this edition of the STANAG. This edition was never formally approved and is very rare. The common edition is edition 1.2.
  3829. # TRUE or FALSE (case-insensitive)
  3830. #s5066sis.edition_one: FALSE
  3831. # Whether the StarTeam dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3832. # TRUE or FALSE (case-insensitive)
  3833. #starteam.desegment: TRUE
  3834. # Whether the BPDU dissector should use 802.1t System ID Extensions when dissecting the Bridge Identifier
  3835. # TRUE or FALSE (case-insensitive)
  3836. #stp.use_system_id_extension: TRUE
  3837. # Reassembles greater than MTU sized STT packets broken into segments on transmit
  3838. # TRUE or FALSE (case-insensitive)
  3839. #stt.reassemble: TRUE
  3840. # Whether to validate the STT checksum or not.
  3841. # TRUE or FALSE (case-insensitive)
  3842. #stt.check_checksum: FALSE
  3843. # Stun Version on the Network
  3844. # One of: Auto, MS-TURN, RFC3489 and earlier, RFC5389 and later
  3845. # (case-insensitive).
  3846. #stun.stunversion: RFC5389 and later
  3847. # Version used by Wireshark
  3848. # One of: Internet Draft version 08, RFC 3868
  3849. # (case-insensitive).
  3850. #sua.version: RFC 3868
  3851. # Set the source and destination addresses to the PC or GT digits, depending on the routing indicator. This may affect TCAP's ability to recognize which messages belong to which TCAP session.
  3852. # TRUE or FALSE (case-insensitive)
  3853. #sua.set_addresses: FALSE
  3854. # No description
  3855. # TRUE or FALSE (case-insensitive)
  3856. #sv.decode_data_as_phsmeas: FALSE
  3857. # Whether the T.38 dissector should decode using the Pre-Corrigendum T.38 ASN.1 specification (1998).
  3858. # TRUE or FALSE (case-insensitive)
  3859. #t38.use_pre_corrigendum_asn1_specification: TRUE
  3860. # Whether a UDP packet that looks like RTP version 2 packet will be dissected as RTP packet or T.38 packet. If enabled there is a risk that T.38 UDPTL packets with sequence number higher than 32767 may be dissected as RTP.
  3861. # TRUE or FALSE (case-insensitive)
  3862. #t38.dissect_possible_rtpv2_packets_as_rtp: FALSE
  3863. # Whether the dissector should reassemble T.38 PDUs spanning multiple TCP segments when TPKT is used over TCP. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3864. # TRUE or FALSE (case-insensitive)
  3865. #t38.reassembly: TRUE
  3866. # Whether T.38 is used with TPKT for TCP
  3867. # One of: Never, Always, Maybe
  3868. # (case-insensitive).
  3869. #t38.tpkt_usage: Maybe
  3870. # Where available, show which protocol and frame caused this T.38 stream to be created
  3871. # TRUE or FALSE (case-insensitive)
  3872. #t38.show_setup_info: TRUE
  3873. # Whether the TACACS+ dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3874. # TRUE or FALSE (case-insensitive)
  3875. #tacplus.desegment: TRUE
  3876. # TACACS+ Encryption Key
  3877. # A string
  3878. #tacplus.key:
  3879. # Whether the TALI dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3880. # TRUE or FALSE (case-insensitive)
  3881. #tali.reassemble: TRUE
  3882. # SCCP (and SUA) SSNs to decode as TCAP
  3883. # A string denoting an positive integer range (e.g., "1-20,30-40")
  3884. #tcap.ssn:
  3885. # Statistics for Response Time
  3886. # TRUE or FALSE (case-insensitive)
  3887. #tcap.persistentsrt: FALSE
  3888. # Maximal delay for message repetition
  3889. # A decimal number
  3890. #tcap.repetitiontimeout: 10
  3891. # Maximal delay for message lost
  3892. # A decimal number
  3893. #tcap.losttimeout: 30
  3894. # Whether the TCP summary line should be shown in the protocol tree
  3895. # TRUE or FALSE (case-insensitive)
  3896. #tcp.summary_in_tree: TRUE
  3897. # Whether to validate the TCP checksum or not. (Invalid checksums will cause reassembly, if enabled, to fail.)
  3898. # TRUE or FALSE (case-insensitive)
  3899. #tcp.check_checksum: FALSE
  3900. # Whether subdissector can request TCP streams to be reassembled
  3901. # TRUE or FALSE (case-insensitive)
  3902. #tcp.desegment_tcp_streams: TRUE
  3903. # Whether out-of-order segments should be buffered and reordered before passing it to a subdissector. To use this option you must also enable "Allow subdissector to reassemble TCP streams".
