diff --git a/80211 WIFI (RCTF)/80211_keys b/80211 WIFI (RCTF)/80211_keys deleted file mode 100755 index 818f67c..0000000 --- a/80211 WIFI (RCTF)/80211_keys +++ /dev/null @@ -1,2 +0,0 @@ -# This file is automatically generated, DO NOT MODIFY. -"wpa-psk","09df7daea191e516d6f7615528072808ce80bc3bfb619bd53756eac4adb89771" diff --git a/80211 WIFI (RCTF)/dfilter_buttons b/80211 WIFI (RCTF)/dfilter_buttons deleted file mode 100755 index a4009ef..0000000 --- a/80211 WIFI (RCTF)/dfilter_buttons +++ /dev/null @@ -1,3 +0,0 @@ -# This file is automatically generated, DO NOT MODIFY. -"TRUE","HANDSHAKE","eapol","" -"TRUE","WEP IV","wlan.wep.iv","" diff --git a/README.md b/README.md index 1ff342a..4a366fe 100644 --- a/README.md +++ b/README.md @@ -1,22 +1,51 @@ -# wifishark +## WiFiShark +

+ wifishark +

+#Purpose - -##Welcome to the WIFIShark Profile (80211 WIFI RFCTF) - -Created with the idea that there was not a "Red Team" 80211 profile for Wireshark -This was a small passion project with a few ideas -Dont do 7000 colors you have to remember +Created with the idea that there was not a "Red Team" 80211 profile for Wireshark. \ +This was a small passion project with a few ideas. Dont do 7000 colors you have to remember \ Show things important to doing a redteam event (like the RFCTF) + +\ Things like: -IVs -Handshakes -Deauths + - IVs + - Handshakes + - Deauths + - Certs + - Creds + + +\ +#Installation + + - Grab the release wifishark or Create zip file of the directory. + - Install it in the same way you would any other profile in Wireshark + +``` +Right Click Profile: in the bottom right hand corner. +Import wifishark.zip file +``` + +

+ import +

+ + +\ +#Usage +Use the colors to decode the packets you want to see without having to drill down on them. -##Instalation +

+ usage +

-install it in the same way you would any other profile in Wireshark -https://www.wireshark.org/docs/wsug_html_chunked/ChCustConfigProfilesSection.html +Or use the button to group packets of the choosen type. +

+ buttons +

diff --git a/wifishark/80211_keys b/wifishark/80211_keys new file mode 100644 index 0000000..aab2946 --- /dev/null +++ b/wifishark/80211_keys @@ -0,0 +1 @@ +# This file is automatically generated, DO NOT MODIFY. diff --git a/80211 WIFI (RCTF)/colorfilters b/wifishark/colorfilters old mode 100755 new mode 100644 similarity index 59% rename from 80211 WIFI (RCTF)/colorfilters rename to wifishark/colorfilters index f0bee37..4262fdc --- a/80211 WIFI (RCTF)/colorfilters +++ b/wifishark/colorfilters @@ -1,4 +1,8 @@ -# DO NOT EDIT THIS FILE! It was created by Wireshark +# This file was created by Wireshark. Edit with care. +@SSL Cert@ssl.handshake.certificate and eapol@[65535,0,0][0,0,0] +@WPA-EAP Identities@eap.type == 1 && eap.code == 2@[65535,0,0][0,0,0] +@GET Creds@http.request.method == GET and http.authbasic@[65535,0,0][0,0,0] +@POST Creds@http.request.method == POST and (lower(http.file_data) contains "pass" or lower(http.request.line) contains "pass" or tcp contains "login")@[65535,0,0][0,0,0] @WEP@wlan.wfa.ie.wpa.ucs.type == 1@[64764,44975,15934][61423,10537,10537] @WEP IV@wlan.wep.iv@[35466,58082,13364][61423,10537,10537] @Disassoc - MDK3@wlan.fc.type_subtype eq 0x00a@[34952,35466,34181][61423,10537,10537] @@ -10,4 +14,5 @@ @802.11R Auth Request@(wlan.fc.type_subtype==0)&&(wlan.rsn.akms.type==3)@[44461,32639,43176][35466,58082,13364] @802.11w capable@wlan.rsn.capabilities.mfpc == 1@[11565,32125,46003][0,0,0] @802.11w required@wlan.rsn.capabilities.mfpr == 1@[29298,40863,53199][0,0,0] -@Handshakes@eapol@[0,0,0][64764,59881,20303] +@802.11w downgradeable@(((wlan.fc.type_subtype == 0x0008) && (wlan.rsn.capabilities)) && (wlan.rsn.capabilities.mfpc == 0 && wlan.rsn.capabilities.mfpr == 0))@[0,43690,65535][0,0,0] +@Handshakes@eapol or wlan.rsn.ie.pmkid@[0,0,0][64764,59881,20303] diff --git a/80211 WIFI (RCTF)/decode_as_entries b/wifishark/decode_as_entries old mode 100755 new mode 100644 similarity index 74% rename from 80211 WIFI (RCTF)/decode_as_entries rename to wifishark/decode_as_entries index 76bb866..af86f63 --- a/80211 WIFI (RCTF)/decode_as_entries +++ b/wifishark/decode_as_entries @@ -1,4 +1,4 @@ -# "Decode As" entries file for Wireshark 3.2.3. +# "Decode As" entries file for Wireshark 4.0.6. # # This file is regenerated each time "Decode As" preferences # are saved within Wireshark. Making manual changes should be safe, diff --git a/wifishark/dfilter_buttons b/wifishark/dfilter_buttons new file mode 100644 index 0000000..9d58338 --- /dev/null +++ b/wifishark/dfilter_buttons @@ -0,0 +1,10 @@ +# This file is automatically generated, DO NOT MODIFY. +"TRUE","WEP","wlan.wfa.ie.wpa.ucs.type == 1","" +"TRUE","WEP IV","wlan.wep.iv","" +"TRUE","HANDSHAKE","eapol or wlan.rsn.ie.pmkid","" +"TRUE","WPA-EAP Identities","eap.type == 1 && eap.code == 2","" +"TRUE","SSL Certs","ssl.handshake.certificate and eapol","" +"TRUE","80211w Downgradeable","(((wlan.fc.type_subtype == 0x0008) && (wlan.rsn.capabilities)) && (wlan.rsn.capabilities.mfpc == 0 && wlan.rsn.capabilities.mfpr == 0))","" +"TRUE","80211w Required","wlan.rsn.capabilities.mfpr == 1","" +"TRUE","POST