NAME

ethereal-filter - Ethereal filter syntax and reference


SYNOPSYS

ethereal [other options] [ -R ``filter expression'' ]

tethereal [other options] [ -R ``filter expression'' ]


DESCRIPTION

Ethereal and Tethereal share a powerful filter engine that helps remove the noise from a packet trace and lets you see only the packets that interest you. If a packet meets the requirements expressed in your filter, then it is displayed in the list of packets. Display filters let you compare the fields within a protocol against a specific value, compare fields against fields, and check the existence of specified fields or protocols.

Filters are also used by other features such as statistics generation and packet list colorization (the latter is only available to Ethereal). This manual page describes their syntax and provides a comprehensive reference of filter fields.


FILTER SYNTAX

Check whether a field or protocol exists

The simplest filter allows you to check for the existence of a protocol or field. If you want to see all packets which contain the IP protocol, the filter would be ``ip'' (without the quotation marks). To see all packets that contain a Token-Ring RIF field, use ``tr.rif''.

Think of a protocol or field in a filter as implicitly having the ``exists'' operator.

Note: all protocol and field names that are available in Ethereal and Tethereal filters are listed in the comprehensive FILTER PROTOCOL REFERENCE (see below).

Comparison operators

Fields can also be compared against values. The comparison operators can be expressed either through English-like abbreviations or through C-like symbols:

    eq, ==    Equal
    ne, !=    Not Equal
    gt, >     Greater Than
    lt, <     Less Than
    ge, >=    Greater than or Equal to
    le, <=    Less than or Equal to

Search and match operators

Additional operators exist expressed only in English, not C-like syntax:

    contains  Does the protocol, field or slice contain a value
    matches   Does the protocol or text string match the given Perl
              regular expression

The ``contains'' operator allows a filter to search for a sequence of characters, expressed as a string (quoted or unquoted), or bytes, expressed as a byte array. For example, to search for a given HTTP URL in a capture, the following filter can be used:

    http contains "http://www.ethereal.com";

The ``contains'' operator cannot be used on atomic fields, such as numbers or IP addresses.

The ``matches'' operator allows a filter to apply to a specified Perl-compatible regular expression (PCRE). The ``matches'' operator is only implemented for protocols and for protocol fields with a text string representation. For example, to search for a given WAP WSP User-Agent, you can write:

    wsp.user_agent matches "(?i)cldc"

This example shows an interesting PCRE feature: pattern match options have to be specified with the (?option) construct. For instance, (?i) performs a case-insensitive pattern match. More information on PCRE can be found in the pcrepattern(3) man page (Perl Regular Expressions are explained in http://www.perldoc.com/perl5.8.0/pod/perlre.html).

Note: the ``matches'' operator is only available if Ethereal or Tethereal have been compiled with the PCRE library. This can be checked by running:

    ethereal -v
    tethereal -v

or selecting the ``About Ethereal'' item from the ``Help'' menu in Ethereal.

Protocol field types

Each protocol field is typed. The types are:

    Unsigned integer (8-bit, 16-bit, 24-bit, or 32-bit)
    Signed integer (8-bit, 16-bit, 24-bit, or 32-bit)
    Boolean
    Ethernet address (6 bytes)
    Byte array
    IPv4 address
    IPv6 address
    IPX network number
    Text string
    Double-precision floating point number

An integer may be expressed in decimal, octal, or hexadecimal notation. The following three display filters are equivalent:

    frame.pkt_len > 10
    frame.pkt_len > 012
    frame.pkt_len > 0xa

Boolean values are either true or false. In a display filter expression testing the value of a Boolean field, ``true'' is expressed as 1 or any other non-zero value, and ``false'' is expressed as zero. For example, a token-ring packet's source route field is Boolean. To find any source-routed packets, a display filter would be:

    tr.sr == 1

Non source-routed packets can be found with:

    tr.sr == 0

Ethernet addresses and byte arrays are represented by hex digits. The hex digits may be separated by colons, periods, or hyphens:

    eth.dst eq ff:ff:ff:ff:ff:ff
    aim.data == 0.1.0.d
    fddi.src == aa-aa-aa-aa-aa-aa
    echo.data == 7a

IPv4 addresses can be represented in either dotted decimal notation or by using the hostname:

    ip.dst eq www.mit.edu
    ip.src == 192.168.1.1

IPv4 addresses can be compared with the same logical relations as numbers: eq, ne, gt, ge, lt, and le. The IPv4 address is stored in host order, so you do not have to worry about the endianness of an IPv4 address when using it in a display filter.

Classless InterDomain Routing (CIDR) notation can be used to test if an IPv4 address is in a certain subnet. For example, this display filter will find all packets in the 129.111 Class-B network:

    ip.addr == 129.111.0.0/16

Remember, the number after the slash represents the number of bits used to represent the network. CIDR notation can also be used with hostnames, as in this example of finding IP addresses on the same Class C network as 'sneezy':

    ip.addr eq sneezy/24

The CIDR notation can only be used on IP addresses or hostnames, not in variable names. So, a display filter like ``ip.src/24 == ip.dst/24'' is not valid (yet).

IPX networks are represented by unsigned 32-bit integers. Most likely you will be using hexadecimal when testing IPX network values:

    ipx.src.net == 0xc0a82c00

Strings are enclosed in double quotes:

    http.request.method == "POST"

Inside double quotes, you may use a backslash to embed a double quote or an arbitrary byte represented in either octal or hexadecimal.

    browser.comment == "An embedded \" double-quote"

Use of hexadecimal to look for ``HEAD'':

    http.request.method == "\x48EAD"

Use of octal to look for ``HEAD'':

    http.request.method == "\110EAD"

This means that you must escape backslashes with backslashes inside double quotes.

    smb.path contains "\\\\SERVER\\SHARE"

looks for \\SERVER\SHARE in ``smb.path''.

The slice operator

You can take a slice of a field if the field is a text string or a byte array. For example, you can filter on the vendor portion of an ethernet address (the first three bytes) like this:

    eth.src[0:3] == 00:00:83

Another example is:

    http.content_type[0:4] == "text"

You can use the slice operator on a protocol name, too. The ``frame'' protocol can be useful, encompassing all the data captured by Ethereal or Tethereal.

    token[0:5] ne 0.0.0.1.1
    llc[0] eq aa
    frame[100-199] contains "ethereal"

The following syntax governs slices:

    [i:j]    i = start_offset, j = length
    [i-j]    i = start_offset, j = end_offset, inclusive.
    [i]      i = start_offset, length = 1
    [:j]     start_offset = 0, length = j
    [i:]     start_offset = i, end_offset = end_of_field

Offsets can be negative, in which case they indicate the offset from the end of the field. The last byte of the field is at offset -1, the last but one byte is at offset -2, and so on. Here's how to check the last four bytes of a frame:

    frame[-4:4] == 0.1.2.3

or

    frame[-4:] == 0.1.2.3

You can concatenate slices using the comma operator:

    ftp[1,3-5,9:] == 01:03:04:05:09:0a:0b

This concatenates offset 1, offsets 3-5, and offset 9 to the end of the ftp data.

Type conversions

If a field is a text string or a byte array, it can be expressed in whichever way is most convenient.

So, for instance, the following filters are equivalent:

    http.request.method == "GET"
    http.request.method == 47.45.54

A range can also be expressed in either way:

    frame[60:2] gt 50.51
    frame[60:2] gt "PQ"

Bit field operations

It is also possible to define tests with bit field operations. Currently the following bit field operation is supported:

    bitwise_and, &      Bitwise AND

The bitwise AND operation allows testing to see if one or more bits are set. Bitwise AND operates on integer protocol fields and slices.

