/usr/share/doc/wireshark-doc/wsug_html_chunked/ChapterWork.html is in wireshark-doc 1.10.6-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 | <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 6. Working with captured packets</title><link rel="stylesheet" type="text/css" href="ws.css"><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="Wireshark User's Guide"><link rel="up" href="index.html" title="Wireshark User's Guide"><link rel="prev" href="ChIOPacketFormatSection.html" title="5.10. The Packet Format frame"><link rel="next" href="ChWorkDisplayPopUpSection.html" title="6.2. Pop-up menus"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 6. Working with captured packets</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ChIOPacketFormatSection.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="ChWorkDisplayPopUpSection.html">Next</a></td></tr></table><hr></div><div class="chapter"><div class="titlepage"><div><div><h1 class="title"><a name="ChapterWork"></a>Chapter 6. Working with captured packets</h1></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl class="toc"><dt><span class="section"><a href="ChapterWork.html#ChWorkViewPacketsSection">6.1. Viewing packets you have captured</a></span></dt><dt><span class="section"><a href="ChWorkDisplayPopUpSection.html">6.2. Pop-up menus</a></span></dt><dd><dl><dt><span class="section"><a href="ChWorkDisplayPopUpSection.html#ChWorkColumnHeaderPopUpMenuSection">6.2.1. Pop-up menu of the "Packet List" column header</a></span></dt><dt><span class="section"><a href="ChWorkDisplayPopUpSection.html#ChWorkPacketListPanePopUpMenuSection">6.2.2. Pop-up menu of the "Packet List" pane</a></span></dt><dt><span class="section"><a href="ChWorkDisplayPopUpSection.html#ChWorkPacketDetailsPanePopUpMenuSection">6.2.3. Pop-up menu of the "Packet Details" pane</a></span></dt></dl></dd><dt><span class="section"><a href="ChWorkDisplayFilterSection.html">6.3. Filtering packets while viewing</a></span></dt><dt><span class="section"><a href="ChWorkBuildDisplayFilterSection.html">6.4. Building display filter expressions</a></span></dt><dd><dl><dt><span class="section"><a href="ChWorkBuildDisplayFilterSection.html#idp34099012">6.4.1. Display filter fields</a></span></dt><dt><span class="section"><a href="ChWorkBuildDisplayFilterSection.html#idp34100772">6.4.2. Comparing values</a></span></dt><dt><span class="section"><a href="ChWorkBuildDisplayFilterSection.html#idp34281260">6.4.3. Combining expressions</a></span></dt><dt><span class="section"><a href="ChWorkBuildDisplayFilterSection.html#ChWorkBuildDisplayFilterMistake">6.4.4. A common mistake</a></span></dt></dl></dd><dt><span class="section"><a href="ChWorkFilterAddExpressionSection.html">6.5. The "Filter Expression" dialog box</a></span></dt><dt><span class="section"><a href="ChWorkDefineFilterSection.html">6.6. Defining and saving filters</a></span></dt><dt><span class="section"><a href="ChWorkDefineFilterMacrosSection.html">6.7. Defining and saving filter macros</a></span></dt><dt><span class="section"><a href="ChWorkFindPacketSection.html">6.8. Finding packets</a></span></dt><dd><dl><dt><span class="section"><a href="ChWorkFindPacketSection.html#idp34331540">6.8.1. The "Find Packet" dialog box</a></span></dt><dt><span class="section"><a href="ChWorkFindPacketSection.html#idp34339932">6.8.2. The "Find Next" command</a></span></dt><dt><span class="section"><a href="ChWorkFindPacketSection.html#idp34340588">6.8.3. The "Find Previous" command</a></span></dt></dl></dd><dt><span class="section"><a href="ChWorkGoToPacketSection.html">6.9. Go to a specific packet</a></span></dt><dd><dl><dt><span class="section"><a href="ChWorkGoToPacketSection.html#idp34342044">6.9.1. The "Go Back" command</a></span></dt><dt><span class="section"><a href="ChWorkGoToPacketSection.html#idp34342692">6.9.2. The "Go