Creds","http.request.method == POST and (lower(http.file_data) contains \x22pass\x22 or lower(http.request.line) contains \x22pass\x22 or tcp contains \x22login\x22)","Find Creds in POST request" +"TRUE","GET Creds","http.request.method == GET and http.authbasic","Passwords from GET request." diff --git a/80211 WIFI (RCTF)/preferences b/wifishark/preferences old mode 100755 new mode 100644 similarity index 84% rename from 80211 WIFI (RCTF)/preferences rename to wifishark/preferences index 749f706..98ed7ae --- a/80211 WIFI (RCTF)/preferences +++ b/wifishark/preferences @@ -1,4 +1,4 @@ -# Configuration file for Wireshark 3.2.3. +# Configuration file for Wireshark 4.0.6. # # This file is regenerated each time preferences are saved within # Wireshark. Making manual changes should be safe, however. @@ -108,15 +108,43 @@ # A decimal number #gui.max_export_objects: 1000 -# Enable Packet Editor (Experimental) -# TRUE or FALSE (case-insensitive) -#gui.packet_editor.enabled: FALSE +# The maximum number of items that can be added to the dissection tree (Increase with caution) +# A decimal number +#gui.max_tree_items: 1000000 + +# The maximum depth of the dissection tree (Increase with caution) +# A decimal number +#gui.max_tree_depth: 500 # The position of "..." in packet list text. # One of: LEFT, RIGHT, MIDDLE, NONE # (case-insensitive). #gui.packet_list_elide_mode: RIGHT +# Sets the count of decimal places for values of type 1.Type 1 values are defined by authors.Value can be in range 2 to 10. +# A decimal number +#gui.decimal_places1: 2 + +# Sets the count of decimal places for values of type 2.Type 2 values are defined by authors.Value can be in range 2 to 10. +# A decimal number +#gui.decimal_places2: 4 + +# Sets the count of decimal places for values of type 3.Type 3 values are defined by authors.Value can be in range 2 to 10. +# A decimal number +#gui.decimal_places3: 6 + +# If set to true, RTP Player saves temporary data to temp files on disk. If not set, it uses memory.Every stream uses one file therefore you might touch OS limit for count of opened files.When ui.rtp_player_use_disk2 is set to true too, it uses two files per RTP stream together. +# TRUE or FALSE (case-insensitive) +#gui.rtp_player_use_disk1: FALSE + +# If set to true, RTP Player saves temporary dictionary to temp files on disk. If not set, it uses memory.Every stream uses one file therefore you might touch OS limit for count of opened files.When ui.rtp_player_use_disk1 is set to true too, it uses two files per RTP stream. +# TRUE or FALSE (case-insensitive) +#gui.rtp_player_use_disk2: FALSE + +# To prevent sorting by mistake (which can take some time to calculate), it can be disabled +# TRUE or FALSE (case-insensitive) +#gui.packet_list_is_sortable: TRUE + # Show all interfaces, including interfaces marked as hidden # TRUE or FALSE (case-insensitive) #gui.interfaces_show_hidden: FALSE @@ -126,7 +154,7 @@ #gui.interfaces_remote_display: TRUE # Hide the given interface types in the startup list. -# A commma-separated string of interface type values (e.g. 5,9). +# A comma-separated string of interface type values (e.g. 5,9). # 0 = Wired, # 1 = AirPCAP, # 2 = Pipe, @@ -140,13 +168,21 @@ # A string gui.interfaces_hidden_types: 4,9,8,0 +# Enables automatic updates for IO Graph +# TRUE or FALSE (case-insensitive) +#gui.io_graph_automatic_update: TRUE + +# Show the byte view in the packet details dialog +# TRUE or FALSE (case-insensitive) +#gui.show_byteview_in_dialog: TRUE + ####### User Interface: Colors ######## -# Foregound color for an active selected item +# Foreground color for an active selected item # A six-digit hexadecimal RGB color triplet (e.g. fce94f) #gui.active_frame.fg: 000000 -# Backgound color for an active selected item +# Background color for an active selected item # A six-digit hexadecimal RGB color triplet (e.g. fce94f) #gui.active_frame.bg: cbe8ff @@ -155,11 +191,11 @@ gui.interfaces_hidden_types: 4,9,8,0 # (case-insensitive). #gui.active_frame.style: DEFAULT -# Foregound color for an inactive selected item +# Foreground color for an inactive selected item # A six-digit hexadecimal RGB color triplet (e.g. fce94f) #gui.inactive_frame.fg: 000000 -# Backgound color for an inactive selected item +# Background color for an inactive selected item # A six-digit hexadecimal RGB color triplet (e.g. fce94f) #gui.inactive_frame.bg: efefef @@ -216,7 +252,7 @@ gui.interfaces_hidden_types: 4,9,8,0 # Packet list hidden columns # List all columns to hide in the packet list. -gui.column.hidden: %i +gui.column.hidden: # Packet list column format # Each pair of strings consists of a column title and its format @@ -230,32 +266,32 @@ gui.column.format: "Source", "%s", "Destination", "%d", "RSSI", "%e", - "Info", "%i" + "Info", "%rd" ####### User Interface: Font ######## # Font name for packet list, protocol tree, and hex dump panes. (Qt) # A string -gui.qt.font_name: Liberation Mono,11,-1,5,50,0,0,0,0,0 +gui.qt.font_name: Consolas,10,-1,5,50,0,0,0,0,0 ####### User Interface: Layout ######## # Layout type (1-6) # A decimal number -#gui.layout_type: 1 +#gui.layout_type: 2 # Layout