Wireshark · Display Filter Reference: SMB Witness Service

Field name	Description	Type	Versions
witness.opnum	Operation	Unsigned integer (16 bits)	2.2.0 to 4.4.2
witness.werror	Windows Error	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_AsyncNotify.context_handle	Context Handle	Byte sequence	2.2.0 to 4.4.2
witness.witness_AsyncNotify.response	Response	Label	2.2.0 to 4.4.2
witness.witness_GetInterfaceList.interface_list	Interface List	Label	2.2.0 to 4.4.2
witness.witness_interfaceInfo.flags	Flags	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_interfaceInfo.group_name	Group Name	Character string	2.2.0 to 4.4.2
witness.witness_interfaceInfo.ipv4	Ipv4	IPv4 address	2.2.0 to 4.4.2
witness.witness_interfaceInfo.ipv6	Ipv6	IPv6 address	2.2.0 to 4.4.2
witness.witness_interfaceInfo.state	State	Unsigned integer (16 bits)	2.2.0 to 4.4.2
witness.witness_interfaceInfo.version	Version	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv4_VALID	WITNESS INFO IPv4 VALID	Boolean	2.2.0 to 4.4.2
witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv6_VALID	WITNESS INFO IPv6 VALID	Boolean	2.2.0 to 4.4.2
witness.witness_interfaceInfo_flags.WITNESS_INFO_WITNESS_IF	WITNESS INFO WITNESS IF	Boolean	2.2.0 to 4.4.2
witness.witness_interfaceList.interfaces	Interfaces	Label	2.2.0 to 4.4.2
witness.witness_interfaceList.num_interfaces	Num Interfaces	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_IPaddrInfo.flags	Flags	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_IPaddrInfo.ipv4	Ipv4	IPv4 address	2.2.0 to 4.4.2
witness.witness_IPaddrInfo.ipv6	Ipv6	IPv6 address	2.2.0 to 4.4.2
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_OFFLINE	WITNESS IPADDR OFFLINE	Boolean	2.2.0 to 4.4.2
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_ONLINE	WITNESS IPADDR ONLINE	Boolean	2.2.0 to 4.4.2
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V4	WITNESS IPADDR V4	Boolean	2.2.0 to 4.4.2
witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V6	WITNESS IPADDR V6	Boolean	2.2.0 to 4.4.2
witness.witness_IPaddrInfoList.addr	Addr	Label	2.2.0 to 4.4.2
witness.witness_IPaddrInfoList.length	Length	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_IPaddrInfoList.num	Num	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_IPaddrInfoList.reserved	Reserved	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_notifyResponse.length	Length	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_notifyResponse.messages	Messages	Label	2.2.0 to 4.4.2
witness.witness_notifyResponse.messages_	Messages	Label	2.2.0 to 4.4.2
witness.witness_notifyResponse.num	Num	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_notifyResponse.type	Type	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_notifyResponse_message.client_move	Client Move	Label	2.2.0 to 4.4.2
witness.witness_notifyResponse_message.data	Data	Label	2.2.0 to 4.4.2
witness.witness_notifyResponse_message.ip_change	Ip Change	Label	2.2.0 to 4.4.2
witness.witness_notifyResponse_message.resource_change	Resource Change	Label	2.2.0 to 4.4.2
witness.witness_notifyResponse_message.share_move	Share Move	Label	2.2.0 to 4.4.2
witness.witness_Register.client_computer_name	Client Computer Name	Character string	2.2.0 to 4.4.2
witness.witness_Register.context_handle	Context Handle	Byte sequence	2.2.0 to 4.4.2
witness.witness_Register.ip_address	Ip Address	Character string	2.2.0 to 4.4.2
witness.witness_Register.net_name	Net Name	Character string	2.2.0 to 4.4.2
witness.witness_Register.version	Version	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_RegisterEx.client_computer_name	Client Computer Name	Character string	2.2.0 to 4.4.2
witness.witness_RegisterEx.context_handle	Context Handle	Byte sequence	2.2.0 to 4.4.2
witness.witness_RegisterEx.flags	Flags	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_RegisterEx.ip_address	Ip Address	Character string	2.2.0 to 4.4.2
witness.witness_RegisterEx.net_name	Net Name	Character string	2.2.0 to 4.4.2
witness.witness_RegisterEx.share_name	Share Name	Character string	2.2.0 to 4.4.2
witness.witness_RegisterEx.timeout	Timeout	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_RegisterEx.version	Version	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_RegisterEx_flags.WITNESS_REGISTER_IP_NOTIFICATION	WITNESS REGISTER IP NOTIFICATION	Boolean	2.2.0 to 4.4.2
witness.witness_RegisterEx_flags.WITNESS_REGISTER_NONE	Witness Register None	Boolean	2.2.0 to 2.2.1
witness.witness_ResourceChange.length	Length	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_ResourceChange.name	Name	Character string	2.2.0 to 4.4.2
witness.witness_ResourceChange.type	Type	Unsigned integer (32 bits)	2.2.0 to 4.4.2
witness.witness_UnRegister.context_handle	Context Handle	Byte sequence	2.2.0 to 4.4.2