User InterfaceIntroduction
By now you have installed Wireshark and
are most likely keen to get started capturing your first packets. In
the next chapters we will explore:
How the Wireshark user interface works
How to capture packets in Wireshark
How to view packets in Wireshark
How to filter packets in Wireshark
... and many other things!
Start Wireshark
You can start Wireshark from your shell or window manager.
Tip!
When starting Wireshark it's possible to specify optional settings using
the command line. See for details.
Note!
In the following chapters, a lot of screenshots from Wireshark will be shown.
As Wireshark runs on many different platforms with many different window
managers, different styles applied and there are different versions of the
underlying GUI toolkit used, your screen might look different from the provided
screenshots. But as there are no real differences in functionality, these
screenshots should still be well understandable.
The Main window
Let's look at Wireshark's user interface. shows
Wireshark as you would usually see it after some packets are captured or loaded
(how to do this will be described later).
Wireshark's main window consists of parts that are commonly known from many
other GUI programs.
The menu (see )
is used to start actions.
The main toolbar (see )
provides quick access to frequently used items from the menu.
The filter toolbar (see )
provides a way to directly manipulate the currently used display filter
(see ).
The packet list pane (see )
displays a summary of each packet captured. By clicking on packets
in this pane you control what is displayed in the other two panes.
The packet details pane (see )
displays the packet selected in the packet list pane in more detail.
The packet bytes pane (see )
displays the data from the packet selected in the packet list pane, and
highlights the field selected in the packet details pane.
The statusbar (see )
shows some detailed information about the current program state and
the captured data.
Tip!
The layout of the main window can be customized by changing preference settings.
See for details!
Main Window Navigation
Packet list and detail navigation can be done entirely from the
keyboard. shows a list of keystrokes
that will let you quickly move around a capture file. See
for additional navigation keystrokes.
Keyboard NavigationAcceleratorDescriptionTab, Shift+Tab
Move between screen elements, e.g. from the toolbars
to the packet list to the packet detail.
Down
Move to the next packet or detail item.
Up
Move to the previous packet or detail item.
Ctrl+Down, F8
Move to the next packet, even if the packet
list isn't focused.
Ctrl+Up, F7
Move to the previous packet, even if the packet
list isn't focused.
Ctrl+.
Move to the next packet of the conversation
(TCP, UDP or IP)
Ctrl+,
Move to the previous packet of the conversation
(TCP, UDP or IP)
Left
In the packet detail, closes the selected tree item.
If it's already closed, jumps to the parent node.
Right
In the packet detail, opens the selected tree item.
Shift+Right
In the packet detail, opens the selected tree item
and all of its subtrees.
Ctrl+Right
In the packet detail, opens all tree items.
Ctrl+Left
In the packet detail, closes all tree items.
Backspace
In the packet detail, jumps to the parent node.
Return, Enter
In the packet detail, toggles the selected
tree item.
Additionally, typing anywhere in the main window will start filling
in a display filter.
The Menu
The Wireshark menu sits on top of the Wireshark window.
An example is shown in .
Note!
Menu items will be greyed out if the corresponding feature isn't
available. For example, you cannot save a capture file if you didn't
capture or load any data before.
It contains the following items:
File
This menu contains items to open and merge capture files,
save / print / export capture files in whole or in part,
and to quit from Wireshark. See .
Edit
This menu contains items to find a packet, time reference or mark one
or more packets, handle configuration profiles, and set your preferences;
(cut, copy, and paste are not presently implemented).
See .
ViewThis menu controls the display of the captured data,
including colorization of packets, zooming the font,
showing a packet in a separate window, expanding and collapsing trees in packet details, ....
See .
GoThis menu contains items to go to a specific packet.
See .
CaptureThis menu allows you to start and stop captures and to edit capture filters.
See .
Analyze
This menu contains items to manipulate display filters, enable or
disable the dissection of protocols, configure user specified decodes
and follow a TCP stream.
See .
Statistics
This menu contains items to display various statistic windows,
including a summary of the packets that have been captured,
display protocol hierarchy statistics and much more.