content of the pane 1 -# One of: NONE, PLIST, PDETAILS, PBYTES +# One of: NONE, PLIST, PDETAILS, PBYTES, PDIAGRAM # (case-insensitive). #gui.layout_content_1: PLIST # Layout content of the pane 2 -# One of: NONE, PLIST, PDETAILS, PBYTES +# One of: NONE, PLIST, PDETAILS, PBYTES, PDIAGRAM # (case-insensitive). #gui.layout_content_2: PDETAILS # Layout content of the pane 3 -# One of: NONE, PLIST, PDETAILS, PBYTES +# One of: NONE, PLIST, PDETAILS, PBYTES, PDIAGRAM # (case-insensitive). gui.layout_content_3: NONE @@ -267,6 +303,10 @@ gui.layout_content_3: NONE # TRUE or FALSE (case-insensitive) #gui.packet_header_column_definition.enabled: TRUE +# Enable Packet List mouse-over colorization +# TRUE or FALSE (case-insensitive) +#gui.packet_list_hover_style.enabled: TRUE + # Show selected packet in the Status Bar # TRUE or FALSE (case-insensitive) #gui.show_selected_packet.enabled: FALSE @@ -361,17 +401,6 @@ gui.layout_content_3: NONE ####### Console ######## -# Log level -# Console log level (for debugging) -# A bitmask of log levels: -# ERROR = 4 -# CRITICAL = 8 -# WARNING = 16 -# MESSAGE = 32 -# INFO = 64 -# DEBUG = 128 -#console.log.level: 28 - # Look for dissectors that left some bytes undecoded (debug) # TRUE or FALSE (case-insensitive) #console.incomplete_dissectors_check_debug: FALSE @@ -382,169 +411,77 @@ gui.layout_content_3: NONE # TRUE or FALSE (case-insensitive) #extcap.gui_save_on_start: TRUE -# Interface index -# A string -#extcap.dpauxmon.interface_id: 0 - -# Run in debug mode -# A string -#extcap.dpauxmon.debug: false - -# Use a file for debug -# A string -#extcap.dpauxmon.debugfile: - -# Listen port -# A string -#extcap.udpdump.port: 5555 - -# Payload type -# A string -#extcap.udpdump.payload: data - -# Run in debug mode -# A string -#extcap.udpdump.debug: false - -# Use a file for debug -# A string -#extcap.udpdump.debugfile: - -# Remote SSH server address -# A string -#extcap.ciscodump.remotehost: - -# Remote SSH server port -# A string -#extcap.ciscodump.remoteport: 22 - -# Remote SSH server username -# A string -#extcap.ciscodump.remoteusername: wasabi - -# Path to SSH private key -# A string -#extcap.ciscodump.sshkey: - -# ProxyCommand +# Snapshot length # A string -#extcap.ciscodump.proxycommand: +#extcap.____usbpcap1.snaplen: 65535 -# Remote interface +# Capture buffer length # A string -#extcap.ciscodump.remoteinterface: +#extcap.____usbpcap1.bufferlen: 1048576 -# Remote capture filter +# Capture from all devices connected # A string -#extcap.ciscodump.remotefilter: deny tcp host fe80::250:56ff:fec0:8 any eq 0, deny tcp any eq 0 host fe80::250:56ff:fec0:8, deny tcp host fe80::250:56ff:fec0:1 any eq 0, deny tcp any eq 0 host fe80::250:56ff:fec0:1, deny tcp host fe80::9bf:2360:b235:2151 any eq 0, deny tcp any eq 0 host fe80::9bf:2360:b235:2151, deny tcp host 172.18.0.1 any eq 0, deny tcp any eq 0 host 172.18.0.1, deny tcp host 172.16.193.1 any eq 0, deny tcp any eq 0 host 172.16.193.1, deny tcp host 172.16.186.1 any eq 0, deny tcp any eq 0 host 172.16.186.1, deny tcp host 172.17.0.1 any eq 0, deny tcp any eq 0 host 172.17.0.1, deny tcp host 192.168.1.130 any eq 0, deny tcp any eq 0 host 192.168.1.130, permit ip any any +#extcap.____usbpcap1.capturefromalldevices: true -# Packets to capture +# Capture from newly connected devices # A string -#extcap.ciscodump.remotecount: +#extcap.____usbpcap1.capturefromnewdevices: true -# Run in debug mode +# Inject already connected devices descriptors into capture data # A string -#extcap.ciscodump.debug: false +#extcap.____usbpcap1.injectdescriptors: true -# Use a file for debug +# Attached USB Devices # A string -#extcap.ciscodump.debugfile: +#extcap.____usbpcap1.devices: -# Max bytes in a packet +# Snapshot length # A string -#extcap.randpkt.maxbytes: 5000 +#extcap.____usbpcap2.snaplen: 65535 -# Number of packets +# Capture buffer length # A string -#extcap.randpkt.count: 1000 +#extcap.____usbpcap2.bufferlen: 1048576 -# Packet delay (ms) +# Capture from all devices connected # A string -#extcap.randpkt.delay: 0 +#extcap.____usbpcap2.capturefromalldevices: true -# Random type +# Capture from newly connected devices # A string -#extcap.randpkt.randomtype: false +#extcap.____usbpcap2.capturefromnewdevices: true -# All random packets +# Inject already connected devices descriptors into capture data # A string -#extcap.randpkt.allrandom: false +#extcap.____usbpcap2.injectdescriptors: true -# Type of packet +# Attached USB Devices # A string -#extcap.randpkt.type: +#extcap.____usbpcap2.devices: -# Run in debug mode +# Snapshot length # A string -#extcap.randpkt.debug: false +#extcap.____usbpcap3.snaplen: 65535 -# Use a file for debug +# Capture buffer length # A string -#extcap.randpkt.debugfile: +#extcap.____usbpcap3.bufferlen: 1048576 -# Remote SSH server address +# Capture from all devices connected # A string -#extcap.sshdump.remotehost: +#extcap.____usbpcap3.capturefromalldevices: true -# Remote SSH server port +# Capture from newly connected devices # A string -#extcap.sshdump.remoteport: +#extcap.