ProfiShark Manager User Guide

The ProfiShark Manager is the application that drives every ProfiShark: it shows the links, runs captures, configures the hardware features, generates traffic on the 10G models, and keeps each unit's firmware up to date. It runs on Windows, Linux and macOS, in English, French, German, Spanish, Simplified Chinese and Japanese. A command line built on the same core does everything the pages do, for scripts.

Reading this manual. Each page of the Manager has its own section in part 3, in the order of the menu, with what it is for, which ProfiShark models show it, a screenshot, and every control it has. Tags such as 10G or all models say which models a feature applies to; new marks what was added from July to October 2026. Menu paths are written Menu › Item.

Run Profishark-<version>.exe. It installs the Manager, the ProfiShark driver (signed by Microsoft), the library, the command line, and the driver of the USB boot loader used for firmware recovery.

The file is available from the ProfiShark repository.

Install the Manager package (.deb for amd64 or arm64, or the Flatpak), then the driver for your distribution and kernel: per-kernel packages for Debian 11–13, Ubuntu 22.04–26.04 and Kali, or the DKMS package (.deb, .rpm) that rebuilds itself for every new kernel. The packages are also on the Profitap APT repository.

For more information, see ProfiShark software setup - Linux.

Open ProfiShark-<version>.pkg (Apple silicon). At the end, ProfiShark Driver opens: click Install, then allow the extension in System Settings › Privacy & Security. A Mac that had the old kernel extension has it removed first.

The file is available from the ProfiShark repository.

1. Plug the ProfiShark into a USB 3 port. A tab appears at the top of the Manager with the unit's model, its mode (CAP or GEN) and its name.
2. If the Manager needs a newer firmware in the unit, only the Device page is shown: update from there (part 4).
3. On Home, install the Wireshark pieces if you use Wireshark (part 5).
4. Press Start Capture in the device header to record with the settings of the Capture page, or open a page from the menu on the left.

The pages keep running. A unit's pages exist from the moment it is plugged in and keep collecting history (charts, counters, logs) whether they are on screen or not.

What it is for
Watch and drive every ProfiShark from one window: see at a glance which unit is capturing or sending, switch between units without losing your place, and read a whole day of measurements without having kept the page open.

The tab row: Home, a ProfiShark 10G in generator mode (GEN), a ProfiShark 10G+ capturing (CAP, green), Batch control and Report.

From left to right:

The mode plate new tells what the unit is doing:

In a narrow window the row wraps onto a second line. While a firmware update writes to a unit, the tabs are locked until the write ends.

The Home screen: version, language and theme, the Wireshark card and the licence-request card for ProfiSharks on a computer without Internet.

• Version of the Manager, and a hint: “Choose a device above”, “Connect a ProfiShark to begin”, or why the ProfiShark library or driver is not answering (with what to reinstall).
• Language: English, Français, Deutsch, Español, 简体中文 (Simplified Chinese), 日本語 (Japanese) new. The window redraws in the new language on the same unit and page.
• Theme: Auto (follows the desktop), Light, Dark.
• Wireshark card: install, update or uninstall the four Wireshark pieces, Open a capture in Wireshark… and Merge captures… (part 5).
• A ProfiShark without Internet: Open a request file… answers the licence request of a ProfiShark whose computer has no Internet (section 3.15).
• Footer: Profitap's address and Third-party notices.

• Name and the pencil Rename device: type an alias (“rack 3, uplink”), Enter to keep it, Esc to cancel; an empty name goes back to the MAC address. The alias shows on the tab, in Batch control, in reports and in the Manager's capture files (section 2.8).
• Model line.
• Link chips: green dot when up, red when down. In SPAN mode one chip per port (“Port A · 10 Gb/s”), inline a single “Link” chip.
• The big button:
  • Start Capture / Stop Capture on a unit in capture mode: records with the settings of the Capture page, even if that page was never opened.
  • Start Generator / Stop Generator on a 10G in generator mode: sends what the Packet Generator page holds.
  • Greyed with a reason when the unit needs a firmware update (“Update the device first: see the Device page.”), when the generator is not in the licence, or while a firmware update writes.

• The pages of the selected unit, in this order, each shown only where the unit has it: Dashboard, Packet Statistics, Microbursts, Ports, Tunnel, Cable Tester, Packet Generator, Link Scope, Filters, Capture, Logs, Timing, Device, Licence. Part 3 describes them one by one.
• The arrow at the top narrows the menu to its icons (the titles become tooltips) or widens it again.
• The language picker sits at the foot of the menu.
• When the unit needs a firmware update, the menu shows only Device.

new

A small dot after a page's title in the menu tells you about that page while you are on another one. Hover the dot for the reason.

A red dot covers the blue one; once it is cleared, the blue shows again if the page is still active.

After a restart. When the open unit leaves the bus (firmware update, switch, restart) the window goes to Home. If the same unit comes back within two minutes and you have not clicked elsewhere, the Manager returns to it, on the same page.

Packet Statistics on a ProfiShark 10G+ while it captures: the bandwidth history of port A and port B on the 24-hour axis.

• Every history chart shows the whole history on one compressed time axis: the last 2 minutes at 1 s per point, then 20 minutes at 10 s, 2 hours at 1 min and 20 hours at 10 min. Alternating shading separates the segments; now is at the right edge.
• Hover a chart: a crosshair snaps to the nearest sample and a readout shows its time and every series. The charts of the same port on a page share the crosshair, so a burst is read against the load at the same instant.
• Reset graphs throws away the history the graphs are drawn from; the ProfiShark's counters are not touched.

new

A ProfiShark 10G+ capturing generated traffic that changes load every second (5 to 95 % of the link, packet slicing on): the strip is green where every frame was recorded and yellow in the seconds the unit had to drop. Hovering the strip shows what the colours mean.

Under the time axis of the Packet Statistics and Microbursts charts, a translucent band says, second by second, whether the ProfiShark was capturing:

• Green (recorded): captured, no frame dropped in that second.
• Yellow (recorded, frames lost): captured, the drop count grew in that second.
• Nothing (not recorded): not capturing, or the file that held those seconds no longer exists.

It covers the Manager's captures and another program's (Wireshark), on every ProfiShark. Hover it for a tooltip with the colours and the state at that point. For a Manager capture the strip stays green only where a capture file still exists: when the ring buffer deletes its oldest file, the seconds it held lose their colour.

Each port's chart has its own strip. When Disable Port A or Disable Port B is on, nothing from that port reaches the capture, so that port's strip stays empty while the other one fills.

The chart's own tooltip, under the pointer, ends with a Capture row: recorded, recorded, frames lost or not recorded for the moment the pointer is on. Its swatch is the strip's colour. The charts that only follow the shared crosshair do not show this row.

The same strip hovered over a yellow second: “Here: recorded, frames lost”.

The chart tooltip at 29.90 % of the link: the Capture row says that second was recorded in full.

At 59.07 % of the link the Capture row says frames were lost: more than the USB link carries, even sliced.

The Report menu: this page or every page, as PDF or HTML.

Report turns what the pages know into a document: This page or Every page, as PDF or HTML (one self-contained file). A save dialog asks where to write it; the button reads “Working…”, “Saving…” and “Saved”. Thirteen pages contribute: facts in two columns, tables with their units, and the charts redrawn at full width with clock time on the axis, with a cover sheet naming the unit and the moment. Nothing has to be on screen.

