Table of Contents
Once you have captured some packets, or you have opened a previously saved capture file, you can view the packets that are displayed in the packet list pane by simply clicking on a packet in the packet list pane, which will bring up the selected packet in the tree view and byte view panes.
You can then expand any part of the tree view by clicking on the plus sign (the symbol itself may vary) to the left of that part of the payload, and you can select individual fields by clicking on them in the tree view pane. An example with a TCP packet selected is shown in Figure 6.1, “Ethereal with a TCP packet selected for viewing”. It also has the Acknowledgment number in the TCP header selected, which shows up in the byte view as the selected bytes.
You can also select and view packets the same way, while Ethereal is capturing, if you selected "Update list of packets in real time" in the Ethereal Capture Preferences dialog box.
In addition, you can view individual packets in a separate window as shown in Figure 6.2, “Viewing a packet in a separate window”. Do this by selecting the packet you are interested in the packet list pane, and then select "Show Packet in New Windows" from the Display menu. This allows you to easily compare two or even more packets.
Finally, you can bring up a pop-up menu over either the "Packet List", "Packet Details" or "Packet Bytes" pane by clicking your right mouse button.
The following table gives an overview which functions are available in the panes, where to find the corresponding function in the menu, and a short description of each item.
Table 6.1. Function overview of the pop-up menus
Item | List | Details | Bytes | Menu | Description |
---|---|---|---|---|---|
Mark Packet (toggle) | X | - | - | Edit |
Mark a packet. |
Time Reference | X | - | - | Edit |
Set/reset and find time references. |
Expand Subtrees | - | X | - | View |
Expand the currently selected subtree. |
Expand All | - | X | - | View |
Expand all subtrees in all packets in the capture. |
Collapse All | - | X | - | View |
Ethereal keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item collapses the tree view of all packets in the capture list. |
Apply as Filter | X | X | - | Analyze |
. |
Prepare a Filter | X | X | - | Analyze |
. |
Follow TCP stream | X | X | - | Analyze |
View all the data on a TCP stream between a pair of nodes. |
Wiki Protocol Page | - | X | - | - |
Show the wiki page corresponding to the currently selected protocol in your web browser. |
Filter Field Reference | - | X | - | - |
Show the filter field reference web page corresponding to the currently selected protocol in your web browser. |
Protocol Preferences... | - | X | - | - |
The menu item takes you to the preferences dialog and selects the page corresponding to the protocol if there are settings associated with the highlighted field. More information on preferences can be found in Section 9.5, “Preferences”. |
Decode As... | X | X | - | Analyze |
. |
Print... | X | - | - | File |
Print (the selected) packet(s). |
Show Packet in New Window | X | - | - | View |
Display the selected packet in another window. |
Resolve name | - | X | - | View/Name Resolution |
Cause a name resolution to be performed for the selected packet, but NOT for every packet in the capture. |
Go to Corresponding Packet | - | X | - | Go |
If the selected field has a packet number in it, go to it. The corresponding packet will often be a response which is requested by this packet, or the request for which this packet is a response. |
Copy | - | - | X | - |
Copy the selected packet data to the clipboard (XXX - in which format). |
Export Selected Packet Bytes... | - | - | X | File->Export |
Export raw packet bytes to a binary file. |
This menu item is the same as the Edit menu item of the same name. It allows you to mark a packet.
This menu item is the same as the Edit menu items of the same name. It allows you to set and work with time references.
This menu item is the same as the Analyze menu items of the same name.
This menu item is the same as the Analyze menu items of the same name.
This menu item is the same as the Analyze menu item of the same name. It allows you to view all the data on a TCP stream between a pair of nodes.
This menu item is the same as the Analyze menu item of the same name.
This menu item is the same as the File menu item of the same name. It allows you to print packets.
This menu item is the same as the View menu item of the same name. It allows you to display the selected packet in another window.
This menu item expands the currently selected subtree.
This menu item expands all subtrees in all packets in the capture.
Ethereal keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item collapses the tree view of all packets in the capture list.
This menu item is the same as the Analyze menu items of the same name.
This menu item is the same as the Analyze menu items of the same name.
This menu item is the same as the Analyze menu item of the same name. It allows you to view all the data on a TCP stream between a pair of nodes.
Show the wiki page corresponding to the currently selected protocol in your web browser.
Show the filter field reference web page corresponding to the currently selected protocol in your web browser.
The menu item takes you to the properties dialog and selects the page corresponding to the protocol if there are properties associated with the highlighted field. More information on preferences can be found in Figure 9.8, “The preferences dialog box”.
This menu item is the same as the Analyze menu item of the same name.
This menu item causes name resolution to be performed for the selected packet, but NOT every packet in the capture.
If the selected field has a corresponding packet, go to it. Corresponding packets will usually be a request/response packet pair or such.
Copy the selected packet data to the clipboard (XXX - in which format).
This menu item is the same as the File menu item of the same name. It allows you to export raw packet bytes to a binary file.