Getting Started

Introduction Registration Capture PCAPs Anonymize PCAPs Upload Feature comparision

PCAP Browser

Overview Search Mass Actions Basic Information Connection view Comments Tags DNS View Indices Capture Point Visualization

Indexing

Defaut Indexer Reindexing Settings

Analyze

Overview Packet List Filter Bar Decode Hex View Explain Field Edit PCAP Graph View Statistics Decryption

Settings

Overview Profile Indexer Roles Tags

Account Management

Profile Deletion

Help

Application errors

Encyclopedia

Initial Round Trip Time Server Name Indication Packet Slicing PCAPng

Decode

Packet Safari Decoding

Decode

  • ⚡️ Decode popout. Open decode in a new window and synchronize with packet list for multi-monitor setup

Decode Right-Click Actions

From the decode a menu is available via right-clicking:

Decode Right Click Actions

The available actions are:

  • filter for field = value
  • apply as column
  • open in external tab (decode popup)
  • explain a display field ()

Decode Popup

The decode pop out allows you to open a decode of a specific PCAP in a dedicated window. This makes it possible to have a multi-monitor setup for going through packets and keeping a good overview. The decode is synchronized with the current packet selection of the packet list in the original window.

Explain display field

The explained display field functionality shows you some basic information about the field, like the field type. If the field is indexed it also shows you a diagram with the known field values in the current PCAP.

Some fields provide additional information. For example, the IPv4 address fields ip.src and ip.dst provide IP lookup information.

Decode Explain Field

On this page