A ProfiShark is known by several names. They serve different readers, and each is set in its own place.

In this manual's screenshots the units carry the aliases Bench A to Bench D, and their MAC addresses are replaced by documentation addresses (00:00:5E:00:53:xx, reserved for examples by RFC 7042).

• Click the pencil beside the name, type the alias, Enter to keep it, Esc to cancel. An empty alias goes back to the MAC address.
• It is kept on this computer, by MAC address, and survives restarts of the Manager; on another computer, give it again. The Manager writes it into the hardware description of its capture files, so a file still says “rack 3, uplink” a year later.

• Windows names every network connection “Ethernet 14” and the like, which says nothing about which ProfiShark it is. The ProfiShark driver names its connection itself when the adapter starts: model and MAC address, e.g. “ProfiShark 10G+ 00-00-5e-00-53-0a”, so two units of the same model never collide.
• It replaces only a name Windows generated, or a name of its own form that no longer matches the unit (another model or another address, which happens when units share an adapter slot). A name you chose is never touched.
• Device page › Network interface: the name the connection carries now, with a ✓ when Windows confirms it (or “disabled” / “disconnected”). Rename to choose another one: Default name fills in the driver's name, Apply renames (Windows asks for administrator rights), Cancel. The rename takes effect at once — Wireshark lists the new name without a restart — and does not interrupt a running capture. Windows refuses \ / : * ? “ < > | in a name and two connections with the same name.

• Through the capture plugin (the usual way, part 5): the interface is listed as the ProfiShark with its model and MAC, with the unit's own capture options.
• On the ProfiShark's network adapter (Windows): the interface carries the Windows connection name above; turn on Enable timestamps in live capture and install the timestamp plugin to get the hardware time.
• In a capture file, the alias, model and MAC are in the file's section header, and each port has its own interface (port A, port B).

In the order of the menu. Each page says what it is for, which ProfiSharks have it, and what every control does.

As shown by the units on our bench; each page appears only where the unit has the hardware for it.

A ProfiShark 100M: five pages - Dashboard, Packet Statistics, Capture, Logs and Device. Its ports negotiate on their own, so there is no Ports page.

Without the licence a licensed page stays visible, with a card on top: ”feature: not included in this ProfiShark's licence“, the reason (no licence, expired on a date, licensing server not reached for too long, suspended, not in the plan) and Open the Licence page. Its controls are locked. Capture, filters, statistics and timestamps never need a licence.

What it is for
The page a ProfiShark opens on: is the link up, at what speed, and what is the unit doing right now.

The Dashboard of a ProfiShark 10G+: identity line, port A at 10 Gb/s, port B down, and the capture with the bytes written.

• Identity: model, SW firmware, HW firmware and driver versions.
• PORT A / PORT B (SPAN mode) or LINK (inline: time up and length of the last outage): the link speed, or “down”.
• CAPTURE (capture mode): bytes written to file, or “not capturing”. GENERATOR (generator mode): packets generated, stopped or running with its packet rate.
• Links Open Ports ›, Open Capture ›, Open Packet Generator ›.

The Dashboard of a ProfiShark SPE inline on a 10BASE-T1L link: one LINK card at 10 Mb/s with the time it has been up, and the capture.

What it is for
How much traffic each port carries and what it is made of — load against the line rate, frame sizes, good and damaged frames — measured by the ProfiShark's own hardware counters, whether or not anything is being captured.

Packet Statistics, further down: the size distribution charts and the Counters table of both ports.

• The ProfiShark counts every frame of each port in hardware, captured or not: valid frames, invalid frames (bad FCS), bytes, frames under 64 bytes and over 1518 bytes. The Manager reads the counters once a second.
• A rate is the difference between two readings divided by the exact time between them. On the 10G family the counters are latched by the FPGA and stamped with its own nanosecond clock new, so the interval is exact and a link at line rate reads 100 %; on the other models the computer's read instant is used.
• The rate is always against the port's actual speed: a port negotiated at 1 Gb/s is measured against 1 Gb/s, not 10.

One chart per port: the share of the line the traffic occupied in each second, 0–100 %. The occupancy counts the wire, not only the frames: each frame's bytes plus its 8-byte preamble and the 12-byte minimum gap. When the microburst detector watches the port, its wire-byte counter is used instead — byte for byte, including the real gaps of the 10G encoding — so the figure is exact for any frame size. Very small loads show two significant figures rather than 0.00 %.

Both units are recorded all the time; switching loses no history. Reset graphs empties every chart of the page (the counters are untouched).

Clear A, Clear B and Clear All restart the totals of the page from zero (“since the last Clear”); the ProfiShark's hardware counters keep counting. The menu dot turns red when a port received invalid frames while you were on another page.

Statistics in capture files. The same per-port counts travel inside every capture file (section 3.10), so a file says afterwards what the link carried and what the ProfiShark lost.

10G10G+new

What it is for
Find the short bursts that overflow a switch buffer for a few hundred microseconds and cause losses no per-second graph shows, and name the sender that caused them. The FPGA watches every frame of each port, with nothing to configure.

The top of the Microbursts page during a test: Watch port A and B, the peak window, the burst-duration histogram, and the port A card with its state chip.

• Watch port A / Watch port B: start or stop the detector of a port. Turning a port off also empties its graphs and event marks. The menu dot is blue while a port is watched.
• Peak window: 13 µs, 105 µs (default) or 839 µs at 10 Gb/s (105 µs, 839 µs, 6.7 ms at 1 Gb/s): the window over which the yellow peak line is measured. All three are measured at once; the choice only picks which is drawn.
• Reset graphs: empties the histogram, timelines and gap charts (the Senders table is kept).
• The burst-duration histogram: twelve classes from <13 µs to ≥13.4 ms, both ports, logarithmic. Hover a class for its counts.
• A summary line per port: bursts so far, bursts in the last second, and the share of that second the link was flat out.

• A history chart: the blue area is the bandwidth over each second, the yellow line the peak over the chosen window; the gap between them is the burstiness. Red marks show the moments of the senders or events selected in the table.
• Measure against: Auto (port link) or 1 Gb/s. Choose 1 Gb/s when a 1 Gb/s link reaches this port through a 10 Gb/s mirror, otherwise nothing ever looks busy. Every figure follows; the link itself is not touched.
• State chip: not watching, watching all clear, n bursts, or saturated right now (red).

Each second, the smallest and largest gap between two frames, in bytes on the wire, with reference lines at 12 B (the standard) and 5 B (the tightest legal gap at 10 Gb/s). A narrow band means evenly spaced frames, a tall one traffic in clumps. The chip says evenly spaced, unevenly spaced, frames arrive in bunches, or n gaps under 5 B (red: a sender crowding the link).

The Senders table: the sender of the bursts on port A with its count, longest burst, time at line rate, bytes per burst and load.

Click a row to select it, Ctrl+click to add one, Shift+click for a range; hovering a row marks its moments on the chart. Ten senders per page, with ‹ › to page through.

