Nick: adamerso E-mail: none Board: unknown Contents: rs in the SRVCC PS-to-CS messages. # This is needed until there's a reliable way to determine the contents of the transparent containers. # One of: Don't decode, Assume UTRAN target # (case-insensitive). #gtpv2.decode_srvcc_p2c_trans_cont_target: Don't decode # H.225 Server TLS Port # A decimal number #h225.tls.port: 1300 # Whether the H.225 dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #h225.reassembly: TRUE # ON - display tunnelled H.245 inside H.225.0 tree, OFF - display tunnelled H.245 in root tree after H.225.0 # TRUE or FALSE (case-insensitive) #h225.h245_in_tree: TRUE # ON - display tunnelled protocols inside H.225.0 tree, OFF - display tunnelled protocols in root tree after H.225.0 # TRUE or FALSE (case-insensitive) #h225.tp_in_tree: TRUE # Whether the H.245 dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #h245.reassembly: TRUE # Whether the dissector should show short names or the long names from the standard # TRUE or FALSE (case-insensitive) #h245.shorttypes: FALSE # Whether the dissector should print items of h245 Info column in reversed order # TRUE or FALSE (case-insensitive) #h245.prepand: FALSE # Desegment H.501 messages that span more TCP segments # TRUE or FALSE (case-insensitive) #h501.desegment: TRUE # Maintain relationships between transactions and contexts and display an extra tree showing context data # TRUE or FALSE (case-insensitive) #h248.ctx_info: FALSE # Desegment H.248 messages that span more TCP segments # TRUE or FALSE (case-insensitive) #h248.desegment: TRUE # The dynamic payload type which will be interpreted as H264; The value must be greater than 95 # A decimal number #h263p.dynamic.payload.type: 0 # Dynamic payload types which will be interpreted as H264; Values must be in the range 96 - 127 # A string denoting an positive integer range (e.g., "1-20,30-40") #h264.dynamic.payload.type: # Whether the HART-IP dissector should desegment all messages spanning multiple TCP segments # TRUE or FALSE (case-insensitive) #hart_ip.desegment: TRUE # Whether the hazel dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #hzlcst.desegment: TRUE # Whether the ACL dissector should reassemble fragmented PDUs # TRUE or FALSE (case-insensitive) #bthci_acl.hci_acl_reassembly: TRUE # The ethernet type used for L2 communications # A decimal number #hcrt.dissector_ethertype: 61522 # Specifies that the raw text of the HL7 message should be displayed in addition to the dissection tree # TRUE or FALSE (case-insensitive) #hl7.display_raw: FALSE # Specifies that the LLP session information should be displayed (Start/End Of Block) in addition to the dissection tree # TRUE or FALSE (case-insensitive) #hl7.display_llp: FALSE # Set the port for HNBAP messages (Default of 29169) # A decimal number #hnbap.port: 29169 # Whether the HPFEEDS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #hpfeeds.desegment_hpfeeds_messages: TRUE # Try to decode the payload using an heuristic sub-dissector # TRUE or FALSE (case-insensitive) #hpfeeds.try_heuristic: TRUE # Whether the HTTP dissector should reassemble headers of a request spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #http.desegment_headers: TRUE # Whether the HTTP dissector should use the "Content-length:" value, if present, to reassemble the body of a request spanning multiple TCP segments, and reassemble chunked data spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #http.desegment_body: TRUE # Whether to reassemble bodies of entities that are transferred using the "Transfer-Encoding: chunked" method # TRUE or FALSE (case-insensitive) #http.dechunk_body: TRUE # Whether to uncompress entity bodies that are compressed using "Content-Encoding: " # TRUE or FALSE (case-insensitive) #http.decompress_body: TRUE # SCTP Ports range # A string denoting an positive integer range (e.g., "1-20,30-40") #http.sctp.port: 80 # SSL/TLS Ports range # A string denoting an positive integer range (e.g., "1-20,30-40") #http.ssl.port: 443 # The UDP port for RROCE messages (default 4791) # A decimal number #infiniband.rroce.port: 4791 # Try to decode a packet using an heuristic sub-dissector before using Decode As # TRUE or FALSE (case-insensitive) #infiniband.try_heuristic_first: TRUE # Maximum number of batch requests allowed # A decimal number #icep.max_batch_requests: 64 # Maximum length allowed of an ICEP string # A decimal number #icep.max_ice_string_len: 512 # Maximum number of context pairs allowed # A decimal number #icep.max_ice_context_pairs: 64 # Whether the 128th and following bytes of the ICMP payload should be decoded as MPLS extensions or as a portion of the original packet # TRUE or FALSE (case-insensitive) #icmp.favor_icmp_mpls: FALSE # Whether fragmented 802.11 datagrams should be reassembled # TRUE or FALSE (case-insensitive) #wlan.defragment: TRUE # Don't dissect 802.11n draft HT elements (which might contain duplicate information). # TRUE or FALSE (case-insensitive) #wlan.ignore_draft_ht: FALSE # Whether retransmitted 802.11 frames should be subdissected # TRUE or FALSE (case-insensitive) #wlan.retransmitted: TRUE # Some 802.11 cards include the FCS at the end of a packet, others do not. # TRUE or FALSE (case-insensitive) #wlan.check_fcs: FALSE # Whether to validate the FCS checksum or not. # TRUE or FALSE (case-insensitive) #wlan.check_checksum: TRUE # Some 802.11 cards leave the Protection bit set even though the packet is decrypted, and some also leave the IV (initialization vector). # One of: No, Yes - without IV, Yes - with IV # (case-insensitive). #wlan.ignore_wep: No # Enable WEP and WPA/WPA2 decryption # TRUE or FALSE (case-insensitive) #wlan.enable_decryption: TRUE # (Hexadecimal) Ethertype used to indicate IEEE 802.15.4 frame. # A hexadecimal number #wpan.802154_ethertype: 0x809a # Set if the FCS field is in TI CC24xx format. # TRUE or FALSE (case-insensitive) #wpan.802154_cc24xx: FALSE # Dissect payload only if FCS is valid. # TRUE or FALSE (case-insensitive) #wpan.802154_fcs_ok: TRUE # Specifies the security suite to use for 802.15.4-2003 secured frames (only supported suites are listed). Option ignored for 802.15.4-2006 and unsecured frames. # One of: AES-128 Encryption, 128-bit Integrity Protection, AES-128 Encryption, 64-bit Integrity Protection, AES-128 Encryption, 32-bit Integrity Protection # (case-insensitive). #wpan.802154_sec_suite: AES-128 Encryption, 64-bit Integrity Protection # Set if the manufacturer extends the authentication data with the security header. Option ignored for 802.15.4-2006 and