Packet List View

Packet List View
Home > Reference > Main Window > Packet List View

The Packet List View displays a list of the packets that are currently stored in the document. By default it contains six columns, but you can change the layout in the Settings dialog on the Packet List Columns Settings page. The default columns will display the following information (see Packet List Columns for more information on these and the other possible column types):

Time (Length)	The capture time and raw length of the collected packet. The time is displayed as local time of your system in hours, minutes, seconds, and micro-seconds. If some packets were lost before this packet was collected, the number of lost packets is displayed here as well (see also System Performance and Packet Loss).
MAC Src.	The MAC address of the sender of this packet in the LAN.
MAC Dest.	The MAC address of the recipient of this packet in the LAN.
Type	The highest detected protocol of the packet (usually Layer 4 or upper layer protocols).
L3 Src.	The layer 3 source address of the packet. The type of address depends on the network protocol used for the packet. It can be an IP-address, an IPX-address, or a NSAP address. Not all packets need to have layer 3 addresses.
L3 Dest.	The layer 3 destination address. It is of the same type as the layer 3 source address.

Note: If you collect packets from different network cards you may experience some irregularities in the time display. This can happen because the application accesses each network interface in a different thread. These threads now receive one after the other a time slice from the operating system to report their collected packets to the packet dispatcher of the application. Thus the packets that were collected on one NIC during the last 12 ms (time depends on the OS) are stored in one scoop. Then the packets of the next card are stored and so on. Hence the capture time of packets collected from different network cards may slightly overlap.

You can use a view filter to reduce the number of packets that are contained in the list. Click the View Filter button , use the View > View Filter menu command, or press F10 on the keyboard. This will open the Settings dialog that allows to choose the addresses or protocols of the packets you want to see in the list.

In this dialog you can also change most of the colors that are used in the list view to display the packet information (see Coloring the List View).

You can remove the view filter to see all packets again. Click the Remove View Filter button , use the View > Remove View Filter menu command, or press Ctrl+F10 on the keyboard.

Click inside the list view to display more information about a packet in the Decode View and Hex View below the packet list. Right-click an address and use the Properties command in its context menu to open the Edit Address Information Dialog.

The packet list view offers also a very convenient way to navigate through the packets with the keyboard. The left and right cursor keys will change the column. The up and down cursor keys will move the selection in a context sensitive manner. Only in the Time/Length column the selection will change to the next/preceding packet when pressing the down or up keys. In the other columns the selection will jump to the next cell with identical content. In the address columns this will be the next packet with the same source/destination address, in the type column it will be the next packet of the same protocol (e.g. jump from one HTTP packet to the next, ignoring any other non-HTTP packets between these).

The Page Up and Page Down keys will move the list one page up or down. The Home and End keys will move the selection to the first and last column, and, if pressed together with the Ctrl key, they will take you to the first or last packet in the list.