Select events or senders and click Open in Wireshark. The Manager builds a display filter on the seconds of those events (one second either side) and on their senders, then:

• after a Manager capture, opens the capture file that holds those seconds, filtered; events spanning several files are merged first. If no file holds them (no capture was running, or the ring buffer deleted it) it says so beside the button;
• during a live capture in Wireshark, sends the filter to that Wireshark, which applies it within a few seconds.

Tip. Switch on Microburst records in the file on the Capture page: the bursts are then in the capture too, and Wireshark's Microbursts button and Filter on this burst work on them (section 5.3).

What it is for
Choose how the ProfiShark sits on the link (one inline link or two SPAN taps), let each SFP port run at the speed of the module plugged into it, and read everything the modules say about themselves.

The Ports page of a ProfiShark 10G+: link mode and port speeds, then the module of each cage.

The ProfiShark 100M has no Ports page. Its two ports negotiate with the link partners on their own; the link, its speed and duplex show in the device header and on the Dashboard.

“Any change on this page takes effect on the network link immediately.”

• SPAN mode: off, the two ports are one inline link through the tap; on, they are two independent taps (two SPAN or mirror ports, two links). Going back to inline turns the tunnel endpoints off and stops a running generator; the chosen speeds are kept.

new

• Beside each choice, Current shows the rate the port runs at, and ”(link down)“ when there is no link.
• The choice is remembered per ProfiShark. A forced rate stays forced even when it equals the module's rate; a rate set from elsewhere (the command line, another computer) shows as what it is.
• A rate takes effect at once; Save to device keeps SPAN mode and the port rates in the unit across a power cycle. The ProfiShark itself keeps a rate, not “automatic”: Automatic is applied by the Manager while it runs, so a unit used without the Manager starts at the rate last saved.
• Everything follows the port's rate: packet statistics against 1 or 10 Gb/s, the microburst detector's windows, the generator's rates, Link Scope's resolution.

“reading…” while the module is read, “no module” for an empty cage. Read again when a module is plugged or unplugged and every 30 s; live diagnostics every 5 s.

The menu dot turns red when both ports lose their link at the same time, blue when a module was plugged or unplugged while you were on another page.

What it is for
Choose how the ProfiShark sits on the link, what each copper port advertises to the far end, and read what the link actually negotiated: the partner's abilities, the pair wiring, energy saving and every fault the PHY counts.

The Ports page of a ProfiShark 1G+ inline: the link mode and the single LINK CONTROL card with what the ports advertise.

The ProfiShark 100M has no Ports page. Its two ports negotiate with the link partners on their own; the link, its speed and duplex show in the device header and on the Dashboard.

“Any change on this page takes effect on the network link immediately.”

Inline, one card sets both ports, since the link passes through both.

After each change the page reads the port back, so it shows what the PHY really advertises. Save to device keeps the settings; Default puts back “everything advertised, negotiated, nothing forced”. The status text says “Applying…”, or that the device refused or did not answer.

SPE

The Ports page of a ProfiShark SPE: Port powered, Role and Transmit level for each port, then the port status.

Default on the SPE: 1.0 Vpp, automatic role.

Port Status of a ProfiShark 1G+ on a gigabit link: the link, master/slave resolution and what the link partner advertises, for each port.

Refreshed every second while the page is open: green good, red fault, grey unknown (—).

On the SPE: link (up/down), speed (10 Mb/s), resolved and configured role, and what the link partner sent — page received, 10BASE-T1L, its role, 2.4 Vpp, EEE.

10G10G+new

What it is for
Receive a mirror sent over the network — VXLAN from a data-centre fabric, ERSPAN from a switch several routers away, GRE — and capture the original traffic at wire speed, with the ProfiShark itself as the end of the tunnel: no server to receive it, no software to decapsulate it.

The Tunnel page: per port, the endpoint address, VLAN, De-tunnel and the tunnel to end, then the status of each port.

1. The port becomes a host. With Endpoint on, the port owns an IPv4 address: it announces it (a gratuitous ARP when enabled, then every 30 s) and answers ARP requests and pings for it, from the hardware. The switch or router that sends the mirror therefore has a reachable destination, and its ARP table keeps the ProfiShark's MAC.
2. The tunnel is recognised. On the first packets addressed to it, the port identifies the encapsulation — VXLAN, ERSPAN type II or III, GRE carrying Ethernet, IP or IPv6, IP in IP, IPv6 in IP — its sender, its session (VXLAN VNI, ERSPAN session) and where the inner frame starts.
3. The tunnel is cut. With De-tunnel on, the FPGA removes the outer headers of every frame at line rate. A pre-filter — a few bytes at fixed offsets that identify this tunnel (EtherType, IP protocol, the endpoint address, the UDP port or GRE type) — lets only this tunnel through and drops everything else in the hardware, so a busy port costs nothing.
4. Everything downstream sees the inner frame. The packet statistics, the Filters page (protocols, addresses, ports, VLAN, deep inspection), the timestamps and the capture all work on the original traffic, as if the ProfiShark were plugged into the remote link.

Needs SPAN mode (the page says so otherwise); switching back to inline turns the endpoints off. The packet generator cannot run while a port is an endpoint. Settings are remembered per ProfiShark and re-applied when the Manager reconnects. The menu dot is blue while a port is an endpoint.

Setting it up on the switch. Point the switch's VXLAN, ERSPAN or GRE mirror session at the address you gave the port. Check with a ping from the switch; the ARP and Ping rows count it. The Prepared frames set “Tunnels the device terminates” (section 3.16) sends one frame of each encapsulation to 203.0.113.20, for a test without a switch.

1G v61G v71G+SPE

What it is for
Check a copper cable from the ProfiShark itself — the length of each pair, or how far away a fault is — without another instrument, and on the SPE watch the quality of a single-pair link continuously.

A cable test on port A of a ProfiShark 1G+: the four pairs OK, with the length of each, measured with the link up.

• Run cable test on PORT A or PORT B. The chip reads idle, testing (orange), all pairs ok (green), fault (red), test failed, or automatic test running.

• The result, one line per pair (A–D):

  Status	Meaning
  OK	The pair is correctly terminated; the length is the cable's.
  Open	The pair is cut, or not connected at the far end: the length is the distance to the break.
  Short	The two wires of the pair touch: the distance to the short.
  Abnormal termination	The far end does not terminate the pair correctly (wrong impedance, damaged port).
  Short to pair X, Abnormal coupling with pair X	The pair touches, or couples into, another pair: a crushed cable or a badly made connector.

  The length reads ”< 3 m“, n m, or “—”; the footer says whether it was a manual or an automatic test, and when.

• Resolution is about 3 m; faults in the first metres read 0 m. Unplug the far end for an accurate distance.
• A test takes up to about 30 s. A gigabit link keeps running during it; a 10/100 link drops and comes back. An inline tap cannot react to link events while it tests.
• In SPAN mode on a gigabit link the ProfiShark also tests by itself, once per link-up, at most every five minutes per port, and never while the generator or the EEE diagnostic holds the PHYs. Both buttons are greyed while an automatic test runs.

SPE

The Cable Tester of a ProfiShark SPE: state, cable length, fault, link quality and SNR of each port, read continuously, and the signal-quality charts.