See .
Telephony
This menu contains items to display various telephony related
statistic windows, including a media analysis, flow diagrams,
display protocol hierarchy statistics and much more.
See .
Tools
This menu contains various tools available in Wireshark, such as
creating Firewall ACL Rules.
See .
Internals
This menu contains items that show information about the internals
of Wireshark.
See .
Help
This menu contains items to help the user, e.g. access to some basic
help, manual pages of the various command line tools, online access
to some of the webpages, and the usual about dialog.
See .
Each of these menu items is described in more detail in the sections
that follow.
Tip!
You can access menu items directly or by pressing the corresponding
accelerator keys which are shown at the right side of the
menu. For example, you can press the Control (or Strg in German) and the K
keys together to open the capture dialog.
The "File" menu
The Wireshark file menu contains the fields shown in
.
File menu itemsMenu ItemAcceleratorDescriptionOpen...Ctrl+O
This menu item brings up the file open dialog box that
allows you to load a capture file for viewing. It is
discussed in more detail in .
Open Recent
This menu item shows a submenu containing the recently opened
capture files. Clicking on one of the submenu items will open the
corresponding capture file directly.
Merge...
This menu item brings up the merge file dialog box that
allows you to merge a capture file into the currently loaded one.
It is discussed in more detail in .
Import...
This menu item brings up the import file dialog box that
allows you to import a text file into a new temporary capture.
It is discussed in more detail in .
CloseCtrl+W
This menu item closes the current capture. If you
haven't saved the capture, you will be asked to do so first
(this can be disabled by a preference setting).
------SaveCtrl+S
This menu item saves the current capture. If you
have not set a default capture file name (perhaps with
the -w <capfile> option), Wireshark pops up the
Save Capture File As dialog box (which is discussed
further in ).
Note!
If you have already saved the current capture, this
menu item will be greyed out.
Note!
You cannot save a live capture while the capture is in
progress. You must stop the capture in order to
save.
Save As...Shift+Ctrl+S
This menu item allows you to save the current capture
file to whatever file you would like. It pops up the
Save Capture File As dialog box (which is discussed
further in ).
------File Set > List Files
This menu item allows you to show a list of files in a file set.
It pops up the Wireshark List File Set dialog box (which is
discussed further in ).
File Set > Next File
If the currently loaded file is part of a file set, jump to the
next file in the set. If it isn't part of a file set or just the
last file in that set, this item is greyed out.
File Set > Previous File
If the currently loaded file is part of a file set, jump to the
previous file in the set. If it isn't part of a file set or just
the first file in that set, this item is greyed out.
------Export > File...
This menu item allows you to export all (or some) of the packets in
the capture file to file.
It pops up the Wireshark Export dialog box (which is discussed further in
).
Export > Selected Packet Bytes...Ctrl+H
This menu item allows you to export the currently selected bytes
in the packet bytes pane to a binary file. It pops up the
Wireshark Export dialog box (which is discussed further in
)
Export > Objects > HTTP
This menu item allows you to export all or some of the captured HTTP objects
into local files. It pops up the Wireshark HTTP object list (which is discussed
further in )
Export > Objects > DICOM
This menu item allows you to export all or some of the captured DICOM objects
into local files. It pops up the Wireshark DICOM object list (which is discussed
further in )
Export > Objects > SMB
This menu item allows you to export all or some of the captured SMB objects
into local files. It pops up the Wireshark SMB object list (which is discussed
further in )
------Print...Ctrl+P
This menu item allows you to print all (or some) of the packets in
the capture file. It pops up the Wireshark Print dialog
box (which is discussed further in
).
------QuitCtrl+Q
This menu item allows you to quit from Wireshark.
Wireshark will ask to save your capture file if you haven't previously saved
it (this can be disabled by a preference setting).
The "Edit" menu
The Wireshark Edit menu contains the fields shown in
.
Edit menu itemsMenu ItemAcceleratorDescriptionCopy > DescriptionShift+Ctrl+D
This menu item will copy the description of the selected item
in the detail view to the clipboard.
