Packet

Displays a packet number as determined by the time-sequential order in which the packets were captured.

Source

Displays the source address. Depending upon the choice under Display Format in the View menu, this address may be a physical address, a higher-level, logical address such as IP, or a symbolic name. Will appear italicized if Calculate implied transmitter is enabled in the Format tab of the Packet List Options dialog.

Source Logical

Shows the logical address of the packet’s source. Unlike the default Source column, this column’s display is unaffected by any choice you make in Display Format under the View menu. This allows you to show different formats for a packet’s source on a single line.

Source Physical

Shows the physical address of the packet’s source. Unlike the default Source column, this column’s display is unaffected by any choice you make in Display Format under the View menu. This allows you to show different formats for a packet’s source on a single line. Will appear italicized if Calculate implied transmitter is enabled in the Format tab of the Packet List Options dialog.

Source Port

Displays the source port or socket, if any, in the notation appropriate for that protocol.

Source Country

Displays the source country. If the source country is not available, then Private Network, Multicast, or Unknown is displayed. See Special address ranges.

Source City

Displays the source city. If the source city is not available, then Private Network, Multicast, or Unknown is displayed. See Special address ranges.

Source Latitude

Displays the latitude of the source city.

Source Longitude

Displays the longitude of the source city.

Destination

Displays the destination address. Depending upon the choice under Display Format in the View menu, this address may be a physical address, a higher-level, logical address such as IP, or a symbolic name.

Destination Logical

Shows the logical address of the packet’s destination. Unlike the default Destination column, this column’s display is unaffected by any choice you make in Display Format under the View menu. This allows you to show different formats for a packet’s destination on a single line.

Destination Physical

Shows the physical address of the packet’s destination. Unlike the default Destination column, this column’s display is unaffected by any choice you make in Display Format under the View menu. This allows you to show different formats for a packet’s destination on a single line.

Destination Port

Displays the destination port or socket, if any, in the notation appropriate for that protocol.

Destination Country

Displays the destination country. If the destination country is not available, then Private Network, Multicast, or Unknown is displayed. See Special address ranges.

Destination City

Displays the destination city. If the destination city is not available, then Private Network, Multicast, or Unknown is displayed. See Special address ranges.

Destination Latitude

Displays the latitude of the destination city.

Flow ID

Displays the ID of the flow.

Destination Longitude

Displays the longitude of the destination city.

BSSID

Displays the ID number of the access point or base station to whose traffic this packet belongs.This six byte hexadecimal number is typically formed from the station’s MAC address.

Transmitter

Displays the physical address of the station identified in the packet header as the Transmitter, regardless of which address field may contain that information. A transmitter is typically the last hop on a relay through the DS (distribution system) and is distinguished from the original Source address. Will appear italicized if Calculate implied transmitter is enabled in the Format tab of the Packet List Options dialog.

Receiver

Displays the physical address of the station identified in the packet header as the Receiver, regardless of which address field may contain that information. A receiver is typically the first hop on a relay through the DS (distribution system) and is distinct from the ultimate Destination address.

Address 1

Displays the physical address found in the first address field of the 802.11 WLAN MAC header, without reference to its type: destination, receiver, or BSSID.

Address 2

Displays the physical address found in the second address field of the 802.11 WLAN MAC header, without reference to its type: source, BSSID or transmitter.

Address 3

Displays the physical address found in the third address field of the 802.11 WLAN MAC header, without reference to its type: source, destination, or BSSID.

Address 4

Displays the physical address found in the fourth address field of the 802.11 WLAN MAC header, without reference to its type. This address field is empty, except in packets relayed through the DS, in which it holds the source address.

GPS Time

Displays the time reported by the GPS receiver for the fix associated with this packet.

Latitude

Displays the latitude portion of the GPS fix associated with the packet, reported (N, north or S, south) in degrees, minutes, and decimal fractions of a minute.

Longitude

Displays the longitude portion of the GPS fix associated with the packet, reported (E, east or W, west) in degrees, minutes, and decimal fractions of a minute.

Altitude

Displays the altitude portion of the GPS fix associated with the packet. Reported in the measurement system appropriate to the local settings associated with the user in the operating system. (US users in feet, all others in meters.)

Speed

Displays the speed portion of the GPS fix associated with this packet. Reported in the measurement system appropriate to the local settings associated with the user in the operating system. (US and UK users in miles per hour, all others in kilometers per hour.)

