6.2. Pop-up Menus

You can open a pop-up menu over the “Packet List”, its column heading, “Packet Details”, or “Packet Bytes” by clicking your right mouse button on the corresponding item.

6.2.1. Pop-up Menu Of The “Packet List” Column Header

Figure 6.3. Pop-up menu of the “Packet List” column header

ws column header popup menu

The following table gives an overview of which functions are available in this header, where to find the corresponding function in the main menu, and a description of each item.

Table 6.1. The menu items of the “Packet List” column header pop-up menu

ItemDescription

Align Left

Left-align values in this column.

Align Center

Center-align values in this column.

Align Right

Right-align values in this column.

Column Preferences…​

Open the “Preferences” dialog for this column.

Edit Column

Open the column editor toolbar for this column.

Resize To Contents

Resize the column to fit its values.

Resolve Names

If this column contains addresses, resolve them.

No., Time, Source, et al.

Show or hide a column by selecting its item.

Remove Column

Remove this column, similar to deleting it in the “Preferences” dialog.


6.2.2. Pop-up Menu Of The “Packet List” Pane

Figure 6.4. Pop-up menu of the “Packet List” pane

ws packet pane popup menu

The following table gives an overview of which functions are available in this pane, where to find the corresponding function in the main menu, and a short description of each item.

Table 6.2. The menu items of the “Packet List” pop-up menu

ItemCorresponding main menu itemDescription

Mark Packet (toggle)

Edit

Mark or unmark a packet.

Ignore Packet (toggle)

Edit

Ignore or inspect this packet while dissecting the capture file.

Set Time Reference (toggle)

Edit

Set or reset a time reference.

Time Shift

Edit

Opens the “Time Shift” dialog, which allows you to adjust the timestamps of some or all packets.

Packet Comment…​

Edit

Opens the “Packet Comment” dialog, which lets you add a comment to a single packet. Note that the ability to save packet comments depends on your file format. E.g. pcapng supports comments, pcap does not.

Edit Resolved Name

 

Allows you to enter a name to resolve for the selected address.

Apply as Filter

Analyze

Immediately replace or append the current display filter based on the most recent packet list or packet details item selected. The first submenu item shows the filter and subsequent items show the different ways that the filter can be applied.

Prepare a Filter

Analyze

Change the current display filter based on the most recent packet list or packet details item selected, but don’t apply it. The first submenu item shows the filter and subsequent items show the different ways that the filter can be changed.

Conversation Filter

 

Apply a display filter with the address information from the selected packet. For example, the IP menu entry will set a filter to show the traffic between the two IP addresses of the current packet.

Colorize Conversation

 

Create a new colorizing rule based on address information from the selected packet.

SCTP

 

Allows you to analyze and prepare a filter for this SCTP association.

FollowTCP Stream

Analyze

Open a window that displays all the TCP segments captured that are on the same TCP connection as a selected packet. See Section 7.2, “Following Protocol Streams”.

FollowUDP Stream

Analyze

Same functionality as “Follow TCP Stream” but for UDP “streams”.

FollowTLS Stream

Analyze

Same functionality as “Follow TCP Stream” but for TLS or SSL streams. See the wiki page on SSL for instructions on providing TLS keys.

FollowHTTP Stream

Analyze

Same functionality as “Follow TCP Stream” but for HTTP streams.

CopySummary as Text

 

Copy the summary fields as displayed to the clipboard as tab-separated text.

Copy…​as CSV

 

Copy the summary fields as displayed to the clipboard as comma-separated text.

Copy…​as YAML

 

Copy the summary fields as displayed to the clipboard as YAML data.

CopyAs Filter

 

Prepare a display filter based on the currently selected item and copy that filter to the clipboard.

CopyBytes as Hex + ASCII Dump

 

Copy the packet bytes to the clipboard in full “hexdump” format.

Copy…​as Hex Dump

 

Copy the packet bytes to the clipboard in “hexdump” format without the ASCII portion.

Copy…​as Printable Text

 

Copy the packet bytes to the clipboard as ASCII text, excluding non-printable characters.

Copy…​as a Hex Stream

 

Copy the packet bytes to the clipboard as an unpunctuated list of hex digits.

Copy…​as Raw Binary

 

Copy the packet bytes to the clipboard as raw binary. The data is stored in the clipboard using the MIME type “application/octet-stream”.

Protocol Preferences

 

Adjust the preferences for the selected protocol.

Decode As…​

Analyze

Change or apply a new relation between two dissectors.

Show Packet in New Window

View

Shows the selected packet in a separate window. The separate window shows only the packet details and bytes. See Figure 6.2, “Viewing a packet in a separate window” for details.


6.2.3. Pop-up Menu Of The “Packet Details” Pane

Figure 6.5. Pop-up menu of the “Packet Details” pane

ws details pane popup menu

The following table gives an overview of which functions are available in this pane, where to find the corresponding function in the main menu, and a short description of each item.