  3904. # TRUE or FALSE (case-insensitive)
  3905. #tcp.reassemble_out_of_order: FALSE
  3906. # Make the TCP dissector analyze TCP sequence numbers to find and flag segment retransmissions, missing segments and RTT
  3907. # TRUE or FALSE (case-insensitive)
  3908. #tcp.analyze_sequence_numbers: TRUE
  3909. # Make the TCP dissector use relative sequence numbers instead of absolute ones. To use this option you must also enable "Analyze TCP sequence numbers".
  3910. # TRUE or FALSE (case-insensitive)
  3911. #tcp.relative_sequence_numbers: TRUE
  3912. # Make the TCP dissector use this scaling factor for streams where the signalled scaling factor is not visible in the capture
  3913. # One of: Not known, 0 (no scaling), 1 (multiply by 2), 2 (multiply by 4), 3 (multiply by 8), 4 (multiply by 16), 5 (multiply by 32), 6 (multiply by 64), 7 (multiply by 128), 8 (multiply by 256), 9 (multiply by 512), 10 (multiply by 1024), 11 (multiply by 2048), 12 (multiply by 4096), 13 (multiply by 8192), 14 (multiply by 16384)
  3914. # (case-insensitive).
  3915. #tcp.default_window_scaling: Not known
  3916. # Make the TCP dissector track the number on un-ACKed bytes of data are in flight per packet. To use this option you must also enable "Analyze TCP sequence numbers". This takes a lot of memory but allows you to track how much data are in flight at a time and graphing it in io-graphs
  3917. # TRUE or FALSE (case-insensitive)
  3918. #tcp.track_bytes_in_flight: TRUE
  3919. # Evaluate BiF on actual sequence numbers or use the historical method based on payloads (default). This option has no effect if not used with "Track number of bytes in flight".
  3920. # TRUE or FALSE (case-insensitive)
  3921. #tcp.bif_seq_based: FALSE
  3922. # Calculate timestamps relative to the first frame and the previous frame in the tcp conversation
  3923. # TRUE or FALSE (case-insensitive)
  3924. #tcp.calculate_timestamps: TRUE
  3925. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port
  3926. # TRUE or FALSE (case-insensitive)
  3927. #tcp.try_heuristic_first: FALSE
  3928. # Do not place the TCP Timestamps in the summary line
  3929. # TRUE or FALSE (case-insensitive)
  3930. #tcp.ignore_tcp_timestamps: FALSE
  3931. # When interpreting ambiguous packets, give precedence to Fast Retransmission or OOO
  3932. # TRUE or FALSE (case-insensitive)
  3933. #tcp.fastrt_supersedes_ooo: TRUE
  3934. # Do not call any subdissectors for Retransmitted or OutOfOrder segments
  3935. # TRUE or FALSE (case-insensitive)
  3936. #tcp.no_subdissector_on_error: TRUE
  3937. # Assume TCP Experimental Options (253, 254) have an Experiment Identifier and use it for dissection
  3938. # TRUE or FALSE (case-insensitive)
  3939. #tcp.dissect_experimental_options_rfc6994: TRUE
  3940. # Collect and store process information retrieved from IPFIX dissector
  3941. # TRUE or FALSE (case-insensitive)
  3942. #tcp.display_process_info_from_ipfix: FALSE
  3943. # Read the sequence number as it was a syn cookie
  3944. # TRUE or FALSE (case-insensitive)
  3945. #tcp.read_seq_as_syn_cookie: FALSE
  3946. # Whether the TCPCLv4 dissector should analyze the sequencing of the messages within each session.
  3947. # TRUE or FALSE (case-insensitive)
  3948. #tcpcl.analyze_sequence: TRUE
  3949. # Whether the TCPCLv4 dissector should combine the sequential segments of a transfer into the full bundle being transfered.To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3950. # TRUE or FALSE (case-insensitive)
  3951. #tcpcl.desegment_transfer: TRUE
  3952. # If enabled, the bundle will be decoded as BPv7 content. Otherwise, it is assumed to be plain CBOR.
  3953. # TRUE or FALSE (case-insensitive)
  3954. #tcpcl.decode_bundle: TRUE
  3955. # Whether the TCPROS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3956. # TRUE or FALSE (case-insensitive)
  3957. #tcpros.desegment_tcpros_messages: TRUE
  3958. # The TDMoE channel that contains the D-Channel.
  3959. # A decimal number
  3960. #tdmoe.d_channel: 24
  3961. # The TDMoD channel that contains the D-Channel.