Forward" command</a></span></dt><dt><span class="section"><a href="ChWorkGoToPacketSection.html#idp34343348">6.9.3. The "Go to Packet" dialog box</a></span></dt><dt><span class="section"><a href="ChWorkGoToPacketSection.html#idp34345196">6.9.4. The "Go to Corresponding Packet" command</a></span></dt><dt><span class="section"><a href="ChWorkGoToPacketSection.html#idp34346612">6.9.5. The "Go to First Packet" command</a></span></dt><dt><span class="section"><a href="ChWorkGoToPacketSection.html#idp34347244">6.9.6. The "Go to Last Packet" command</a></span></dt></dl></dd><dt><span class="section"><a href="ChWorkMarkPacketSection.html">6.10. Marking packets</a></span></dt><dt><span class="section"><a href="ChWorkIgnorePacketSection.html">6.11. Ignoring packets</a></span></dt><dt><span class="section"><a href="ChWorkTimeFormatsSection.html">6.12. Time display formats and time
references</a></span></dt><dd><dl><dt><span class="section"><a href="ChWorkTimeFormatsSection.html#ChWorkTimeReferencePacketSection">6.12.1. Packet time referencing</a></span></dt></dl></dd></dl></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="ChWorkViewPacketsSection"></a>6.1. Viewing packets you have captured</h2></div></div></div><p>
Once you have captured some packets, or you have opened a previously
saved capture file, you can view the packets that are displayed in
the packet list pane by simply clicking on a packet in the
packet list pane, which will bring up the selected packet in the
tree view and byte view panes.
</p><p>
You can then expand any part of the tree view by clicking on the
<span class="command"><strong>plus</strong></span> sign (the symbol itself may vary) to the left of
that part of the payload,
and you can select individual fields by clicking on them in the tree
view pane. An example with a TCP packet selected is shown in
<a class="xref" href="ChapterWork.html#ChWorkSelPack1" title="Figure 6.1. Wireshark with a TCP packet selected for viewing">Figure 6.1, “Wireshark with a TCP packet selected for viewing”</a>. It also has the Acknowledgment number
in the TCP header selected, which shows up in the byte view as the
selected bytes.
</p><div class="figure"><a name="ChWorkSelPack1"></a><p class="title"><b>Figure 6.1. Wireshark with a TCP packet selected for viewing</b></p><div class="figure-contents"><div><img src="wsug_graphics/ws-packet-selected.png" alt="Wireshark with a TCP packet selected for viewing"></div></div></div><p><br class="figure-break">
</p><p>
You can also select and view packets the same way, while Wireshark is
capturing, if you selected "Update list of packets in real time" in the
Wireshark Capture Preferences dialog box.
</p><p>
In addition, you can view individual packets in a separate window as
shown in <a class="xref" href="ChapterWork.html#ChWorkPacketSepView" title="Figure 6.2. Viewing a packet in a separate window">Figure 6.2, “Viewing a packet in a separate window”</a>. Do this by selecting the
packet in which you are interested in the packet list pane, and then
select "Show Packet in New Windows" from the Display menu. This
allows you to easily compare two or even more packets.
</p><div class="figure"><a name="ChWorkPacketSepView"></a><p class="title"><b>Figure 6.2. Viewing a packet in a separate window</b></p><div class="figure-contents"><div><img src="wsug_graphics/ws-packet-sep-win.png" alt="Viewing a packet in a separate window"></div></div></div><p><br class="figure-break">
</p></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ChIOPacketFormatSection.html">Prev</a> </td><td width="20%" align="center"> </td><td width="40%" align="right"> <a accesskey="n" href="ChWorkDisplayPopUpSection.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">5.10. The Packet Format frame </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> 6.2. Pop-up menus</td></tr></table></div></body></html>
|