unsecured frames. # TRUE or FALSE (case-insensitive) #wpan.802154_extend_auth: TRUE # (Hexadecimal) Ethertype used to indicate IEEE 802.1ah tag. # A hexadecimal number #ieee8021ah.8021ah_ethertype: 0x88e7 # Whether the iFCP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #ifcp.desegment: TRUE # Whether the ILP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #ilp.desegment_ilp_messages: TRUE # Whether to use heuristics for post-STARTTLS detection of encrypted IMAP conversations # TRUE or FALSE (case-insensitive) #imap.ssl_heuristic: TRUE # TCAP Subsystem numbers used for INAP # A string denoting an positive integer range (e.g., "1-20,30-40") #inap.ssn: 106,241 # Whether the IPDC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #ipdc.desegment_ipdc_messages: TRUE # FRU Language Code is English; strings are ASCII+LATIN1 (vs. Unicode) # TRUE or FALSE (case-insensitive) #ipmi.fru_langcode_is_english: TRUE # Do not search for responses coming after this timeout (milliseconds) # A decimal number #ipmi.response_after_req: 5000 # Allow for responses before requests (milliseconds) # A decimal number #ipmi.response_before_req: 0 # Format of messages embedded into Send/Get/Forward Message # One of: None, IPMB, Session-based (LAN, ...), Use heuristics # (case-insensitive). #ipmi.msgfmt: Use heuristics # Selects which OEM format is used for commands that IPMI does not define # One of: None, Pigeon Point Systems # (case-insensitive). #ipmi.selected_oem: None # Whether the IPv4 type-of-service field should be decoded as a Differentiated Services field (see RFC2474/RFC2475) # TRUE or FALSE (case-insensitive) #ip.decode_tos_as_diffserv: TRUE # Whether fragmented IPv4 datagrams should be reassembled # TRUE or FALSE (case-insensitive) #ip.defragment: TRUE # Whether the IPv4 summary line should be shown in the protocol tree # TRUE or FALSE (case-insensitive) #ip.summary_in_tree: TRUE # Whether to validate the IPv4 checksum # TRUE or FALSE (case-insensitive) #ip.check_checksum: FALSE # Whether to correct for TSO-enabled (TCP segmentation offload) hardware captures, such as spoofing the IP packet length # TRUE or FALSE (case-insensitive) #ip.tso_support: TRUE # Whether to look up IP addresses in each GeoIP database we have loaded # TRUE or FALSE (case-insensitive) #ip.use_geoip: TRUE # Whether to interpret the originally reserved flag as security flag # TRUE or FALSE (case-insensitive) #ip.security_flag: FALSE # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port # TRUE or FALSE (case-insensitive) #ip.try_heuristic_first: FALSE # Whether fragmented IPv6 datagrams should be reassembled # TRUE or FALSE (case-insensitive) #ipv6.defragment: TRUE # Whether the IPv6 summary line should be shown in the protocol tree # TRUE or FALSE (case-insensitive) #ipv6.summary_in_tree: TRUE # Whether to look up IPv6 addresses in each GeoIP database we have loaded # TRUE or FALSE (case-insensitive) #ipv6.use_geoip: TRUE # Check that all RPL Source Routed packets conform to RFC 6554 and do not visit a node more than once # TRUE or FALSE (case-insensitive) #ipv6.perform_strict_rpl_srh_rfc_checking: FALSE # Try to decode a packet using an heuristic sub-dissector before using a sub-dissector registered to a specific port # TRUE or FALSE (case-insensitive) #ipv6.try_heuristic_first: FALSE # Whether to display IPv6 extension headers as a separate protocol or a sub-protocol of the IPv6 packet # TRUE or FALSE (case-insensitive) #ipv6.exthdr_under_root_protocol_tree: FALSE # If enabled the Length field in octets will be hidden # TRUE or FALSE (case-insensitive) #ipv6.exthdr_hide_len_oct_field: FALSE # The iSCSI protocol version # One of: Draft 08, Draft 09, Draft 11, Draft 12, Draft 13 # (case-insensitive). #iscsi.protocol_version: Draft 13 # Whether the iSCSI dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #iscsi.desegment_iscsi_messages: TRUE # When enabled, packets that appear bogus are ignored # TRUE or FALSE (case-insensitive) #iscsi.bogus_pdu_filter: TRUE # Ignore packets that haven't set the F bit when they should have # TRUE or FALSE (case-insensitive) #iscsi.demand_good_f_bit: FALSE # Treat packets whose data segment length is greater than this value as bogus # A decimal number #iscsi.bogus_pdu_max_data_len: 262144 # Range of iSCSI target ports(default 3260) # A string denoting an positive integer range (e.g., "1-20,30-40") #iscsi.target_ports: 3260 # System port number of iSCSI target # A decimal number #iscsi.target_system_port: 860 # The protocol running on the D channel # One of: LAPD, DPNSS # (case-insensitive). #isdn.dchannel_protocol: LAPD # Range of iSER target ports(default 3260) # A string denoting an positive integer range (e.g., "1-20,30-40") #iser.target_ports: 3260 # The dynamic payload type which will be interpreted as ISMACryp # A decimal number #ismacryp.dynamic.payload.type: 0 # ISMACryp version # One of: ISMACryp v1.1, ISMACryp v2.0 # (case-insensitive). #ismacryp.version: ISMACryp v1.1 # Indicates whether or not the ISMACryp version deduced from RTP payload type, if present, is used or whether the version above is used # TRUE or FALSE (case-insensitive) #ismacryp.override_rtp_pt: FALSE # Set the length of the IV in the ISMACryp AU Header in bytes # A decimal number #ismacryp.iv_length: 4 # Set the length of the Delta IV in the ISMACryp AU Header in bytes # A decimal number #ismacryp.delta_iv_length: 0 # Set the length of the Key Indicator in the ISMACryp AU Header in bytes # A decimal number #ismacryp.key_indicator_length: 0 # Indicates whether or not the Key Indicator is present in all AU Headers (T/F) # TRUE or FALSE (case-insensitive) #ismacryp.key_indicator_per_au_flag: FALSE # Indicates whether or not selective encryption is enabled (T/F) # TRUE or FALSE (case-insensitive) #ismacryp.selective_encryption: TRUE # Indicates whether or not slice start / end is present (T/F) # TRUE or FALSE (case-insensitive) #ismacryp.slice_indication: FALSE # Indicates whether or not padding information is present (T/F) # TRUE or FALSE (case-insensitive) #ismacryp.padding_indication: FALSE # RFC3640 mode # One of: aac-hbr, mpeg4-video, avc-video # (case-insensitive). #ismacryp.rfc3640_mode: avc-video # Indicates use of user mode instead of RFC3640 modes (T/F) # TRUE or FALSE (case-insensitive) #ismacryp.user_mode: FALSE # Set the length of the AU size in the AU Header in bits # A decimal number #ismacryp.au_size_length: 0 # Set the length of the AU index in the AU Header in bits # A decimal number #ismacryp.au_index_length: 0 # Set the length of the AU delta index in