Copy > FieldnameShift+Ctrl+F
This menu item will copy the fieldname of the selected item
in the detail view to the clipboard.
Copy > ValueShift+Ctrl+V
This menu item will copy the value of the selected item
in the detail view to the clipboard.
Copy > As FilterShift+Ctrl+C
This menu item will use the selected item in the detail view to
create a display filter. This display filter is then copied to
the clipboard.
------Find Packet...Ctrl+F
This menu item brings up a dialog box that allows you
to find a packet by many criteria.
There is further information on finding packets in
.
Find NextCtrl+N
This menu item tries to find the next packet matching the
settings from "Find Packet...".
Find PreviousCtrl+B
This menu item tries to find the previous packet matching the
settings from "Find Packet...".
------Mark Packet (toggle)Ctrl+M
This menu item "marks" the currently selected packet. See
for details.
Toggle Marking Of All Displayed PacketsShift+Ctrl+Alt+M
This menu item toggles the mark on all displayed packets.
Mark All Displayed PacketsShift+Ctrl+M
This menu item "marks" all displayed packets.
Unmark All Displayed PacketsCtrl+Alt+M
This menu item "unmarks" all displayed packets.
Find Next MarkShift+Ctrl+N
Find the next marked packet.
Find Previous MarkShift+Ctrl+B
Find the previous marked packet.
------Ignore Packet (toggle)Ctrl+D
This menu item marks the currently selected packet as ignored.
See for details.
Ignore All Displayed Packets (toggle)Shift+Ctrl+D
This menu item marks all displayed packets as ignored.
Un-Ignore All PacketsCtrl+Alt+D
This menu item unmarks all ignored packets.
------Set Time Reference (toggle)Ctrl+T
This menu item set a time reference on the currently selected
packet. See for more information
about the time referenced packets.
Un-Time Reference All PacketsCtrl+Alt+T
This menu item removes all time references on the packets.
Find Next Time ReferenceCtrl+Alt+N
This menu item tries to find the next time referenced packet.
Find Previous Time ReferenceCtrl+Alt+B
This menu item tries to find the previous time referenced packet.
------Configuration Profiles...Shift+Ctrl+A
This menu item brings up a dialog box for handling configuration
profiles. More detail is provided in
.
Preferences...Shift+Ctrl+P
This menu item brings up a dialog box that allows
you to set preferences for many parameters that control
Wireshark. You can also save your preferences so Wireshark
will use them the next time you start it. More detail
is provided in .
The "View" menu
The Wireshark View menu contains the fields shown in
.
View menu itemsMenu ItemAcceleratorDescriptionMain Toolbar
This menu item hides or shows the main toolbar, see
.
Filter Toolbar
This menu item hides or shows the filter toolbar, see
.
Wireless Toolbar (Windows only)
This menu item hides or shows the wireless toolbar. See
the AirPcap documentation for more information.
Statusbar
This menu item hides or shows the statusbar, see
.
------Packet List
This menu item hides or shows the packet list pane, see
.
Packet Details
This menu item hides or shows the packet details pane, see
.
Packet Bytes
This menu item hides or shows the packet bytes pane, see
.
------Time Display Format > Date and Time of Day: 1970-01-01 01:02:03.123456
Selecting this tells Wireshark to display the
time stamps in date and time of day format, see
.
Note!
The fields "Time of Day", "Date and Time of
Day", "Seconds Since Beginning of Capture", "Seconds Since
Previous Captured Packet" and "Seconds Since Previous
Displayed Packet" are mutually exclusive.
Time Display Format > Time of Day: 01:02:03.123456
Selecting this tells Wireshark to display time
stamps in time of day format, see
.
Time Display Format > Seconds Since Epoch (1970-01-01): 1234567890.123456
Selecting this tells Wireshark to display time stamps in
seconds since 1970-01-01 00:00:00, see
.
Time Display Format > Seconds Since Beginning of Capture: 123.123456
Selecting this tells Wireshark to display time
stamps in seconds since beginning of capture format, see
.
