Chapter 6. Working with captured packets

Table of Contents

6.1. Viewing packets you have captured
6.2. Filtering packets while viewing
6.3. Building display filter expressions
6.3.1. Display filter fields
6.3.2. Comparing values
6.3.3. Combining expressions
6.3.4. A common mistake
6.4. The "Filter Expression" dialog box
6.5. Defining and saving filters
6.6. Finding packets
6.6.1. The "Find Packet" dialog box
6.6.2. The "Find Next" command
6.6.3. The "Find Previous" command
6.7. Go to a specific packet
6.7.1. The "Go Back" command
6.7.2. The "Go Forward" command
6.7.3. The "Go to Packet" dialog box
6.7.4. The "Go to Corresponding Packet" command
6.7.5. The "Go to First Packet" command
6.7.6. The "Go to Last Packet" command
6.8. Marking packets
6.9. Time display formats and time references
6.9.1. Packet time referencing

6.1. Viewing packets you have captured

Once you have captured some packets, or you have opened a previously saved capture file, you can view the packets that are displayed in the packet list pane by simply clicking on a packet in the packet list pane, which will bring up the selected packet in the tree view and byte view panes.

You can then expand any part of the tree view by clicking on the plus sign (the symbol itself may vary) to the left of that part of the payload, and you can select individual fields by clicking on them in the tree view pane. An example with a TCP packet selected is shown in Figure 6.1, “Ethereal with a TCP packet selected for viewing”. It also has the Acknowledgment number in the TCP header selected, which shows up in the byte view as the selected bytes.

Figure 6.1. Ethereal with a TCP packet selected for viewing

Ethereal with a TCP packet selected for viewing

You can also select and view packets the same way, while Ethereal is capturing, if you selected "Update list of packets in real time" in the Ethereal Capture Preferences dialog box.

In addition, you can view individual packets in a separate window as shown in Figure 6.2, “Viewing a packet in a separate window”. Do this by selecting the packet you are interested in the packet list pane, and then select "Show Packet in New Windows" from the Display menu. This allows you to easily compare two or even more packets.

Figure 6.2. Viewing a packet in a separate window

Viewing a packet in a separate window

Finally, you can bring up a pop-up menu over either the "Packet List", "Packet Details" or "Packet Bytes" pane by clicking your right mouse button.

The following table gives an overview which functions are available in the panes, where to find the corresponding function in the menu, and a short description of each item.

Table 6.1. Function overview of the pop-up menus

ItemListDetailsBytesMenuDescription
Mark Packet (toggle)X--Edit

Mark a packet.

Time ReferenceX--Edit

Set/reset and find time references.

Expand Subtrees-X-View

Expand the currently selected subtree.

Expand All-X-View

Expand all subtrees in all packets in the capture.

Collapse All-X-View

Ethereal keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item collapses the tree view of all packets in the capture list.

Apply as FilterXX-Analyze

.

Prepare a FilterXX-Analyze

.

Follow TCP streamXX-Analyze

View all the data on a TCP stream between a pair of nodes.

Wiki Protocol Page-X--

Show the wiki page corresponding to the currently selected protocol in your web browser.

Filter Field Reference-X--

Show the filter field reference web page corresponding to the currently selected protocol in your web browser.

Protocol Preferences...-X--

The menu item takes you to the preferences dialog and selects the page corresponding to the protocol if there are settings associated with the highlighted field. More information on preferences can be found in Section 9.5, “Preferences”.

Decode As...XX-Analyze

.

Print...X--File

Print (the selected) packet(s).

Show Packet in New WindowX--View

Display the selected packet in another window.

Resolve name-X-View/Name Resolution

Cause a name resolution to be performed for the selected packet, but NOT for every packet in the capture.

Go to Corresponding Packet-X-Go

If the selected field has a packet number in it, go to it. The corresponding packet will often be a response which is requested by this packet, or the request for which this packet is a response.

Copy--X-

Copy the selected packet data to the clipboard (XXX - in which format).

Export Selected Packet Bytes...--XFile->Export

Export raw packet bytes to a binary file.

Figure 6.3. Pop-up menu of "Packet List" pane

Pop-up menu of "Packet List" pane

Mark Packet (toggle)

This menu item is the same as the Edit menu item of the same name. It allows you to mark a packet.

Time Reference

This menu item is the same as the Edit menu items of the same name. It allows you to set and work with time references.

Apply as Filter

This menu item is the same as the Analyze menu items of the same name.

Prepare a Filter

This menu item is the same as the Analyze menu items of the same name.

Follow TCP Stream

This menu item is the same as the Analyze menu item of the same name. It allows you to view all the data on a TCP stream between a pair of nodes.

Decode As...

This menu item is the same as the Analyze menu item of the same name.

Print...

This menu item is the same as the File menu item of the same name. It allows you to print packets.

Show Packet in New Window

This menu item is the same as the View menu item of the same name. It allows you to display the selected packet in another window.

Figure 6.4. Pop-up menu of "Packet Details" pane

Pop-up menu of "Packet Details" pane

Expand Subtrees

This menu item expands the currently selected subtree.

Expand All

This menu item expands all subtrees in all packets in the capture.

Collapse All

Ethereal keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item collapses the tree view of all packets in the capture list.

Apply as Filter

This menu item is the same as the Analyze menu items of the same name.

Prepare a Filter

This menu item is the same as the Analyze menu items of the same name.

Follow TCP Stream

This menu item is the same as the Analyze menu item of the same name. It allows you to view all the data on a TCP stream between a pair of nodes.

Wiki Protocol Page

Show the wiki page corresponding to the currently selected protocol in your web browser.

Filter Field Reference

Show the filter field reference web page corresponding to the currently selected protocol in your web browser.

Protocol Properties...

The menu item takes you to the properties dialog and selects the page corresponding to the protocol if there are properties associated with the highlighted field. More information on preferences can be found in Figure 9.8, “The preferences dialog box”.

Decode As...

This menu item is the same as the Analyze menu item of the same name.

Resolve Name

This menu item causes name resolution to be performed for the selected packet, but NOT every packet in the capture.

Go to Corresponding Packet

If the selected field has a corresponding packet, go to it. Corresponding packets will usually be a request/response packet pair or such.

Figure 6.5. Pop-up menu of "Packet Bytes" pane

Pop-up menu of "Packet Bytes" pane

Copy

Copy the selected packet data to the clipboard (XXX - in which format).

Export Selected Packet Bytes...

This menu item is the same as the File menu item of the same name. It allows you to export raw packet bytes to a binary file.