____usbpcap3.capturefromnewdevices: true -# Remote SSH server username +# Inject already connected devices descriptors into capture data # A string -#extcap.sshdump.remoteusername: +#extcap.____usbpcap3.injectdescriptors: true -# Path to SSH private key +# Attached USB Devices # A string -#extcap.sshdump.sshkey: - -# ProxyCommand -# A string -#extcap.sshdump.proxycommand: - -# Remote interface -# A string -#extcap.sshdump.remoteinterface: - -# Remote capture command -# A string -#extcap.sshdump.remotecapturecommand: - -# Use sudo on the remote machine -# A string -#extcap.sshdump.remotesudo: - -# No promiscuous mode -# A string -#extcap.sshdump.remotenoprom: - -# Remote capture filter -# A string -#extcap.sshdump.remotefilter: not ((host fe80::250:56ff:fec0:8 or host fe80::250:56ff:fec0:1 or host fe80::9bf:2360:b235:2151 or host 172.18.0.1 or host 172.16.193.1 or host 172.16.186.1 or host 172.17.0.1 or host 192.168.1.130) and port 22) - -# Packets to capture -# A string -#extcap.sshdump.remotecount: 0 - -# Run in debug mode -# A string -#extcap.sshdump.debug: false - -# Use a file for debug -# A string -#extcap.sshdump.debugfile: - -# Starting position -# A string -#extcap.sdjournal.startfrom: - -# Run in debug mode -# A string -#extcap.sdjournal.debug: false - -# Use a file for debug -# A string -#extcap.sdjournal.debugfile: +#extcap.____usbpcap3.devices: ####### Name Resolution ######## @@ -560,7 +497,7 @@ nameres.transport_name: TRUE # TRUE or FALSE (case-insensitive) nameres.network_name: TRUE -# Whether address/name pairs found in captured DNS packets should be used by Wireshark for name resolution. +# Use address/name pairs found in captured DNS packets for name resolution. # TRUE or FALSE (case-insensitive) #nameres.dns_pkt_addr_resolution: TRUE @@ -568,7 +505,7 @@ nameres.network_name: TRUE # TRUE or FALSE (case-insensitive) #nameres.use_external_name_resolver: TRUE -# Uses DNS Servers list to resolve network names if TRUE. If FALSE, default information is used +# Use a DNS Servers list to resolve network names if TRUE. If FALSE, default information is used # TRUE or FALSE (case-insensitive) #nameres.use_custom_dns_servers: FALSE @@ -610,7 +547,7 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #protocols.enable_incomplete_dissectors_check: FALSE -# Protocols may use things like VLAN ID or interface ID to narrow the potential for duplicate conversations.Currently only ICMP and ICMPv6 use this preference to add VLAN ID to conversation tracking +# Protocols may use things like VLAN ID or interface ID to narrow the potential for duplicate conversations. Currently ICMP and ICMPv6 use this preference to add VLAN ID to conversation tracking, and IPv4 uses this preference to take VLAN ID into account during reassembly # TRUE or FALSE (case-insensitive) #protocols.strict_conversation_tracking_heuristics: FALSE @@ -674,6 +611,18 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #lbmr.use_lbmr_domain: FALSE +# Set the LBMSRS IP Address +# A string +#lbmsrs.source_ip_address: 127.0.0.1 + +# Set the source TCP port +# A decimal number +#lbmsrs.source_port: 0 + +# Use table of LBMSRS tags to decode the packet instead of above values +# TRUE or FALSE (case-insensitive) +#lbmsrs.use_lbmsrs_domain: FALSE + # Set the low end of the LBT-RM multicast address range (context transport_lbtrm_multicast_address_low) # A string #lbtrm.mc_address_low: 224.10.10.10 @@ -950,6 +899,10 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #aeron.use_heuristic_subdissectors: FALSE +# Whether fragmented AFS PDUs should be reassembled +# TRUE or FALSE (case-insensitive) +#afs.defragment: FALSE + # Whether the AIM dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #aim.desegment: TRUE @@ -976,14 +929,6 @@ protocols.display_hidden_proto_items: TRUE # A decimal number #amqp.tls.port: 5671 -# The dynamic payload types which will be interpreted as AMR(default 0) -# A string denoting an positive integer range (e.g., "1-20,30-40") -#amr.dynamic.payload.type: - -# The dynamic payload types which will be interpreted as AMR-WB(default 0) -# A string denoting an positive integer range (e.g., "1-20,30-40") -#amr.wb.dynamic.payload.type: - # Type of AMR encoding of the payload # One of: RFC 3267 octet aligned, RFC 3267 BW-efficient, AMR IF1, AMR IF2 # (case-insensitive). @@ -1046,91 +991,126 @@ protocols.display_hidden_proto_items: TRUE #arp.register_network_address_binding: TRUE # Select the CAT001 version -# One of: Version 1.2 +# One of: Version 1.4 (latest), Version 1.4, Version 1.3, Version 1.2 # (case-insensitive). -#asterix.i001_version: Version 1.2 +#asterix.i001_version: Version 1.4 (latest) # Select the CAT002 version -# One of: Version 1.0 +# One of: Version 1.1 (latest), Version 1.1, Version 1.0 # (case-insensitive). -#asterix.i002_version: Version 1.0 +#asterix.i002_version: Version 1.1 (latest) # Select the CAT004 version -# One of: Version 1.7 +# One of: Version 1.12 (latest), Version 1.12 # (case-insensitive). -#asterix.i004_version: Version 1.7 +#asterix.i004_version: Version 1.12 (latest) # Select the CAT008 version -# One of: Version 1.1 +# One of: Version 1.3 (latest), Version 1.3, Version 1.2 # (case-insensitive). -#asterix.i008_version: Version 1.1 +#asterix.i008_version: Version 1.3 (latest) # Select the CAT009 version -# One of: Version 2.0 +# One of: Version 2.1 (latest), Version 2.1 +# (case-insensitive). +#asterix.i009_version: Version 2.1 (latest) + +# Select the CAT010 version +# One of: Version 1.1 (latest), Version 1.1 # (case-insensitive). -#asterix.i009_version: Version 2.0 +#asterix.i010_version: Version 1.1 (latest) + +# Select the CAT011 version +# One of: Version 1.3 (latest), Version 1.3, Version 1.2 +# (case-insensitive). +#asterix.i011_version: Version 1.3 (latest) + +# Select the CAT015 version +# One of: Version 1.1 (latest), Version 1.1, Version 1.0 +# (case-insensitive). +#asterix.i015_version: Version 1.1 (latest) + +# Select the CAT016 version +# One of: Version 1.0 (latest), Version 1.0 +# (case-insensitive). +#asterix.i016_version: Version 1.0 (latest) + +# Select the CAT018 version +# One of: Version 1.7 (latest), Version 1.7 +# (case-insensitive). +#asterix.i018_version: Version 1.7 (latest) # Select the CAT019 version -# One of: Version 1.3 +# One of: Version 1.3 (latest), Version 1.3 # (case-insensitive). -#asterix.i019_version: Version 1.3 +#asterix.i019_version: Version 1.3 (latest) # Select the CAT020 version -# One of: Version 1.9 +# One of: Version 1.10 (latest), Version 1.10, Version 1.9 # (case-insensitive). -#asterix.i020_version: Version 1.9 +#asterix.i020_version: Version 1.10 (latest) # Select the CAT021 version -# One of: Version 2.3, Version 2.1, Version 0.26, Version 0.23 +# One of: Version 2.6 (latest), Version 2.6, Version 2.5, Version 2.4, Version 0.23 # (case-insensitive). -#asterix.i021_version: Version 2.3 +#asterix.i021_version: Version 2.6 (latest) # Select the CAT023 version -# One of: Version 1.2 +# One of: Version 1.3 (latest), Version 1.3, Version 1.2 # (case-insensitive). -#asterix.i023_version: Version 1.2 +#asterix.i023_version: Version 1.3 (latest) # Select the CAT025 version -# One of: Version 1.1 +# One of: Version 1.5 (latest), Version 1.5 # (case-insensitive). -#asterix.i025_version: Version 1.1 +#asterix.i025_version: Version 1.5 (latest) # Select the CAT032 version -# One of: Version 1.0 +# One of: Version 1.1 (latest), Version 1.1 # (case-insensitive). -#asterix.i032_version: Version 1.0 +#asterix.i032_version: Version 1.1 (latest) # Select the CAT034 version -# One of: Version 1.27 +# One of: Version 1.29 (latest), Version 1.29, Version 1.28, Version 1.27 # (case-insensitive). -#asterix.i034_version: Version 1.27 +#asterix.i034_version: Version 1.29 (latest) # Select the CAT048 version -# One of: Version 1.23, Version 1.21, Version 1.17 +# One of: Version 1.31 (latest), Version 1.31, Version 1.30, Version 1.29, Version 1.28, Version 1.27 # (case-insensitive). -#asterix.i048_version: Version 1.23 +#asterix.i048_version: Version 1.31 (latest) # Select the CAT062 version -# One of: Version 1.18, Version 1.17, Version 1.16, Version 0.17 +# One of: Version 1.19 (latest), Version 1.19, Version 1.18, Version 1.17 # (case-insensitive). -#asterix.i062_version: Version 1.18 +#asterix.i062_version: Version 1.19 (latest) # Select the CAT063 version -# One of: Version 1.4 +# One of: Version 1.6 (latest), Version 1.6 # (case-insensitive). -#asterix.i063_version: Version 1.4 +#asterix.i063_version: Version 1.6 (latest) # Select the CAT065 version -# One of: Version 1.4, Version 1.3 +# One of: Version 1.5 (latest), Version 1.5, Version 1.4 +# (case-insensitive). +#asterix.i065_version: Version 1.5 (latest) + +# Select the CAT240 version +# One of: Version 1.3 (latest), Version 1.3 +# (case-insensitive). +#asterix.i240_version: Version 1.3 (latest) + +# Select the CAT247 version +# One of: Version 1.3 (latest), Version 1.3, Version 1.2 # (case-insensitive). -#asterix.i065_version: Version 1.4 +#asterix.i247_version: Version 1.3 (latest) # Force treat packets as DTE (PC) or DCE (Modem) role # One of: Off, Sent is DTE, Rcvd is DCE, Sent is DCE, Rcvd is DTE # (case-insensitive). #at.role: Off -# Autodection between LANE and SSCOP is hard. As default LANE is preferred +# Autodetection between LANE and SSCOP is hard. As default LANE is preferred # TRUE or FALSE (case-insensitive) #atm.dissect_lane_as_sscop: FALSE @@ -1138,13 +1118,20 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #atp.desegment: TRUE -# In the standard the Source Node Identifier is the first byte and the Control Bit Vector is the second byte. Using this parameter they can be swapped -# TRUE or FALSE (case-insensitive) -#autosar-nm.swap_ctrl_and_src: TRUE +# Define the standard version that applies to the CBV field +# One of: AUTOSAR 3.0 or 3.1, AUTOSAR 3.2, AUTOSAR 4.0, AUTOSAR 4.1 or newer, AUTOSAR 20-11 +# (case-insensitive). +#autosar-nm.cbv_version: AUTOSAR 4.1 or newer -# Revision 4.3.1 of the specification doesn't have 'NM Coordinator Id' in Control Bit Vector. Using this parameter one may switch to a mode compatible with revision 3.2 of the specification. -# TRUE or FALSE (case-insensitive) -#autosar-nm.interpret_coord_id: FALSE +# Make the NM dissector interpret this byte as Control Bit Vector (CBV) +# One of: Byte Position 0, Byte Position 