Time Display Format > Seconds Since Previous Captured Packet: 1.123456
Selecting this tells Wireshark to display time stamps in
seconds since previous captured packet format, see
.
Time Display Format > Seconds Since Previous Displayed Packet: 1.123456
Selecting this tells Wireshark to display time stamps in
seconds since previous displayed packet format, see
.
Time Display Format > ------Time Display Format > Automatic (File Format Precision)
Selecting this tells Wireshark to display time stamps with the
precision given by the capture file format used, see
.
Note!
The fields "Automatic", "Seconds" and "...seconds" are mutually exclusive.
Time Display Format > Seconds: 0
Selecting this tells Wireshark to display time stamps with a precision of one second, see
.
Time Display Format > ...seconds: 0....
Selecting this tells Wireshark to display time stamps with a precision of one second,
decisecond, centisecond, millisecond, microsecond or nanosecond, see
.
Time Display Format > Display Seconds with hours and minutes
Selecting this tells Wireshark to display time stamps in seconds,
with hours and minutes.
Name Resolution > Resolve Name
This item allows you to trigger a name resolve of the current packet
only, see .
Name Resolution > Enable for MAC Layer
This item allows you to control whether or not
Wireshark translates MAC addresses into names, see
.
Name Resolution > Enable for Network Layer
This item allows you to control whether or not
Wireshark translates network addresses into names, see
.
Name Resolution > Enable for Transport Layer
This item allows you to control whether or not
Wireshark translates transport addresses into names, see
.
Colorize Packet List
This item allows you to control whether or not Wireshark should colorize
the packet list.Note!
Enabling colorization will slow down the display
of new packets while capturing / loading capture files.
Auto Scroll in Live Capture
This item allows you to specify that Wireshark
should scroll the packet list pane as new packets come
in, so you are always looking at the last packet. If you
do not specify this, Wireshark simply adds new packets onto
the end of the list, but does not scroll the packet list
pane.
------Zoom InCtrl++
Zoom into the packet data (increase the font size).
Zoom OutCtrl+-
Zoom out of the packet data (decrease the font size).
Normal SizeCtrl+=
Set zoom level back to 100% (set font size back to normal).
Resize All ColumnsShift+Ctrl+R
Resize all column widths so the content will fit into it.
Note!
Resizing may take a significant amount of time, especially if a
large capture file is loaded.
Displayed Columns
This menu items folds out with a list of all configured columns.
These columns can now be shown or hidden in the packet list.
------Expand SubtreesShift+Right
This menu item expands the currently selected subtree in the
packet details tree.
Expand AllCtrl+Right
Wireshark keeps a list of all the protocol subtrees
that are expanded, and uses it to ensure that the
correct subtrees are expanded when you display a packet.
This menu item expands all subtrees in all packets in
the capture.
Collapse AllCtrl+Left
This menu item collapses the tree view of all packets
in the capture list.
------Colorize Conversation
This menu item brings up a submenu that allows you
to color packets in the packet list pane based
on the addresses of the currently selected packet.
This makes it easy to distinguish packets
belonging to different conversations.
.
Colorize Conversation > Color 1-10
These menu items enable one of the ten temporary color
filters based on the currently selected conversation.
Colorize Conversation > Reset coloring
This menu item clears all temporary coloring rules.
Colorize Conversation > New Coloring Rule...
This menu item opens a dialog window in which a new
permanent coloring rule can be created based on the
currently selected conversation.
Coloring Rules...
This menu item brings up a dialog box that allows you
to color packets in the packet list pane according to
filter expressions you choose. It can be very useful
for spotting certain types of packets, see
.
------Show Packet in New Window
This menu item brings up the selected packet in a
separate window. The separate window shows only the
tree view and byte view panes.
ReloadCtrl+R
This menu item allows you to reload the current
capture file.
The "Go" menu
The Wireshark Go menu contains the fields shown in
.
Go menu itemsMenu ItemAcceleratorDescriptionBackAlt+Left
Jump to the recently visited packet in the packet
history, much like the page history in a web browser.
ForwardAlt+Right
Jump to the next visited packet in the packet
history, much like the page history in a web browser.
