The links below list common data fields and properties that can be used for filtering with Network Monitor 3.x.  They are categorized by protocol.  This list is helpful for understanding some of the more common data fields and properties with descriptions of what they do.  Please help us extend the list by editing the wiki with fields you've found useful.

Data Fields represent real data that is on the wire.  Each piece of the raw data will most likely have a field associated with it.

Properties represent meta data.  There are many uses for Properties in the protocol parsing code, but a few useful ones from a user perspective are:

• Calculation or summary of multiple data fields - For Instance, there is no field that represents the TCP length, but there is a property that does.
• Represents a data field with different root paths- For instance and SMB file name can appear in many different structures and locations with in and SMB and SMB2 packet.  It's difficult to filter on each of these separately because you'd have to know all the possible paths.  In some instances, a property decorates the data fields in each location it appears in the parser code.  Using these properties to filter makes it easier to find any instance of a value regardless where it appears in the protocol parser.
• Pairs- Pairs are special properties and in the tables below are listed under the fields section as they are associated with a protocol.  Pair properties represent two pieces of data at the same time so, for instance, that they can be evaluated as a source/destination pair.  When you filter with a pair, the

Click on each protocol below to see a list of data fields, properties and examples.

 Go to Network Monitor Blog