When testing for TCP SYN packets, you can write:

    tcp.flags & 0x02

That expression will match all packets that contain a ``tcp.flags'' field with the 0x02 bit, i.e. the SYN bit, set.

Similarly, filtering for all WSP GET and extended GET methods is achieved with:

    wsp.pdu_type & 0x40

When using slices, the bit mask must be specified as a byte string, and it must have the same number of bytes as the slice itself, as in:

    ip[42:2] & 40:ff

Logical expressions

Tests can be combined using logical expressions. These too are expressable in C-like syntax or with English-like abbreviations:

    and, &&   Logical AND
    or,  ||   Logical OR
    not, !    Logical NOT

Expressions can be grouped by parentheses as well. The following are all valid display filter expressions:

    tcp.port == 80 and ip.src == 192.168.2.1
    not llc
    http and frame[100-199] contains "ethereal"
    (ipx.src.net == 0xbad && ipx.src.node == 0.0.0.0.0.1) || ip

Remember that whenever a protocol or field name occurs in an expression, the ``exists'' operator is implicitly called. The ``exists'' operator has the highest priority. This means that the first filter expression must be read as ``show me the packets for which tcp.port exists and equals 80, and ip.src exists and equals 192.168.2.1''. The second filter expression means ``show me the packets where not (llc exists)'', or in other words ``where llc does not exist'' and hence will match all packets that do not contain the llc protocol. The third filter expression includes the constraint that offset 199 in the frame exists, in other words the length of the frame is at least 200.

A special caveat must be given regarding fields that occur more than once per packet. ``ip.addr'' occurs twice per IP packet, once for the source address, and once for the destination address. Likewise, ``tr.rif.ring'' fields can occur more than once per packet. The following two expressions are not equivalent:

        ip.addr ne 192.168.4.1
    not ip.addr eq 192.168.4.1

The first filter says ``show me packets where an ip.addr exists that does not equal 192.168.4.1''. That is, as long as one ip.addr in the packet does not equal 192.168.4.1, the packet passes the display filter. The other ip.addr could equal 192.168.4.1 and the packet would still be displayed. The second filter says ``don't show me any packets that have an ip.addr field equal to 192.168.4.1''. If one ip.addr is 192.168.4.1, the packet does not pass. If neither ip.addr field is 192.168.4.1, then the packet is displayed.

It is easy to think of the 'ne' and 'eq' operators as having an implict ``exists'' modifier when dealing with multiply-recurring fields. ``ip.addr ne 192.168.4.1'' can be thought of as ``there exists an ip.addr that does not equal 192.168.4.1''. ``not ip.addr eq 192.168.4.1'' can be thought of as ``there does not exist an ip.addr equal to 192.168.4.1''.

Be careful with multiply-recurring fields; they can be confusing.

Care must also be taken when using the display filter to remove noise from the packet trace. If, for example, you want to filter out all IP multicast packets to address 224.1.2.3, then using:

    ip.dst ne 224.1.2.3

may be too restrictive. Filtering with ``ip.dst'' selects only those IP packets that satisfy the rule. Any other packets, including all non-IP packets, will not be displayed. To display the non-IP packets as well, you can use one of the following two expressions:

    not ip or ip.dst ne 224.1.2.3
    not ip.addr eq 224.1.2.3

The first filter uses ``not ip'' to include all non-IP packets and then lets ``ip.dst ne 224.1.2.3'' filter out the unwanted IP packets. The second filter has already been explained above where filtering with multiply occuring fields was discussed.


FILTER PROTOCOL REFERENCE

Each entry below provides an abbreviated protocol or field name. Every one of these fields can be used in a display filter. The type of the field is also given.

3Com XNS Encapsulation (3comxns)

    xnsllc.type  Type
        Unsigned 16-bit integer

3GPP2 A11 (a11)