1, Turned off +# (case-insensitive). +#autosar-nm.cbv_position: Byte Position 0 + +# Make the NM dissector interpret this byte as Source Node Identifier (SNI) +# One of: Byte Position 0, Byte Position 1, Turned off +# (case-insensitive). +#autosar-nm.sni_position: Byte Position 1 # Identifier that is used to filter packets that should be dissected. Set bit 31 when defining an extended id. (works with the mask defined below) # A hexadecimal number @@ -1152,7 +1139,15 @@ protocols.display_hidden_proto_items: TRUE # Mask applied to CAN identifiers when decoding whether a packet should dissected. Use 0xFFFFFFFF mask to require exact match. # A hexadecimal number -#autosar-nm.can_id_mask: 0 +#autosar-nm.can_id_mask: 0xffffffff + +# PDU Transport IDs. +# A string denoting an positive integer range (e.g., "1-20,30-40") +#autosar-nm.pdu_transport.ids: + +# I-PDU Multiplexer PDU IDs. +# A string denoting an positive integer range (e.g., "1-20,30-40") +#autosar-nm.ipdum.pdu.id: # Enable checksum calculation. # TRUE or FALSE (case-insensitive) @@ -1219,6 +1214,10 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #bittorrent.decode_client: FALSE +# The maximum size of the buffer for uncompressed messages. If a message is larger than this, then the packet containing the message, as well as subsequent packets, will fail to decompress +# A decimal number +#blip.max_uncompressed_size: 64 + # Force decoding stream as A2DP with Content Protection SCMS-T # TRUE or FALSE (case-insensitive) #bta2dp.a2dp.content_protection.scms_t: FALSE @@ -1289,31 +1288,42 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #bthci_acl.hci_acl_reassembly: TRUE +# Whether the ISO dissector should reassemble fragmented PDUs +# TRUE or FALSE (case-insensitive) +#bthci_iso.hci_iso_reassembly: TRUE + # Whether the BMP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #bmp.desegment: TRUE -# For the sake of sub-dissectors registering to accept data from the BSSAP/BSAP dissector, this defines whether it is identified as BSSAP or BSAP. -# One of: BSSAP, BSAP -# (case-insensitive). -#bssap.bsap_or_bssap: BSSAP +# If enabled, the blocks will have CRC checks performed. +# TRUE or FALSE (case-insensitive) +#bpv7.bp_compute_crc: TRUE + +# Whether the dissector should reassemble fragmented bundle payloads. +# TRUE or FALSE (case-insensitive) +#bpv7.bp_reassemble_payload: TRUE + +# When dissecting block type-specific data and payload and no destination matches, attempt heuristic dissection. +# TRUE or FALSE (case-insensitive) +#bpv7.bp_payload_try_heur: FALSE -# GSM-A is the interface between the BSC and the MSC. Lb is the interface between the BSC and the SMLC. -# One of: GSM A, Lb +# The default protocol assumed by the heuristic dissector,which does not easily distinguish between BSSAP (on the GSM A interface between the BSC and the MSC), BSSAP-LE (on the GSM Lb interface between the BSC and the SMLC), and BSAP (on the CDMA2000 A interface between the BS and MSC). +# One of: BSSAP (GSM A-I/F), BSAP (CDMA2000 A-I/F), BSSAP-LE (GSM Lb-I/F) # (case-insensitive). -#bssap.gsm_or_lb_interface: GSM A +#bssap.default_protocol: BSSAP (GSM A-I/F) -# Set Subsystem number used for BSSAP+ -# A decimal number -#bssap_plus.ssn: 98 +# Make the uTP dissector analyze uTP sequence numbers. Currently this just means that it tries to find the correct start offset of a PDU if it detected that previous in-order packets spanned multiple frames. +# TRUE or FALSE (case-insensitive) +#bt-utp.analyze_sequence_numbers: TRUE -# Decode NRI (for use with SGSN in Pool) +# Whether the dissector should attempt to dissect packets with the obsolete format (version 0) that predates BEP 29 (22-Jun-2009) # TRUE or FALSE (case-insensitive) -#bssgp.decode_nri: FALSE +#bt-utp.enable_version0: FALSE -# NRI length, in bits -# A decimal number -#bssgp.nri_length: 4 +# Maximum receive window size allowed by the dissector. Early clients (and a few modern ones) set this value to 0x380000 (the default), later ones use smaller values like 0x100000 and 0x40000. A higher value can detect nonstandard packets, but at the cost of false positives. +# A hexadecimal number +#bt-utp.max_window_size: 0x380000 # Dissect next layer # TRUE or FALSE (case-insensitive) @@ -1344,10 +1354,6 @@ protocols.display_hidden_proto_items: TRUE # A string denoting an positive integer range (e.g., "1-20,30-40") #camel.tcap.ssn: 146 -# Enable response time analysis -# TRUE or FALSE (case-insensitive) -#camel.srt: FALSE - # Statistics for Response Time # TRUE or FALSE (case-insensitive) #camel.persistentsrt: FALSE @@ -1444,6 +1450,10 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #cip.enhanced_info_column: TRUE +# Whether the CIP Motion dissector always display the full raw attribute data bytes +# TRUE or FALSE (case-insensitive) +#cipm.display_full_attribute_data: FALSE + # NSAP selector for Transport Protocol (last byte in hex) # A hexadecimal number #clnp.tp_nsap_selector: 0x21 @@ -1472,6 +1482,14 @@ protocols.display_hidden_proto_items: TRUE # A decimal number #cmp.tcp_style_http_alternate_port: 0 +# Whether to base64-encode the Community ID hash