General Navigation
Below you can find a quick explanation on how to use the app. You can check Opening Files on how to open a (new) project.
This list show a overview of all parsed packet data. Each line in the list represents one parsed packet. You can navigate this list by just clicking in it, using arrow keys etc. list you would on any list box. The shown name and color gives you a quick idea what the data is about. By default the left facing green arrow indicates data that is incoming (from the capture's perspective), and the blue right facing arrows are for outgoing. The background color is the same by default. You can change these colors in the Program Settings if you want.
If there is a video linked to the project, and the video window is open, it will also show a film-strip icon next to the direction arrows of the data that falls within the video's length.
If the data you are viewing supports what we call a Sync ID, then on the right you will also see a black bar of which packets are grouped together.
The rest of the ListBox's line consist of what we call the Header Text. This generally includes, the capture timestamp, The direction as IN/OUT/UNK, the related stream's short name (if the project has multiple streams), the PacketID and the packet's name _(if applicable).
The exact format can be different depending on the Input Reader and Input Parser used.
You can right-click on a packet in the list to get a popup-menu with different options.
The first item is simply a iteration of what you clicked on, the PacketID and name. The following 5 entries are quick filter options. If you hold shift while clicking one of the filter options, it will active the filter in highlight mode instead of a normal filter. The last option on the list will open the Rules Editor that is attached to the selected packet. If no rule is attached yet, it will ask you if you want to create one for it. Note that this will only work on full project, and not on things imported from clipboard.
Also called Field Grid View, shows the results of the parsed data. Each row corresponds to one entry of parsed data from the currently selected packet in the packet list. It shows the position within the packet where the data is located, the name of the parsed field, and it's data. When you click a row, it will also show it's selecting in the Raw Data View. You can also right-click the View to change it to show the Local Vars from this packet parse result. Or show more debugging information on them.
If you switch to this view, it will show the results of all internal variables used while parsing this packet. This can be useful for debugging when writing packet rules.
If you click this from the popup menu it will show the Parsed Data View again, but will include debug information about every step of the parsing process. This includes results of functions, loops and similar things on top of the normal data.
This view shows the raw data in a hexadecimal format. If you click inside the view to move the cursor, then on the right in the Suggestios View it will try to show additional information on what it might be.
If you click on data in the Raw Data View this ListBox will try to show some data related to the data you clicked. The suggestions will come from different normal type, and data from the lookup data tables