Wireshark · Display Filter Reference: Remote Procedure Call

Field name	Description	Type	Versions
rpc.argument_length	Argument length	Unsigned integer (32 bits)	2.0.0 to 4.4.2
rpc.array.len	num	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.array_no_values	no values	Label	2.0.0 to 4.4.2
rpc.auth.ctime	CTIME	Date and time	3.0.0 to 4.4.2
rpc.auth.flags	FLAGS	Unsigned integer (32 bits)	3.0.0 to 4.4.2
rpc.auth.flavor	Flavor	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.auth.gid	GID	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.auth.length	Length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.auth.lk_owner	Lock Owner	Byte sequence	1.8.0 to 4.4.2
rpc.auth.machinename	Machine Name	Character string	1.0.0 to 4.4.2
rpc.auth.pid	PID	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rpc.auth.stamp	Stamp	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.auth.uid	UID	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authdes.convkey	Conversation Key (encrypted)	Unsigned integer (64 bits)	1.0.0 to 4.4.2
rpc.authdes.namekind	Namekind	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authdes.netname	Netname	Character string	1.0.0 to 4.4.2
rpc.authdes.nickname	Nickname	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authdes.timestamp	Timestamp (encrypted)	Unsigned integer (64 bits)	1.0.0 to 4.4.2
rpc.authdes.timeverf	Timestamp verifier (encrypted)	Unsigned integer (64 bits)	1.0.0 to 4.4.2
rpc.authdes.window	Window (encrypted)	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authdes.windowverf	Window verifier (encrypted)	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.checksum	GSS Checksum	Byte sequence	1.0.0 to 4.4.2
rpc.authgss.context	GSS Context	Byte sequence	1.0.0 to 4.4.2
rpc.authgss.context.created_frame	Created in frame	Frame number	1.8.0 to 4.4.2
rpc.authgss.context.destroyed_frame	Destroyed in frame	Frame number	1.8.0 to 4.4.2
rpc.authgss.context.length	GSS Context Length	Unsigned integer (32 bits)	1.8.0 to 4.4.2
rpc.authgss.data	GSS Data	Byte sequence	1.0.0 to 4.4.2
rpc.authgss.data.length	Length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.major	GSS Major Status	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.minor	GSS Minor Status	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.procedure	GSS Procedure	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.seqnum	GSS Sequence Number	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.service	GSS Service	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.token	GSS Token	Byte sequence	1.0.0 to 4.4.2
rpc.authgss.token_length	GSS Token Length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.version	GSS Version	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgss.window	GSS Sequence Window	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgssapi.handle	Client Handle	Byte sequence	1.0.0 to 4.4.2
rpc.authgssapi.isn	Signed ISN	Byte sequence	1.0.0 to 4.4.2
rpc.authgssapi.message	AUTH_GSSAPI Message	Boolean	1.0.0 to 4.4.2
rpc.authgssapi.msgversion	Msg Version	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.authgssapi.version	AUTH_GSSAPI Version	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.call.dup	Duplicate to the call in	Frame number	1.0.0 to 4.4.2
rpc.cannot_dissect	Cannot dissect	Label	2.0.0 to 4.4.2
rpc.continuation_data	Continuation data	Byte sequence	2.0.0 to 4.4.2
rpc.dup	Duplicate Call/Reply	Label	1.0.0 to 4.4.2
rpc.fill_bytes	fill bytes	Byte sequence	2.0.0 to 4.4.2
rpc.fraglen	Fragment Length	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.fragment	RPC Fragment	Frame number	1.0.0 to 4.4.2
rpc.fragment.count	Fragment count	Unsigned integer (32 bits)	1.6.0 to 4.4.2
rpc.fragment.error	Defragmentation error	Frame number	1.0.0 to 4.4.2
rpc.fragment.multipletails	Multiple tail fragments found	Boolean	1.0.0 to 4.4.2
rpc.fragment.overlap	Fragment overlap	Boolean	1.0.0 to 4.4.2
rpc.fragment.overlap.conflict	Conflicting data in fragment overlap	Boolean	1.0.0 to 4.4.2
rpc.fragment.toolongfragment	Fragment too long	Boolean	1.0.0 to 4.4.2
rpc.fragment_data	Fragment Data	Byte sequence	2.0.0 to 4.4.2
rpc.fragments	RPC Fragments	Label	1.0.0 to 4.4.2
rpc.lastfrag	Last Fragment	Boolean	1.0.0 to 4.4.2
rpc.msgtyp	Message Type	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.opaque_data	opaque data	Byte sequence	2.0.0 to 4.4.2
rpc.opaque_length	length	Unsigned integer (32 bits)	2.0.0 to 4.4.2
rpc.procedure	Procedure	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.program	Program	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.programversion	Program Version	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.programversion.max	Program Version (Maximum)	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.programversion.min	Program Version (Minimum)	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.reassembled.length	Reassembled RPC length	Unsigned integer (32 bits)	1.4.0 to 4.4.2
rpc.repframe	Reply Frame	Frame number	1.0.0 to 4.4.2
rpc.reply.dup	Duplicate to the reply in	Frame number	1.0.0 to 4.4.2
rpc.replystat	Reply State	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.reqframe	Request Frame	Frame number	1.0.0 to 4.4.2
rpc.segment_needed	Need another TCP segment but cannot desegment or not enabled (check RPC and TCP preferences)	Label	3.6.0 to 4.4.2
rpc.state_accept	Accept State	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.state_auth	Auth State	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.state_reject	Reject State	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.time	Time from request	Time offset	1.0.0 to 4.4.2
rpc.unknown_body	Unknown RPC call/reply body	Label	2.0.0 to 4.4.2
rpc.value_follows	Value Follows	Boolean	1.0.0 to 4.4.2
rpc.version	RPC Version	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.version.max	RPC Version (Maximum)	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.version.min	RPC Version (Minimum)	Unsigned integer (32 bits)	1.0.0 to 4.4.2
rpc.xid	XID	Unsigned integer (32 bits)	1.0.0 to 4.4.2