Table 6.3. The menu items of the “Packet Details” pop-up menu

ItemCorresponding main menu itemDescription

Expand Subtrees

View

Expand the currently selected subtree.

Collapse Subtrees

View

Collapse the currently selected subtree.

Expand All

View

Expand all subtrees in all packets in the capture.

Collapse All

View

Wireshark keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item collapses the tree view of all packets in the capture list.

Apply as Column

 

Use the selected protocol item to create a new column in the packet list.

Apply as Filter

Analyze

Immediately replace or append the current display filter based on the most recent packet list or packet details item selected. The first submenu item shows the filter and subsequent items show the different ways that the filter can be applied.

Prepare a Filter

Analyze

Change the current display filter based on the most recent packet list or packet details item selected, but don’t apply it. The first submenu item shows the filter and subsequent items show the different ways that the filter can be changed.

Colorize with Filter

 

This menu item uses a display filter with the information from the selected protocol item to build a new colorizing rule.

FollowTCP Stream

Analyze

Open a window that displays all the TCP segments captured that are on the same TCP connection as a selected packet. See Section 7.2, “Following Protocol Streams”.

FollowUDP Stream

Analyze

Same functionality as “Follow TCP Stream” but for UDP “streams”.

FollowTLS Stream

Analyze

Same functionality as “Follow TCP Stream” but for TLS or SSL streams. See the wiki page on SSL for instructions on providing TLS keys.

FollowHTTP Stream

Analyze

Same functionality as “Follow TCP Stream” but for HTTP streams.

CopyAll Visible Items

Edit

Copy the packet details as displayed.

CopyAll Visible Selected Tree Items

Edit

Copy the selected packet detail and its children as displayed.

CopyDescription

Edit

Copy the displayed text of the selected field to the system clipboard.

CopyFieldname

Edit

Copy the name of the selected field to the system clipboard.

CopyValue

Edit

Copy the value of the selected field to the system clipboard.

CopyAs Filter

Edit

Prepare a display filter based on the currently selected item and copy it to the clipboard.

CopyBytes as Hex + ASCII Dump

 

Copy the packet bytes to the clipboard in full “hexdump” format.

Copy…​as Hex Dump

 

Copy the packet bytes to the clipboard in “hexdump” format without the ASCII portion.

Copy…​as Printable Text

 

Copy the packet bytes to the clipboard as ASCII text, excluding non-printable characters.

Copy…​as a Hex Stream

 

Copy the packet bytes to the clipboard as an unpunctuated list of hex digits.

Copy…​as Raw Binary

 

Copy the packet bytes to the clipboard as raw binary. The data is stored in the clipboard using the MIME type “application/octet-stream”.

Copy…​as Escaped String

 

Copy the packet bytes to the clipboard as C-style escape sequences.

Export Packet Bytes…​

File

This menu item is the same as the File menu item of the same name. It allows you to export raw packet bytes to a binary file.

Wiki Protocol Page

 

Show the wiki page corresponding to the currently selected protocol in your web browser.

Filter Field Reference

 

Show the filter field reference web page corresponding to the currently selected protocol in your web browser.

Protocol Preferences

 

Adjust the preferences for the selected protocol.

Decode As…​

Analyze

Change or apply a new relation between two dissectors.

Go to Linked Packet

Go

If the selected field has a corresponding packet such as the matching request for a DNS response, go to it.

Show Linked Packet in New Window

Go

If the selected field has a corresponding packet such as the matching request for a DNS response, show the selected packet in a separate window. See Figure 6.2, “Viewing a packet in a separate window” for details.


6.2.4. Pop-up Menu Of The “Packet Bytes” Pane

Figure 6.6. Pop-up menu of the “Packet Bytes” pane

ws bytes pane popup menu

The following table gives an overview of which functions are available in this pane along with a short description of each item.

Table 6.4. The menu items of the “Packet Bytes” pop-up menu

ItemDescription

Copy Bytes as Hex + ASCII Dump

Copy the packet bytes to the clipboard in full “hexdump” format.

…​as Hex Dump

Copy the packet bytes to the clipboard in “hexdump” format without the ASCII portion.

…​as Printable Text

Copy the packet bytes to the clipboard as ASCII text, excluding non-printable characters.

…​as a Hex Stream

Copy the packet bytes to the clipboard as an unpunctuated list of hex digits.

…​as Raw Binary

Copy the packet bytes to the clipboard as raw binary. The data is stored in the clipboard using the MIME type “application/octet-stream”.

…​as Escaped String

Copy the packet bytes to the clipboard as C-style escape sequences.

Show bytes as hexadecimal

Display the byte data as hexadecimal digits.

Show bytes as bits

Display the byte data as binary digits.

Show text based on packet

Show the “hexdump” data with text.

…​as ASCII

Use ASCII encoding when displaying “hexdump” text.

…​as EBCDIC

Use EBCDIC encoding when displaying “hexdump” text.