    a11.ackstat  Reply Status
        Unsigned 8-bit integer
        A11 Registration Ack Status.
    a11.auth.auth  Authenticator
        Byte array
        Authenticator.
    a11.auth.spi  SPI
        Unsigned 32-bit integer
        Authentication Header Security Parameter Index.
    a11.b  Broadcast Datagrams
        Boolean
        Broadcast Datagrams requested
    a11.coa  Care of Address
        IPv4 address
        Care of Address.
    a11.code  Reply Code
        Unsigned 8-bit integer
        A11 Registration Reply code.
    a11.d  Co-located Care-of Address
        Boolean
        MN using Co-located Care-of address
    a11.ext.apptype  Application Type
        Unsigned 8-bit integer
        Application Type.
    a11.ext.ase.key  GRE Key
        Unsigned 32-bit integer
        GRE Key.
    a11.ext.ase.len  Entry Length
        Unsigned 8-bit integer
        Entry Length.
    a11.ext.ase.pcfip  PCF IP Address
        IPv4 address
        PCF IP Address.
    a11.ext.ase.ptype  GRE Protocol Type
        Unsigned 16-bit integer
        GRE Protocol Type.
    a11.ext.ase.srid  Service Reference ID (SRID)
        Unsigned 8-bit integer
        Service Reference ID (SRID).
    a11.ext.ase.srvopt  Service Option
        Unsigned 16-bit integer
        Service Option.
    a11.ext.auth.subtype  Gen Auth Ext SubType
        Unsigned 8-bit integer
        Mobile IP Auth Extension Sub Type.
    a11.ext.canid  CANID
        Byte array
        CANID
    a11.ext.code  Reply Code
        Unsigned 8-bit integer
        PDSN Code.
    a11.ext.dormant  All Dormant Indicator
        Unsigned 16-bit integer
        All Dormant Indicator.
    a11.ext.fqi.dscp  Forward DSCP
        Unsigned 8-bit integer
        Forward Flow DSCP.
    a11.ext.fqi.entrylen  Entry Length
        Unsigned 8-bit integer
        Forward Entry Length.
    a11.ext.fqi.flags  Flags
        Unsigned 8-bit integer
        Forward Flow Entry Flags.
    a11.ext.fqi.flowcount  Forward Flow Count
        Unsigned 8-bit integer
        Forward Flow Count.
    a11.ext.fqi.flowid  Forward Flow Id
        Unsigned 8-bit integer
        Forward Flow Id.
    a11.ext.fqi.flowstate  Forward Flow State
        Unsigned 8-bit integer
        Forward Flow State.
    a11.ext.fqi.graqos  Granted QoS
        Byte array
        Forward Granted QoS.
    a11.ext.fqi.graqoslen  Granted QoS Length
        Unsigned 8-bit integer
        Forward Granted QoS Length.
    a11.ext.fqi.reqqos  Requested QoS
        Byte array
        Forward Requested QoS.
    a11.ext.fqi.reqqoslen  Requested QoS Length
        Unsigned 8-bit integer
        Forward Requested QoS Length.
    a11.ext.fqi.srid  SRID
        Unsigned 8-bit integer
        Forward Flow Entry SRID.
    a11.ext.fqui.flowcount  Forward QoS Update Flow Count
        Unsigned 8-bit integer
        Forward QoS Update Flow Count.
    a11.ext.fqui.updatedqos  Foward Updated QoS Sub-Blob
        Byte array
        Foward Updated QoS Sub-Blob.
    a11.ext.fqui.updatedqoslen  Foward Updated QoS Sub-Blob Length
        Unsigned 8-bit integer
        Foward Updated QoS Sub-Blob Length.
    a11.ext.key  Key
        Unsigned 32-bit integer
        Session Key.
    a11.ext.len  Extension Length
        Unsigned 16-bit integer
        Mobile IP Extension Length.
    a11.ext.mnsrid  MNSR-ID
        Unsigned 16-bit integer
        MNSR-ID
    a11.ext.msid  MSID(BCD)
        Byte array
        MSID(BCD).
    a11.ext.msid_len  MSID Length
        Unsigned 8-bit integer
        MSID Length.
    a11.ext.msid_type  MSID Type
        Unsigned 16-bit integer
        MSID Type.
    a11.ext.panid  PANID
        Byte array
        PANID
    a11.ext.ppaddr  Anchor P-P Address
        IPv4 address
        Anchor P-P Address.
    a11.ext.ptype  Protocol Type
        Unsigned 16-bit integer
        Protocol Type.
    a11.ext.qosmode  QoS Mode
        Unsigned 8-bit integer
        QoS Mode.
    a11.ext.rqi.entrylen  Entry Length
        Unsigned 8-bit integer
        Reverse Flow Entry Length.
    a11.ext.rqi.flowcount  Reverse Flow Count
        Unsigned 8-bit integer
        Reverse Flow Count.
    a11.ext.rqi.flowid  Reverse Flow Id
        Unsigned 8-bit integer
        Reverse Flow Id.
    a11.ext.rqi.flowstate  Flow State
        Unsigned 8-bit integer
        Reverse Flow State.
    a11.ext.rqi.graqos  Granted QoS
        Byte array
        Reverse Granted QoS.
    a11.ext.rqi.graqoslen  Granted QoS Length
        Unsigned 8-bit integer
        Reverse Granted QoS Length.
    a11.ext.rqi.reqqos  Requested QoS
        Byte array
        Reverse Requested QoS.
    a11.ext.rqi.reqqoslen  Requested QoS Length
        Unsigned 8-bit integer
        Reverse Requested QoS Length.
    a11.ext.rqi.srid  SRID
        Unsigned 8-bit integer
        Reverse Flow Entry SRID.
    a11.ext.rqui.flowcount  Reverse QoS Update Flow Count
        Unsigned 8-bit integer
        Reverse QoS Update Flow Count.
    a11.ext.rqui.updatedqos  Reverse Updated QoS Sub-Blob
        Byte array
        Reverse Updated QoS Sub-Blob.
    a11.ext.rqui.updatedqoslen  Reverse Updated QoS Sub-Blob Length
        Unsigned 8-bit integer
        Reverse Updated QoS Sub-Blob Length.
    a11.ext.sidver  Session ID Version
        Unsigned 8-bit integer
        Session ID Version
    a11.ext.sqp.profile  Subscriber QoS Profile
        Byte array
        Subscriber QoS Profile.
    a11.ext.sqp.profilelen  Subscriber QoS Profile Length
        Byte array
        Subscriber QoS Profile Length.
    a11.ext.srvopt  Service Option
        Unsigned 16-bit integer
        Service Option.
    a11.ext.type  Extension Type
        Unsigned 8-bit integer
        Mobile IP Extension Type.
    a11.ext.vid  Vendor ID
        Unsigned 32-bit integer
        Vendor ID.
    a11.extension  Extension
        Byte array
        Extension
    a11.flags  Flags
        Unsigned 8-bit integer
    a11.g  GRE
        Boolean
        MN wants GRE encapsulation
    a11.haaddr  Home Agent
        IPv4 address
        Home agent IP Address.
    a11.homeaddr  Home Address
        IPv4 address
        Mobile Node's home address.
    a11.ident  Identification
        Byte array
        MN Identification.
    a11.life  Lifetime
        Unsigned 16-bit integer
        A11 Registration Lifetime.
    a11.m  Minimal Encapsulation
        Boolean
        MN wants Minimal encapsulation
    a11.nai  NAI
        String
        NAI
    a11.s  Simultaneous Bindings
        Boolean
        Simultaneous Bindings Allowed
    a11.t  Reverse Tunneling
        Boolean
        Reverse tunneling requested
    a11.type  Message Type
        Unsigned 8-bit integer
        A11 Message type.
    a11.v  Van Jacobson
        Boolean
        Van Jacobson

3com Network Jack (njack)

    njack.getresp.unknown1  Unknown1
        Unsigned 8-bit integer
    njack.magic  Magic
        String
    njack.set.length  SetLength
        Unsigned 16-bit integer
    njack.set.salt  Salt
        Unsigned 32-bit integer
    njack.setresult  SetResult
        Unsigned 8-bit integer
    njack.tlv.addtagscheme  TlvAddTagScheme
        Unsigned 8-bit integer
    njack.tlv.authdata  Authdata
        Byte array
    njack.tlv.contermode  TlvTypeCountermode
        Unsigned 8-bit integer
    njack.tlv.data  TlvData
        Byte array
    njack.tlv.devicemac  TlvTypeDeviceMAC
        6-byte Hardware (MAC) Address
    njack.tlv.dhcpcontrol  TlvTypeDhcpControl
        Unsigned 8-bit integer
    njack.tlv.length  TlvLength
        Unsigned 8-bit integer
    njack.tlv.maxframesize  TlvTypeMaxframesize
        Unsigned 8-bit integer
    njack.tlv.portingressmode  TlvTypePortingressmode
        Unsigned 8-bit integer
    njack.tlv.powerforwarding  TlvTypePowerforwarding
        Unsigned 8-bit integer
    njack.tlv.scheduling  TlvTypeScheduling
        Unsigned 8-bit integer
    njack.tlv.snmpwrite  TlvTypeSnmpwrite
        Unsigned 8-bit integer
    njack.tlv.type  TlvType
        Unsigned 8-bit integer
    njack.tlv.typeip  TlvTypeIP
        IPv4 address
    njack.tlv.typestring  TlvTypeString
        String
    njack.tlv.version  TlvFwVersion
        IPv4 address
    njack.type  Type
        Unsigned 8-bit integer

802.1Q Virtual LAN (vlan)

    vlan.cfi  CFI
        Unsigned 16-bit integer
        CFI
    vlan.etype  Type
        Unsigned 16-bit integer
        Type
    vlan.id  ID
        Unsigned 16-bit integer
        ID
    vlan.len  Length
        Unsigned 16-bit integer
        Length
    vlan.priority  Priority
        Unsigned 16-bit integer
        Priority
    vlan.trailer  Trailer
        Byte array
        VLAN Trailer

