Wireshark · Display Filter Reference: Linux netlink protocol

Field name	Description	Type	Versions
netlink.attr_data	Data	Byte sequence	2.4.0 to 4.4.2
netlink.attr_index	Index	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink.attr_len	Len	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.attr_type	Type	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink.attr_type.nested	Nested	Boolean	2.4.0 to 4.4.2
netlink.attr_type.net_byteorder	Network byte order	Boolean	2.4.0 to 4.4.2
netlink.error	Error code	Signed integer (32 bits)	2.4.0 to 4.4.2
netlink.family	Family	Unsigned integer (16 bits)	1.12.0 to 4.4.2
netlink.hatype	Link-layer address type	Unsigned integer (16 bits)	1.12.0 to 4.4.2
netlink.hdr_flags	Flags	Unsigned integer (16 bits)	1.12.0 to 4.4.2
netlink.hdr_flags.ack	Ack	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.append	Append	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.atomic	Atomic	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.create	Create	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.dump_filtered	Dump filtered	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink.hdr_flags.dump_intr	Dump inconsistent	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink.hdr_flags.echo	Echo	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.excl	Excl	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.match	Return all matching	Unsigned integer (16 bits)	2.4.0 to 4.4.2
netlink.hdr_flags.match_all	Return all matching	Unsigned integer (16 bits)	2.0.0 to 2.2.17
netlink.hdr_flags.multi	Multipart message	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.replace	Replace	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.request	Request	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_flags.root	Specify tree root	Unsigned integer (16 bits)	2.0.0 to 4.4.2
netlink.hdr_len	Length	Unsigned integer (32 bits)	1.12.0 to 4.4.2
netlink.hdr_pid	Port ID	Unsigned integer (32 bits)	1.12.0 to 4.4.2
netlink.hdr_seq	Sequence	Unsigned integer (32 bits)	1.12.0 to 4.4.2
netlink.hdr_type	Message type	Unsigned integer (16 bits)	1.12.0 to 4.4.2
netlink.padding	Padding	Byte sequence	4.4.0 to 4.4.2