osmocom
/
wireshark
11
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

Make some text verbatim. 

svn path=/trunk/; revision=24585
This commit is contained in:
Gerald Combs 2008-03-07 23:44:40 +00:00
parent 9c28399930
commit 71d81e88b1
1 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
doc/rawshark.pod
View File

@ -36,12 +36,12 @@ B<Wireshark> and B<TShark>.
B<Rawshark> expects input records with the following format. Note that this
matches the pcap_pkthdr struct and packet data used in libpcap.
struct rawshark_rec_s {
struct timeval ts; /* Time stamp */
uint32_t caplen; /* Length of the packet buffer */
uint32_t len; /* "On the wire" length of the packet */
uint8_t *data; /* Packet data */
};
struct rawshark_rec_s {
struct timeval ts; /* Time stamp */
uint32_t caplen; /* Length of the packet buffer */
uint32_t len; /* "On the wire" length of the packet */
uint8_t *data; /* Packet data */
};
=head1 OUTPUT
@ -53,20 +53,20 @@ display filter. A "-" is used to signal the end of a field description and
at the end of each packet line. For example, the flags B<-F ip.src -F
dns.qry.type> might generate the following output:
0 FT_IPv4 BASE_NONE - 1 FT_UINT16 BASE_HEX -
1 1="1" 0="192.168.77.10" 1 -
2 1="1" 0="192.168.77.250" 1 -
3 0="192.168.77.10" 1 -
4 0="74.125.19.104" 1 -
0 FT_IPv4 BASE_NONE - 1 FT_UINT16 BASE_HEX -
1 1="1" 0="192.168.77.10" 1 -
2 1="1" 0="192.168.77.250" 1 -
3 0="192.168.77.10" 1 -
4 0="74.125.19.104" 1 -
Note that packets 1 and 2 are DNS queries, and 3 and 4 are not. Adding B<-R "not dns"> still prints each line, but there's an indication
that packets 1 and 2 didn't pass the filter:
0 FT_IPv4 BASE_NONE - 1 FT_UINT16 BASE_HEX -
1 1="1" 0="192.168.77.10" 0 -
2 1="1" 0="192.168.77.250" 0 -
3 0="192.168.77.10" 1 -
4 0="74.125.19.104" 1 -
0 FT_IPv4 BASE_NONE - 1 FT_UINT16 BASE_HEX -
1 1="1" 0="192.168.77.10" 0 -
2 1="1" 0="192.168.77.250" 0 -
3 0="192.168.77.10" 1 -
4 0="74.125.19.104" 1 -
Also note that the output may be in any order, and that multiple matching
fields might be displayed.