802.1X Authentication (eapol)

    eapol.keydes.data  WPA Key
        Byte array
        WPA Key Data
    eapol.keydes.datalen  WPA Key Length
        Unsigned 16-bit integer
        WPA Key Data Length
    eapol.keydes.id  WPA Key ID
        Byte array
        WPA Key ID(RSN Reserved)
    eapol.keydes.index.indexnum  Index Number
        Unsigned 8-bit integer
        Key Index number
    eapol.keydes.index.keytype  Key Type
        Boolean
        Key Type (unicast/broadcast)
    eapol.keydes.key  Key
        Byte array
        Key
    eapol.keydes.key_info  Key Information
        Unsigned 16-bit integer
        WPA key info
    eapol.keydes.key_info.encr_key_data  Encrypted Key Data flag
        Boolean
        Encrypted Key Data flag
    eapol.keydes.key_info.error  Error flag
        Boolean
        Error flag
    eapol.keydes.key_info.install  Install flag
        Boolean
        Install flag
    eapol.keydes.key_info.key_ack  Key Ack flag
        Boolean
        Key Ack flag
    eapol.keydes.key_info.key_index  Key Index
        Unsigned 16-bit integer
        Key Index (0-3) (RSN: Reserved)
    eapol.keydes.key_info.key_mic  Key MIC flag
        Boolean
        Key MIC flag
    eapol.keydes.key_info.key_type  Key Type
        Boolean
        Key Type (Pairwise or Group)
    eapol.keydes.key_info.keydes_ver  Key Descriptor Version
        Unsigned 16-bit integer
        Key Descriptor Version Type
    eapol.keydes.key_info.request  Request flag
        Boolean
        Request flag
    eapol.keydes.key_info.secure  Secure flag
        Boolean
        Secure flag
    eapol.keydes.key_iv  Key IV
        Byte array
        Key Initialization Vector
    eapol.keydes.key_signature  Key Signature
        Byte array
        Key Signature
    eapol.keydes.keylen  Key Length
        Unsigned 16-bit integer
        Key Length
    eapol.keydes.mic  WPA Key MIC
        Byte array
        WPA Key Message Integrity Check
    eapol.keydes.nonce  Nonce
        Byte array
        WPA Key Nonce
    eapol.keydes.replay_counter  Replay Counter
        Unsigned 64-bit integer
        Replay Counter
    eapol.keydes.rsc  WPA Key RSC
        Byte array
        WPA Key Receive Sequence Counter
    eapol.keydes.type  Descriptor Type
        Unsigned 8-bit integer
        Key Descriptor Type
    eapol.len  Length
        Unsigned 16-bit integer
        Length
    eapol.type  Type
        Unsigned 8-bit integer
    eapol.version  Version
        Unsigned 8-bit integer

AAL type 2 signalling protocol (Q.2630) (alcap)

