Wireshark-users: [Wireshark-users] How can I see protocol number instead of protocol name
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Ian Brown" <ianbrn@xxxxxxxxx>
Date: Wed, 21 May 2008 13:06:57 +0300
Hello,
I am working on linux redhat Red Hat Enterprise Linux ES release 4
(Nahant Update 2) using
wireshark-0.99.5-EL4.1.

 I had noticed that in some cases , when sniffing with ethereal, (
tethereal -R udp port...) I see port numbers, and in some
other cases, I see the protocol name. This depends on which porotocol
I am using,


For example,

  tethereal -R udp port 5002
tshark: Promiscuous mode not supported on the "any" device.

Capturing on Pseudo-device that captures on all interfaces
  0.000000 192.168.0.13 -> 192.168.0.10 UDP Source port: 32834
Destination port: rfe [UDP CHECKSUM INCORRECT]
1 packets captured


As we see here,  the source port is in number 32834.
The dest is a text (rfe) ; this is in fact port 5002.

How can I configure my system so that I will see only port numbers (or
both numbers and description) when
snuffing with tethereal ?

Regards,
Ian