Wireshark · Display Filter Reference: Black Box Log

Field name	Description	Type	Versions
bblog.dupacks	Duplicate Acknowledgements	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.errno	Error Number	Signed integer (32 bits)	3.6.0 to 4.4.2
bblog.event_flags	Event Flags	Unsigned integer (16 bits)	3.6.0 to 4.4.2
bblog.event_flags_hdr	TCP header	Boolean	3.6.0 to 4.4.2
bblog.event_flags_rxbuf	Receive buffer information	Boolean	3.6.0 to 4.4.2
bblog.event_flags_stack	Stack specific information	Boolean	3.6.0 to 4.4.2
bblog.event_flags_txbuf	Send buffer information	Boolean	3.6.0 to 4.4.2
bblog.event_flags_verbose	Additional information	Boolean	3.6.0 to 4.4.2
bblog.event_id	Event Identifier	Unsigned integer (8 bits)	3.6.0 to 4.4.2
bblog.first_byte_in	Time of First Byte In	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.first_byte_out	Time of First Byte Out	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.flex_1	Flex 1	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.flex_2	Flex 2	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.iss	Initial Sending Sequence Number (ISS)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.pad_1	Padding	Unsigned integer (8 bits)	3.6.0 to 4.4.2
bblog.pad_2	Padding	Unsigned integer (8 bits)	3.6.0 to 4.4.2
bblog.pad_3	Padding	Unsigned integer (8 bits)	3.6.0 to 4.4.2
bblog.payload_length	TCP Payload Length	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.rcv_adv	Receive Advanced (RCV.ADV)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.rcv_nxt	Receive Next (RCV.NXT)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.rcv_shift	Rcv.Wind.Shift	Unsigned integer (8 bits)	3.6.0 to 4.4.2
bblog.rcv_up	Receive Urgent Pointer (RCV.UP)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.rcv_wnd	Receive Window (RCV.WND)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.rttvar	Round Trip Timer Variance (RTTVAR)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.rxb_acc	Receive Buffer ACC	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.rxb_ccc	Receive Buffer CCC	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.rxb_spare	Receive Buffer Spare	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.seg_qlen	Segment Queue Length	Signed integer (32 bits)	3.6.0 to 4.4.2
bblog.serial_nr	Serial Number	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.snd_cwnd	Congestion Window	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.snd_max	Newest Sequence Number Sent (SND.MAX)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.snd_num_holes	Number of Holes	Signed integer (32 bits)	3.6.0 to 4.4.2
bblog.snd_nxt	Next Sequence Number (SND.NXT)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.snd_recover	Recovery Sequence Number (SND.RECOVER)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.snd_shift	Snd.Wind.Shift	Unsigned integer (8 bits)	3.6.0 to 4.4.2
bblog.snd_ssthresh	Slowstart Threshold (SSTHREASH)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.snd_una	Oldest Unacknowledged Sequence Number (SND.UNA)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.snd_wnd	Send Window (SND.WND)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.srtt	Smoothed Round Trip Time (SRTT)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.stack_id	Stack Identifier	Unsigned integer (8 bits)	3.6.0 to 4.4.2
