The packet decode window
Network problems are revealed more quickly by looking at the detailed information contained in individual packets. Looking into the packets can help you troubleshoot your network, track down a security breach, or examine protocol structure and compliance.
To view the decode of a packet:
1. Double-click a packet in the Packets view of a capture window. The Packet Decode window appears. The decoded packet data is presented in byte order from top to bottom.
TIP: You can open individual Packet Decode windows for up to 10 packets at once. When multiple packets are selected in the active Packet List, click to open them all.
2. Click on the - minus or + plus signs in the margin to collapse or expand the view of any header section.
• Window header: Click or at the top of the window to step through the packets shown in the Packet List of the active capture window.
• Decode view: The body of the Decode view is laid out in the same order as it appears in the packet. A quick glance at this section often reveals the source of trouble. Problems like a misconfigured client, or incompatible versions of the same protocol from different vendors can be easily understood when you can see and compare the packets themselves.
• Hexadecimal view: The Hex view at the bottom of the decode window shows the offset of the first character in each line, the raw packet data in hex, and the ASCII version of raw packet data
3. Highlight an item in one part of the window. The same bytes of the packet are highlighted in all the other views or panes as well. The highlight matches in the Decode, Hex, and ASCII panes.
Color coding is used to link the Decode view with the Hex view for both Hex and its ASCII equivalent. The Hex and ASCII views are in turn linked to the color of the protocol shown in the Protocols column of the Packet List.
TIP: Use in the toolbar to tile the Decode and Hex views vertically or horizontally.