  3962. # A decimal number
  3963. #tdmop.d_channel: 16
  3964. # The bitmask of channels in uncompressed TDMoP frame
  3965. # A hexadecimal number
  3966. #tdmop.ts_mask: 0xffffffff
  3967. # The ethertype assigned to TDMoP (without IP/UDP) stream
  3968. # A hexadecimal number
  3969. #tdmop.ethertype: 0
  3970. # Whether the TDS dissector should reassemble TDS buffers spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  3971. # TRUE or FALSE (case-insensitive)
  3972. #tds.desegment_buffers: TRUE
  3973. # Whether the TDS dissector should defragment messages spanning multiple Netlib buffers
  3974. # TRUE or FALSE (case-insensitive)
  3975. #tds.defragment: TRUE
  3976. # Hint as to version of TDS protocol being decoded
  3977. # One of: Not Specified, TDS 4.x, TDS 5.0, TDS 7.0, TDS 7.1, TDS 7.2, TDS 7.3, TDS 7.3A, TDS 7.3B, TDS 7.4
  3978. # (case-insensitive).
  3979. #tds.protocol_type: Not Specified
  3980. # Hint as to whether to decode TDS protocol as little-endian or big-endian. (TDS7/8 always decoded as little-endian)
  3981. # One of: Little Endian, Big Endian
  3982. # (case-insensitive).
  3983. #tds.endian_type: Little Endian
  3984. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to "decode as"
  3985. # TRUE or FALSE (case-insensitive)
  3986. #tecmp.try_heuristic_first: FALSE
  3987. # Treat the analog samples as signed integers and decode them accordingly.
  3988. # TRUE or FALSE (case-insensitive)
  3989. #tecmp.analog_samples_sint: TRUE
  3990. # Whether the captured data include carrier number
  3991. # TRUE or FALSE (case-insensitive)
  3992. #tetra.include_carrier_number: TRUE
  3993. # Whether fragmented TFTP files should be reassembled
  3994. # TRUE or FALSE (case-insensitive)
  3995. #tftp.defragment: FALSE
  3996. # 32-bit sequence counter for hash
  3997. # A string
  3998. #thread.thr_seq_ctr:
  3999. # Set if the PAN ID should be used as the first two octets of the master key (PAN ID LSB), (PAN ID MSB), Key[2]...
  4000. # TRUE or FALSE (case-insensitive)
  4001. #thread.thr_use_pan_id_in_key: FALSE
  4002. # Set if the Thread sequence counter should be automatically acquired from Key ID mode 2 MLE messages.
  4003. # TRUE or FALSE (case-insensitive)
  4004. #thread.thr_auto_acq_thr_seq_ctr: TRUE
  4005. # How the binary should be decoded
  4006. # One of: UTF-8 if printable, Binary (hexadecimal string), ASCII String, UTF-8 String, UTF-16 Big Endian, UTF-16 Little Endian, UTF-32 Big Endian, UTF-32 Little Endian
  4007. # (case-insensitive).
  4008. #thrift.decode_binary: UTF-8 if printable
  4009. # Thrift TLS port
  4010. # A decimal number
  4011. #thrift.tls.port: 0
  4012. # Whether the Thrift dissector should display Thrift internal fields for sub-dissectors.
  4013. # TRUE or FALSE (case-insensitive)
  4014. #thrift.show_internal: FALSE
  4015. # Whether the Thrift dissector should try to dissect the data if the sub-dissector failed. This option can be useful if the data is well-formed but the sub-dissector is expecting different type/content.
  4016. # TRUE or FALSE (case-insensitive)
  4017. #thrift.fallback_on_generic: FALSE
  4018. # Maximum expected depth of nested types in the Thrift structures and containers. A Thrift-based protocol using no parameter and void return types only uses a depth of 0. A Thrift-based protocol using only simple types as parameters or return values uses a depth of 1.