VLAN

Displays the VLAN tags present in the packet.

Flags

Contains flag characters indicating that a packet matches some particular condition, such as an error condition or type of protocol data. The characters used for flags are assignable in the Flags tab of the Packet List Options dialog.

Adapter

Displays the IP address or name of the adapter, or the access point or access point controller, from which each packet originated.

Channel

When an 802.11 adapter is selected as the capture adapter, this column displays the wireless channel for 802.11 captures.

 

When a Capture Engine adapter is selected as the capture adapter, this column displays the channel on which the packet was captured.

Frequency

The center frequency of the 802.11 WLAN channel on which the packet was captured.

Band

The 802.11 WLAN standard(s) governing the use of the channel on which the packet was captured.

Signal

Displays the RSSI (Received Signal Strength Indicator) reported in the receipt of this packet, with RSSI normalized to a percentage value.

Signal dBm

Displays the received signal strength reported in the receipt of this packet, in dBm (decibel milliWatts).

Data Rate

Displays the data rate at which the body of this packet was transmitted.

Noise

Displays the noise detected on receipt of this packet, expressed as a percentage.

Noise dBm

Displays the noise detected on receipt of this packet, expressed in dBm (decibel milliWatts).

802.11 Flags

Displays the 802.11 frame control flags. The flags and their codes are as follows:

- Order (O)

- Protected Frame (W)

- More Data (D)

- Power Management (P)

- Retransmission (R)

- More Fragments (M)

- From DS (F)

- To DS (T)

MCS

Displays the Modulation Coding Scheme (MCS) index for various 802.11 packets.,

Spatial Streams

Displays the number of spatial streams for various 802.11 packets.

Size

Displays the length of the packet in bytes, including the packet header, FCS bytes, and any padding.

Size Bar

Contains a graphic representation of the relative size of each packet, color-coded to indicate the relative size of basic protocol elements within the packet.

IP Length

Displays the total length of the IP datagram, in bytes. It includes the length of the IP header and data.

IP ID

Displays the IP ID (Identifier) of the packet. The IP ID uniquely identifies each IP datagram sent by a host. It normally increments by one each time a datagram is sent.

IP TTL

Displays the IP TTL (Time To Live) for IP packets, or Hop Count for IPv6 packets.

Date

Shows the date the packet was received.

Absolute Time

Displays the timestamp assigned to each packet as the actual time of capture, according to the system clock of the computer on which the program is running. Use the Format tab of the Packet List Options dialog to set the display units for all timestamps to milliseconds, microseconds, or nanoseconds.

Delta Time

Shows the timestamp of each packet as the elapsed time since the capture of the previous visible packet. When packets are hidden, the time shown is relative only to the previous visible packet. Use the Format tab of the Packet List Options dialog to set the display units for all timestamps to milliseconds, microseconds, or nanoseconds.

Relative Time

Displays the timestamp of each packet as the elapsed time since the start of the current session. You can set a particular packet as the “zero” time for all items in the Relative Time column. Packets captured before will show negative values, those after, positive values, all relative to the new zero time. To set a packet as the zero time by setting it as the Relative Packet, right-click the packet’s line and choose Set Relative Packet. Use the Format tab of the Packet List Options dialog to set the display units for all timestamps to milliseconds, microseconds, or nanoseconds.

Protocol

Displays the protocol type of the packet. This may be shown as an LSAP value, a SNAP value, or a ProtoSpec. If you have established a symbolic name for a protocol otherwise unknown to ProtoSpecs, that name may be taken from the Name Table and displayed here.

Application

Displays the application associated with the packet.

Filter

Displays the name of the filter that allowed the packet to be entered into the capture buffer.

Summary

Lists any information provided about the packet by enabled Analysis Modules.

Analysis Module Name

Displays the name of the Analysis Module that supplied the information on that packet that is displayed in the Summary column.

Note

Shows the full text of any user-entered note associated with the packet.

Expert

Presents data collected about the packet by the Expert Analysis tools. Typically, this is a short description of the type of problem found in the packet or a description of the event, and may include a measurement (such as response time since another named packet) which caused this packet to be identified as an event.

Dynamic Decode

Displays a portion of the information present in the Decode view of the packet, when that information matches the most recently highlighted part of any decode of any packet in the capture window. It shows the same part of the decode for every packet that contains the selected type of information.