User Guide

User Interface
45
Toolbar
Icon
Toolbar Item Description
Note!
This field is also where the current filter in effect is displayed.
Expression... The middle button labeled "Add Expression..." opens a dialog box that
lets you edit a display filter from a list of protocol fields, described in
Section 6.5, “The "Filter Expression" dialog box”
Clear Reset the current display filter and clears the edit area.
Apply Apply the current value in the edit area as the new display filter.
Note!
Applying a display filter on large capture files might take
quite a long time!
3.18. The "Packet List" pane
The packet list pane displays all the packets in the current capture file.
Figure 3.16. The "Packet List" pane
Each line in the packet list corresponds to one packet in the capture file. If you select a line in this pane,
more details will be displayed in the "Packet Details" and "Packet Bytes" panes.
While dissecting a packet, Wireshark will place information from the protocol dissectors into the columns.
As higher level protocols might overwrite information from lower levels, you will typically see the
information from the highest possible level only.
For example, let's look at a packet containing TCP inside IP inside an Ethernet packet. The Ethernet
dissector will write its data (such as the Ethernet addresses), the IP dissector will overwrite this by its own
(such as the IP addresses), the TCP dissector will overwrite the IP information, and so on.
There are a lot of different columns available. Which columns are displayed can be selected by preference
settings, see Section 10.5, “Preferences”.
The default columns will show:
• No. The number of the packet in the capture file. This number won't change, even if a display filter
is used.