  4019. # A decimal number
  4020. #thrift.nested_type_depth: 25
  4021. # Whether the Thrift dissector should reassemble framed messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4022. # TRUE or FALSE (case-insensitive)
  4023. #thrift.desegment_framed: TRUE
  4024. # Try the default RSA key in use by nearly all Open Tibia servers
  4025. # TRUE or FALSE (case-insensitive)
  4026. #tibia.try_otserv_key: TRUE
  4027. # Shows active character for every packet
  4028. # TRUE or FALSE (case-insensitive)
  4029. #tibia.show_char_name: TRUE
  4030. # Shows account name/password or session key for every packet
  4031. # TRUE or FALSE (case-insensitive)
  4032. #tibia.show_acc_info: TRUE
  4033. # Shows which XTEA key was applied for a packet
  4034. # TRUE or FALSE (case-insensitive)
  4035. #tibia.show_xtea_key: FALSE
  4036. # Only decrypt packets and dissect login packets. Pass game commands to the data dissector
  4037. # TRUE or FALSE (case-insensitive)
  4038. #tibia.dissect_game_commands: FALSE
  4039. # Whether the Tibia dissector should reassemble packets spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4040. # TRUE or FALSE (case-insensitive)
  4041. #tibia.reassemble_tcp_segments: TRUE
  4042. # Time display type
  4043. # One of: UTC, Local
  4044. # (case-insensitive).
  4045. #time.display_time_type: Local
  4046. # Whether TIPCv1 SEGMENTATION_MANAGER datagrams should be reassembled
  4047. # TRUE or FALSE (case-insensitive)
  4048. #tipc.defragment: TRUE
  4049. # Whether to try to dissect TIPC data or not
  4050. # TRUE or FALSE (case-insensitive)
  4051. #tipc.dissect_tipc_data: TRUE
  4052. # Try to decode a TIPCv2 packet using an heuristic sub-dissector before using a registered sub-dissector
  4053. # TRUE or FALSE (case-insensitive)
  4054. #tipc.try_heuristic_first: FALSE
  4055. # TIPC 1.7 removes/adds fields (not) available in TIPC 1.5/1.6 while keeping the version number 2 in the packages. "ALL" shows all fields that were ever used in both versions.
  4056. # One of: ALL, TIPC 1.5/1.6, TIPC 1.7
  4057. # (case-insensitive).
  4058. #tipc.handle_v2_as: ALL
  4059. # Whether the TIPC-over-TCP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4060. # TRUE or FALSE (case-insensitive)
  4061. #tipc.desegment: TRUE
  4062. # Redirect TLS debug to the file specified. Leave empty to disable debugging or use "-" to redirect output to stderr.
  4063. # A path to a file
  4064. #tls.debug_file:
  4065. # Whether the TLS dissector should reassemble TLS records spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4066. # TRUE or FALSE (case-insensitive)
  4067. #tls.desegment_ssl_records: TRUE
  4068. # Whether the TLS dissector should reassemble TLS Application Data spanning multiple TLS records.
  4069. # TRUE or FALSE (case-insensitive)
  4070. #tls.desegment_ssl_application_data: TRUE
  4071. # For troubleshooting ignore the mac check result and decrypt also if the Message Authentication Code (MAC) fails.
  4072. # TRUE or FALSE (case-insensitive)
  4073. #tls.ignore_ssl_mac_failed: FALSE
  4074. # Pre-Shared Key as HEX string. Should be 0 to 16 bytes.
  4075. # A string
  4076. #tls.psk:
  4077. # The name of a file which contains a list of
  4078. # (pre-)master secrets in one of the following formats:
  4079. #
  4080. # RSA <EPMS> <PMS>
  4081. # RSA Session-ID:<SSLID> Master-Key:<MS>
  4082. # CLIENT_RANDOM <CRAND> <MS>
  4083. # PMS_CLIENT_RANDOM <CRAND> <PMS>
  4084. #
  4085. # Where:
  4086. # <EPMS> = First 8 bytes of the Encrypted PMS
  4087. # <PMS> = The Pre-Master-Secret (PMS) used to derive the MS
  4088. # <SSLID> = The SSL Session ID
  4089. # <MS> = The Master-Secret (MS)
  4090. # <CRAND> = The Client's random number from the ClientHello message
  4091. #
  4092. # (All fields are in hex notation)
  4093. # A path to a file
  4094. #tls.keylog_file:
  4095. # Whether the TNS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4096. # TRUE or FALSE (case-insensitive)
  4097. #tns.desegment_tns_messages: TRUE
  4098. # Whether Linux mangling of the link-layer header should be checked for and worked around
  4099. # TRUE or FALSE (case-insensitive)
  4100. #tr.fix_linux_botches: FALSE
  4101. # Whether the TPKT dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4102. # TRUE or FALSE (case-insensitive)
  4103. #tpkt.desegment: TRUE
  4104. # Whether to load the Database or not; not loading the DB disables the protocol; Wireshark has to be restarted for the setting to take effect.
  4105. # TRUE or FALSE (case-insensitive)
  4106. #tpncp.load_db: FALSE
  4107. # Position of the capture unit that produced this trace. This setting affects the way TRANSUM handles TCP Retransmissions. See the manual for details.
