Wireshark · Wireshark-users: Re: [Wireshark-users] basic packet byte pane interpretation

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jul 11, 2012, at 4:44 AM, Mike DeYoung wrote:

> Data Byte Pane sections are 1) Offset, 2) Data, 3) ASCII.
> 
> Q#1: What is 1) Offset?

Offset from the beginning of the chunk of data being displayed in the byte pane tab in question.

For the leftmost (or only) tab, it's the raw packet data.  Note that this might include a pseudo-header; for example, Wi-Fi captures might begin with a "radio information" header such  as radiotap.

For other tabs, it's reassembled or decrypted or otherwise-processed data.

> Q#2: In 2) Data section, is data read column1 / line1 - 8 bytes across THEN column2 / line2 - 8 bytes across 
> - OR - 
>  column1 / line1 - 8 bytes across THEN column2 / line1 - 8 bytes across?

You could think of it as two columns of data or as 16 columns of data grouped into two sections.  The intent is that it be viewed as the latter, which means that if you view it instead as the former, it's column 1/line 1 (the first 8 columns in the latter view) followed by column 2 / line 1 (the next 8 columns in the latter view).

The same applies to the ASCII data.