• Nothing to start: the PHY watches its pair all the time. Per port: State (Unsupported, Stopped, Running, Valid, Invalid), Cable length with the link up, or Distance to fault; Fault (ok, open circuit, short circuit); Link quality (0–7, coloured); SNR (est.) in dB.
• Run TDR test: measures the distance to a fault by reflectometry. It drops that port's link for a moment, and the button is greyed for about 4 s.
• PORT A / PORT B — signal quality (SQI): two minutes of the link quality, 0–7; a link down is drawn as 0. A quality that dips when something switches on nearby is interference on the pair.
• Unplug the far end for an accurate distance: a transmitting partner interferes with the measurement.

10G10G+new

What it is for
Judge a cable, an optic or a transceiver on a live link, without a scope and without breaking the link: the receiver measures the signal it gets and the page gives the margins, a verdict and what to do.

A quick scan of port B in 4 seconds over a 1 m DAC: the whole eye inside the frame, horizontal opening 53 % of the bit, vertical 71 %, verdict Excellent. Port A has no link, so there is nothing to scan.

• Quick scan: one sweep at full detail, in seconds: the eye, the margins and a first verdict. Becomes Stop while it runs.
• Continuous: sweeps over and over, refreshing the eye live, while someone moves a marginal cable. Both ports can run at once.
• Deep scan: a fresh eye, then longer and longer looks: the bathtub curve, the estimated bit error rate, deterministic and random jitter, and the margin left at one error in 10¹².
• The eye: black is the opening (no error), green to red rising error rates. H opening is the timing margin (share of one bit), V opening the level margin. The verdict reads Excellent, Good, Marginal or Critical, with a diagnosis and numbered recommendations (reseat, swap the cable, clean the fibre, check the far transmitter…).
• One equaliser setting for every scan. The receiver normally adapts its equaliser to each link on its own, and the eye is measured after it, so two ports, or the same port on two days, would each be shown at their own setting. For the scan, the ProfiShark holds the equaliser of both ports at one reference setting, then gives the receiver back its own: every eye is on the same scale and two scans compare. The link stays up meanwhile. The setting is chosen so that even a strong signal (a short DAC) shows its whole eye inside the frame. The eye is the one at that setting, not the receiver's day-to-day one, so its height can differ a little from what the adapted receiver would show.
• RX power (modules that report it): the received optical power and its last 3 minutes; comfortable above −8 dBm.
• Set as reference stores this scan for the link; later scans are compared with it (“vs reference: H ±n pts, V ±n pts”) to catch drift. Remove reference deletes it. A reference stored by an earlier version, taken at the receiver's own equaliser setting, is not compared with the new scans: set it again.

Not available on a port without link, on a copper SFP with a PHY (the eye would be the module's own internal link; DAC cables are fine) or while a capture runs. A scan keeps running if you go to another page; the menu dot is blue meanwhile.

What it is for
Keep only the traffic you need, decided in the hardware at line rate, when the link carries more than the computer can take.

The packet type filter: each tile is a packet type, green captured, grey not.

Three stages, each with Set (apply now, highlighted while the screen differs from what runs) and Save (keep across power cycles). The menu dot is blue while the ProfiShark filters something.

Click a tile to keep or drop that type; All on / All off per group. Groups: Frames (Valid frames, Invalid frames), Layer 2 (Unicast, Broadcast, Multicast, ARP, VLAN tagged, L2 Other), Layer 3 (IPv4, IPv6, ICMP, IGMP), Layer 4 (TCP, UDP, L4 Other), TCP flags (SYN, ACK, RST, FIN, PUSH, Zero window) and Layer 7 by port: HTTP, HTTPS, QUIC, DNS, DHCP, SSH, FTP, SMB, SIP, and on the 10G family new mDNS, DHCPv6, NTP, PTP, SNMP, Syslog, NetFlow/IPFIX, Telnet, RDP, TFTP, LDAP, Kerberos, IKE, VXLAN.

The field filter and the deep packet inspection card.

Source and destination MAC (wildcards allowed: aa:bb:*:dd:*:*), source and destination IP (IPv4 or IPv6, IPv6 written in full), source and destination port, VLAN ID — each with its own switch. For each pair, Specify source and destination (both must match) or Source or destination (either may). Enable filter drops every packet that does not match the enabled fields.

Up to 16 bytes, typed in hex or ASCII; Enable deep packet inspection drops every packet that does not contain the pattern anywhere in the frame.

Behind a tunnel endpoint with De-tunnel on, the filters see the inner frame.

What it is for
Record a link to pcapng files straight from the driver, at the ProfiShark's full rate, for minutes or for weeks, in files cut and kept as you plan, each file saying which unit took it, what its clock was worth and what it lost.

The Capture page during a capture: Capture format and Files (a new file every minute, ring buffer of 10 files), Output, the capture plan, the status and the marker packet card.

A capture runs from the header's Start Capture (or Batch control), with the settings of this page — even if the page was never opened. The ProfiShark timestamps each frame in hardware and sends it over USB; the driver writes the files itself, so a capture keeps running whatever the Manager window is doing.

These are settings of the ProfiShark itself: they act at once, also on a capture run by another program, and Save keeps them across a power cycle (highlighted while what runs differs from what is saved).

On the 1G family and the SPE slicing is fixed at 128 bytes, and Raw frames and Microburst records in the file belong to the 10G family (greyed elsewhere). Everything else is the same.

The Capture page of a ProfiShark 1G+: the same cards, with Packet slicing (128B).

A file boundary is decided by the frames' own timestamps, not by the computer's clock: the frame stamped 15:00:00.000 is the first of the next file whatever the computer was doing.

new

A drawing of what the settings will do before anything starts: a row of file boxes, each labelled with its size or duration (“whichever comes first”, “first file, shorter” for a file aligned on the clock) and the name the pattern will give it, then the end of the sequence — a red stop after N files, ∞ until stopped, or the ring arrow back to the first file — and one sentence with what it comes to, e.g. “A new file every 1 min, ring buffer of 10 files (10 min): the oldest file is overwritten.”

Inject Marker puts one marker frame, numbered with Next marker (which then counts up), into the capture stream; Periodic marker Start / Stop injects one every Period seconds (from 0.1 s). Markers flag a moment in a long capture (“the test starts now”) and line up captures of several ProfiSharks. A marker carries the time of the last frame captured, or the time of the computer when no frame has come yet.

new

A file opened a year later still says which unit recorded it, whether its clock could be trusted, what it was keeping and what it lost.

What it is for
Start or stop several ProfiSharks at the same moment: captures at several points of a network, or captures and generators of one test.

Batch control: every ProfiShark with its alias, model, MAC, mode and state, and Start Selected / Stop Selected.

• The table lists every unit: Alias, Model, MAC, Mode (Capture or Generator) and State (Idle, Capturing, Generating, Capturing elsewhere, Unlicensed, Error). Click rows to select them.
• Start Selected / Stop Selected. A capture unit records with the settings of its own Capture page; a generator unit sends what its Packet Generator page holds. On Start the captures go first so they see the first frame; on Stop the generators stop first. Units that write into the same folder each put their alias (or their MAC) in front of their file names, whatever their file name patterns, so two files started in the same second never share a name.