    alcap.acc.level  Congestion Level
        Unsigned 8-bit integer
    alcap.alc.bitrate.avg.bw  Average Backwards Bit Rate
        Unsigned 16-bit integer
    alcap.alc.bitrate.avg.fw  Average Forward Bit Rate
        Unsigned 16-bit integer
    alcap.alc.bitrate.max.bw  Maximum Backwards Bit Rate
        Unsigned 16-bit integer
    alcap.alc.bitrate.max.fw  Maximum Forward Bit Rate
        Unsigned 16-bit integer
    alcap.alc.sdusize.avg.bw  Average Backwards CPS SDU Size
        Unsigned 8-bit integer
    alcap.alc.sdusize.avg.fw  Average Forward CPS SDU Size
        Unsigned 8-bit integer
    alcap.alc.sdusize.max.bw  Maximum Backwards CPS SDU Size
        Unsigned 8-bit integer
    alcap.alc.sdusize.max.fw  Maximum Forward CPS SDU Size
        Unsigned 8-bit integer
    alcap.cau.coding  Cause Coding
        Unsigned 8-bit integer
    alcap.cau.diag  Diagnostic
        Byte array
    alcap.cau.diag.field_num  Field Number
        Unsigned 8-bit integer
    alcap.cau.diag.len  Length
        Unsigned 8-bit integer
        Diagnostics Length
    alcap.cau.diag.msg  Message Identifier
        Unsigned 8-bit integer
    alcap.cau.diag.param  Parameter Identifier
        Unsigned 8-bit integer
    alcap.cau.value  Cause Value (ITU)
        Unsigned 8-bit integer
    alcap.ceid.cid  CID
        Unsigned 8-bit integer
    alcap.ceid.pathid  Path ID
        Unsigned 32-bit integer
    alcap.compat  Message Compatibility
        Byte array
    alcap.compat.general.ii  General II
        Unsigned 8-bit integer
        Instruction Indicator
    alcap.compat.general.sni  General SNI
        Unsigned 8-bit integer
        Send Notificaation Indicator
    alcap.compat.pass.ii  Pass-On II
        Unsigned 8-bit integer
        Instruction Indicator
    alcap.compat.pass.sni  Pass-On SNI
        Unsigned 8-bit integer
        Send Notificaation Indicator
    alcap.cp.level  Level
        Unsigned 8-bit integer
    alcap.dnsea.addr  Address
        Byte array
    alcap.dsaid  DSAID
        Unsigned 32-bit integer
        Destination Service Association ID
    alcap.fbw.bitrate.bw  CPS Backwards Bitrate
        Unsigned 24-bit integer
    alcap.fbw.bitrate.fw  CPS Forward Bitrate
        Unsigned 24-bit integer
    alcap.fbw.bucket_size.bw  Backwards CPS Bucket Size
        Unsigned 16-bit integer
    alcap.fbw.bucket_size.fw  Forward CPS Bucket Size
        Unsigned 16-bit integer
    alcap.fbw.max_size.bw  Backwards CPS Packet Size
        Unsigned 8-bit integer
    alcap.fbw.max_size.fw  Forward CPS Packet Size
        Unsigned 8-bit integer
    alcap.hc.codepoint  Codepoint
        Unsigned 8-bit integer
    alcap.leg.cause  Leg's cause value in REL
        Unsigned 8-bit integer
    alcap.leg.cid  Leg's channel id
        Unsigned 32-bit integer
    alcap.leg.dnsea  Leg's destination NSAP
        String
    alcap.leg.dsaid  Leg's ECF OSA id
        Unsigned 32-bit integer
    alcap.leg.msg  a message of this leg
        Frame number
    alcap.leg.onsea  Leg's originating NSAP
        String
    alcap.leg.osaid  Leg's ERQ OSA id
        Unsigned 32-bit integer
    alcap.leg.pathid  Leg's path id
        Unsigned 32-bit integer
    alcap.leg.sugr  Leg's SUGR
        Unsigned 32-bit integer
    alcap.msg_type  Message Type
        Unsigned 8-bit integer
    alcap.onsea.addr  Address
        Byte array
    alcap.osaid  OSAID
        Unsigned 32-bit integer
        Originating Service Association ID
    alcap.param  Parameter
        Unsigned 8-bit integer
        Parameter Id
    alcap.param.len  Length
        Unsigned 8-bit integer
        Parameter Length
    alcap.pfbw.bitrate.bw  CPS Backwards Bitrate
        Unsigned 24-bit integer
    alcap.pfbw.bitrate.fw  CPS Forward Bitrate
        Unsigned 24-bit integer
    alcap.pfbw.bucket_size.bw  Backwards CPS Bucket Size
        Unsigned 16-bit integer
    alcap.pfbw.bucket_size.fw  Forward CPS Bucket Size
        Unsigned 16-bit integer
    alcap.pfbw.max_size.bw  Backwards CPS Packet Size
        Unsigned 8-bit integer
    alcap.pfbw.max_size.fw  Forward CPS Packet Size
        Unsigned 8-bit integer
    alcap.plc.bitrate.avg.bw  Average Backwards Bit Rate
        Unsigned 16-bit integer
    alcap.plc.bitrate.avg.fw  Average Forward Bit Rate
        Unsigned 16-bit integer
    alcap.plc.bitrate.max.bw  Maximum Backwards Bit Rate
        Unsigned 16-bit integer
    alcap.plc.bitrate.max.fw  Maximum Forward Bit Rate
        Unsigned 16-bit integer
    alcap.plc.sdusize.max.bw  Maximum Backwards CPS SDU Size
        Unsigned 8-bit integer
    alcap.plc.sdusize.max.fw  Maximum Forward CPS SDU Size
        Unsigned 8-bit integer
    alcap.pssiae.cas  CAS
        Unsigned 8-bit integer
        Channel Associated Signalling
    alcap.pssiae.cmd  Circuit Mode
        Unsigned 8-bit integer
    alcap.pssiae.dtmf  DTMF
        Unsigned 8-bit integer
    alcap.pssiae.fax  Fax
        Unsigned 8-bit integer
        Facsimile
    alcap.pssiae.frm  Frame Mode
        Unsigned 8-bit integer
    alcap.pssiae.lb  Loopback
        Unsigned 8-bit integer
    alcap.pssiae.mfr1  Multi-Frequency R1
        Unsigned 8-bit integer
    alcap.pssiae.mfr2  Multi-Frequency R2
        Unsigned 8-bit integer
    alcap.pssiae.oui  OUI
        Byte array
        Organizational Unique Identifier
    alcap.pssiae.pcm  PCM Mode
        Unsigned 8-bit integer
    alcap.pssiae.profile.id  Profile Id
        Unsigned 8-bit integer
    alcap.pssiae.profile.type  Profile Type
        Unsigned 8-bit integer
        I.366.2 Profile Type
    alcap.pssiae.rc  Rate Conctrol
        Unsigned 8-bit integer
    alcap.pssiae.syn  Syncronization
        Unsigned 8-bit integer
        Transport of synchronization of change in SSCS operation
    alcap.pssime.frm  Frame Mode
        Unsigned 8-bit integer
    alcap.pssime.lb  Loopback
        Unsigned 8-bit integer
    alcap.pssime.max  Max Len
        Unsigned 16-bit integer
    alcap.pssime.mult  Multiplier
        Unsigned 8-bit integer
    alcap.pt.codepoint  QoS Codepoint
        Unsigned 8-bit integer
    alcap.pvbws.bitrate.bw  Peak CPS Backwards Bitrate
        Unsigned 24-bit integer
    alcap.pvbws.bitrate.fw  Peak CPS Forward Bitrate
        Unsigned 24-bit integer
    alcap.pvbws.bucket_size.bw  Peak Backwards CPS Bucket Size
        Unsigned 16-bit integer
    alcap.pvbws.bucket_size.fw  Peak Forward CPS Bucket Size
        Unsigned 16-bit integer
    alcap.pvbws.max_size.bw  Backwards CPS Packet Size
        Unsigned 8-bit integer
    alcap.pvbws.max_size.fw  Forward CPS Packet Size
        Unsigned 8-bit integer
    alcap.pvbws.stt  Source Traffic Type
        Unsigned 8-bit integer
    alcap.pvbwt.bitrate.bw  Peak CPS Backwards Bitrate
        Unsigned 24-bit integer
    alcap.pvbwt.bitrate.fw  Peak CPS Forward Bitrate
        Unsigned 24-bit integer
    alcap.pvbwt.bucket_size.bw  Peak Backwards CPS Bucket Size
        Unsigned 16-bit integer
    alcap.pvbwt.bucket_size.fw  Peak Forward CPS Bucket Size
        Unsigned 16-bit integer
    alcap.pvbwt.max_size.bw  Backwards CPS Packet Size
        Unsigned 8-bit integer
    alcap.pvbwt.max_size.fw  Forward CPS Packet Size
        Unsigned 8-bit integer
    alcap.ssia.cas  CAS
        Unsigned 8-bit integer
        Channel Associated Signalling
    alcap.ssia.cmd  Circuit Mode
        Unsigned 8-bit integer
    alcap.ssia.dtmf  DTMF
        Unsigned 8-bit integer
    alcap.ssia.fax  Fax
        Unsigned 8-bit integer
        Facsimile
    alcap.ssia.frm  Frame Mode
        Unsigned 8-bit integer
    alcap.ssia.max_fmdata_len  Max Len of FM Data
        Unsigned 16-bit integer
    alcap.ssia.mfr1  Multi-Frequency R1
        Unsigned 8-bit integer
    alcap.ssia.mfr2  Multi-Frequency R2
        Unsigned 8-bit integer
    alcap.ssia.oui  OUI
        Byte array
        Organizational Unique Identifier
    alcap.ssia.pcm  PCM Mode
        Unsigned 8-bit integer
    alcap.ssia.profile.id  Profile Id
        Unsigned 8-bit integer
    alcap.ssia.profile.type  Profile Type
        Unsigned 8-bit integer
        I.366.2 Profile Type
    alcap.ssiae.cas  CAS
        Unsigned 8-bit integer
        Channel Associated Signalling
    alcap.ssiae.cmd  Circuit Mode
        Unsigned 8-bit integer
    alcap.ssiae.dtmf  DTMF
        Unsigned 8-bit integer
    alcap.ssiae.fax  Fax
        Unsigned 8-bit integer
        Facsimile
    alcap.ssiae.frm  Frame Mode
        Unsigned 8-bit integer
    alcap.ssiae.lb  Loopback
        Unsigned 8-bit integer
    alcap.ssiae.mfr1  Multi-Frequency R1
        Unsigned 8-bit integer
    alcap.ssiae.mfr2  Multi-Frequency R2
        Unsigned 8-bit integer
    alcap.ssiae.oui  OUI
        Byte array
        Organizational Unique Identifier
    alcap.ssiae.pcm  PCM Mode
        Unsigned 8-bit integer
    alcap.ssiae.profile.id  Profile Id
        Unsigned 8-bit integer
    alcap.ssiae.profile.type  Profile Type
        Unsigned 8-bit integer
        I.366.2 Profile Type
    alcap.ssiae.rc  Rate Conctrol
        Unsigned 8-bit integer
    alcap.ssiae.syn  Syncronization
        Unsigned 8-bit integer
        Transport of synchronization of change in SSCS operation
    alcap.ssim.frm  Frame Mode
        Unsigned 8-bit integer
    alcap.ssim.max  Max Len
        Unsigned 16-bit integer
    alcap.ssim.mult  Multiplier
        Unsigned 8-bit integer
    alcap.ssime.frm  Frame Mode
        Unsigned 8-bit integer
    alcap.ssime.lb  Loopback
        Unsigned 8-bit integer
    alcap.ssime.max  Max Len
        Unsigned 16-bit integer
    alcap.ssime.mult  Multiplier
        Unsigned 8-bit integer
    alcap.ssisa.sscop.max_sdu_len.bw  Maximum Len of SSSAR-SDU Backwards
        Unsigned 16-bit integer
    alcap.ssisa.sscop.max_sdu_len.fw  Maximum Len of SSSAR-SDU Forward
        Unsigned 16-bit integer
    alcap.ssisa.sscop.max_uu_len.bw  Maximum Len of SSSAR-SDU Backwards
        Unsigned 16-bit integer
    alcap.ssisa.sscop.max_uu_len.fw  Maximum Len of SSSAR-SDU Forward
        Unsigned 16-bit integer
    alcap.ssisa.sssar.max_len.fw  Maximum Len of SSSAR-SDU Forward
        Unsigned 24-bit integer
    alcap.ssisu.sssar.max_len.fw  Maximum Len of SSSAR-SDU Forward
        Unsigned 24-bit integer
    alcap.ssisu.ted  Transmission Error Detection
        Unsigned 8-bit integer
    alcap.suci  SUCI
        Unsigned 8-bit integer
        Served User Correlation Id
    alcap.sugr  SUGR
        Byte array
        Served User Generated Reference
    alcap.sut.sut_len  SUT Length
        Unsigned 8-bit integer
    alcap.sut.transport  SUT
        Byte array
        Served User Transport
    alcap.unknown.field  Unknown Field Data
        Byte array
    alcap.vbws.bitrate.bw  CPS Backwards Bitrate
        Unsigned 24-bit integer
    alcap.vbws.bitrate.fw  CPS Forward Bitrate
        Unsigned 24-bit integer
    alcap.vbws.bucket_size.bw  Backwards CPS Bucket Size
        Unsigned 16-bit integer
    alcap.vbws.bucket_size.fw  Forward CPS Bucket Size
        Unsigned 16-bit integer
    alcap.vbws.max_size.bw  Backwards CPS Packet Size
        Unsigned 8-bit integer
    alcap.vbws.max_size.fw  Forward CPS Packet Size
        Unsigned 8-bit integer
    alcap.vbws.stt  Source Traffic Type
        Unsigned 8-bit integer
    alcap.vbwt.bitrate.bw  Peak CPS Backwards Bitrate
        Unsigned 24-bit integer
    alcap.vbwt.bitrate.fw  Peak CPS Forward Bitrate
        Unsigned 24-bit integer
    alcap.vbwt.bucket_size.bw  Peak Backwards CPS Bucket Size
        Unsigned 16-bit integer
    alcap.vbwt.bucket_size.fw  Peak Forward CPS Bucket Size
        Unsigned 16-bit integer
    alcap.vbwt.max_size.bw  Backwards CPS Packet Size
        Unsigned 8-bit integer
    alcap.vbwt.max_size.fw  Forward CPS Packet Size
        Unsigned 8-bit integer

