Wireshark · Display Filter Reference: Linux netlink netfilter protocol

Field name	Description	Type	Versions
netlink-netfilter.ct.attr	Type	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.id	ID	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status	Status	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.assured	Assured	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.confirmed	Confirmed	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.dst_nat	Destination NAT	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.dst_nat_done	Destination NAT done	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.dying	Dying	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.expected	Expected	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.fixed_timeout	Fixed timeout	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.helper	Helper	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.hw_offload	HW offload	Unsigned integer (32 bits)	4.2.0 to 4.4.2
netlink-netfilter.ct_attr.status.offload	Offload	Unsigned integer (32 bits)	3.4.0 to 4.4.2
netlink-netfilter.ct_attr.status.seen_reply	Seen reply	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.seq_adjust	Sequence adjust	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.src_nat	Source NAT	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.src_nat_done	Source NAT done	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.template	Template	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.status.untracked	Untracked	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_attr.timeout	Timeout	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_help_attr	Helper	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_help_attr.help_name	Helper name	Character string	2.6.0 to 4.4.2
netlink-netfilter.ct_seqadj_attr	Adjustment	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_seqadj_correction_pos	Position	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_seqadj_offset_after	Offset	Signed integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.ct_seqadj_offset_before	Offset	Signed integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.exp.attr	Type	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.exp_type	Type	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.family	Address family	Unsigned integer (8 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset.cadt_flags	Flags	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset.cidr	CIDR	Unsigned integer (8 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset.comment	Comment	Character string	2.4.0 to 4.4.2
netlink-netfilter.ipset.family	Settype family	Unsigned integer (8 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset.flags	Flags	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset.ip6_addr	IPv6 address	IPv6 address	2.4.0 to 4.4.2
netlink-netfilter.ipset.ip_addr	IPv4 address	IPv4 address	2.4.0 to 4.4.2
netlink-netfilter.ipset.setname	Setname	Character string	2.4.0 to 4.4.2
netlink-netfilter.ipset.timeout	Timeout	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset.typename	Typename	Character string	2.4.0 to 4.4.2
netlink-netfilter.ipset_adt_attr	Type	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset_attr	Type	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset_cadt_attr	Type	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset_command	Command	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.ipset_ip_attr	Type	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.nfct_tuple	Type	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfct_tuple.ip	Type	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfct_tuple.ip.ip6_addr	IPv6 address	IPv6 address	2.6.0 to 4.4.2
netlink-netfilter.nfct_tuple.ip.ip_addr	IPv4 address	IPv4 address	2.6.0 to 4.4.2
netlink-netfilter.nfct_tuple.proto	Type	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfct_tuple.proto.dst_port	Port	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfct_tuple.proto.num	Protocol	Unsigned integer (8 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfct_tuple.proto.src_port	Port	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfct_tuple.zone	Zone	Unsigned integer (16 bits)	4.0.0 to 4.4.2
netlink-netfilter.nfexp.class	Class	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.flags	Flags	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.flags.inactive	Inactive	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.flags.permanent	Permanent	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.flags.userspace	Userspace	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.fn	Name	Character string	2.6.0 to 4.4.2
netlink-netfilter.nfexp.id	ID	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.nat	Type	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.nat.dir	Direction	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.timeout	Timeout	Unsigned integer (32 bits)	2.6.0 to 4.4.2
netlink-netfilter.nfexp.zone	Zone	Unsigned integer (16 bits)	2.6.0 to 4.4.2
netlink-netfilter.nftables_command	Command	Unsigned integer (16 bits)	4.4.0 to 4.4.2
netlink-netfilter.padding	Padding	Byte sequence	4.4.0 to 4.4.2
netlink-netfilter.queue.attr	Type	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.caplen	Length of captured packet	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.config.command.command	Command	Unsigned integer (8 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.config.command.pf	Protocol family	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.config.flags	Flags	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.config.mask	Flags mask	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.config.params.copy_mode	Copy mode	Unsigned integer (8 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.config.params.copy_range	Copy range	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.config.queue_maxlen	Maximum queue length	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.config_attr	Type	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.ct_info	Conntrack info	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.gid	GID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.hwaddr.addr	Address	Ethernet or other MAC address	2.4.0 to 4.4.2
netlink-netfilter.queue.hwaddr.len	Address length	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.ifindex_indev	IFINDEX_INDEV	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.ifindex_outdev	IFINDEX_OUTDEV	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.ifindex_physindev	IFINDEX_PHYSINDEV	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.ifindex_physoutdev	IFINDEX_PHYSOUTDEV	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.nfmark	Mark	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.packet.hook	Netfilter hook	Unsigned integer (8 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.packet.id	Packet ID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.packet.protocol	HW protocol	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.timestamp	Timestamp	Date and time	2.4.0 to 4.4.2
netlink-netfilter.queue.uid	UID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.verdict.id	Verdict ID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue.verdict.verdict	Verdict	Unsigned integer (32 bits)	2.4.0 to 4.4.2
netlink-netfilter.queue_type	Type	Unsigned integer (16 bits)	1.12.0 to 4.4.2
netlink-netfilter.res_id	Resource id	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink-netfilter.subsys	Subsystem	Unsigned integer (16 bits)	1.12.0 to 4.4.2
netlink-netfilter.ulog_type	Type	Unsigned integer (16 bits)	1.12.0 to 4.4.2
netlink-netfilter.version	Version	Unsigned integer (8 bits)	2.4.0 to 4.4.2