What it is for
The history of what happened to the unit while the Manager watched: links up and down, speed changes, modules plugged, captures started and stopped.

• Clear Log empties it; Export Log saves it as a text file (ISO time, source, message).
• Show events from: Port A, Port B, Capture, Device.
• The table shows the newest first (the last 500; up to 2000 are kept). The menu dot is blue for lines that arrived while the page was closed.

GPS / PPS models

What it is for
Decide where the ProfiShark's clock gets its time — the computer, the GPS, a pulse per second from a reference — compensate the cables, keep several ProfiSharks on the same time, and see at any moment whether the timestamps can be trusted.

The Timing page: timestamp initialisation, PPS output and compensation, GPS antenna cable delay, the device time, and the timing status with the deviation from the PPS and the satellites.

• Every frame is stamped in hardware, to the nanosecond, by a counter in the FPGA. Every ProfiShark reports the moment the frame reached its input connector new: the fixed delay of each PHY and each medium (copper, optics, 1 Gb/s or 10 Gb/s, SPE) is compensated per model, so a 1G, a 10G and an SPE give the same time to the same event.

• The counter gets its time (the date and the second) from one source and is disciplined (kept from drifting) by another:

  Mode	Time from	Kept by	Good for
  Free running	Set once (system time, RTC, by hand)	The unit's own oscillator	Intervals inside one capture (latency, jitter); absolute time drifts slowly.
  Host sync	The computer	The computer's clock, re-aligned every second (Synchronize timestamps on the Capture page) — tighter since 2026, with less drift and less jitter new	Captures that must match the computer's logs; as good as the computer's NTP.
  GPS	The GPS receiver	The GPS pulse per second	Absolute time at any site, and captures at two sites compared frame by frame.
  External PPS	Set from the computer, the RTC or by hand	A PPS from a reference (a grandmaster, another ProfiShark) on the PPS connector	Several units in one building on the same second.

• The clock state is written into every capture file every second, and Wireshark's Expert Information flags a lost PPS or a free-running clock.

The Timing page of a ProfiShark 1G+ (GPS model): the same settings and status as on the 10G+.

• Current device time: the ProfiShark's clock, in UTC.
• Set the time from: System time (this computer), NTP server (the Manager queries the server you give — e.g. pool.ntp.org — through the network interface you choose, and remembers both), or GPS.
• Set time sets this unit; Set all ProfiShark time sets every connected unit at once. The status says querying…, setting…, time set, or why it failed.

A unit following the GPS or an external PPS takes its time from those; the device time is what it counts from when it does not. Save to device keeps the timing settings across a power cycle.

• Deviation from PPS/GPS: two minutes of the clock's deviation from the PPS at each second, in ns, µs or ms, with the current value in the header. It fills only while a PPS is present. A flat line near zero is a disciplined clock; a slope is drift; steps are a source changing. Reset graph starts it over.
• GPS reception: satellites used and in view for GPS, GLONASS and Galileo new, and the total used. More satellites, and three constellations, hold a fix under a poor sky. Messages say when the timing board is missing or held by another application.

The menu dot is blue while the GPS sees satellites or a PPS arrives.

What it is for
See what the unit is and what it runs, bring its firmware up to date, switch a 10G between capture and generation, and restart or reset it.

The Device page: model, versions checked against what the Manager needs, USB speed, the Windows network connection name, and Device control.

• Model, variant, API version, driver version, SW firmware, HW firmware, MAC address and USB speed. Each version shows a green ✓, or “needs x” with an Update button when the Manager can bring it up to date (part 4). The library and the driver come with the ProfiShark software: reinstall it to update them.
• Network interface (Windows) new: the name Windows gives the ProfiShark's network connection, which Wireshark shows. Rename it (administrator rights needed; Default name puts back the model and MAC); a running capture is not interrupted.

Shown when the unit is behind what this Manager needs: it lists what is behind. Every other page is hidden until the update is done.

The Device page of a ProfiShark 1G+ (v2): versions, the network connection, and Device control with Restart Device and Erase settings and restart.

• Packet Capture, Microburst Detector, Tunnel Termination, Link Scope / Packet Generator and Switch (10G family): writes the other firmware and restarts the unit (section 4.2).
• The 1G family and the SPE have no such switch: they capture always, and their generator is the PHY generator (section 3.17).
• Restart Device, after a confirmation (the link drops while it reboots).
• Erase settings and restart (red): every saved setting goes back to its default — capture options, slicing, SPAN or inline, timestamping, PPS; the model and MAC are kept.

10G10G+

What it is for
Give a 10G its feature pack — microburst detection, tunnel termination, Link Scope and the packet generator — kept inside the ProfiShark, so it follows the unit from one computer to another.

The Licence page: the licence held in the ProfiShark, its state, key and expiry, the features it holds, and how to extend it.

• State: No licence activated, Valid, Subscription expired, Valid but the server not reached lately, Grace period over, Suspended. A chip counts the days left when fewer than seven remain. Key (masked; Copy for support), Expires - the last day: the licence runs until midnight at the end of that day, on this PC's clock -, Last read.
• Features: a ✓ for each feature the licence holds.
• Try it for a month (never activated): Start the trial — every feature for one month, once per ProfiShark, with Internet on this computer.
• Buy a licence / Extend the licence: Months paid at once (no renewal), 1 to 36; or Monthly subscription, renewed every month / Yearly subscription, renewed every year, charged again automatically for one more month or year each time until the subscription is cancelled; Buy… / Pay… opens the payment page in the browser, and the licence comes into the ProfiShark as soon as the payment is done (Stop waiting if you gave up).
• Activate a key: Licence key and Activate online. Once licensed: Check for renewal reads the licence again online. If the licence was withdrawn on Profitap's side, it activates the key again; if the licence no longer exists, it takes it out of the ProfiShark and this computer, so that the trial, a purchase or another key can be used.
• Install a licence file… and Read again (reads the licence in the ProfiShark now).

1. On that computer, Licence page: Write the request file… (with a key, if you have one).
2. On any computer with Internet and the Manager, Home or Licence page: Open a request file…, then start the trial, buy, use a key, or (already licensed) Write the licence file…. Save the licence file.
3. Back on the first computer: Install a licence file….

10G10G+new

What it is for
Test a link, a switch, a firewall or a tap with traffic you control to the bit and to the nanosecond: line-rate loads, real conversations replayed from a capture, shaped traffic, and frames a normal network card cannot send (runts, bad FCS, fragments). The FPGA walks the list by itself, with the same clock that timestamps captures deciding when each frame leaves.

The Packet Generator page of a ProfiShark 10G: the toolbar, the generator list with its address, port and Type columns, Packet View with the selected frame dissected, and Traffic Shaping with its plan.

The page needs the generator firmware (Device page › Device control › Packet Generator › Switch); on the capture firmware it only says so. The generator runs in SPAN mode. Start Generator / Stop Generator are in the device header. Everything on the page is remembered per ProfiShark.

Loading frames (capture, prepared set, configuration) sends them to the ProfiShark at once; nothing is transmitted before Start Generator.

Prepared frames: five sets that qualify the link, ten conversations that qualify what reads it.