the AU Header in bits # A decimal number #ismacryp.au_index_delta_length: 0 # Set the length of the CTS delta field in the AU Header in bits # A decimal number #ismacryp.cts_delta_length: 0 # Set the length of the DTS delta field in the AU Header in bits # A decimal number #ismacryp.dts_delta_length: 0 # Indicates whether or not the RAP field is present in the AU Header (T/F) # TRUE or FALSE (case-insensitive) #ismacryp.random_access_indication: FALSE # Indicates the number of bits on which the stream state field is encoded in the AU Header (bits) # A decimal number #ismacryp.stream_state_indication: 0 # Whether the iSNS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #isns.desegment: TRUE # Addressing of ISO 15765. Normal or Extended # One of: Normal addressing, Extended addressing # (case-insensitive). #iso15765.addressing: Normal addressing # Window of ISO 15765 fragments # A decimal number #iso15765.window: 8 # Endian of the length field. Big endian or Little endian # One of: Big endian, Little endian # (case-insensitive). #iso8583.len_endian: Little endian # charset for numbers # One of: Digits represented as ASCII Characters, Digits represented in nibbles # (case-insensitive). #iso8583.charset: Digits represented as ASCII Characters # binary data representation # One of: Bin data represented as Hex Ascii characters, Bin data not encoded # (case-insensitive). #iso8583.binencode: Bin data represented as Hex Ascii characters # Note national variants may not be fully supported # One of: ITU Standard, French National Standard, Israeli National Standard, Russian National Standard, Japan National Standard, Japan National Standard (TTC) # (case-insensitive). #isup.variant: ITU Standard # Show the CIC value (in addition to the message type) in the Info column # TRUE or FALSE (case-insensitive) #isup.show_cic_in_info: TRUE # Whether APM messages datagrams should be reassembled # TRUE or FALSE (case-insensitive) #isup.defragment_apm: TRUE # The MPLS label (aka Flow Bundle ID) used by ITDM traffic. # A hexadecimal number #itdm.mpls_label: 0x99887 # Flow Number used by I-TDM Control Protocol traffic. # A decimal number #itdm.ctl_flowno: 0 # Support Implementers Guide (version 01) # TRUE or FALSE (case-insensitive) #iua.support_ig: FALSE # Use SAPI values as specified in TS 48 056 # TRUE or FALSE (case-insensitive) #iua.use_gsm_sapi_values: TRUE # Whether IuUP Payload bits should be dissected # TRUE or FALSE (case-insensitive) #iuup.dissect_payload: FALSE # The payload contains a two byte pseudoheader indicating direction and circuit_id # TRUE or FALSE (case-insensitive) #iuup.two_byte_pseudoheader: FALSE # The dynamic payload type which will be interpreted as IuUP # A decimal number #iuup.dynamic.payload.type: 0 # Whether the trailer summary line should be shown in the protocol tree # TRUE or FALSE (case-insensitive) #ixiatrailer.summary_in_tree: TRUE # Enable to have correctly typed MIME media dissected as JXTA Messages. # TRUE or FALSE (case-insensitive) #jxta.msg.mediatype: TRUE # Whether the JXTA dissector should reassemble messages spanning multiple UDP/TCP/SCTP segments. To use this option you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings and enable "Reassemble fragmented IP datagrams" in the IP protocol settings. # TRUE or FALSE (case-insensitive) #jxta.desegment: TRUE # No description # TRUE or FALSE (case-insensitive) #kafka.show_string_bytes_lengths: FALSE # Set the SCTP port for kNet messages # A decimal number #knet.sctp.port: 2345 # Whether the Kpasswd dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #kpasswd.desegment: TRUE # Whether the Kerberos dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #kerberos.desegment: TRUE # Whether the dissector should try to decrypt encrypted Kerberos blobs. This requires that the proper keytab file is installed as well. # TRUE or FALSE (case-insensitive) #kerberos.decrypt: FALSE # The keytab file containing all the secrets # A path to a file #kerberos.file: # KT allows binary values in keys and values. Attempt to show an ASCII representation anyway (which might be prematurely terminated by a NULL! # TRUE or FALSE (case-insensitive) #kt.present_key_val_as_ascii: FALSE # Whether the L&G 8979 dissector should desegment all messages spanning multiple TCP segments # TRUE or FALSE (case-insensitive) #lg8979.desegment: TRUE # L2TPv3 Cookie Size # One of: Detect, None, 4 Byte Cookie, 8 Byte Cookie # (case-insensitive). #l2tp.cookie_size: Detect # L2TPv3 L2-Specific Sublayer # One of: Detect, None, Default L2-Specific, ATM-Specific, LAPD-Specific, DOCSIS DMPT-Specific # (case-insensitive). #l2tp.l2_specific: Detect # Shared secret used for control message digest authentication # A string #l2tp.shared_secret: # Use SAPI values as specified in TS 48 056 # TRUE or FALSE (case-insensitive) #lapd.use_gsm_sapi_values: FALSE # RTP payload type for embedded LAPD. It must be one of the dynamic types from 96 to 127. Set it to 0 to disable. # A decimal number #lapd.rtp_payload_type: 0 # SCTP Payload Protocol Identifier for LAPD. It is a 32 bits value from 0 to 4294967295. Set it to 0 to disable. # A decimal number #lapd.sctp_payload_protocol_identifier: 0 # Whether the dissector should defragment LAPDm messages spanning multiple packets. # TRUE or FALSE (case-insensitive) #lapdm.reassemble: TRUE # Whether the Laplink dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #laplink.desegment_laplink_over_tcp: TRUE # Set the SCTP port for LCSAP messages # A decimal number #lcsap.sctp.port: 9082 # Whether the LDAP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #ldap.desegment_ldap_messages: TRUE # Set the port for LDAP operations over SSL # A decimal number #ldap.ssl.port: 636 # Whether the LDP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #ldp.desegment_ldp_messages: TRUE # Which Information will be showed at Column Information is decided by the selection # One of: Default Column Info, PROFINET Special Column Info # (case-insensitive). #lldp.column_info_selection: Default Column Info # Dissect this ethertype as LLT traffic in addition to the default, 0xCAFE. # A hexadecimal number #llt.alternate_ethertype: 0 # Whether LMP contains a checksum which can be checked # TRUE or FALSE (case-insensitive) #lmp.checksum: FALSE # Use oneline info column by replace all new line characters by spaces # TRUE or FALSE (case-insensitive) #logcat.oneline_info_column: TRUE # Swap frame control bytes (needed for some APs # TRUE or FALSE (case-insensitive) #lwapp.swap_fc: FALSE # Whether to validate the LWL4 crc when