<HTML> <HEAD> <TITLE>KSnuffle: Packet Display</TITLE> </HEAD> <BODY TEXT="#000000" BGCOLOR="#FFFFFF" LINK="#AA0000"> <FONT FACE="Helvetica"> <A HREF="http://www.kde.org/"><IMG SRC="logotp3.gif" ALT="The K Desktop Environment" BORDER=0 ></A> <BR> <HR noshade> <DIV ALIGN=right> <A HREF="index-4.8.html">Next</A> <A HREF="index-4.6.html">Previous</A> <A HREF="index.html#toc4">Table of Contents</A> </DIV> <BR> <H3> <A NAME="ss4.7"></A>4.7 Packet Display </H3> <P> The packet display shows details of each captured and filtered packet. Up to six columns of infornation can be displayed, as selected from the common configuration page. </P> <P> <A HREF="packets.html" target="Packet Display">Click for full size image</A><IMG SRC="packets_s.png"> </P> <P> <UL> <LI><B>Time</B><BR> This is the time at which the packet was logged from the network. The time is shown as hours:minutes:seconds from midnight, plus, in principle, microseconds. The accuracy of the latter depends on the system clock. <LI><B>Protocol</B><BR> This shows the protocol (for instance, <I>tcp</I> or <I>udp</I>) plus possible some extra information (for instance, <I>arp who-has</I> and <I>arp is-at</I>). <LI><B>Source</B><BR> This is the packet's source. Unless disabled from the global setup page, IP addresses are converted to names, and ports to services. Note that name lookup is done asynchronously so as not to hold up execution of the monitor. Hence, the first few times an address appears it will not be decoded. <LI><B>Destination</B><BR> This is the packet's destination. The same comments apply. <LI><B>Info</B><BR> This column contains miscellaneous other information, for instance IP fragment size and offset values. <LI><B>Size</B><BR> The size column contains two values, the total packet size and the data size. See the comments <A HREF="index-4.6.html" here</A> about the interpretation of packet and data size. </LI> </UL> </P> <P> Below the main display are shown the total number of accepted packets, and the total network traffic and data in bytes. These apply to the total time for which the <I>sniffer</I> or <I>replayer</I> has been running. </P> <P> Double-clicking on a packet brings up a <A HREF="index-6.html#details">packet details display</A>. Alternatively, right-clicking brings up a menu containing a <I>Show Details</I> item and, if the packet contains TCP/IP data, an option to show the contents of the <A HREF="index-6.html#tcpip">TCP/IP data stream</A>. </P> <P> Since the update of this page can present a serious load on the processor, it is <I>paused</I> if the number of packets received in a second exceeds a certain value, and remains <I>paused</I> until the number of packets has fallen below this value for some number of seconds. During this time the bottom-most line of the list will contain periods and <I>Paused</I> will be shown in the status bar. The packet count and reset time values can be set on the <A HREF="index-4.10.html">global setup</A> page. </P> <P> <A HREF="index-4.8.html">Next</A> <A HREF="index-4.6.html">Previous</A> <A HREF="index.html#toc4">Table of Contents</A> </P> <P> <HR size="3" noshade> </P> </BODY> </HTML>