  4108. # One of: Client, Intermediate, Service
  4109. # (case-insensitive).
  4110. #transum.capture_position: Client
  4111. # Set this to match to the TCP subdissector reassembly setting
  4112. # TRUE or FALSE (case-insensitive)
  4113. #transum.reassembly: TRUE
  4114. # Add and remove ports numbers separated by commas
  4115. # Ranges are supported e.g. 25,80,2000-3000,5432
  4116. # A string denoting an positive integer range (e.g., "1-20,30-40")
  4117. #transum.tcp_port_ranges: 25,80,443,1433
  4118. # Add and remove ports numbers separated by commas
  4119. # Ranges are supported e.g. 123,137-139,520-521,2049
  4120. # A string denoting an positive integer range (e.g., "1-20,30-40")
  4121. #transum.udp_port_ranges: 137-139
  4122. # Set this to discard any packet in the direction client to service,
  4123. # with a 1-byte payload of 0x00 and the ACK flag set
  4124. # TRUE or FALSE (case-insensitive)
  4125. #transum.orphan_ka_discard: FALSE
  4126. # RTE data will be added to the first request packet
  4127. # TRUE or FALSE (case-insensitive)
  4128. #transum.rte_on_first_req: FALSE
  4129. # RTE data will be added to the last request packet
  4130. # TRUE or FALSE (case-insensitive)
  4131. #transum.rte_on_last_req: TRUE
  4132. # RTE data will be added to the first response packet
  4133. # TRUE or FALSE (case-insensitive)
  4134. #transum.rte_on_first_rsp: FALSE
  4135. # RTE data will be added to the last response packet
  4136. # TRUE or FALSE (case-insensitive)
  4137. #transum.rte_on_last_rsp: FALSE
  4138. # Set this only to troubleshoot problems
  4139. # TRUE or FALSE (case-insensitive)
  4140. #transum.debug_enabled: FALSE
  4141. # Critical Traffic Mask (base hex)
  4142. # A hexadecimal number
  4143. #tte.ct_mask_value: 0
  4144. # Critical Traffic Marker (base hex)
  4145. # A hexadecimal number
  4146. #tte.ct_marker_value: 0xffffffff
  4147. # Setup RTP/RTCP conversations when parsing Start/Record RTP messages
  4148. # TRUE or FALSE (case-insensitive)
  4149. #ua3g.setup_conversations: TRUE
  4150. # NOE SIP Protocol
  4151. # TRUE or FALSE (case-insensitive)
  4152. #uasip.noesip: FALSE
  4153. # IPv4 address of the proxy (Invalid values will be ignored)
  4154. # A string
  4155. #uasip.proxy_ipaddr:
  4156. # IPv4 (or IPv6) address of the call server. (Used only in case of identical source and destination ports)
  4157. # A string
  4158. #uaudp.system_ip:
  4159. # Whether the UCP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4160. # TRUE or FALSE (case-insensitive)
  4161. #ucp.desegment_ucp_messages: TRUE
  4162. # Whether the UDP summary line should be shown in the protocol tree
  4163. # TRUE or FALSE (case-insensitive)
  4164. #udp.summary_in_tree: TRUE
  4165. # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port
  4166. # TRUE or FALSE (case-insensitive)
  4167. #udp.try_heuristic_first: FALSE
  4168. # Whether to validate the UDP checksum
  4169. # TRUE or FALSE (case-insensitive)
  4170. #udp.check_checksum: FALSE
  4171. # Whether to ignore zero-value UDP checksums over IPv6
  4172. # TRUE or FALSE (case-insensitive)
  4173. #udp.ignore_ipv6_zero_checksum: FALSE
  4174. # Collect process flow information from IPFIX
  4175. # TRUE or FALSE (case-insensitive)
  4176. #udp.process_info: FALSE
  4177. # Calculate timestamps relative to the first frame and the previous frame in the udp conversation
  4178. # TRUE or FALSE (case-insensitive)
  4179. #udp.calculate_timestamps: TRUE
  4180. # Ignore an invalid checksum coverage field and continue dissection
  4181. # TRUE or FALSE (case-insensitive)
  4182. #udplite.ignore_checksum_coverage: TRUE
  4183. # Whether to validate the UDP-Lite checksum
  4184. # TRUE or FALSE (case-insensitive)
  4185. #udplite.check_checksum: FALSE
  4186. # Calculate timestamps relative to the first frame and the previous frame in the udp-lite conversation
  4187. # TRUE or FALSE (case-insensitive)
  4188. #udplite.calculate_timestamps: TRUE
  4189. # No description
  4190. # TRUE or FALSE (case-insensitive)
  4191. #udpcp.attempt_reassembly: TRUE
  4192. # No description
  4193. # TRUE or FALSE (case-insensitive)
  4194. #udpcp.attempt_xml_decode: TRUE
  4195. # Whether the ULP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4196. # TRUE or FALSE (case-insensitive)
  4197. #ulp.desegment_ulp_messages: TRUE
  4198. # Whether the UMA dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4199. # TRUE or FALSE (case-insensitive)
  4200. #uma.desegment_ucp_messages: TRUE
  4201. # Try to decode a packet using a heuristic sub-dissector before attempting to dissect the packet using the "usb.bulk", "usb.interrupt" or "usb.control" dissector tables.
