Appendix A. Ethereal Display Filter Fields

Field	Field Name	Type
dns.count.answers	Answer RRs	Unsigned 16-bit integer
dns.count.auth_rr	Authority RRs	Unsigned 16-bit integer
dns.count.queries	Questions	Unsigned 16-bit integer
dns.flags	Flags	Unsigned 16-bit integer
dns.flags.authenticated	Answer authenticated	Boolean
dns.flags.authoritative	Authoritative	Boolean
dns.flags.checkdisable	Non-authenticated data	Boolean
	OK
dns.flags.opcode	Opcode	Unsigned 16-bit integer
dns.flags.rcode	Reply code	Unsigned 16-bit integer
dns.flags.recavail	Recursion available	Boolean
dns.flags.recdesired	Recursion desired	Boolean
dns.flags.response	Response	Boolean
dns.flags.truncated	Truncated	Boolean
dns.id	Transaction ID	Unsigned 16-bit integer
dns.length	Length	Unsigned 16-bit integer

Dynamic DNS Tools Protocol (ddtp)

Table A-56. Dynamic DNS Tools Protocol (ddtp)

Field	Field Name	Type
ddtp.encrypt	Encryption	Unsigned 32-bit integer
ddtp.hostid	Hostid	Unsigned 32-bit integer
ddtp.ipaddr	IP address	IPv4 address
ddtp.msgtype	Message type	Unsigned 32-bit integer
ddtp.opcode	Opcode	Unsigned 32-bit integer
ddtp.status	Status	Unsigned 32-bit integer
ddtp.version	Version	Unsigned 32-bit integer

Encapsulating Security Payload (esp)

Table A-57. Encapsulating Security Payload (esp)

Field	Field Name	Type
esp.sequence	Sequence	Unsigned 32-bit integer

147

Appendix A. Ethereal Display Filter Fields

Field	Field Name	Type
esp.spi	SPI	Unsigned 32-bit integer

Enhanced Interior Gateway Routing Protocol (eigrp)

Table A-58. Enhanced Interior Gateway Routing Protocol (eigrp)

Field	Field Name	Type
eigrp.as	Autonomous System	Unsigned 16-bit integer
eigrp.opcode	Opcode	Unsigned 8-bit integer
eigrp.tlv	Entry	Unsigned 16-bit integer

Ethernet (eth)

Table A-59. Ethernet (eth)

Field	Field Name	Type
eth.addr	Source or Destination	6-byte Hardware (MAC)
	Address	Address
eth.dst	Destination	6-byte Hardware (MAC)
		Address
eth.len	Length	Unsigned 16-bit integer
eth.src	Source	6-byte Hardware (MAC)
		Address
eth.trailer	Trailer	Byte array
eth.type	Type	Unsigned 16-bit integer

Extensible Authentication Protocol (eap)

Table A-60. Extensible Authentication Protocol (eap)

Field	Field Name	Type
eap.code	Code	Unsigned 8-bit integer
eap.id	Id	Unsigned 8-bit integer
eap.len	Length	Unsigned 16-bit integer
eap.type	Type	Unsigned 8-bit integer
eaptls.fragment	EAP-TLS Fragment	No value

148

Appendix A. Ethereal Display Filter Fields

Field	Field Name	Type
eaptls.fragment.error	Defragmentation error	No value
eaptls.fragment.multipletailsMultiple	tail fragments	Boolean
	found
eaptls.fragment.overlap	Fragment overlap	Boolean
eaptls.fragment.overlap.conflictConflicting data in		Boolean
	fragment overlap
eaptls.fragment.toolongfragmentFragment too long		Boolean
eaptls.fragments	EAP-TLS Fragments	No value

FTP Data (ftp-data)

Table A-61. FTP Data (ftp-data)

Field	Field Name	Type

Fiber Distributed Data Interface (fddi)

Table A-62. Fiber Distributed Data Interface (fddi)

Field	Field Name	Type
fddi.addr	Source or Destination	6-byte Hardware (MAC)
	Address	Address
fddi.dst	Destination	6-byte Hardware (MAC)
		Address
fddi.fc	Frame Control	Unsigned 8-bit integer
fddi.fc.clf	Class/Length/Format	Unsigned 8-bit integer
fddi.fc.mac_subtype	MAC Subtype	Unsigned 8-bit integer
fddi.fc.prio	Priority	Unsigned 8-bit integer
fddi.fc.smt_subtype	SMT Subtype	Unsigned 8-bit integer
fddi.src	Source	6-byte Hardware (MAC)
		Address

149

Appendix A. Ethereal Display Filter Fields

File Transfer Protocol (FTP) (ftp)

Table A-63. File Transfer Protocol (FTP) (ftp)

Field	Field Name	Type
ftp.request	Request	Boolean
ftp.request.arg	Request arg	String
ftp.request.command	Request command	String
ftp.response	Response	Boolean
ftp.response.arg	Response arg	String
ftp.response.code	Response code	Unsigned 32-bit integer

Frame (frame)

Table A-64. Frame (frame)

Field	Field Name	Type
frame.cap_len	Capture Frame Length	Unsigned 32-bit integer
frame.file_off	File Offset	Signed 32-bit integer
frame.marked	Frame is marked	Boolean
frame.number	Frame Number	Unsigned 32-bit integer
frame.p2p_dir	Point-to-Point Direction	Unsigned 8-bit integer
frame.pkt_len	Total Frame Length	Unsigned 32-bit integer
frame.time	Arrival Time	Date/Time stamp
frame.time_delta	Time delta from previous	Time duration
	packet
frame.time_relative	Time relative to first packet	Time duration

Frame Relay (fr)

Table A-65. Frame Relay (fr)

Field	Field Name	Type
fr.becn	BECN	Boolean
fr.chdlctype	Type	Unsigned 16-bit integer
fr.cr	CR	Boolean
fr.dc	DC	Boolean

150