crc bit is not set # TRUE or FALSE (case-insensitive) #lwl4.check_crc: TRUE # 128-bit decryption key in hexadecimal format # A string #lwm.lwmes_key: # Version used by Wireshark # One of: Internet Draft version 2, Internet Draft version 8, RFC 4165 # (case-insensitive). #m2pa.version: RFC 4165 # Set the port for M2PA messages (default: 3565) # A decimal number #m2pa.port: 3565 # The value of the parameter tag for protocol data 1 # One of: 0x000e (Draft 7), 0x0300 (RFC3331) # (case-insensitive). #m2ua.protocol_data_1_tag: 0x0300 (RFC3331) # Version used by Wireshark # One of: Internet Draft version 5, Internet Draft version 6, Internet Draft version 7, RFC 4666 # (case-insensitive). #m3ua.version: RFC 4666 # TSN size in bits, either 6 or 14 bit # One of: 6 bits, 14 bits # (case-insensitive). #mac.tsn_size: 6 bits # Number of Re-Transmits before expert warning triggered # A decimal number #mac-lte.retx_count_warn: 3 # Attempt to decode BCH, PCH and CCCH data using LTE RRC dissector # TRUE or FALSE (case-insensitive) #mac-lte.attempt_rrc_decode: TRUE # Attempt to dissect frames that have failed CRC check # TRUE or FALSE (case-insensitive) #mac-lte.attempt_to_dissect_crc_failures: FALSE # Will call LTE RLC dissector with standard settings as per RRC spec # TRUE or FALSE (case-insensitive) #mac-lte.attempt_to_dissect_srb_sdus: TRUE # Will call LTE RLC dissector for MCH LCID 0 # TRUE or FALSE (case-insensitive) #mac-lte.attempt_to_dissect_mcch: FALSE # Call RLC dissector MTCH LCIDs # TRUE or FALSE (case-insensitive) #mac-lte.call_rlc_for_mtch: FALSE # Set whether LCID -> drb Table is taken from static table (below) or from info learned from control protocol (e.g. RRC) # One of: From static table, From configuration protocol # (case-insensitive). #mac-lte.lcid_to_drb_mapping_source: From static table # If any BSR report is >= this number, an expert warning will be added # A decimal number #mac-lte.bsr_warn_threshold: 50 # Track status of SRs, providing links between requests, failure indications and grants # TRUE or FALSE (case-insensitive) #mac-lte.track_sr: TRUE # Can show PHY, MAC or RLC layer info in Info column # One of: PHY Info, MAC Info, RLC Info # (case-insensitive). #mac-lte.layer_to_show: RLC Info # Attempt to decode 6 bytes of Contention Resolution body as an UL CCCH PDU # TRUE or FALSE (case-insensitive) #mac-lte.decode_cr_body: FALSE # Apply DRX config and show DRX state within each UE # TRUE or FALSE (case-insensitive) #mac-lte.show_drx: FALSE # Add as a generated field the middle of the range indicated by the BSR index # TRUE or FALSE (case-insensitive) #mac-lte.show_bsr_median: FALSE # The name of the file containing the mate module's configuration # A path to a file #mate.config: # Decode control data received on "usb.control" with an unknown interface class as MBIM # TRUE or FALSE (case-insensitive) #mbim.control_decode_unknown_itf: FALSE # Format used for SMS PDU decoding # One of: Automatic, 3GPP, 3GPP2 # (case-insensitive). #mbim.sms_pdu_format: Automatic # Set the UDP port for the MCPE Server # A decimal number #mcpe.udp.port: 19132 # A frame is considered for decoding as MDSHDR if either ethertype is 0xFCFC or zero. Turn this flag off if you don't want ethertype zero to be decoded as MDSHDR. This might be useful to avoid problems with test frames. # TRUE or FALSE (case-insensitive) #mdshdr.decode_if_etype_zero: FALSE # Set the SCTP port for MEGACO text messages # A decimal number #megaco.sctp.txt_port: 2944 # Specifies that the raw text of the MEGACO message should be displayed instead of (or in addition to) the dissection tree # TRUE or FALSE (case-insensitive) #megaco.display_raw_text: TRUE # Specifies that the dissection tree of the MEGACO message should be displayed instead of (or in addition to) the raw text # TRUE or FALSE (case-insensitive) #megaco.display_dissect_tree: TRUE # Maintain relationships between transactions and contexts and display an extra tree showing context data # TRUE or FALSE (case-insensitive) #megaco.ctx_info: FALSE # Whether the MEMCACHE dissector should reassemble headers of a request spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #memcache.desegment_headers: TRUE # Whether the memcache dissector should reassemble PDUs spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #memcache.desegment_pdus: TRUE # Set the UDP port for gateway messages (if other than the default of 2427) # A decimal number #mgcp.tcp.gateway_port: 2427 # Set the TCP port for gateway messages (if other than the default of 2427) # A decimal number #mgcp.udp.gateway_port: 2427 # Set the TCP port for callagent messages (if other than the default of 2727) # A decimal number #mgcp.tcp.callagent_port: 2727 # Set the UDP port for callagent messages (if other than the default of 2727) # A decimal number #mgcp.udp.callagent_port: 2727 # Specifies that the raw text of the MGCP message should be displayed instead of (or in addition to) the dissection tree # TRUE or FALSE (case-insensitive) #mgcp.display_raw_text: FALSE # Display the number of MGCP messages found in a packet in the protocol column. # TRUE or FALSE (case-insensitive) #mgcp.display_mgcp_message_count: FALSE # Display multipart bodies with no media type dissector as raw text (may cause problems with binary data). # TRUE or FALSE (case-insensitive) #mime_multipart.display_unknown_body_as_text: FALSE # Remove any base64 content-transfer encoding from bodies. This supports export of the body and its further dissection. # TRUE or FALSE (case-insensitive) #mime_multipart.remove_base64_encoding: FALSE # Dissect payload only if MIC is valid. # TRUE or FALSE (case-insensitive) #mle.meshlink_mic_ok: FALSE # Register Format # One of: UINT16 , INT16 , UINT32 , INT32 , IEEE FLT , MODICON FLT # (case-insensitive). #modbus.mbus_register_format: UINT16 # Whether the Modbus RTU dissector should desegment all messages spanning multiple TCP segments # TRUE or FALSE (case-insensitive) #mbrtu.desegment: TRUE # Whether to validate the CRC # TRUE or FALSE (case-insensitive) #mbrtu.crc_verification: FALSE # Whether the Modbus RTU dissector should desegment all messages spanning multiple TCP segments # TRUE or FALSE (case-insensitive) #mbtcp.desegment: TRUE # The dynamic payload type which will be interpreted as MP4V-ES # A decimal number #mp4v-es.dynamic.payload.type: 0 # Whether the section dissector should verify the CRC or checksum # TRUE or FALSE (case-insensitive) #mpeg_dsmcc.verify_crc: FALSE # Whether the section dissector should verify the CRC # TRUE or FALSE (case-insensitive) #mpeg_sect.verify_crc: FALSE # Lowest label is used to segregate flows inside a pseudowire # TRUE or FALSE (case-insensitive) #mpls.flowlabel_in_mpls_header: FALSE # Enable to allow non-zero Length in Control Word. This may be needed to correctly decode traffic from some legacy devices which generate non-zero Length even if there is no padding in the packet. Note that Length should have proper value (dissector checks this anyway). # Disable to blame all packets with CW.Length <> 0. This conforms to RFC4717. # TRUE or FALSE (case-insensitive) #mplspwatmaal5sdu.allow_cw_length_nonzero_aal5: FALSE # Enable to use reserved bits (8..9) of Control Word as an extension of CW.Length. This may be needed to correctly decode traffic from some legacy devices which uses reserved bits as extension of Length # Disable to blame all packets with CW.Reserved <> 0. This conforms to RFC4717. # TRUE or FALSE (case-insensitive) #mplspwatmaal5sdu.extend_cw_length_with_rsvd_aal5: FALSE # Enable to allow non-zero Length in Control Word. This may be needed to correctly decode traffic from some legacy devices which generate non-zero Length even if there is no padding in the packet. Note that Length should have proper value (dissector checks this anyway). # Disable to blame all packets with CW.Length <> 0. This conforms to RFC4717. # TRUE or FALSE (case-insensitive) #mplspwatmn1cw.allow_cw_length_nonzero: FALSE # Enable to use reserved bits (8..9) of Control Word as an extension of CW.Length. This may be needed to correctly decode traffic from some legacy devices which uses reserved bits as extension of Length # Disable to blame all packets with CW.Reserved <> 0. This conforms to RFC4717. # TRUE or FALSE (case-insensitive) #mplspwatmn1cw.extend_cw_length_with_rsvd: FALSE # To use this option you must also enable "Analyze TCP sequence numbers". # TRUE or FALSE (case-insensitive) #mptcp.analyze_mptcp: TRUE # In case you don't capture the key, it will use the first DSN seen # TRUE or FALSE (case-insensitive) #mptcp.relative_sequence_numbers: TRUE # You need to capture the handshake for this to work."Map TCP subflows to their respective MPTCP connections" # TRUE or FALSE (case-insensitive) #mptcp.analyze_mappings: FALSE # You need to enable DSS mapping analysis for this option to work # TRUE or FALSE (case-insensitive) #mptcp.intersubflows_retransmission: FALSE # Whether the MQ dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #mq.desegment: TRUE # Whether the MQ dissector should reassemble MQ messages spanning multiple TSH segments # TRUE or FALSE (case-insensitive) #mq.reassembly: TRUE # When dissecting PCF there can be a lot of parameters. You can limit the number of parameter decoded, before it continue with the next PCF. # A decimal number #mqpcf.maxprm: 999 # When dissecting a parameter of a PCFm, if it is a StringList, IntegerList or Integer64 List, You can limit the number of elements displayed, before it continues with the next Parameter. # A decimal number #mqpcf.maxlst: 20000 # Specifies that the raw text of the MSRP message should be displayed in addition to the dissection tree # TRUE or FALSE (case-insensitive) #msrp.display_raw_text: TRUE # Where available, show which protocol and frame caused this MSRP stream to be created # TRUE or FALSE (case-insensitive) #msrp.show_setup_info: TRUE # Whether the MTP2 dissector should use extended sequence numbers as described in Q.703, Annex A as a default. # TRUE or FALSE (case-insensitive) #mtp2.use_extended_sequence_numbers: FALSE # This only works for SCCP traffic for now # TRUE or FALSE (case-insensitive) #mtp3.heuristic_standard: FALSE # The SS7 standard used in MTP3 packets # One of: ITU, ANSI, Chinese ITU, Japan # (case-insensitive). #mtp3.standard: ITU # The structure of the pointcodes in ITU networks # One of: Unstructured, 3-8-3, 4-3-4-3 # (case-insensitive). #mtp3.itu_pc_structure: Unstructured # The structure of the pointcodes in Japan networks # One of: Unstructured, 7-4-5, 3-4-4-5 # (case-insensitive). #mtp3.japan_pc_structure: Unstructured # Use 5-bit (instead of 8-bit) SLS in ANSI MTP3 packets # TRUE or FALSE (case-insensitive) #mtp3.ansi_5_bit_sls: FALSE # Use 5-bit (instead of 4-bit) SLS in Japan MTP3 packets # TRUE or FALSE (case-insensitive) #mtp3.japan_5_bit_sls: FALSE # Format for point code in the address columns # One of: Decimal, Hexadecimal, NI-Decimal, NI-Hexadecimal, Dashed # (case-insensitive). #mtp3.addr_format: Dashed # Decode the spare bits of the SIO as the MSU priority (a national option in ITU) # TRUE or FALSE (case-insensitive) #mtp3.itu_priority: FALSE # Whether the MySQL dissector should reassemble MySQL buffers spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #mysql.desegment_buffers: TRUE # Whether the MySQL dissector should display the SQL query string in the INFO column. # TRUE or FALSE (case-insensitive) #mysql.show_sql_query: FALSE # Always dissect NAS EPS messages as plain # TRUE or FALSE (case-insensitive) #nas-eps.dissect_plain: FALSE # This should work when the NAS ciphering algorithm is NULL (128-EEA0) # TRUE or FALSE (case-insensitive) #nas-eps.null_decipher: TRUE # No description # TRUE or FALSE (case-insensitive) #nas-eps.user_data_container_as_ip: TRUE # Whether the Nasdaq ITCH dissector should decode Chi X extensions. # TRUE or FALSE (case-insensitive) #nasdaq_itch.chi_x: TRUE # Whether the Nasdaq-SoupTCP dissector should reassemble messages spanning multiple TCP segments. # TRUE or FALSE (case-insensitive) #nasdaq_soup.desegment: TRUE # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch1_content: MAC_CONTENT_DCCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch2_content: MAC_CONTENT_DCCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch3_content: MAC_CONTENT_DCCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch4_content: MAC_CONTENT_DCCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch5_content: MAC_CONTENT_CS_DTCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch6_content: MAC_CONTENT_CS_DTCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch7_content: MAC_CONTENT_CS_DTCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch8_content: MAC_CONTENT_DCCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch9_content: MAC_CONTENT_PS_DTCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch10_content: MAC_CONTENT_UNKNOWN # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch11_content: MAC_CONTENT_PS_DTCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch12_content: MAC_CONTENT_PS_DTCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch13_content: MAC_CONTENT_CS_DTCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch14_content: MAC_CONTENT_PS_DTCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch15_content: MAC_CONTENT_CCCH # foo # One of: MAC_CONTENT_UNKNOWN, MAC_CONTENT_DCCH, MAC_CONTENT_PS_DTCH, MAC_CONTENT_CS_DTCH, MAC_CONTENT_CCCH # (case-insensitive). #nbap.lch16_content: MAC_CONTENT_DCCH # Whether the NBD dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings # TRUE or FALSE (case-insensitive) #nbd.desegment_nbd_messages: TRUE # Whether the NBSS dissector should reassemble packets spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #nbss.desegment_nbss_commands: TRUE # Whether the NCP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #ncp.desegment: TRUE # Whether the NCP dissector should defragment NDS messages spanning multiple reply packets. # TRUE or FALSE (case-insensitive) #ncp.defragment_nds: TRUE # Dissect the NetWare Information Structure as NetWare 5.x or higher or as older NetWare 3.x. # TRUE or FALSE (case-insensitive) #ncp.newstyle: TRUE # Whether the NCP dissector should echo the NDS Entry ID to name resolves to the expert table. # TRUE or FALSE (case-insensitive) #ncp.eid_2_expert: TRUE # Whether the NCP dissector should echo NCP connection information to the expert table. # TRUE or FALSE (case-insensitive) #ncp.connection_2_expert: FALSE # Whether the NCP dissector should echo protocol errors to the expert table. # TRUE or FALSE (case-insensitive) #ncp.error_2_expert: TRUE # Whether the NCP dissector should echo server information to the expert table. # TRUE or FALSE (case-insensitive) #ncp.server_2_expert: TRUE # Whether the NCP dissector should echo file open/close/oplock information to the expert table. # TRUE or FALSE (case-insensitive) #ncp.file_2_expert: FALSE # Version of the NDMP protocol to assume if the version can not be automatically detected from the capture # One of: Version 2, Version 3, Version 4, Version 5 # (case-insensitive). #ndmp.default_protocol_version: Version 4 # Whether the NDMP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #ndmp.desegment: TRUE # Whether the dissector should defragment NDMP messages spanning multiple packets. # TRUE or FALSE (case-insensitive) #ndmp.defragment: TRUE # Whether the NDPS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #ndps.desegment_tcp: TRUE # Whether the NDPS dissector should reassemble fragmented NDPS messages spanning multiple SPX packets # TRUE or FALSE (case-insensitive) #ndps.desegment_spx: TRUE # Whether or not the NDPS dissector should show object id's and other details # TRUE or FALSE (case-insensitive) #ndps.show_oid: FALSE # Whether the NetBIOS dissector should defragment messages spanning multiple frames # TRUE or FALSE (case-insensitive) #netbios.defragment: TRUE # Whether the Netsync dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #netsync.desegment_netsync_messages: TRUE # Whether the dissector should snoop the FH to filename mappings by looking inside certain packets # TRUE or FALSE (case-insensitive) #nfs.file_name_snooping: FALSE # Whether the dissector should snoop the full pathname for files for matching FH's # TRUE or FALSE (case-insensitive) #nfs.file_full_name_snooping: FALSE # With this option display filters for nfs fhandles (nfs.fh.{name|full_name|hash}) will find both the request and response packets for a RPC call, even if the actual fhandle is only present in one of the packets # TRUE or FALSE (case-insensitive) #nfs.fhandle_find_both_reqrep: FALSE # When enabled, this option will print the NFSv4 tag (if one exists) in the Info column in the Summary pane # TRUE or FALSE (case-insensitive) #nfs.display_nfsv4_tag: TRUE # When enabled, shows only the significant NFSv4 Operations in the info column. Others (like GETFH, PUTFH, etc) are not displayed # TRUE or FALSE (case-insensitive) #nfs.display_major_nfsv4_ops: TRUE # Whether the Authentication Extension data contains the source address. Some Cisco IOS implementations forgo this part of RFC2332. # TRUE or FALSE (case-insensitive) #nhrp.auth_ext_has_addr: TRUE # Whether the dissector will track and match MSG and RES calls for asynchronous NLM # TRUE or FALSE (case-insensitive) #nlm.msg_res_matching: FALSE # In the standard the Source Node Identifier is the first byte and the Control Bit Vector is the second byte. Using this parameter they can be swapped # TRUE or FALSE (case-insensitive) #nm.swap_ctrl_and_src: TRUE # NT Password (used to decrypt payloads) # A string #ntlmssp.nt_password: # Range of NVMe Subsystem ports(default 4420) # A string denoting an positive integer range (e.g., "1-20,30-40") #nvme-rdma.subsystem_ports: 4420 # Dissect custom olsr.org message types (compatible with rfc routing agents) # TRUE or FALSE (case-insensitive) #olsr.ff_olsrorg: TRUE # Dissect custom nrlolsr tc message (incompatible with rfc routing agents) # TRUE or FALSE (case-insensitive) #olsr.nrlolsr: TRUE # SSL/TLS Ports range # A string denoting an positive integer range (e.g., "1-20,30-40") #opa.fe.ssl.port: 3249-3252 # Attempt to parse mad payload even when MAD.Status is non-zero # TRUE or FALSE (case-insensitive) #opa.mad.parse_mad_error: FALSE # Whether the OpenFlow dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #openflow.desegment: TRUE # To be able to fully dissect SSDO and SPDO packages, a valid UDID for the SCM has to be provided # A string #opensafety.scm_udid: 00:00:00:00:00:00 # Automatically assign a detected SCM UDID (by reading SNMT->SNTM_assign_UDID_SCM) and set it for the file # TRUE or FALSE (case-insensitive) #opensafety.scm_udid_autoset: TRUE # A comma-separated list of nodes to be filtered during dissection # A string #opensafety.filter_nodes: # If set to true, only nodes in the list will be shown, otherwise they will be hidden # TRUE or FALSE (case-insensitive) #opensafety.filter_show_nodes_in_filterlist: TRUE # Port used by any UDP demo implementation to transport data # A decimal number #opensafety.network_udp_port: 9877 # UDP port used by SercosIII to transport data # A decimal number #opensafety.network_udp_port_sercosiii: 8755 # In an SercosIII/UDP transport stream, openSAFETY frame 2 will be expected before frame 1 # TRUE or FALSE (case-insensitive) #opensafety.network_udp_frame_first_sercosiii: FALSE # In the transport stream, openSAFETY frame 2 will be expected before frame 1 # TRUE or FALSE (case-insensitive) #opensafety.network_udp_frame_first: FALSE # Modbus/TCP words can be transcoded either big- or little endian. Default will be little endian # TRUE or FALSE (case-insensitive) #opensafety.mbtcp_big_endian: FALSE # Enables additional information in the dissection for better debugging an openSAFETY trace # TRUE or FALSE (case-insensitive) #opensafety.debug_verbose: FALSE # Enable heuristic dissection for openSAFETY over UDP encoded traffic # TRUE or FALSE (case-insensitive) #opensafety.enable_udp: TRUE # Enable heuristic dissection for Modbus/TCP # TRUE or FALSE (case-insensitive) #opensafety.enable_mbtcp: TRUE # Display the data between openSAFETY packets # TRUE or FALSE (case-insensitive) #opensafety.display_intergap_data: FALSE # SPDOs may only be found in cyclic data, SSDOs/SNMTS only in acyclic data # TRUE or FALSE (case-insensitive) #opensafety.classify_transport: TRUE # If tls-auth detection fails, you can choose to override detection and set tls-auth yourself # TRUE or FALSE (case-insensitive) #openvpn.tls_auth_detection_override: FALSE # If the parameter --tls-auth is used, the following preferences must also be defined. # TRUE or FALSE (case-insensitive) #openvpn.tls_auth: FALSE # If the parameter --tls-auth is used, a HMAC header is being inserted. # The default HMAC algorithm is SHA-1 which generates a 160 bit HMAC, therefore 20 bytes should be ok. # The value must be between 20 (160 bits) and 64 (512 bits). # A decimal number #openvpn.tls_auth_hmac_size: 20 # If the parameter --tls-auth is used, an additional packet-id for replay protection is inserted after the HMAC signature. This field can either be 4 bytes or 8 bytes including an optional time_t timestamp long. # This option is only evaluated if tls_auth_hmac_size > 0. # The default value is TRUE. # TRUE or FALSE (case-insensitive) #openvpn.long_format: TRUE # Whether the Openwire dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #openwire.desegment: TRUE # Whether verbose type and length information are displayed in the protocol tree # TRUE or FALSE (case-insensitive) #openwire.verbose_type: FALSE # Whether the OPSI dissector should desegment all messages spanning multiple TCP segments # TRUE or FALSE (case-insensitive) #opsi.desegment_opsi_messages: TRUE # Whether segmented TPKT datagrams should be reassembled # TRUE or FALSE (case-insensitive) #osi.tpkt_reassemble: FALSE # Whether segmented RTSE datagrams should be reassembled. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #rtse.reassemble: TRUE # Whether the IDMP dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #idmp.desegment_idmp_messages: TRUE # Whether segmented IDMP datagrams should be reassembled. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #idmp.reassemble: TRUE # Reassemble fragmented P_Mul packets # TRUE or FALSE (case-insensitive) #p_mul.reassemble: TRUE # Make the P_Mul dissector use relative message id number instead of absolute ones # TRUE or FALSE (case-insensitive) #p_mul.relative_msgid: TRUE # Calculate sequence/acknowledgement analysis # TRUE or FALSE (case-insensitive) #p_mul.seq_ack_analysis: TRUE # Type of content in Data_PDU # One of: No decoding, BER encoded ASN.1, Compressed Data Type # (case-insensitive). #p_mul.decode: No decoding # Attempt to decode parts of the message that aren't fully understood yet # TRUE or FALSE (case-insensitive) #papi.experimental_decode: FALSE # SCCP (and SUA) SSNs to decode as PCAP # A string denoting an positive integer range (e.g., "1-20,30-40") #pcap.ssn: # Whether the PCLI summary line should be shown in the protocol tree # TRUE or FALSE (case-insensitive) #pcli.summary_in_tree: TRUE # Show uncompressed User-Plane data as IP # TRUE or FALSE (case-insensitive) #pdcp-lte.show_user_plane_as_ip: TRUE # Show unciphered Signalling-Plane data as RRC # TRUE or FALSE (case-insensitive) #pdcp-lte.show_signalling_plane_as_rrc: TRUE # Do sequence number analysis # One of: No-Analysis, Only-RLC-frames, Only-PDCP-frames # (case-insensitive). #pdcp-lte.check_sequence_numbers: Only-RLC-frames # Attempt to decode ROHC data # TRUE or FALSE (case-insensitive) #pdcp-lte.dissect_rohc: FALSE # Can show RLC, PDCP or Traffic layer info in Info column # One of: RLC Info, PDCP Info, Traffic Info # (case-insensitive). #pdcp-lte.layer_to_show: RLC Info # If RRC Security Info not seen, e.g. in Handover # One of: EEA0 (NULL), EEA1 (SNOW3G), EEA2 (AES), EEA3 (ZUC) # (case-insensitive). #pdcp-lte.default_ciphering_algorithm: EEA0 (NULL) # If RRC Security Info not seen, e.g. in Handover # One of: EIA0 (NULL), EIA1 (SNOW3G), EIA2 (AES), EIA3 (ZUC) # (case-insensitive). #pdcp-lte.default_integrity_algorithm: EIA0 (NULL) # N.B. only possible if build with algorithm support, and have key available and configured # TRUE or FALSE (case-insensitive) #pdcp-lte.decipher_signalling: TRUE # N.B. only possible if build with algorithm support, and have key available and configured # TRUE or FALSE (case-insensitive) #pdcp-lte.decipher_userplane: FALSE # N.B. only possible if build with algorithm support, and have key available and configured # TRUE or FALSE (case-insensitive) #pdcp-lte.verify_integrity: TRUE # Ignore the LTE RRC security algorithm configuration, to be used when PDCP is already deciphered in the capture # TRUE or FALSE (case-insensitive) #pdcp-lte.ignore_rrc_sec_params: FALSE # Whether the dissector should put the internal PER data in the tree or if it should hide it # TRUE or FALSE (case-insensitive) #per.display_internal_per_fields: FALSE # Whether or not UID and PID fields are dissected in big or little endian # TRUE or FALSE (case-insensitive) #pflog.uid_endian: TRUE # Whether to check the validity of the PGM checksum # TRUE or FALSE (case-insensitive) #pgm.check_checksum: TRUE # Whether the PIM payload is shown off of the main tree or encapsulated within the PIM options # TRUE or FALSE (case-insensitive) #pim.payload_tree: TRUE # The password to used to decrypt the encrypted elements within the PKCS#12 file # A string #pkcs12.password: # Whether to try and decrypt the encrypted data within the PKCS#12 with a NULL password # TRUE or FALSE (case-insensitive) #pkcs12.try_null_password: FALSE # Whether the PN-RT summary line should be shown in the protocol tree # TRUE or FALSE (case-insensitive) #pn_rt.summary_in_tree: TRUE # Reassemble PNIO Fragments and get them decoded # TRUE or FALSE (case-insensitive) #pn_rt.desegment: TRUE # Protocol payload type # One of: Data, Sony FeliCa, NXP MiFare, ISO 7816 # (case-insensitive). #pn532.prtype532: Data # Whether the PNIO dissector is allowed to use detailed PROFIsafe dissection of cyclic data frames # TRUE or FALSE (case-insensitive) #pn_io.pnio_ps_selection: TRUE # Select your Networkpath to your