Standard spread (8 frames, 64 to 1518 B), Small frames (the highest packet rate), PRBS payload (finds a marginal module or fibre), Jumbo frames (2 KB and 10 KB), Jumbo and small mixed (the worst case for a capture pipeline). They have no timing of their own: the gap you set decides the rate.

TLS session over TCP, VoIP call (SIP and RTP), DNS lookup and HTTP fetch, Tunnels the device terminates, VLAN and QinQ, PTP (IEEE 1588v2), Segment background, IPv6, IPv4 fragments, TCP flow storm (a new flow every loop). Each brings its own spacing and replays in a loop.

The Add packet menu: a search box and 14 categories, each opening its frames to the side.

Categories: Ethernet / IP, Layer 2 control, ICMP & NDP, Routing & multicast, Tunnels, VPN & tunnels, TSN, Raw, Packet types, Application, Services, OT / Industrial (real-time Ethernet, power and substation, fieldbus over IP, building), Automotive, Avionics & Defence. Typing in Find a packet type… searches every level at once; arrows, Enter and Esc navigate.

Frames are sent in the order of the list, up to 255 frames and 16,384 bytes of frame memory (shown under the table).

With Fixed gap every frame follows the gap of the port: the Gap and Gap max cells are greyed. Capture deltas gives them back to each row.

Right-click on a destination address of a selected row: set the address on the selection, its modifier, select the same, copy, open in Wireshark, paste, delete, undo.

Right-click a cell to set it on that row, or on every selected row: send or skip, port A, B or alternate, good or bad FCS, a gap, an address, a port, a frame size, the IP-ID or TCP sequence (with Random, a different one per row), a field value, or the modifier of an address or port (Unchanged, Increment (+1), Decrement (-1), Random). The checksums follow. Then: Select the same …, Select the others, Select all / none, Reverse the selection, Copy, Open in Wireshark, Paste after, Delete, Undo, Redo. Right-click a column header to remove a field column or go back to the Default columns; drag a header to move a column; drag a field from Packet View onto the headers to add one.

• A switch in a row (Send, Bad FCS, SFD→SFD) changes that frame only: it does not select the row nor change the selection.
• The click that closes a context menu, or the click that leaves a field you have just changed, does nothing else: it closes the menu or validates the field, no row is selected and no card folds. Click again to act.

• Fixed gap: every frame is followed by the Inter-frame gap (× 8 byte times). Capture deltas: the gaps reproduce the spacing recorded in the capture, divided by Speed × (0.000000001 to 100000; 2 replays twice as fast).
• Send: Free running, At each GPS PPS or At each external PPS (units with the timing board): each second starts one run, its first frame leaving exactly on the second; Lead (in nanoseconds) is how long before the second the frame is launched. The address and port modifiers (increment, decrement, random) carry on from one second to the next: each second continues where the last one stopped, it does not start the list over (generator firmware 0497 and later).
• Frames to send (empty: loop forever; with a PPS: Frames each second).
• Output: Port A, Port B, or Per packet (each frame on its own port). The two ports never transmit at the same instant.

The splitter between the list and Packet View: the list grows to show its rows until Packet View reaches its minimum height, then scrolls; drag the handle to share the height by hand, double-click it for the automatic split.

new

Two frames selected: what they share is shown once, a field that differs reads “≠ varies”, and the bytes that differ show as ··.

The selected frames, taken apart the way Wireshark does: protocols and fields on the left, bytes on the right. Hover a field to light its bytes, or a byte to find its field. With several frames selected, what they share is shown once; a field that differs reads “≠ varies” with its values under the pointer. Packet View folds when nothing is selected. It knows hundreds of protocols, from Ethernet, VLAN, MPLS, IP and TCP/UDP to tunnels (VXLAN, Geneve, GRE, ERSPAN, GTP-U), TSN and preemption, routing, applications, OT and industrial (Modbus, PROFINET, EtherCAT, IEC 61850, DNP3…), automotive and avionics.

• Edit a field: double-click it, Enter applies, Esc cancels; a hex / dec button switches the base. One-bit fields have a switch: a click sets or clears the bit.
• Edit the bytes: click a byte and type hex digits; Insert adds a byte, Delete removes; arrows move, Shift extends.
• An edit goes to every selected frame that has the field. Lengths follow; with Keep checksums correct on, every checksum and the FCS are rewritten (a checksum you typed yourself stays). Fix checksums rewrites them now.

new

Any field of Packet View can be watched and set across all the frames at once, as a column of the generator list:

1. Press on the field's row in Packet View (its name, not its value) and drag it up onto the header row of the generator list.
2. A blue bar shows where the column will go - before or after the heading under the pointer; release there. The Bad FCS, Gap, SFD→SFD and Gap max columns stay at the right: dropped on one of them, the field goes just before them.
3. The column shows that field's value in every frame; a frame that does not have the field shows nothing.

The same without dragging: right-click the field › Add as a column in the generator list. In the list, right-click a cell of the column to set the value on that row or on every selected row (the lengths and, with Keep checksums correct, the checksums follow); drag the heading to move the column; the × in the heading, or right-click › Remove column, takes it away. The columns are kept with the page and in Save config….

Right-click on the IPv4 layer: insert a header before or after, encapsulate in a tunnel, add a transport or application layer, remove the payload.

The ProfiShark walks the shape itself; a change applies at once, even while sending.

The Traffic plan draws the share of the link second by second, and Where the time goes how long the link spends in each load band over windows of 10 µs to 1 s, before anything is sent; a sentence spells out the mean load, rates and burst lengths. The summary bar at the bottom gives, per port, the speed, bit and packet rate ranges, the gap range, the state (Stopped, Loading, Running) and the frames sent.

Unexpected drops downstream? Look at the shaping first: a sweep or random profile varies the load on purpose, down to 0 %.

Used by Load capture file…, Choose frames and frames sent from Wireshark. Left: the frames of the file (#, Bytes, Source, Type, Port); Add selected, Add as many as fit, or double-click a frame. Right: the list to send, which starts with what is already loaded so several files can be combined; drag to reorder, choose each frame's port, ✕ to remove, Clear list. OK replaces the generator list; Cancel changes nothing.

1G+ v21G v61G v7SPE

What it is for
Turn the ProfiShark into a link tester: its PHY builds frames and sends them to the link partner, and the capture engine counts what comes back — a quick check of a link, a cable or a far-end loopback without a traffic generator.

The PHY packet generator of a ProfiShark 1G+: frame length, duration, rate and bad FCS per port, with the frames and CRC errors received.

The PHY builds pseudo-random frames: port A sends from ff:ff:ff:ff:ff:f1 to ff:ff:ff:ff:ff:f0, port B the reverse. The tap does not capture its own generated traffic.

Readouts: Received frames (counted by the capture engine on this port since the last start) and Received CRC errors (red when not zero). The chip reads idle or running; Start / Stop per port, and the options are locked while it runs.

The packet generator of a ProfiShark SPE: number of packets and length per port, with what was transmitted and received.

Readouts: Transmitted, Transmitted with CRC error, Received, Received with CRC error. Start / Stop per port.

Not on a production network. The generator is refused while the tap is inline (“Not while the tap is inline: generating would inject into the live link”): set SPAN mode on the Ports page first.