value +# TRUE or FALSE (case-insensitive) +#communityid.do_base64: TRUE + +# A 16-bit seed value to add to the hashed data +# A decimal number +#communityid.seed: 0 + # Whether the COPS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #cops.desegment: TRUE @@ -1493,11 +1511,11 @@ protocols.display_hidden_proto_items: TRUE # (case-insensitive). #cotp.tsap_display: As strings if printable -# Whether to decode OSI TPDUs with ATN (Aereonautical Telecommunications Network) extensions. To use this option, you must also enable "Always try to decode NSDU as transport PDUs" in the CLNP protocol settings. +# Whether to decode OSI TPDUs with ATN (Aeronautical Telecommunications Network) extensions. To use this option, you must also enable "Always try to decode NSDU as transport PDUs" in the CLNP protocol settings. # TRUE or FALSE (case-insensitive) #cotp.decode_atn: FALSE -# Whether the memcache dissector should reassemble PDUs spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. +# Whether the Couchbase dissector should reassemble PDUs spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #couchbase.desegment_pdus: TRUE @@ -1553,6 +1571,10 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #dccp.check_checksum: TRUE +# Make the DCCP dissector use relative sequence numbers instead of absolute ones. +# TRUE or FALSE (case-insensitive) +#dccp.relative_sequence_numbers: TRUE + # Whether the DCE/RPC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #dcerpc.desegment_dcerpc: TRUE @@ -1585,6 +1607,10 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #dct2000.convert_old_protocol_names: FALSE +# When set, if there is a Wireshark dissector matching the protocol name, it will parse the PDU using that dissector. This may be slow, so should be disabled unless you are using this feature. +# TRUE or FALSE (case-insensitive) +#dct2000.use_protocol_name_as_dissector_name: FALSE + # Novell Servers option 85 can be configured as a string instead of address # TRUE or FALSE (case-insensitive) #dhcp.novellserverstring: FALSE @@ -1615,10 +1641,6 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #dhcpv6.bulk_leasequery.desegment: TRUE -# SCTP ports to be decoded as Diameter (default: 3868) -# A string denoting an positive integer range (e.g., "1-20,30-40") -#diameter.sctp.ports: 3868 - # Whether the Diameter dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #diameter.desegment: TRUE @@ -1655,9 +1677,9 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #djiuav.desegment: TRUE -# Set the SCTP port for Distributed Lock Manager -# A decimal number -#dlm3.sctp.port: 21064 +# Whether the DLEP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. +# TRUE or FALSE (case-insensitive) +#dlep.desegment: TRUE # Select the type of decoding for nationally-defined values # One of: None (raw data), As for regular, Thales XOmail @@ -1724,6 +1746,10 @@ protocols.display_hidden_proto_items: TRUE # A decimal number #dof.custom_dof_track_operations_window: 5 +# Should the dissector hide the names for addresses? +# TRUE or FALSE (case-insensitive) +#doip.hide_address_name_entries: TRUE + # Whether the DRDA dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #drda.desegment: TRUE @@ -1732,12 +1758,24 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #dsi.desegment: TRUE +# Semicolon-separated list of private RSA keys used for DTLS decryption. Used by versions of Wireshark prior to 1.6 +# A string +#dtls.keys_list: + # redirect dtls debug to file name; leave empty to disable debug, use "-" to redirect output to stderr # # A path to a file #dtls.debug_file: -# Pre-Shared-Key as HEX string. Should be 0 to 16 bytes. +# Default client Connection ID length used when the Client Handshake message is missing +# A decimal number +#dtls.client_cid_length: 0 + +# Default server Connection ID length used when the Server Handshake message is missing +# A decimal number +#dtls.server_cid_length: 0 + +# Pre-Shared Key as HEX string. Should be 0 to 16 bytes. # A string #dtls.psk: @@ -1753,10 +1791,28 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #dvb-ci.dissect_lsc_msg: FALSE +# Check this to enable full protocol dissection of data above BBHeader +# TRUE or FALSE (case-insensitive) +#dvb-s2_modeadapt.decode_df: FALSE + # Check this to enable full protocol dissection of data above GSE Layer # TRUE or FALSE (case-insensitive) #dvb-s2_modeadapt.full_decode: FALSE +# The preferred Mode Adaptation Interface +# One of: L.1 (0 bytes), L.2 (2 bytes including sync), L.3 (4 bytes including sync), L.4 (3 bytes) +# (case-insensitive). +#dvb-s2_modeadapt.default_modeadapt: L.3 (4 bytes including sync) + +# Try all supported Mode Adaptation Interface Types, using the preferred value in the case of ambiguity; if unset, only look for Base Band Frames with the preferred type +# TRUE or FALSE (case-insensitive) +#dvb-s2_modeadapt.try_all_modeadapt: TRUE + +# defines the RCS protocol version used in table dissection +# One of: RCS protocol, RCS2 protocol +# (case-insensitive). +#dvb-s2_table.rcs_protocol: RCS2 protocol + # Allow only packets with Major=0x03//Minor=0xFF as DVMRP V3 packets # TRUE