bblog.starttime	Starttime	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.state	TCP State	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.t_flags	TCB Flags	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.t_flags2	TCB Flags2	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.t_flags2_ace_permit	Accurate ECN mode	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_drop_after_data	Drop connection after all data has been acknowledged	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_ecn_permit	ECN	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_ecn_snd_cwr	ECN CWR queued	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_ecn_snd_ece	ECN ECE queued	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_first_bytes_complete	First bytes in/out	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_log_auto	Connection auto-logging	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_plpmtu_blackhole	PMTU blackhole detection	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_plpmtu_maxsegsnt	Last segment sent was a full segment	Boolean	3.6.0 to 4.4.2
bblog.t_flags2_plpmtu_pmtud	Path MTU discovery	Boolean	3.6.0 to 4.4.2
bblog.t_flags_ack_now	Ack now	Boolean	3.6.0 to 4.4.2
bblog.t_flags_be_in_cong_recovery	Currently in congestion avoidance	Boolean	3.6.0 to 4.4.2
bblog.t_flags_be_in_fast_recovery	Currently in fast recovery	Boolean	3.6.0 to 4.4.2
bblog.t_flags_delayed_ack	Delayed ack	Boolean	3.6.0 to 4.4.2
bblog.t_flags_force_data	Force data	Boolean	3.6.0 to 4.4.2
bblog.t_flags_goodput_in_progress	Goodput measurement in progress	Boolean	3.6.0 to 4.4.2
bblog.t_flags_last_idle	Connection was previously idle	Boolean	3.6.0 to 4.4.2
bblog.t_flags_listen_queue_overflow	Listen queue overflow	Boolean	3.6.0 to 4.4.2
bblog.t_flags_lost_rtx_detection	Lost retransmission detection	Boolean	3.6.0 to 4.4.2
bblog.t_flags_more_to_come	More to come	Boolean	3.6.0 to 4.4.2
bblog.t_flags_need_fin	Need FIN	Boolean	3.6.0 to 4.4.2
bblog.t_flags_need_syn	Need SYN	Boolean	3.6.0 to 4.4.2
bblog.t_flags_no_delay	No delay	Boolean	3.6.0 to 4.4.2
bblog.t_flags_no_opt	No options	Boolean	3.6.0 to 4.4.2
bblog.t_flags_no_push	No push	Boolean	3.6.0 to 4.4.2
bblog.t_flags_prev_valid	Saved values for bad retransmission valid	Boolean	3.6.0 to 4.4.2
bblog.t_flags_received_timestamp	Peer has requested Timestamp	Boolean	3.6.0 to 4.4.2
bblog.t_flags_received_window_scale	Peer has requested Window Scaling	Boolean	3.6.0 to 4.4.2
bblog.t_flags_request_timestamp	Have or will request Timestamps	Boolean	3.6.0 to 4.4.2
bblog.t_flags_request_window_scale	Have or will request Window Scaling	Boolean	3.6.0 to 4.4.2
bblog.t_flags_sack_permitted	SACK permitted	Boolean	3.6.0 to 4.4.2
bblog.t_flags_sent_fin	Sent FIN	Boolean	3.6.0 to 4.4.2
bblog.t_flags_signature	MD5 signature required	Boolean	3.6.0 to 4.4.2
bblog.t_flags_tfo	TFO	Boolean	3.6.0 to 4.4.2
bblog.t_flags_toe	TOE	Boolean	3.6.0 to 4.4.2
bblog.t_flags_tso	TSO	Boolean	3.6.0 to 4.4.2
bblog.t_flags_unused_0	Unused 1	Boolean	3.6.0 to 4.0.17
bblog.t_flags_unused_1	Unused 1	Boolean	3.6.0 to 4.4.2
bblog.t_flags_unused_2	Unused 2	Boolean	4.2.0 to 4.4.2
bblog.t_flags_wake_socke_receive	Wakeup receive socket	Boolean	3.6.0 to 3.6.24
bblog.t_flags_wake_socket_receive	Wakeup receive socket	Boolean	4.0.0 to 4.4.2
bblog.t_flags_was_in_cong_recovery	Was in congestion avoidance	Boolean	3.6.0 to 4.4.2
bblog.t_flags_was_in_fast_recovery	Was in fast recovery	Boolean	3.6.0 to 4.4.2
bblog.t_flags_zero_recv_window_sent	Sent a RCV.WND = 0 in response	Boolean	3.6.0 to 4.4.2
bblog.ticks	Ticks	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.txb_acc	Send Buffer ACC	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.txb_accs	Send Buffer CCC	Unsigned integer (32 bits)	3.6.0 to 4.4.2
bblog.txb_spare	Send Buffer Spare	Unsigned integer (32 bits)	3.6.0 to 4.4.2