The three panes

Start with one frame

Open a capture from the lab and the window splits into three panes. The top pane is one row per frame: a number, a time, two addresses, a protocol, a length, and a short summary. That row is a headline. It is enough to notice a handshake or a DNS query, and it is a weak place to stop if you are about to write a finding.

Click a row and the middle pane fills in. Wireshark has separated the frame into layers, from the link header up through whatever application protocol it recognized. Expand a layer, click a field, and the bottom pane highlights the bytes that field came from. When the headline and the highlight disagree, write down the bytes. The headline is the dissector’s summary of them.

The status bar is the field name

Every field you can filter on has a name, and the name is easy to miss if you only read the Info column. Click the field. The status bar at the bottom shows the display-filter name on the left and a short description beside it. That spelling is the one the filter box accepts. Guessing a name that “should” exist wastes a long afternoon.

Right-click the field when you want the next action: Apply as Filter, Prepare as Filter, or Apply as Column. Apply as Filter replaces the display filter and the list shrinks to frames that contain that value. The frames are still in the file. Clearing the box brings them back.

Worked case: the name is in the tree, not the headline

A lab capture on 10.8.0.40 has a row whose Info column says Client Hello. You need the name the client asked for. Select the row, expand Transport Layer Security, expand the handshake, and click the Server Name Indication field. The details pane shows the hostname, and the bytes pane highlights those characters in the Client Hello. The status bar reads tls.handshake.extensions_server_name.

Put that field in the filter box with the value you just read. The list drops to Client Hellos that asked for the same name. You still have the rest of the file. You have only changed which rows are on screen, which is the right first move when a capture is too busy to read top to bottom.

tls.handshake.extensions_server_name == "files.lab.example"

A habit that keeps notes honest

Write claims from a field, a frame number, and a time. “Frame 1840 at 14:02:11, field tls.handshake.extensions_server_name, value files.lab.example” survives a second look. “The packet said files” does not, because the Info column is allowed to abbreviate.

The packet number in the list is frame.number. It stays stable for a file. A display filter does not renumber the frames. When you hand someone a frame number, they can jump to it with Go, and then with the same field you clicked.

• Headline in the list, then the field in the details tree.
• Bytes highlight under the field you selected.
• Status bar for the filter name.
• Frame number and time in the note.