ACP133 Attribute Syntaxes (acp133)

    acp133.ACPLegacyFormat  ACPLegacyFormat
        Signed 32-bit integer
        ACPLegacyFormat
    acp133.ACPPreferredDelivery  ACPPreferredDelivery
        Unsigned 32-bit integer
        ACPPreferredDelivery
    acp133.ALType  ALType
        Signed 32-bit integer
        ALType
    acp133.AddressCapabilities  AddressCapabilities
        No value
        AddressCapabilities
    acp133.Addressees  Addressees
        Unsigned 32-bit integer
        Addressees
    acp133.Addressees_item  Item
        String
        Addressees/_item
    acp133.Capability  Capability
        No value
        Capability
    acp133.Classification  Classification
        Unsigned 32-bit integer
        Classification
    acp133.Community  Community
        Unsigned 32-bit integer
        Community
    acp133.DLPolicy  DLPolicy
        No value
        DLPolicy
    acp133.DLSubmitPermission  DLSubmitPermission
        Unsigned 32-bit integer
        DLSubmitPermission
    acp133.DistributionCode  DistributionCode
        String
        DistributionCode
    acp133.JPEG  JPEG
        Byte array
        JPEG
    acp133.Kmid  Kmid
        Byte array
        Kmid
    acp133.MLReceiptPolicy  MLReceiptPolicy
        Unsigned 32-bit integer
        MLReceiptPolicy
    acp133.MonthlyUKMs  MonthlyUKMs
        No value
        MonthlyUKMs
    acp133.OnSupported  OnSupported
        Byte array
        OnSupported
    acp133.RIParameters  RIParameters
        No value
        RIParameters
    acp133.Remarks  Remarks
        Unsigned 32-bit integer
        Remarks
    acp133.Remarks_item  Item
        String
        Remarks/_item
    acp133.acp127-nn  acp127-nn
        Boolean
    acp133.acp127-pn  acp127-pn
        Boolean
    acp133.acp127-tn  acp127-tn
        Boolean
    acp133.address  address
        No value
        AddressCapabilities/address
    acp133.algorithm_identifier  algorithm-identifier
        No value
    acp133.capabilities  capabilities
        Unsigned 32-bit integer
        AddressCapabilities/capabilities
    acp133.capabilities_item  Item
        No value
        AddressCapabilities/capabilities/_item
    acp133.classification  classification
        Unsigned 32-bit integer
        RIParameters/classification
    acp133.content_types  content-types
        Unsigned 32-bit integer
        Capability/content-types
    acp133.content_types_item  Item
        
        Capability/content-types/_item
    acp133.conversion_with_loss_prohibited  conversion-with-loss-prohibited
        Unsigned 32-bit integer
        DLPolicy/conversion-with-loss-prohibited
    acp133.date  date
        String
        PairwiseTag/date
    acp133.description  description
        String
        AddressCapabilities/description
    acp133.disclosure_of_other_recipients  disclosure-of-other-recipients
        Unsigned 32-bit integer
        DLPolicy/disclosure-of-other-recipients
    acp133.edition  edition
        Signed 32-bit integer
        PairwiseTag/edition
    acp133.encoded_information_types_constraints  encoded-information-types-constraints
        No value
        Capability/encoded-information-types-constraints
    acp133.encrypted  encrypted
        Byte array
        MonthlyUKMs/encrypted
    acp133.further_dl_expansion_allowed  further-dl-expansion-allowed
        Boolean
        DLPolicy/further-dl-expansion-allowed
    acp133.implicit_conversion_prohibited  implicit-conversion-prohibited
        Unsigned 32-bit integer
        DLPolicy/implicit-conversion-prohibited
    acp133.inAdditionTo  inAdditionTo
        Unsigned 32-bit integer
        MLReceiptPolicy/inAdditionTo
    acp133.inAdditionTo_item  Item
        Unsigned 32-bit integer
        MLReceiptPolicy/inAdditionTo/_item
    acp133.individual  individual
        No value
        DLSubmitPermission/individual
    acp133.insteadOf  insteadOf
        Unsigned 32-bit integer
        MLReceiptPolicy/insteadOf
    acp133.insteadOf_item  Item
        Unsigned 32-bit integer
        MLReceiptPolicy/insteadOf/_item
    acp133.kmid  kmid
        Byte array
        PairwiseTag/kmid
    acp133.maximum_content_length  maximum-content-length
        Unsigned 32-bit integer
        Capability/maximum-content-length
    acp133.member_of_dl  member-of-dl
        No value
        DLSubmitPermission/member-of-dl
    acp133.member_of_group  member-of-group
        Unsigned 32-bit integer
        DLSubmitPermission/member-of-group
    acp133.minimize  minimize
        Boolean
        RIParameters/minimize
    acp133.none  none
        No value
        MLReceiptPolicy/none
    acp133.originating_MTA_report  originating-MTA-report
        Signed 32-bit integer
        DLPolicy/originating-MTA-report
    acp133.originator_certificate_selector  originator-certificate-selector
        No value
        AlgorithmInformation/originator-certificate-selector
    acp133.originator_report  originator-report
        Signed 32-bit integer
        DLPolicy/originator-report
    acp133.originator_requested_alternate_recipient_removed  originator-requested-alternate-recipient-removed
        Boolean
        DLPolicy/originator-requested-alternate-recipient-removed
    acp133.pattern_match  pattern-match
        No value
        DLSubmitPermission/pattern-match
    acp133.priority  priority
        Signed 32-bit integer
        DLPolicy/priority
    acp133.proof_of_delivery  proof-of-delivery
        Signed 32-bit integer
        DLPolicy/proof-of-delivery
    acp133.rI  rI
        String
        RIParameters/rI
    acp133.rIType  rIType
        Unsigned 32-bit integer
        RIParameters/rIType
    acp133.recipient_certificate_selector  recipient-certificate-selector
        No value
        AlgorithmInformation/recipient-certificate-selector
    acp133.removed  removed
        No value
        DLPolicy/requested-delivery-method/removed
    acp133.replaced  replaced
        Unsigned 32-bit integer
        DLPolicy/requested-delivery-method/replaced
    acp133.report_from_dl  report-from-dl
        Signed 32-bit integer
        DLPolicy/report-from-dl
    acp133.report_propagation  report-propagation
        Signed 32-bit integer
        DLPolicy/report-propagation
    acp133.requested_delivery_method  requested-delivery-method
        Unsigned 32-bit integer
        DLPolicy/requested-delivery-method
    acp133.return_of_content  return-of-content
        Unsigned 32-bit integer
        DLPolicy/return-of-content
    acp133.sHD  sHD
        String
        RIParameters/sHD
    acp133.security_labels  security-labels
        Unsigned 32-bit integer
        Capability/security-labels
    acp133.tag  tag
        No value
        UKMEntry/tag
    acp133.token_encryption_algorithm_preference  token-encryption-algorithm-preference
        Unsigned 32-bit integer
        DLPolicy/token-encryption-algorithm-preference
    acp133.token_encryption_algorithm_preference_item  Item
        No value
        DLPolicy/token-encryption-algorithm-preference/_item
    acp133.token_signature_algorithm_preference  token-signature-algorithm-preference
        Unsigned 32-bit integer
        DLPolicy/token-signature-algorithm-preference
    acp133.token_signature_algorithm_preference_item  Item
        No value
        DLPolicy/token-signature-algorithm-preference/_item
    acp133.ukm  ukm
        Byte array
        UKMEntry/ukm
    acp133.ukm_entries  ukm-entries
        Unsigned 32-bit integer
        MonthlyUKMs/ukm-entries
    acp133.ukm_entries_item  Item
        No value
        MonthlyUKMs/ukm-entries/_item
    acp133.unchanged  unchanged
        No value
        DLPolicy/requested-delivery-method/unchanged