What it is for
Keep every ProfiShark on the firmware its features need, change the role of a 10G between capture and generation, and bring back a unit whose firmware was damaged — all from the Manager, without a separate tool and without returning the unit. The firmware images travel inside the Manager: one device (SW) firmware for every model, and per-model FPGA (HW) firmware — on the 10G family, one for capture and one for the generator. They are sealed: the Manager opens an image only for the length of a write, and refuses one that was altered. There is never a file to choose.

The Device page of a ProfiShark 10G in generator mode: every version with a green tick, and Device control with Packet Generator selected.

• The Manager compares each unit with the versions it needs. When something is behind, the menu shows only Device, the UPDATE REQUIRED card lists what is behind, and Start is greyed (“Update the device first: see the Device page.”).
• SW firmware: “needs x” and Update when it is older than required.
• HW firmware: “needs x” and Update when the Manager carries a newer image for the role the unit runs (a 10G in generator mode is compared with the generator image, so an update never changes its role).
• HW firmware 0000: a unit whose FPGA flash holds no image yet new. It cannot say which product it is (the Model reads “ProfiShark (0x4a)”), so the row reads “needs a bitstream” and offers a list, Which product is it?, with the HW firmware of each model, and Write. Pick the model on the unit's label: the Manager asks to confirm, writes it like an update and restarts the unit, which then comes back as its model with every page. The wrong model's firmware leaves a unit that captures nothing and no longer offers the list: check the label before writing, and contact Profitap support if it happened.
• API version, Driver version: no button — they come with the ProfiShark software; install the newer software package.

A ProfiShark 1G+ whose device firmware is behind: the menu shows only Device, the SW firmware row says “needs 0.2.5.17” with Update, and the UPDATE REQUIRED card explains.

1. On the Device page, click Update on the row. A progress bar replaces “needs x”. The row reads ”erasing the flash…“ first (the bar stays empty for up to about 30 seconds while the flash is erased), then ”writing…“ as the bar fills new. The window is locked while the flash is written: do not unplug the ProfiShark.
2. When the image is written the row reads “written — restarting…”: the unit restarts on the new firmware. The window goes to Home while it is away, then back to the Device page when it returns (up to about 25 s).
3. ”done — restarted on the new firmware“: the row shows ✓; if nothing else is behind, every page comes back. When both firmwares are behind, update one row, then the other.

The same 1G+ during the update: the progress of the write in the SW firmware row. It came back on 0.2.5.17 with every page.

A 10G FPGA image takes about 30 seconds to write new.

A 10G or 10G+ runs one of two FPGA firmwares. Packet Capture: everything except the packet generator. Packet Generator: the generator and the packet statistics; the capture pages disappear, the tab shows GEN and the header button becomes Start/Stop Generator.

1. Device page › DEVICE CONTROL: choose the other firmware in the list, then Switch.
2. Confirm: “Write the generator HW firmware into the unit and restart it? It takes up to two minutes.” (or the capture one).
3. A progress bar runs through preparing the flash, writing, and the restart, while the unit is off the bus. The window is locked meanwhile.
4. The unit comes back on the new firmware (the Manager waits up to 90 s): the list shows the new firmware and the pages change to match.

If the unit comes back on the old firmware the bar turns red with “back, but still on the … firmware: switch again”.

A ProfiShark whose device firmware is blank or damaged (a power cut during an update, for instance) starts as a bare USB boot loader: it is not a ProfiShark yet, so it gets no tab. The Manager notices it and shows a banner above the tabs:

1. Click Recover firmware. “booting…”: the Manager loads the device firmware into the unit's memory (not its flash).
2. “booted — waiting for it to come back…”: the unit restarts from memory and appears again (up to 20 s).
3. “booted — writing the firmware to its flash…”: the normal update writes the same firmware into the flash, then restarts the unit.
4. ”recovered — the firmware is in its flash and will survive a power cycle“. The unit appears as a normal tab. The whole recovery takes about one minute.

Recovery works on Windows, Linux and macOS. On macOS new it needs no extra driver or software: the Manager reaches the boot loader directly.

From the command line: recovery status, recovery boot <image>, then update --sw <image> (section 6).

What it is for
Use Wireshark as the ProfiShark's own analyser: capture live with the unit's hardware settings, read its statistics and microburst records, and send what you see straight back to the generator.

Wireshark and the Manager now work as one tool. Wireshark captures live from a ProfiShark with the unit's own settings, reads everything a ProfiShark writes into a file, and hands packets back to the Manager's generator; the Manager opens captures, live captures and microburst events in Wireshark.

The Wireshark card on Home: the four pieces installed, the profile switch Open Wireshark in it (off), and the buttons to open or merge captures.

The Wireshark card on the Manager's Home page shows each piece with its state and an Install, Update or Uninstall button. No administrator rights are needed (the pieces go into your personal Wireshark folders) and they survive a Wireshark upgrade. Install them after Wireshark if Wireshark came later. On Windows the Manager finds Wireshark wherever its installer put it, on any drive new.

On macOS the installer links the capture plugin into ~/.local/lib/wireshark/extcap. From the command line: wireshark status, wireshark install, wireshark update, wireshark uninstall.

After updating the Manager, open Home › Wireshark and update each piece so that Wireshark gets the new plugin, capture plugin and profile.

Wireshark started from the Manager stays in the profile you work in: your own columns and settings are left alone. To have it open in the ProfiShark profile, turn on Open Wireshark in it on its row of the Home › Wireshark card. At any time you can also choose ProfiShark in the profile area at the bottom right of Wireshark's status bar.

In a merge of two ProfiShark captures, the frames of both ProfiSharks show their port in the Port column, and the Port A / Port B buttons select that port on both.

• Port: A or B, the ProfiShark port the frame came in on.
• Time: absolute date and time to the nanosecond.
• Seen before: the time since the same frame was seen on another interface (section 5.7).

Wireshark capturing live from a ProfiShark 10G+ with the ProfiShark profile: the Port column, nanosecond timestamps and the filter buttons on the right of the filter bar; the display filter is the one sent by the Microbursts page of the Manager.

Colours mark what the ProfiShark reports (drops, clock problems, microbursts), on top of Wireshark's own colouring rules.

A ProfiShark capture contains, besides the frames, blocks under Profitap's IANA enterprise number. The dissector turns them into readable rows in the packet list, protocol ProfiShark blocks:

• Per-second statistics per port: frames received, kept by the filter and dropped (cumulative since the start of the capture), with the moment.
• Clock state: disciplined to a PPS, GPS or external PPS present, GPS fix, time set by the host, where the time was initialised from, deviation from the PPS in picoseconds.
• Microburst records (with the Capture option on): per port and per second, bursts, bytes, packets, backlog peak, time at line rate; each burst with its start (ns since the epoch), duration and senders (MAC, IPv4, IPv6).
• Each block carries the interface of the port it describes, so one display filter keeps a port's frames and everything measured about them together.

Analyze › Expert Information lists what the ProfiShark itself reported: The ProfiShark dropped frames, The ProfiShark's clock lost its PPS, The ProfiShark's clock is free running, and each Microburst.

Right-click a microburst record › ProfiShark › Filter on this burst: the display filter is set to the frames of that burst (its start and duration, a millisecond either side), without the ProfiShark blocks. Press Enter to apply it. The entry appears only on microburst records.