Go to Packet...Ctrl+G
Bring up a dialog box that allows you
to specify a packet number, and then goes to that packet. See
for details.
Go to Corresponding Packet
Go to the corresponding packet of the currently
selected protocol field. If the selected field doesn't correspond
to a packet, this item is greyed out.
------Previous PacketCtrl+Up
Move to the previous packet in the list. This can be
used to move to the previous packet even if the packet
list doesn't have keyboard focus.
Next PacketCtrl+Down
Move to the next packet in the list. This can be
used to move to the previous packet even if the packet
list doesn't have keyboard focus.
First PacketCtrl+Home
Jump to the first packet of the capture file.
Last PacketCtrl+End
Jump to the last packet of the capture file.
Previous Packet In ConversationCtrl+,
Move to the previous packet in the current conversation. This can be
used to move to the previous packet even if the packet
list doesn't have keyboard focus.
Next Packet In ConversationCtrl+.
Move to the next packet in the current conversation. This can be
used to move to the previous packet even if the packet
list doesn't have keyboard focus.
The "Capture" menu
The Wireshark Capture menu contains the fields shown in
.
Capture menu itemsMenu ItemAcceleratorDescriptionInterfaces...Ctrl+I
This menu item brings up a dialog box that shows what's going on
at the network interfaces Wireshark knows of, see
) .
Options...Ctrl+K
This menu item brings up the Capture Options
dialog box (discussed further in
) and allows you to
start capturing packets.
StartCtrl+E
Immediately start capturing packets with the same settings than
the last time.
StopCtrl+E
This menu item stops the currently running capture, see
) .
RestartCtrl+R
This menu item stops the currently running capture and starts
again with the same options, this is just for convenience.
Capture Filters...
This menu item brings up a dialog box that allows you to
create and edit capture filters. You can name filters,
and you can save them for future use. More detail on
this subject is provided in
The "Analyze" menu
The Wireshark Analyze menu contains the fields shown in
.
Analyze menu itemsMenu ItemAcceleratorDescriptionDisplay Filters...
This menu item brings up a dialog box that allows you
to create and edit display filters. You can name
filters, and you can save them for future use. More
detail on this subject is provided in
Display Filter Macros...
This menu item brings up a dialog box that allows you
to create and edit display filter macros. You can name
filter macros, and you can save them for future use. More
detail on this subject is provided in
------Apply as Column
This menu item adds the selected protocol item in the packet details
pane as a column to the packet list.
Apply as Filter > ...
These menu items will change the current display filter and apply
the changed filter immediately. Depending on the chosen menu item,
the current display filter string will be replaced or appended to
by the selected protocol field in the packet details pane.
Prepare a Filter > ...
These menu items will change the current display filter but won't
apply the changed filter. Depending on the chosen menu item,
the current display filter string will be replaced or appended to
by the selected protocol field in the packet details pane.
------Enabled Protocols...Shift+Ctrl+E
This menu item allows the user to enable/disable protocol
dissectors, see Decode As...
This menu item allows the user to force Wireshark to
decode certain packets as a particular protocol, see
User Specified Decodes...
This menu item allows the user to force Wireshark to
decode certain packets as a particular protocol, see
------Follow TCP Stream
This menu item brings up a separate window and displays
all the TCP segments captured that are on the same TCP
connection as a selected packet, see
Follow UDP Stream
Same functionality as "Follow TCP Stream" but
for UDP streams.
Follow SSL Stream
Same functionality as "Follow TCP Stream" but for SSL streams.
XXX - how to provide the SSL keys?
Expert Info
Open a dialog showing some expert information about the captured
packets in a log style display.
The amount of information will depend on the protocol and varies
from very detailed to none existing. This is currently a work in
progress. XXX - add a new section about this and link from here
Expert Info Composite
Same information as in "Expert Info" but trying to group items
together for faster analysis.
Conversation Filter > ...
In this menu you will find conversation filter for various
protocols.
The "Statistics" menu
The Wireshark Statistics menu contains the fields shown in
.