AFS (4.0) Replication Server call declarations (rep_proc)

    rep_proc.opnum  Operation
        Unsigned 16-bit integer
        Operation

AIM Administrative (aim_admin)

    admin.confirm_status  Confirmation status
        Unsigned 16-bit integer
    aim.acctinfo.code  Account Information Request Code
        Unsigned 16-bit integer
    aim.acctinfo.permissions  Account Permissions
        Unsigned 16-bit integer

AIM Advertisements (aim_adverts)

AIM Buddylist Service (aim_buddylist)

AIM Chat Navigation (aim_chatnav)

AIM Chat Service (aim_chat)

AIM Directory Search (aim_dir)

AIM E-mail (aim_email)

AIM Generic Service (aim_generic)

    aim.client_verification.hash  Client Verification MD5 Hash
        Byte array
    aim.client_verification.length  Client Verification Request Length
        Unsigned 32-bit integer
    aim.client_verification.offset  Client Verification Request Offset
        Unsigned 32-bit integer
    aim.evil.new_warn_level  New warning level
        Unsigned 16-bit integer
    aim.ext_status.data  Extended Status Data
        Byte array
    aim.ext_status.flags  Extended Status Flags
        Unsigned 8-bit integer
    aim.ext_status.length  Extended Status Length
        Unsigned 8-bit integer
    aim.ext_status.type  Extended Status Type
        Unsigned 16-bit integer
    aim.idle_time  Idle time (seconds)
        Unsigned 32-bit integer
    aim.migrate.numfams  Number of families to migrate
        Unsigned 16-bit integer
    aim.privilege_flags  Privilege flags
        Unsigned 32-bit integer
    aim.privilege_flags.allow_idle  Allow other users to see idle time
        Boolean
    aim.privilege_flags.allow_member  Allow other users to see how long account has been a member
        Boolean
    aim.ratechange.msg  Rate Change Message
        Unsigned 16-bit integer
    aim.rateinfo.class.alertlevel  Alert Level
        Unsigned 32-bit integer
    aim.rateinfo.class.clearlevel  Clear Level
        Unsigned 32-bit integer
    aim.rateinfo.class.currentlevel  Current Level
        Unsigned 32-bit integer
    aim.rateinfo.class.curstate  Current State
        Unsigned 8-bit integer
    aim.rateinfo.class.disconnectlevel  Disconnect Level
        Unsigned 32-bit integer
    aim.rateinfo.class.id  Class ID
        Unsigned 16-bit integer
    aim.rateinfo.class.lasttime  Last Time
        Unsigned 32-bit integer
    aim.rateinfo.class.limitlevel  Limit Level
        Unsigned 32-bit integer
    aim.rateinfo.class.maxlevel  Max Level
        Unsigned 32-bit integer
    aim.rateinfo.class.numpairs  Number of Family/Subtype pairs
        Unsigned 16-bit integer
    aim.rateinfo.class.window_size  Window Size
        Unsigned 32-bit integer
    aim.rateinfo.numclasses  Number of Rateinfo Classes
        Unsigned 16-bit integer
    aim.rateinfoack.class  Acknowledged Rate Class
        Unsigned 16-bit integer
    aim.selfinfo.warn_level  Warning level
        Unsigned 16-bit integer
    generic.motd.motdtype  MOTD Type
        Unsigned 16-bit integer
    generic.servicereq.service  Requested Service
        Unsigned 16-bit integer

AIM ICQ (aim_icq)

    aim_icq.chunk_size  Data chunk size
        Unsigned 16-bit integer
    aim_icq.offline_msgs.dropped_flag  Dropped messages flag
        Unsigned 8-bit integer
    aim_icq.owner_uid  Owner UID
        Unsigned 32-bit integer
    aim_icq.request_seq_number  Request Sequence Number
        Unsigned 16-bit integer
    aim_icq.request_type  Request Type
        Unsigned 16-bit integer
    aim_icq.subtype  Meta Request Subtype
        Unsigned 16-bit integer

AIM Invitation Service (aim_invitation)

AIM Location (aim_location)

    aim.snac.location.request_user_info.infotype  Infotype
        Unsigned 16-bit integer

AIM Messaging (aim_messaging)

    aim.clientautoresp.client_caps_flags  Client Capabilities Flags
        Unsigned 32-bit integer
    aim.clientautoresp.protocol_version  Version
        Unsigned 16-bit integer
    aim.clientautoresp.reason  Reason
        Unsigned 16-bit integer
    aim.evil.warn_level  Old warning level
        Unsigned 16-bit integer
    aim.evilreq.origin  Send Evil Bit As
        Unsigned 16-bit integer
    aim.icbm.channel  Channel to setup
        Unsigned 16-bit integer
    aim.icbm.extended_data.message.flags  Message Flags
        Unsigned 8-bit integer
    aim.icbm.extended_data.message.flags.auto  Auto Message
        Boolean
    aim.icbm.extended_data.message.flags.normal  Normal Message
        Boolean
    aim.icbm.extended_data.message.priority_code  Priority Code
        Unsigned 16-bit integer
    aim.icbm.extended_data.message.status_code  Status Code
        Unsigned 16-bit integer
    aim.icbm.extended_data.message.text  Text
        String
    aim.icbm.extended_data.message.text_length  Text Length
        Unsigned 16-bit integer
    aim.icbm.extended_data.message.type  Message Type
        Unsigned 8-bit integer
    aim.icbm.flags  Message Flags
        Unsigned 32-bit integer
    aim.icbm.max_receiver_warnlevel  max receiver warn level
        Unsigned 16-bit integer
    aim.icbm.max_sender_warn-level  Max sender warn level
        Unsigned 16-bit integer
    aim.icbm.max_snac  Max SNAC Size
        Unsigned 16-bit integer
    aim.icbm.min_msg_interval  Minimum message interval (seconds)
        Unsigned 16-bit integer
    aim.icbm.rendezvous.extended_data.message.flags.multi  Multiple Recipients Message
        Boolean
    aim.icbm.unknown  Unknown parameter
        Unsigned 16-bit integer
    aim.messaging.channelid  Message Channel ID
        Unsigned 16-bit integer
    aim.messaging.icbmcookie  ICBM Cookie
        Byte array
    aim.notification.channel  Notification Channel
        Unsigned 16-bit integer
    aim.notification.cookie  Notification Cookie
        Byte array
    aim.notification.type  Notification Type
        Unsigned 16-bit integer
    aim.rendezvous.msg_type  Message Type
        Unsigned 16-bit integer