GSD-Files. # A path to a directory #pn_io.pnio_ps_networkpath: # Whether the POP dissector should reassemble RETR and TOP responses and spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #pop.desegment_data: TRUE # Whether fragmented 802.11 aggregated MPDUs should be reassembled # TRUE or FALSE (case-insensitive) #ppi.reassemble: TRUE # The type of PPP frame checksum (none, 16-bit, 32-bit) # One of: None, 16-Bit, 32-Bit # (case-insensitive). #ppp.fcs_type: None # Default Protocol ID to be used for PPPMuxCP # A hexadecimal number #ppp.default_proto_id: 0 # Whether PPP Multilink frames use 12-bit sequence numbers # TRUE or FALSE (case-insensitive) #mp.short_seqno: FALSE # Maximum number of PPP Multilink fragments to try to reassemble into one frame # A decimal number #mp.max_fragments: 6 # Age off unreassmbled fragments after this many packets # A decimal number #mp.fragment_aging: 4000 # Show values of tags and lengths of data fields # TRUE or FALSE (case-insensitive) #pppoed.show_tags_and_lengths: FALSE # Properly translates vendor specific opcodes # One of: Unknown vendor, Eastman Kodak, Canon, Nikon, Casio EX-F1, Microsoft / MTP, Olympus E series # (case-insensitive). #ptpip.vendor: Unknown vendor # Whether the PVFS dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #pvfs.desegment: TRUE # Whether the Q.931 dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #q931.desegment_h323_messages: TRUE # Reassemble segmented Q.931 messages (Q.931 - Annex H) # TRUE or FALSE (case-insensitive) #q931.reassembly: TRUE # Decode ISO/IEC cause coding standard as ITU-T # TRUE or FALSE (case-insensitive) #q931.iso_iec_cause_coding: FALSE # Type of Facility encoding # One of: Dissect facility as QSIG, Dissect facility as ETSI # (case-insensitive). #q932.facility_encoding: Dissect facility as QSIG # Set the UDP base port for the Quake III Arena Server # A decimal number #quake3.udp.arena_port: 27960 # Set the UDP base port for the Quake III Arena Master Server # A decimal number #quake3.udp.master_port: 27950 # Help for debug... # TRUE or FALSE (case-insensitive) #quic.debug.quic: FALSE # Shared secret used to decode User Passwords and validate Response Authenticators # A string #radius.shared_secret: # Whether to check or not if Response Authenticator is correct. You need to define shared secret for this to work. # TRUE or FALSE (case-insensitive) #radius.validate_authenticator: FALSE # Whether to add or not to the tree the AVP's payload length # TRUE or FALSE (case-insensitive) #radius.show_length: FALSE # Whether to interpret 241-246 as extended attributes according to RFC 6929 # TRUE or FALSE (case-insensitive) #radius.disable_extended_attributes: FALSE # The SCCP SubSystem Number for RANAP (default 142) # A decimal number #ranap.sccp_ssn: 142 # Attempt to dissect RRC message embedded in RRC-Container IE # TRUE or FALSE (case-insensitive) #ranap.dissect_rrc_container: FALSE # Where available, show which protocol and frame caused this RDT stream to be created # TRUE or FALSE (case-insensitive) #rdt.show_setup_info: TRUE # Whether fragmented RELOAD datagrams should be reassembled # TRUE or FALSE (case-insensitive) #reload.defragment: TRUE # Length of the NodeId as defined in the overlay. # A decimal number #reload.nodeid_length: 16 # topology plugin defined in the overlay # A string #reload.topology_plugin: CHORD-RELOAD # Display the third and forth bytes of the RIPv2 header as the Routing Domain field (introduced in RFC 1388 [January 1993] and obsolete as of RFC 1723 [November 1994]) # TRUE or FALSE (case-insensitive) #rip.display_routing_domain: FALSE # When enabled, try to reassemble SDUs from the various PDUs received # TRUE or FALSE (case-insensitive) #rlc.perform_reassembly: TRUE # When enabled, if data is not present, don't report as an error, but instead add expert info to indicate that headers were omitted # TRUE or FALSE (case-insensitive) #rlc.header_only_mode: FALSE # When enabled, rlc will assume all data is ciphered # TRUE or FALSE (case-insensitive) #rlc.ciphered_data: FALSE # When enabled, rlc will try to decipher data. (Experimental) # TRUE or FALSE (case-insensitive) #rlc.try_decipher: FALSE # LI size in bits, either 7 or 15 bit # One of: 7 bits, 15 bits, Let upper layers decide # (case-insensitive). #rlc.li_size: Let upper layers decide # Attempt to keep track of PDUs for AM channels, and point out problems # One of: No-Analysis, Only-MAC-frames, Only-RLC-frames # (case-insensitive). #rlc-lte.do_sequence_analysis_am: Only-MAC-frames # Attempt to keep track of PDUs for UM channels, and point out problems # One of: No-Analysis, Only-MAC-frames, Only-RLC-frames # (case-insensitive). #rlc-lte.do_sequence_analysis: Only-MAC-frames # Call PDCP dissector for signalling PDUs. Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC) # TRUE or FALSE (case-insensitive) #rlc-lte.call_pdcp_for_srb: TRUE # Call PDCP dissector for user-plane PDUs. Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC) # One of: Off, 7-bit SN, 12-bit SN, 15-bit SN, 18-bit SN, Use signalled value # (case-insensitive). #rlc-lte.call_pdcp_for_drb: Use signalled value # Call RRC dissector for CCCH PDUs # TRUE or FALSE (case-insensitive) #rlc-lte.call_rrc_for_ccch: TRUE # Call RRC dissector for MCCH PDUs Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC) # TRUE or FALSE (case-insensitive) #rlc-lte.call_rrc_for_mcch: FALSE # Call ip dissector for MTCH PDUs Note that without reassembly, it canonly be called for complete PDUs (i.e. not segmented over RLC) # TRUE or FALSE (case-insensitive) #rlc-lte.call_ip_for_mtch: FALSE # When enabled, if data is not present, don't report as an error, but instead add expert info to indicate that headers were omitted # TRUE or FALSE (case-insensitive) #rlc-lte.header_only_mode: FALSE # When enabled, attempts to re-assemble upper-layer SDUs that are split over more than one RLC PDU. Note: does not currently support out-of-order or re-segmentation. N.B. sequence analysis must also be turned on in order for reassembly to work # TRUE or FALSE (case-insensitive) #rlc-lte.reassembly: TRUE # Whether the RPC dissector should reassemble messages spanning multiple TCP segments. To use this option, you must also enable "Allow subdissectors to reassemble TCP streams" in the TCP protocol settings. # TRUE or FALSE (case-insensitive) #rpc.desegment_rpc_over_tcp: TRUE # Whether the RPC dissector should defragment RPC-over-TCP messages. # TRUE or FALSE (case-insensitive) #rpc.defragment_rpc_over_tcp: TRUE # Set the maximum size of RPCoverTCP PDUs. If the size field