  4202. # TRUE or FALSE (case-insensitive)
  4203. #usb.try_heuristics: TRUE
  4204. # Use specified speed if speed is not indicated in capture
  4205. # One of: Unknown, Low-Speed, Full-Speed, High-Speed
  4206. # (case-insensitive).
  4207. #usbll.global_pref_dissect_unknown_speed_as: Unknown
  4208. # Activate workaround for weird Ettus UHD header offset on data packets
  4209. # TRUE or FALSE (case-insensitive)
  4210. #vrt.ettus_uhd_header_format: FALSE
  4211. # Whether the vlan summary line should be shown in the protocol tree
  4212. # TRUE or FALSE (case-insensitive)
  4213. #vlan.summary_in_tree: TRUE
  4214. # The (hexadecimal) Ethertype used to indicate 802.1QinQ VLAN in VLAN tunneling.
  4215. # A hexadecimal number
  4216. #vlan.qinq_ethertype: 0x9100
  4217. # IEEE 802.1Q specification version used (802.1Q-1998 uses 802.1D-2004 for PRI values)
  4218. # One of: IEEE 802.1Q-1998, IEEE 802.1Q-2005, IEEE 802.1Q-2011
  4219. # (case-insensitive).
  4220. #vlan.version: IEEE 802.1Q-2011
  4221. # Number of priorities supported, and number of those drop eligible (not used for 802.1Q-1998)
  4222. # One of: 8 Priorities, 0 Drop Eligible, 7 Priorities, 1 Drop Eligible, 6 Priorities, 2 Drop Eligible, 5 Priorities, 3 Drop Eligible
  4223. # (case-insensitive).
  4224. #vlan.priority_drop: 8 Priorities, 0 Drop Eligible
  4225. # Whether the VNC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4226. # TRUE or FALSE (case-insensitive)
  4227. #vnc.desegment: TRUE
  4228. # There is some ambiguity on how to calculate V3 checksumsAs in V3 will use a pseudo header(which may only be implemented for IPv6 by some manufacturers)
  4229. # TRUE or FALSE (case-insensitive)
  4230. #vrrp.v3_checksum_as_in_v2: FALSE
  4231. # Whether the VSS Monitoring dissector should attempt to dissect trailers with no timestamp, only port stamping. Note that this can result in a large number of false positives.
  4232. # TRUE or FALSE (case-insensitive)
  4233. #vssmonitoring.dissect_portstamping_only: FALSE
  4234. # Whether the VSS Monitoring dissector should assume that the port stamp is two bytes, instead of the standard one byte.
  4235. # TRUE or FALSE (case-insensitive)
  4236. #vssmonitoring.two_byte_portstamps: FALSE
  4237. # Enable this preference if you want to view the WBXML tokens without the representation in a media type (e.g., WML). Tokens will show up as Tag_0x12, attrStart_0x08 or attrValue_0x0B for example.
  4238. # TRUE or FALSE (case-insensitive)
  4239. #wbxml.skip_wbxml_token_mapping: FALSE
  4240. # Enable this preference if you want to skip the parsing of the WBXML tokens that constitute the body of the WBXML document. Only the WBXML header will be dissected (and visualized) then.
  4241. # TRUE or FALSE (case-insensitive)
  4242. #wbxml.disable_wbxml_token_parsing: FALSE
  4243. # Select dissector for websocket text
  4244. # One of: No subdissection, Line based text, As json, As SIP
  4245. # (case-insensitive).
  4246. #websocket.text_type: No subdissection
  4247. # No description
  4248. # TRUE or FALSE (case-insensitive)
  4249. #websocket.decompress: TRUE
  4250. # The TCP port DPP over TCP uses
  4251. # A decimal number
  4252. #dpp.tcp.port: 7871
  4253. # Set the maximum Basic CID used in the Wimax decoder (if other than the default of 320). Note: The maximum Primary CID is double the maximum Basic CID.
