Display Filter Reference: Spotlight metadata search service

Protocol field name: mdssvc

Versions: 1.12.0 to 3.4.5

Back to Display Filter Reference

Field name Description Type Versions
mdssvc.mdssvc_blob.length Length Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_blob.size Size Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_blob.spotlight_blob Spotlight Blob Unsigned integer, 1 byte 1.12.0 to 3.4.5
mdssvc.mdssvc_close.device_id Device Id Unsigned integer, 4 bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_close.in_handle In Handle Sequence of bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_close.out_handle Out Handle Sequence of bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_close.status Status Unsigned integer, 4 bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_close.unkn1 Unkn1 Unsigned integer, 4 bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_close.unkn2 Unkn2 Unsigned integer, 4 bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_close.unkn3 Unkn3 Unsigned integer, 4 bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_cmd.device_id Device Id Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.flags Flags Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.fragment Fragment Unsigned integer, 4 bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_cmd.handle Handle Sequence of bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_cmd.max_fragment_size1 Max Fragment Size1 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.max_fragment_size2 Max Fragment Size2 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.request_blob Request Blob Label 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.response_blob Response Blob Label 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.share_handle Share Handle Sequence of bytes 1.12.0 to 3.0.14
mdssvc.mdssvc_cmd.status Status Unsigned integer, 4 bytes 1.12.0 to 3.0.14
mdssvc.mdssvc_cmd.unkn1 Unkn1 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.unkn3 Unkn3 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.unkn4 Unkn4 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.unkn5 Unkn5 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.unkn6 Unkn6 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.unkn7 Unkn7 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.unkn8 Unkn8 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_cmd.unkn9 Unkn9 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_open.device_id Device Id Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_open.handle Handle Sequence of bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_open.share_handle Share Handle Sequence of bytes 1.12.0 to 3.0.14
mdssvc.mdssvc_open.share_mount_path Share Mount Path Character string 1.12.0 to 3.4.5
mdssvc.mdssvc_open.share_name Share Name Character string 1.12.0 to 3.4.5
mdssvc.mdssvc_open.share_path Share Path Character string 1.12.0 to 3.4.5
mdssvc.mdssvc_open.unkn2 Unkn2 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_open.unkn3 Unkn3 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_unknown1.device_id Device Id Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_unknown1.flags Flags Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_unknown1.gid Gid Unsigned integer, 4 bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_unknown1.handle Handle Sequence of bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_unknown1.share_handle Share Handle Sequence of bytes 1.12.0 to 3.0.14
mdssvc.mdssvc_unknown1.status Status Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_unknown1.uid Uid Unsigned integer, 4 bytes 3.2.0 to 3.4.5
mdssvc.mdssvc_unknown1.unkn1 Unkn1 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_unknown1.unkn3 Unkn3 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_unknown1.unkn4 Unkn4 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.mdssvc_unknown1.unkn5 Unkn5 Unsigned integer, 4 bytes 1.12.0 to 3.0.14
mdssvc.mdssvc_unknown1.unkn6 Unkn6 Unsigned integer, 4 bytes 1.12.0 to 3.0.14
mdssvc.mdssvc_unknown1.unkn7 Unkn7 Unsigned integer, 4 bytes 1.12.0 to 3.4.5
mdssvc.opnum Operation Unsigned integer, 2 bytes 1.12.0 to 3.4.5
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ AppResponse 11
  • • Full stack analysis – from packets to pages
  • • Rich performance metrics & pre-defined insights for fast problem identification/resolution
  • • Modular, flexible solution for deeply-analyzing network & application performance
Learn More