All menu items will bring up a new window showing specific statistical
information.
Statistics menu itemsMenu ItemAcceleratorDescriptionSummary
Show information about the data captured, see .
Protocol Hierarchy
Display a hierarchical tree of protocol statistics, see .
Conversations
Display a list of conversations (traffic between two endpoints),
see .
Endpoints
Display a list of endpoints (traffic to/from an address), see
.
Packet Lengths...See IO Graphs
Display user specified graphs (e.g. the number of packets in the
course of time), see .
------Conversation List
Display a list of conversations, obsoleted by the combined window
of Conversations above, see
.
Endpoint List
Display a list of endpoints, obsoleted by the combined window
of Endpoints above, see
.
Service Response Time
Display the time between a request and the corresponding response, see
.
------ANCP...See BOOTP-DHCP...See Colledtd...See Compare...See Flow Graph...See HTTPHTTP request/response statistics, see IP Addresses...See IP Destinations...See IP Protocol Types...See ONC-RPC ProgramsSee SametimeSee TCP Stream GraphSee UDP Multicast StreamsSee WLAN TrafficSee
The "Telephony" menu
The Wireshark Telephony menu contains the fields shown in
.
All menu items will bring up a new window showing specific telephony
related statistical information.
The "Tools" menu
The Wireshark Tools menu contains the fields shown in
.
Tools menu itemsMenu ItemAcceleratorDescriptionFirewall ACL Rules
This allows you to create command-line ACL rules for many different
firewall products, including Cisco IOS, Linux Netfilter (iptables),
OpenBSD pf and Windows Firewall (via netsh). Rules for MAC addresses,
IPv4 addresses, TCP and UDP ports, and IPv4+port combinations are
supported.
It is assumed that the rules will be applied to an outside interface.
Lua
These options allow you to work with the Lua interpreter optionally
build into Wireshark, see .
The "Internals" menu
The Wireshark Internals menu contains the fields shown in
.
Help menu itemsMenu ItemAcceleratorDescriptionDissector tables
This menu item brings up a dialog box showing the tables
with subdissector relationships.
Supported Protocols (slow!)
This menu item brings up a dialog box showing the supported
protocols and protocol fields.
The "Help" menu
The Wireshark Help menu contains the fields shown in
.
Help menu itemsMenu ItemAcceleratorDescriptionContentsF1
This menu item brings up a basic help system.
Manual Pages > ...
This menu item starts a Web browser showing one of the locally
installed html manual pages.
------Website
This menu item starts a Web browser showing the
webpage from:
&WiresharkWebSite;.
FAQ's
This menu item starts a Web browser showing various FAQ's.
Downloads
This menu item starts a Web browser showing the
downloads from:
&WiresharkWebSite;.
------Wiki
This menu item starts a Web browser showing the
front page from:
&WiresharkWikiPage;.
Sample Captures
This menu item starts a Web browser showing the
sample captures from:
&WiresharkWikiPage;.
------About Wireshark
This menu item brings up an information window that
provides various detailed information items on Wireshark,
such as how it's build, the plugins loaded, the used folders, ...
Note!
Calling a Web browser might be unsupported in your version of Wireshark.
If this is the case, the corresponding menu items will be hidden.
Note!
If calling a Web browser fails on your machine, maybe because just nothing
happens or the browser is started but no page is shown, have a look at the
web browser setting in the preferences dialog.
The "Main" toolbar
The main toolbar provides quick access to frequently used items from the
menu. This toolbar cannot be customized by the user, but it can be hidden
using the View menu, if the space on the screen is needed to show even
more packet data.
As in the menu, only the items useful in the current program state will
be available. The others will be greyed out (e.g. you cannot save a capture
file if you haven't loaded one).
Main toolbar itemsToolbar IconToolbar ItemCorresponding Menu ItemDescriptionInterfaces...Capture/Interfaces...
This item brings up the Capture Interfaces List
dialog box (discussed further in
).
Options...Capture/Options...
This item brings up the Capture Options
dialog box (discussed further in
) and allows you to
start capturing packets.