  4254. # A decimal number
  4255. #wmx.basic_cid_max: 320
  4256. # Set to TRUE to use the Corrigendum 2 version of Wimax message decoding. Set to FALSE to use the 802.16e-2005 version.
  4257. # TRUE or FALSE (case-insensitive)
  4258. #wmx.corrigendum_2_version: FALSE
  4259. # Show transaction ID direction bit separately from the rest of the transaction ID field.
  4260. # TRUE or FALSE (case-insensitive)
  4261. #wimaxasncp.show_transaction_id_d_bit: FALSE
  4262. # Print debug output to the console.
  4263. # TRUE or FALSE (case-insensitive)
  4264. #wimaxasncp.debug_enabled: FALSE
  4265. # Version of the NWG that the R6 protocol complies with
  4266. # One of: R1.0 v1.0.0, R1.0 v1.2.0, R1.0 v1.2.1
  4267. # (case-insensitive).
  4268. #wimaxasncp.nwg_version: R1.0 v1.2.1
  4269. # Whether the WINS-Replication dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4270. # TRUE or FALSE (case-insensitive)
  4271. #winsrepl.reassemble: TRUE
  4272. # Whether the IP dissector should dissect decrypted transport data.
  4273. # TRUE or FALSE (case-insensitive)
  4274. #wg.dissect_packet: TRUE
  4275. # The path to the file which contains a list of secrets in the following format:
  4276. # "<key-type> = <base64-encoded-key>" (without quotes, leading spaces and spaces around '=' are ignored).
  4277. # <key-type> is one of: LOCAL_STATIC_PRIVATE_KEY, REMOTE_STATIC_PUBLIC_KEY, LOCAL_EPHEMERAL_PRIVATE_KEY or PRESHARED_KEY.
  4278. # A path to a file
  4279. #wg.keylog_file:
  4280. # Whether the wow dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4281. # TRUE or FALSE (case-insensitive)
  4282. #wow.desegment: TRUE
  4283. # If CALL REQUEST not seen or didn't specify protocol, dissect as QLLC/SNA
  4284. # TRUE or FALSE (case-insensitive)
  4285. #x25.payload_is_qllc_sna: FALSE
  4286. # If CALL REQUEST has no data, assume the protocol handled is COTP
  4287. # TRUE or FALSE (case-insensitive)
  4288. #x25.call_request_nodata_is_cotp: FALSE
  4289. # If CALL REQUEST not seen or didn't specify protocol, check user data before checking heuristic dissectors
  4290. # TRUE or FALSE (case-insensitive)
  4291. #x25.payload_check_data: FALSE
  4292. # Reassemble fragmented X.25 packets
  4293. # TRUE or FALSE (case-insensitive)
  4294. #x25.reassemble: TRUE
  4295. # Whether the X11 dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4296. # TRUE or FALSE (case-insensitive)
  4297. #x11.desegment: TRUE
  4298. # Select whether RRC Context should be dissected as legacy LTE or NB-IOT
  4299. # One of: LTE, NB-IoT
  4300. # (case-insensitive).
  4301. #x2ap.dissect_rrc_context_as: LTE
  4302. # Try to recognize XML encoded in Unicode (UCS-2BE)
  4303. # TRUE or FALSE (case-insensitive)
  4304. #xml.heuristic_unicode: FALSE
  4305. # Whether the XMPP dissector should reassemble messages. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings
  4306. # TRUE or FALSE (case-insensitive)
  4307. #xmpp.desegment: TRUE
  4308. # Select whether target NG-RAN container should be decoded automatically (based on Xn Setup procedure) or manually
  4309. # One of: automatic, gNB, ng-eNB
  4310. # (case-insensitive).
  4311. #xnap.dissect_target_ng_ran_container_as: automatic
  4312. # Select whether LTE RRC Context should be dissected as legacy LTE or NB-IOT
  4313. # One of: LTE, NB-IoT
  4314. # (case-insensitive).
  4315. #xnap.dissect_lte_rrc_context_as: LTE
  4316. # Whether the X.25-over-TCP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings
  4317. # TRUE or FALSE (case-insensitive)
  4318. #xot.desegment: TRUE
  4319. # Whether the X.25-over-TCP dissector should reassemble all X.25 packets before calling the X25 dissector. If the TCP packets arrive out-of-order, the X.25 reassembly can otherwise fail. To use this option, you should also enable "Reassemble X.25-over-TCP messages spanning multiple TCP segments", "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings and "Reassemble fragmented X.25 packets" in the X.25 protocol settings.