At file close the driver writes one Interface Statistics Block per port; Statistics › Capture File Properties then shows the frames dropped per interface.

With the capture plugin installed, every ProfiShark appears in Wireshark's interface list as ProfiShark <model> (<MAC>). Click the gear beside it for its options, in tabs:

Everything is put back as it was after the capture. If Wireshark is closed during a capture, the plugin stops the ProfiShark's capture, restores its settings and frees it for the next program.

View › Interface Toolbars › ProfiShark while a capture runs:

• The link, speed and frame count of each port.
• A Note field and Mark event: writes a marker with the note into the capture (filter frame.comment).
• Slicing and ports A / B switched live; a log.

The Manager sees the capture (section 3.10): the tab turns green, the Capture page shows the counters and the capture strip fills.

The dissector adds a ProfiShark menu in two places. Each one starts the Manager (or brings the open one forward) and hands it the packets in a temporary capture file.

Tools › ProfiShark › Send displayed packets to the generator: the Manager comes forward with its frame picker, Wireshark's three packets on the left, the generator list on the right. Nothing is sent before Start.

In the Manager: it comes to the front on a ProfiShark in generator mode (and asks which one when there are several), then opens the frame picker with Wireshark's packets on the left. Choose what to add and click OK, or Cancel to leave the list as it was. Nothing is transmitted until you press Start. A further send while the picker is open waits for it.

Wireshark started from the Manager uses the ProfiShark profile when Open Wireshark in it is on (Home › Wireshark), and your current profile otherwise.

The dissector recognises the same frame seen on two interfaces: two ports of an inline ProfiShark, or two ProfiSharks whose captures were merged. Such a frame shows:

• Time since first seen (profishark_blocks.match.delta), the Seen before column;
• First seen in frame and on interface;
• Hops between, the TTL difference.

Between ports A and B of one ProfiShark this is the time a device inline added; between two ProfiSharks synchronised to GPS it is the one-way latency from one point to the other.

The fields you are most likely to filter on. Type profishark_blocks. in Wireshark's filter bar for the full list.

What it is for
Do from a script what the pages do by hand: start captures unattended, set filters and timing on a fleet, run a generator test from a saved configuration, check licences and firmware, on Windows, Linux and macOS with one grammar.

Below, ProfisharkCLI stands for the program of your system. Commands marked M exist only in profishark-cmd, C only in the ProfiShark CLI.

Two names to watch. In the ProfiShark CLI, pktgen is the 1G-family PHY generator and the 10G generator is pktgen10g; in profishark-cmd, pktgen is the 10G generator. On/off switches are written --inline=off or --inline off.

ProfisharkCLI directcapture start --dir D:\captures --count 24 --loop --fileduration 3600 --alignclock

profishark-cmd microburst sources --port B --interval 10 --json
ProfisharkCLI timing setsntp -d all --sntpserver pool.ntp.org

Command pktgen10g in the ProfiShark CLI, pktgen in profishark-cmd. The 10G must run its generator firmware, loaded from the Device page (section 4.2; on a capture firmware the commands say so); starting is licensed. A gap is counted in 8-byte words of 6.4 ns.

ProfisharkCLI pktgen10g load --config test.json
ProfisharkCLI pktgen10g start --config test.json
profishark-cmd pktgen profile set --shape=triangle --from=90 --to=10 --every=2 --bytes=1500

The configuration file ("format": "profishark-pktgen10g") is the one the Manager's Save config writes: the port gap, the count, whether gaps replay the capture, and for each frame its bytes in hex, gap, gap max, address modifiers (none, increment, decrement, random), bad FCS and raw preamble. Unknown keys are ignored, so the Manager's own section does not disturb the command line.

The 1G-family PHY generator (C): pktgen start [-p A|B] [--count n] [--length 64|125|1518|10000] [--random] [--pattern 0xNNNN] [--lowrate] [--badfcs], pktgen stop, pktgen stats.

ProfisharkCLI update --firmware ProfiShark-10G-update.bin --restart
ProfisharkCLI license offline-request req.txt
profishark-cmd wireshark install

Other diag commands (registers, transceiver access, flash erase) are for Profitap support.

1. On the Capture page, switch on Microburst records in the file and start the capture (or start a live capture in Wireshark with the same option in the Features tab).
2. On Microbursts, watch the timeline; the Senders table names who sent each burst.
3. Select the sender or its events and click Open in Wireshark: the file that holds them opens, filtered to those seconds and senders.
4. In Wireshark, click Microbursts, right-click a burst › ProfiShark › Filter on this burst and press Enter to see the frames of that burst only.

1. Look at the capture strip: yellow seconds had drops.
2. Open the file in Wireshark and click Drops: the seconds in which the ProfiShark dropped, per port.
3. Statistics › Capture File Properties gives the totals per interface.
4. If the load is close to the USB link's capacity, slice the frames or filter in hardware (section 3.9).

1. In Wireshark, select a packet of the conversation and apply Conversation Filter.
2. Tools › ProfiShark › Send displayed packets to the generator - port A or B by direction.
3. In the Manager's picker click OK. Keep capture deltas for the recorded timing, or set gaps by hand.
4. Connect the device under test between ports A and B and press Start.

1. Add a packet from the menu, or send one from Wireshark with “Edit this packet”.
2. In Packet View, add a VLAN, change the transport, edit fields; switch off Keep checksums correct to send a wrong checksum on purpose.
3. For a runt, set the size under 64 bytes (down to 10): the frame goes out raw with its own preamble and FCS.

1. Two ProfiSharks with GPS, both disciplined (Timing page), one at each end.
2. Capture on both at the same time.
3. Home › Merge captures… with the two files: the Seen before column gives, for each frame seen at both ends, the time it took.

Driver signed through Microsoft's hardware programme. It writes the self-describing capture files and the per-second statistics; the microburst records in the file come with driver 1.4.38. A cable pulled during a firmware update no longer stops Windows.

Per-kernel driver packages for Debian 11, 12 and 13 (amd64, and arm64 for 12 and 13), Ubuntu 22.04, 24.04 and 26.04 and Kali, plus a DKMS package (.deb and .rpm) that rebuilds for each new kernel. The Manager as .deb (amd64, arm64) or Flatpak; the capture plugin for both architectures. The driver writes the same capture-file blocks as Windows.

Apple silicon. A DriverKit driver extension installed by the ProfiShark Driver app (it replaces the old kernel extension, which the installer removes). The package is signed and notarized by Apple: double-click it and follow the installer. Then open ProfiShark Driver (Applications), click Install, and allow it when macOS asks: System Settings > General > Login Items & Extensions > Driver Extensions, switch ProfiShark Driver on and enter your password. A ProfiShark already plugged in is taken by the new driver after a restart of the Mac new. The command line and the capture plugin are installed as signed bundles, linked into /usr/local/bin and Wireshark's extcap folder. Capture to disk runs through a small helper installed with the Manager and the command line. To remove everything, run /Library/Application Support/Profitap/Uninstall ProfiShark.command (it asks for an administrator password and removes the driver through ProfiShark Driver first) new.

Firmware and FPGA images ship inside the Manager, so a ProfiShark is brought up to date from the application.