Analyzing Data

Home > Quickstart > Analyzing Data

To take a closer look at the navigation and decode features, you should first collect some packets or open a saved network data file. Now the packet list view displays some basic information about the network packets. You can see the capture time, the raw packet length, the source and destination addresses of the network layers 2 and 3, and the protocol or type of the packet.

To get a more detailed description of a packet, click inside the packet list. This will display a clear text description of the packet content in the decode view (on the left below the packet list) and the corresponding hexadecimal values of the decoded data in the hex view (right of the decode view). You can resize these views by dragging the separators between them.

The detail level of the displayed data in the decode view can be adjusted. To see the complete packet content with all details, click the All Details button or use the View > Detail > All menu command. To get only common details, click the Common Details button , to see only the most important information, use the Minimum Details button . As above you can also use the corresponding menu commands in the View > Detail submenu.

The decode and hex view are synchronized. So if you scroll one of them, the other view will also scroll. Thus the hex view always displays the hexadecimal values of the decoded data in the same line as the decode view.

Note: If you encounter some synchronization trouble between decode and hex view, or you have problems to scroll either view all the way down, you will most likely use an old rich edit control. In this case use the full MTNA setup, which will install the needed version of the control.

After clicking into the packet list view, you can also navigate through the packets with the keyboard. The left and right cursor keys will change the column. The up and down cursor keys will move the selection in a context sensitive manner. Only in the Time/Length column the selection will change to the next/preceding packet when pressing the cursor down or up key. In the other columns the selection will jump to the next cell with identical content. In the address columns, this will be the next packet with the same source/destination address, and in the type column it will be the next packet of the same protocol (e.g. jump from one HTTP packet to the next ignoring any other packets between these).

The Page Up and Page Down keys will move the list one page up or down. The Home and End keys will move the selection to the first and last column, and, if used together with the Ctrl key, they will take you to the first or last packet in the list.

You can set bookmarks for selected packets in the list view. For this purpose press Ctrl+F2 on the keyboard or use the Edit > Bookmarks > Toggle Bookmark menu command. Press Ctrl+F2 again to remove the bookmark. You can now use F2 and Shift+F2 on the keyboard or the commands in the Edit > Bookmarks submenu to jump to the next or previous packet entry that has a bookmark.

Use the Remove all Bookmarks command in the Edit > Bookmarks submenu to remove all previously assigned bookmarks. The bookmarks are saved in the document on disk.