  4320. # TRUE or FALSE (case-insensitive)
  4321. #xot.x25_desegment: FALSE
  4322. # Whether the YAMI dissector should reassemble messages spanning multiple TCP segments.To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4323. # TRUE or FALSE (case-insensitive)
  4324. #yami.desegment: TRUE
  4325. # Whether the YMSG dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4326. # TRUE or FALSE (case-insensitive)
  4327. #ymsg.desegment: TRUE
  4328. # Whether the Z39.50 dissector should reassemble TDS buffers spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings.
  4329. # TRUE or FALSE (case-insensitive)
  4330. #z3950.desegment_buffers: TRUE
  4331. # Specifies the security level to use in the
  4332. # decryption process. This value is ignored
  4333. # for ZigBee 2004 and unsecured networks.
  4334. # One of: No Security, No Encryption, 32-bit Integrity Protection, No Encryption, 64-bit Integrity Protection, No Encryption, 128-bit Integrity Protection, AES-128 Encryption, No Integrity Protection, AES-128 Encryption, 32-bit Integrity Protection, AES-128 Encryption, 64-bit Integrity Protection, AES-128 Encryption, 128-bit Integrity Protection
  4335. # (case-insensitive).
  4336. #zbee_nwk.seclevel: AES-128 Encryption, 32-bit Integrity Protection
  4337. # Specifies the ZigBee Smart Energy version used when dissecting ZigBee APS messages within the Smart Energy Profile
  4338. # One of: SE 1.1b, SE 1.2, SE 1.2a, SE 1.2b, SE 1.4
  4339. # (case-insensitive).
  4340. #zbee_aps.zbeeseversion: SE 1.4
  4341. ####### Statistics ########
  4342. # Determines time between tap updates
  4343. # A decimal number
  4344. #statistics.update_interval: 3000
  4345. # If enabled burst rates will be calculated for statistics that use the stats_tree system. Burst rates are calculated over a much shorter time interval than the rate column.
  4346. # TRUE or FALSE (case-insensitive)
  4347. #statistics.st_enable_burstinfo: TRUE
  4348. # If selected the stats_tree statistics nodes will show the count of events within the burst window instead of a burst rate. Burst rate is calculated as number of events within burst window divided by the burst windown length.
  4349. # TRUE or FALSE (case-insensitive)
  4350. #statistics.st_burst_showcount: FALSE
  4351. # Sets the duration of the time interval into which events are grouped when calculating the burst rate. Higher resolution (smaller number) increases processing overhead.
  4352. # A decimal number
  4353. #statistics.st_burst_resolution: 5
  4354. # Sets the duration of the sliding window during which the burst rate is measured. Longer window relative to burst rate resolution increases processing overhead. Will be truncated to a multiple of burst resolution.
  4355. # A decimal number
  4356. #statistics.st_burst_windowlen: 100
  4357. # Sets the default column by which stats based on the stats_tree system is sorted.
  4358. # One of: Node name (topic/item), Item count, Average value of the node, Minimum value of the node, Maximum value of the node, Burst rate of the node
  4359. # (case-insensitive).
  4360. #statistics.st_sort_defcolflag: Item count
  4361. # When selected, statistics based on the stats_tree system will by default be sorted in descending order.
  4362. # TRUE or FALSE (case-insensitive)
  4363. #statistics.st_sort_defdescending: TRUE
  4364. # When selected, the item/node names of statistics based on the stats_tree system will be sorted taking case into account. Else the case of the name will be ignored.
  4365. # TRUE or FALSE (case-insensitive)
  4366. #statistics.st_sort_casesensitve: TRUE
  4367. # When selected, the stats_tree nodes representing a range of values (0-49, 50-100, etc.) will always be sorted by name (the range of the node). Else range nodes are sorted by the same column as the rest of the tree.
  4368. # TRUE or FALSE (case-insensitive)
  4369. #statistics.st_sort_rng_nameonly: TRUE
  4370. # When selected, the stats_tree nodes representing a range of values (0-49, 50-100, etc.) will always be sorted ascending; else it follows the sort direction of the tree. Only effective if "Always sort 'range' nodes by name" is also selected.
  4371. # TRUE or FALSE (case-insensitive)
  4372. #statistics.st_sort_rng_fixorder: TRUE
  4373. # When selected, the full name (including menu path) of the stats_tree plug-in is show in windows. If cleared the plug-in name is shown without menu path (only the part of the name after last '/' character.)
  4374. # TRUE or FALSE (case-insensitive)
  4375. #statistics.st_sort_showfullname: FALSE