3.10. The “Analyze” Menu

The Wireshark Analyze menu contains the fields shown in Table 3.8, “Analyze menu items”.

Figure 3.8. The “Analyze” Menu

ws analyze menu

Table 3.8. Analyze menu items

Menu ItemAcceleratorDescription

Display Filters…​

 

This menu item brings up a dialog box that allows you to create and edit display filters. You can name filters, and you can save them for future use. More detail on this subject is provided in Section 6.6, “Defining and saving filters”

Display Filter Macros…​

 

This menu item brings up a dialog box that allows you to create and edit display filter macros. You can name filter macros, and you can save them for future use. More detail on this subject is provided in Section 6.7, “Defining and saving filter macros”

Apply as Column

 

This menu item adds the selected protocol item in the packet details pane as a column to the packet list.

Apply as Filter…​

 

These menu items will change the current display filter and apply the changed filter immediately. Depending on the chosen menu item, the current display filter string will be replaced or appended to by the selected protocol field in the packet details pane.

Prepare a Filter…​

 

These menu items will change the current display filter but won’t apply the changed filter. Depending on the chosen menu item, the current display filter string will be replaced or appended to by the selected protocol field in the packet details pane.

Enabled Protocols…​

Shift+Ctrl+E

This menu item allows the user to enable/disable protocol dissectors, see Section 11.4.1, “The “Enabled Protocols” dialog box”

Decode As…​

 

This menu item allows the user to force Wireshark to decode certain packets as a particular protocol, see Section 11.4.2, “User Specified Decodes”

User Specified Decodes…​

 

This menu item allows the user to force Wireshark to decode certain packets as a particular protocol, see Section 11.4.3, “Show User Specified Decodes”

FollowTCP Stream

 

This menu item brings up a separate window and displays all the TCP segments captured that are on the same TCP connection as a selected packet, see Section 7.2, “Following Protocol Streams”

FollowUDP Stream

 

Same functionality as “Follow TCP Stream” but for UDP streams.

FollowTLS Stream

 

Same functionality as “Follow TCP Stream” but for TLS or SSL streams. See the wiki page on SSL for instructions on providing TLS keys.

FollowHTTP Stream

 

Same functionality as “Follow TCP Stream” but for HTTP streams.

Expert Info

 

Open a dialog showing some expert information about the captured packets. The amount of information will depend on the protocol and varies from very detailed to non-existent. XXX - add a new section about this and link from here

Conversation Filter…​

 

In this menu you will find conversation filter for various protocols.