AIM OFT (aim_oft)

AIM Popup (aim_popup)

AIM Privacy Management Service (aim_bos)

    aim.bos.userclass  User class
        Unsigned 32-bit integer

AIM Server Side Info (aim_ssi)

    aim.fnac.ssi.bid  SSI Buddy ID
        Unsigned 16-bit integer
    aim.fnac.ssi.buddyname  Buddy Name
        String
    aim.fnac.ssi.buddyname_len  SSI Buddy Name length
        Unsigned 16-bit integer
    aim.fnac.ssi.data  SSI Buddy Data
        Unsigned 16-bit integer
    aim.fnac.ssi.gid  SSI Buddy Group ID
        Unsigned 16-bit integer
    aim.fnac.ssi.last_change_time  SSI Last Change Time
        Unsigned 32-bit integer
    aim.fnac.ssi.numitems  SSI Object count
        Unsigned 16-bit integer
    aim.fnac.ssi.tlvlen  SSI TLV Len
        Unsigned 16-bit integer
    aim.fnac.ssi.type  SSI Buddy type
        Unsigned 16-bit integer
    aim.fnac.ssi.version  SSI Version
        Unsigned 8-bit integer

AIM Server Side Themes (aim_sst)

    aim.sst.icon  Icon
        Byte array
    aim.sst.icon_size  Icon Size
        Unsigned 16-bit integer
    aim.sst.md5  MD5 Hash
        Byte array
    aim.sst.md5.size  MD5 Hash Size
        Unsigned 8-bit integer
    aim.sst.ref_num  Reference Number
        Unsigned 16-bit integer
    aim.sst.unknown  Unknown Data
        Byte array

AIM Signon (aim_signon)

AIM Statistics (aim_stats)

AIM Translate (aim_translate)

AIM User Lookup (aim_lookup)

    aim.userlookup.email  Email address looked for
        String
        Email address

ANSI A-I/F BSMAP (ansi_a_bsmap)

    ansi_a.bsmap_msgtype  BSMAP Message Type
        Unsigned 8-bit integer
    ansi_a.cell_ci  Cell CI
        Unsigned 16-bit integer
    ansi_a.cell_lac  Cell LAC
        Unsigned 16-bit integer
    ansi_a.cell_mscid  Cell MSCID
        Unsigned 24-bit integer
    ansi_a.cld_party_ascii_num  Called Party ASCII Number
        String
    ansi_a.cld_party_bcd_num  Called Party BCD Number
        String
    ansi_a.clg_party_ascii_num  Calling Party ASCII Number
        String
    ansi_a.clg_party_bcd_num  Calling Party BCD Number
        String
    ansi_a.dtap_msgtype  DTAP Message Type
        Unsigned 8-bit integer
    ansi_a.elem_id  Element ID
        Unsigned 8-bit integer
    ansi_a.esn  ESN
        Unsigned 32-bit integer
    ansi_a.imsi  IMSI
        String
    ansi_a.len  Length
        Unsigned 8-bit integer
    ansi_a.min  MIN
        String
    ansi_a.none  Sub tree
        No value
    ansi_a.pdsn_ip_addr  PDSN IP Address
        IPv4 address
        IP Address

ANSI A-I/F DTAP (ansi_a_dtap)

ANSI IS-637-A (SMS) Teleservice Layer (ansi_637_tele)

    ansi_637.bin_addr  Binary Address
        Byte array
    ansi_637.len  Length
        Unsigned 8-bit integer
    ansi_637.none  Sub tree
        No value
    ansi_637.tele_msg_id  Message ID
        Unsigned 24-bit integer
    ansi_637.tele_msg_rsvd  Reserved
        Unsigned 24-bit integer
    ansi_637.tele_msg_type  Message Type
        Unsigned 24-bit integer
    ansi_637.tele_subparam_id  Teleservice Subparam ID
        Unsigned 8-bit integer
    ansi_637.trans_msg_type  Message Type
        Unsigned 24-bit integer
    ansi_637.trans_param_id  Transport Param ID
        Unsigned 8-bit integer

ANSI IS-637-A (SMS) Transport Layer (ansi_637_trans)

ANSI IS-683-A (OTA (Mobile)) (ansi_683)

    ansi_683.for_msg_type  Forward Link Message Type
        Unsigned 8-bit integer
    ansi_683.len  Length
        Unsigned 8-bit integer
    ansi_683.none  Sub tree
        No value
    ansi_683.rev_msg_type  Reverse Link Message Type
        Unsigned 8-bit integer

ANSI IS-801 (Location Services (PLD)) (ansi_801)

    ansi_801.for_req_type  Forward Request Type
        Unsigned 8-bit integer
    ansi_801.for_rsp_type  Forward Response Type
        Unsigned 8-bit integer
    ansi_801.for_sess_tag  Forward Session Tag
        Unsigned 8-bit integer
    ansi_801.rev_req_type  Reverse Request Type
        Unsigned 8-bit integer
    ansi_801.rev_rsp_type  Reverse Response Type
        Unsigned 8-bit integer
    ansi_801.rev_sess_tag  Reverse Session Tag
        Unsigned 8-bit integer
    ansi_801.sess_tag  Session Tag
        Unsigned 8-bit integer

ANSI Mobile Application Part (ansi_map)

    ansi_map.billing_id  Billing ID
        Signed 32-bit integer
    ansi_map.id  Value
        Unsigned 8-bit integer
    ansi_map.ios401_elem_id  IOS 4.0.1 Element ID
        No value
    ansi_map.len  Length
        Unsigned 8-bit integer
    ansi_map.min  MIN
        String
    ansi_map.number  Number
        String
    ansi_map.oprcode  Operation Code
        Signed 32-bit integer
    ansi_map.param_id  Param ID
        Unsigned 32-bit integer
    ansi_map.tag  Tag
        Unsigned 8-bit integer

AOL Instant Messenger (aim)

    aim.buddyname  Buddy Name
        String
    aim.buddynamelen  Buddyname len
        Unsigned 8-bit integer
    aim.channel  Channel ID
        Unsigned 8-bit integer
    aim.cmd_start  Command Start
        Unsigned 8-bit integer
    aim.data  Data
        Byte array
    aim.datalen  Data Field Length
        Unsigned 16-bit integer
    aim.dcinfo.addr  Internal IP address
        IPv4 address
    aim.dcinfo.auth_cookie  Authorization Cookie
        Byte array
    aim.dcinfo.client_futures  Client Futures
        Unsigned 32-bit integer
    aim.dcinfo.last_ext_info_update  Last Extended Info Update
        Unsigned 32-bit inte