or FALSE (case-insensitive) #dvmrp.strict_v3: FALSE @@ -1800,7 +1856,7 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #epl.show_soc_flags: FALSE -# For analysis purposes one might want to show the command layer even if the dissectore assumes a duplicated frame +# For analysis purposes one might want to show the command layer even if the dissector assumes a duplicated frame # TRUE or FALSE (case-insensitive) #epl.show_duplicated_command_layer: FALSE @@ -1842,7 +1898,7 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #gsm_abis_pgsl.ir: FALSE -# This is done only if the Decoding is not SET or the packet does not belong to a SA. Assumes a 12 byte auth (HMAC-SHA1-96/HMAC-MD5-96/AES-XCBC-MAC-96) and attempts decode based on the ethertype 13 bytes from packet end +# This is done only if the Decoding is not SET or the packet does not belong to a SA. Tries ICV lengths of 12, 16, 24, and 32 bytes, checks for valid padding, and attempts to decode based on the derived Next Header field. Does not detect ENCR_NULL_AUTH_AES_GMAC (i.e. assumes 0 length IV) # TRUE or FALSE (case-insensitive) #esp.enable_null_encryption_decode_heuristic: FALSE @@ -1866,17 +1922,23 @@ protocols.display_hidden_proto_items: TRUE # A path to a directory #etch.file: -# Some devices add trailing data to frames. When this setting is checked the Ethernet dissector will assume there has been added padding to the frame before the trailer was added. Uncheck if a device added a trailer before the frame was padded. -# TRUE or FALSE (case-insensitive) -#eth.assume_padding: TRUE +# Some devices add trailing data to frames. Depending on where this device exists in the network, padding could be added to short frames before the additional trailer. This option determines how that padding will be detected. +# +# Never - Don't detect any padding. Any bytes after the ethernet payload will be considered trailer. +# Zeros (default) - Consecutive bytes of zeros up to the minimum ethernet frame size will be treated as padding. Additional bytes will be considered trailer. +# Any - Any bytes after the payload up to the minimum ethernet frame size will be treated as padding. Additional bytes will be considered trailer. +# One of: Never, Zeros, Any +# (case-insensitive). +#eth.padding: Zeros # Some TAPs add a fixed length ethernet trailer at the end of the frame, but before the (optional) FCS. Make sure it gets interpreted correctly. # A decimal number #eth.trailer_length: 0 -# Some Ethernet adapters and drivers include the FCS at the end of a packet, others do not. The Ethernet dissector attempts to guess whether a captured packet has an FCS, but it cannot always guess correctly. -# TRUE or FALSE (case-insensitive) -#eth.assume_fcs: FALSE +# Some Ethernet adapters and drivers include the FCS at the end of a packet, others do not. Some capture file formats and protocols do not indicate whether or not the FCS is included. The Ethernet dissector then attempts to guess whether a captured packet has an FCS, but it cannot always guess correctly. This option can override that heuristic and assume that the FCS is either never or always present in such cases. +# One of: According to heuristic, Never, Always +# (case-insensitive). +#eth.fcs: According to heuristic # Whether to validate the Frame Check Sequence # TRUE or FALSE (case-insensitive) @@ -1910,9 +1972,9 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #evrc.legacy_pt_60: FALSE -# The dynamic payload type which will be interpreted as EVS; The value must be greater than 95 -# A decimal number -#evs.dynamic.payload.type: 0 +# Decode payload assuming that Header-Full format only is used +# TRUE or FALSE (case-insensitive) +#evs.hf_only: FALSE # Controls the display of the session's username in the info column. This is only displayed if the packet containing it was seen during this capture session. # TRUE or FALSE (case-insensitive) @@ -1922,13 +1984,17 @@ protocols.display_hidden_proto_items: TRUE # TRUE or FALSE (case-insensitive) #exec.info_show_command: FALSE +# In a few cases a short ethernet frame will be padded with non-zerobytes. If this happens, an f5ethtrailer will not be found.Enabling this will step through each byte of the ethernet trailerto try and find the start of an f5ethtrailer +# TRUE or FALSE (case-insensitive) +#f5ethtrailer.pref_walk_trailer: FALSE + # Disable this if you do not want this dissector to populate well-known fields in other dissectors (i.e. ip.addr, ipv6.addr, tcp.port and udp.port). Enabling this will allow filters that reference those fields to also find data in the trailers but will reduce performance. After disabling, you should restart Wireshark to get performance back. # TRUE or FALSE (case-insensitive) -#f5ethtrailer.pop_other_fields: FALSE +#f5ethtrailer.pref_pop_other_fields: FALSE # Enabling this will perform analysis of the trailer data. It will enable taps on other protocols and slow down Wireshark. # TRUE or FALSE (case-insensitive) -#f5ethtrailer.perform_analysis: TRUE +#f5ethtrailer.perform_analysis: FALSE # In/out only removes slot/tmm information. Brief shortens the string to >S/T (for in) or