The packet list pane displays all the packets in the current capture file.
Each line in the packet list corresponds to one packet in the capture file. If you select a line in this pane, more details will be displayed in the "Packet Details" and "Packet Bytes" panes.
While dissecting a packet, Wireshark will place information from the protocol dissectors into the columns. As higher level protocols might overwrite information from lower levels, you will typically see the information from the highest possible level only.
For example, let's look at a packet containing TCP inside IP inside an Ethernet packet. The Ethernet dissector will write its data (such as the Ethernet addresses), the IP dissector will overwrite this by its own (such as the IP addresses), the TCP dissector will overwrite the IP information, and so on.
There are a lot of different columns available. Which columns are displayed can be selected by preference settings, see Section 10.5, “Preferences”.
The default columns will show:
-
No. The number of the packet in the capture file. This number won't change, even if a display filter is used.
-
Time The timestamp of the packet. The presentation format of this timestamp can be changed, see Section 6.12, “Time display formats and time references”.
-
Source The address where this packet is coming from.
-
Destination The address where this packet is going to.
-
Protocol The protocol name in a short (perhaps abbreviated) version.
-
Info Additional information about the packet content.
There is a context menu (right mouse click) available, see details in Figure 6.4, “Pop-up menu of the "Packet List" pane”.