StartCapture/Start
This item starts capturing packets with the options form
the last time.
StopCapture/Stop
This item stops the currently running live capture process
).
RestartCapture/Restart
This item stops the currently running live capture process
and restarts it again, for convenience.
------Open...File/Open...
This item brings up the file open dialog box that
allows you to load a capture file for viewing. It is
discussed in more detail in .
Save As...File/Save As...
This item allows you to save the current capture file to whatever
file you would like. It pops up the Save Capture File As dialog
box (which is discussed further in ).
Note!
If you currently have a temporary capture file, the Save icon
will be
shown instead.
CloseFile/Close
This item closes the current capture. If you
have not saved the capture, you will be asked to save it first.
ReloadView/Reload
This item allows you to reload the current capture file.
Print...File/Print...
This item allows you to print all (or some of) the packets in
the capture file. It pops up the Wireshark Print dialog
box (which is discussed further in
).
------Find Packet...Edit/Find Packet...
This item brings up a dialog box that allows you
to find a packet. There is further information on finding packets
in .
Go BackGo/Go Back
This item jumps back in the packet history.
Go ForwardGo/Go Forward
This item jumps forward in the packet history.
Go to Packet...Go/Go to Packet...
This item brings up a dialog box that allows you
to specify a packet number to go to that packet.
Go To First PacketGo/First Packet
This item jumps to the first packet of the capture file.
Go To Last PacketGo/Last Packet
This item jumps to the last packet of the capture file.
------ColorizeView/Colorize
Colorize the packet list (or not).
Auto Scroll in Live CaptureView/Auto Scroll in Live Capture
Auto scroll packet list while doing a live capture (or not).
------Zoom InView/Zoom In
Zoom into the packet data (increase the font size).
Zoom OutView/Zoom Out
Zoom out of the packet data (decrease the font size).
Normal SizeView/Normal Size
Set zoom level back to 100%.
Resize ColumnsView/Resize Columns
Resize columns, so the content fits into them.
------Capture Filters...Capture/Capture Filters...
This item brings up a dialog box that allows you to
create and edit capture filters. You can name filters,
and you can save them for future use. More detail on
this subject is provided in
.
Display Filters...Analyze/Display Filters...
This item brings up a dialog box that allows you
to create and edit display filters. You can name
filters, and you can save them for future use. More
detail on this subject is provided in
.
Coloring Rules...View/Coloring Rules...
This item brings up a dialog box that allows you
color packets in the packet list pane according to
filter expressions you choose. It can be very useful
for spotting certain types of packets. More
detail on this subject is provided in
.
Preferences...Edit/Preferences
This item brings up a dialog box that allows
you to set preferences for many parameters that control
Wireshark. You can also save your preferences so Wireshark
will use them the next time you start it. More detail
is provided in ------HelpHelp/Contents
This item brings up help dialog box.
The "Filter" toolbar
The filter toolbar lets you quickly edit and apply display filters. More information on
display filters is available in .
Filter toolbar itemsToolbar IconToolbar ItemDescriptionFilter:
Brings up the filter construction dialog, described in .
Filter input
The area to enter or edit a display filter string,
see
. A syntax check of your filter string is done while you are typing.
The background will turn red if you enter an incomplete or invalid
string, and will become green when you enter a valid string. You can
click on the pull down arrow to select a previously-entered filter
string from a list. The entries in the pull down list will remain
available even after a program restart.
Note!
After you've changed something in this field, don't forget to press
the Apply button (or the Enter/Return key), to apply this filter
string to the display.
Note!
This field is also where the current filter in effect is displayed.
Expression...
The middle button labeled "Add Expression..." opens a dialog box that lets
you edit a display filter from a list of protocol fields, described in
Clear
Reset the current display filter and clears the edit area.
Apply
Apply the current value in the edit area as the new display filter.
Note!
Applying a display filter on large capture files might take quite a long time!
The "Packet List" pane
The packet list pane displays all the packets in the current capture
file.
Each line in the packet list corresponds to one packet in the capture
file. If you select a line in this pane, more details will be displayed in
the "Packet Details" and "Packet Bytes" panes.
