3.16. The "Packet List" pane
The packet list pane displays all the packets in the current capture
file.
Each line in the packet list corresponds to one packet in the capture
file. If you select a line in this pane, more details will be displayed in
the "Packet Details" and "Packet Bytes" panes.
While dissecting a packet, Wireshark will place information from the
protocol dissectors into the columns. As higher level protocols might
overwrite information from lower levels, you will typically see the
information from the highest possible level only.
For example, let's look at a packet containing TCP inside IP inside
an Ethernet packet. The Ethernet dissector will write its data (such as
the Ethernet addresses), the IP dissector will overwrite this by its own
(such as the IP addresses), the TCP dissector will overwrite the IP
information, and so on.
There are a lot of different columns available. Which columns are
displayed can be selected by preference settings, see
Section 9.5, “Preferences”.
The default columns will show:
-
No.
The number of the packet in the capture file. This number won't change,
even if a display filter is used.
-
Time
The timestamp of the packet. The presentation format of this timestamp
can be changed, see Section 6.11, “Time display formats and time
references”.
-
Source
The address where this packet is coming from.
-
Destination
The address where this packet is going to.
-
Protocol
The protocol name in a short (perhaps abbreviated) version.
-
Info
Additional information about the packet content.
There is a context menu (right mouse click) available, see details in
Figure 6.3, “Pop-up menu of the "Packet List" pane”.
