3.18. The “Packet List” Pane

The packet list pane displays all the packets in the current capture file.

Figure 3.16. The “Packet List” pane

ws list pane

Each line in the packet list corresponds to one packet in the capture file. If you select a line in this pane, more details will be displayed in the “Packet Details” and “Packet Bytes” panes.

While dissecting a packet, Wireshark will place information from the protocol dissectors into the columns. As higher-level protocols might overwrite information from lower levels, you will typically see the information from the highest possible level only.

For example, let’s look at a packet containing TCP inside IP inside an Ethernet packet. The Ethernet dissector will write its data (such as the Ethernet addresses), the IP dissector will overwrite this by its own (such as the IP addresses), the TCP dissector will overwrite the IP information, and so on.

There are many different columns available. You can choose which columns are displayed in the preferences. See Section 11.5, “Preferences”.

The default columns will show:

The first column shows how each packet is related to the selected packet. For example, in the image above the first packet is selected, which is a DNS request. Wireshark shows a rightward arrow for the request itself, followed by a leftward arrow for the response in packet 2. Why is there a dashed line? There are more DNS packets further down that use the same port numbers. Wireshark treats them as belonging to the same conversation and draws a line connecting them.

Table 3.16. Related packet symbols

related first

First packet in a conversation.

related current

Part of the selected conversation.

related other

Not part of the selected conversation.

related last

Last packet in a conversation.

related request


related response


related ack

The selected packet acknowledges this packet.

related dup ack

The selected packet is a duplicate acknowledgement of this packet.

related segment

The selected packet is related to this packet in some other way, e.g., as part of reassembly.

The packet list has an Intelligent Scrollbar which shows a miniature map of nearby packets. Each raster line of the scrollbar corresponds to a single packet, so the number of packets shown in the map depends on your physical display and the height of the packet list. A tall packet list on a high-resolution (“Retina”) display will show you quite a few packets. In the image above the scrollbar shows the status of more than 500 packets along with the 15 shown in the packet list itself.

Right clicking will show a context menu, described in Figure 6.4, “Pop-up menu of the “Packet List” pane”.