While dissecting a packet, Wireshark will place information from the
protocol dissectors into the columns. As higher level protocols might
overwrite information from lower levels, you will typically see the
information from the highest possible level only.
For example, let's look at a packet containing TCP inside IP inside
an Ethernet packet. The Ethernet dissector will write its data (such as
the Ethernet addresses), the IP dissector will overwrite this by its own
(such as the IP addresses), the TCP dissector will overwrite the IP
information, and so on.
There are a lot of different columns available. Which columns are
displayed can be selected by preference settings, see
.
The default columns will show:
No.
The number of the packet in the capture file. This number won't change,
even if a display filter is used.
Time
The timestamp of the packet. The presentation format of this timestamp
can be changed, see .
Source
The address where this packet is coming from.
Destination
The address where this packet is going to.
Protocol
The protocol name in a short (perhaps abbreviated) version.
Info
Additional information about the packet content.
There is a context menu (right mouse click) available, see details in
.
The "Packet Details" pane
The packet details pane shows the current packet (selected in the "Packet List"
pane) in a more detailed form.
This pane shows the protocols and protocol fields of the packet selected
in the "Packet List" pane. The protocols and fields of the packet are
displayed using a tree, which can be expanded and collapsed.
There is a context menu (right mouse click) available, see details in
.
Some protocol fields are specially displayed.
Generated fields
Wireshark itself will generate additional protocol fields which are
surrounded by brackets. The information in these fields is derived from the
known context to other packets in the capture file. For example, Wireshark
is doing a sequence/acknowledge analysis of each TCP stream,
which is displayed in the [SEQ/ACK analysis] fields of the TCP protocol.
Links
If Wireshark detected a relationship to another packet in the capture file,
it will generate a link to that packet. Links are underlined and displayed
in blue. If double-clicked, Wireshark jumps to the corresponding packet.
The "Packet Bytes" pane
The packet bytes pane shows the data of the current packet (selected in the "Packet List"
pane) in a hexdump style.
As usual for a hexdump, the left side shows the offset in the packet data,
in the middle the packet data is shown in a hexadecimal representation and
on the right the corresponding ASCII characters (or . if not appropriate)
are displayed.
Depending on the packet data, sometimes more than one page is available,
e.g. when Wireshark has reassembled some packets into a single chunk of
data, see . In this case there are
some additional tabs shown at the bottom of the pane to let you select
the page you want to see.
Note!
The additional pages might contain data picked from multiple packets.
The context menu (right mouse click) of the tab labels will show a list of
all available pages. This can be helpful if the size in the pane is too
small for all the tab labels.
The Statusbar
The statusbar displays informational messages.
In general, the left side will show context related information, the
middle part will show the current number of packets, and the right side will
show the selected configuration profile. Drag the handles between the text
areas to change the size.
This statusbar is shown while no capture file is loaded, e.g. when
Wireshark is started.
The colorized bullet on the left shows the highest expert
info level found in the currently loaded capture file. Hovering the mouse
over this icon will show a textual description of the expert info level,
and clicking the icon will bring up the Expert Infos dialog box.
For a detailed description of expert info, see .
The left side shows information about the capture file, its
name, its size and the elapsed time while it was being captured.
The middle part shows the current number of packets in the capture file.
The following values are displayed:
Packets: the number of captured packetsDisplayed: the number of packets currently being
displayedMarked: the number of marked packetsDropped: the number of dropped packets (only displayed
if Wireshark was unable to capture all packets)Ignored: the number of ignored packets (only displayed
if packets are ignored)The right side shows the selected configuration profile.
Clicking in this part of the statusbar will bring up a menu with all available
configuration profiles, and selecting from this list will change the configuration profile.
For a detailed description of configuration profiles, see
.
This is displayed if you have selected a protocol field from the
"Packet Details" pane.
Tip!
The value between the brackets (in this example
arp.opcode) can be used as a display filter string,
representing the selected protocol field.
This is displayed if you are trying to use a display filter which
may have unexpected results. For a detailed description, see
.