User DLTs Protocol Table in Wireshark

Wireshark uses tables to show data and statistics to the user. The summarized data displayed in tables reduce the complexity of the information and make it easy for the user to analyze. For managing and editing these tables in Wireshark, the User Table editor is used.

Wireshark’s “User DLTs protocol” table is also a user table to know which protocol to use for each user DLT in a case when a captured pcap file uses one of the user DLTs from 147 to 162.

Steps To Open User DLTs Protocol Table:

Start the Wireshark by selecting the network we want to analyze or opening any previously saved captured file.

• Now go into the Wireshark and click on the Edit → Preferences menu or toolbar item.

• This will open Wireshark’s “Preferences” dialogue box.

• On the “Preferences” dialogue box, click on the drop-down option “Protocols”. All the available protocols that Wireshark supports are listed down below.
• Now scroll down and search for the “DLT_USER”.

• Now just click on the “Edit” option. This will bring up Wireshark’s User DLTs Protocol table.

This users’ table has the following fields :

• DLT: It displays one of the user DLTs.
• Payload protocol: It displays the name of the payload protocol. For example, “eth” for Ethernet and “IP” for IPv4.
• Header size: It displays the size of the header protocol if it is there before the payload protocol. A value of 0 indicates the header protocol is disabled.
• Header protocol: It displays the name of the header protocol.
• Trailer size: It displays the size of the trailer protocol if it is there after the payload protocol. A value of 0 indicates the trailer protocol is disabled.
• Trailer protocol: It displays the name of the trailer protocol.

This user table contains the following controls :

• “ +” :  For adding a new entry in the user table.
• “—”:  For removing any existing entry from the user table
• “ ∧ “:  For moving up in the entries.
• “ ∨ “:  For down in the entries.
• Copy: For creating a duplicate of the selected entry.
• Clear: For clearing all the existing entries from the user table.