Sophie: ksnuffle-2.2-6mdk i586

ksnuffle-2.2-6mdk.i586.rpm

<HTML>
  <HEAD>
    <TITLE>KSnuffle: Packet Display</TITLE>
  </HEAD>
  <BODY TEXT="#000000" BGCOLOR="#FFFFFF" LINK="#AA0000">
    <FONT FACE="Helvetica">
    <A HREF="http://www.kde.org/"><IMG SRC="logotp3.gif" ALT="The K Desktop Environment" BORDER=0 ></A>
    <BR>
    <HR noshade>
    <DIV ALIGN=right>
      <A HREF="index-4.8.html">Next</A>
      <A HREF="index-4.6.html">Previous</A>
      <A HREF="index.html#toc4">Table of Contents</A>
    </DIV>
    <BR>&nbsp;
    <H3>
      <A NAME="ss4.7"></A>4.7 Packet Display
    </H3>
    <P>
      The packet display shows details of each captured and filtered
      packet. Up to six columns of infornation can be displayed,
      as selected from the common configuration page.
    </P>
    <P>
      <A HREF="packets.html" target="Packet Display">Click for full size
      image</A><IMG SRC="packets_s.png">
    </P>
    <P>
      <UL>
	<LI><B>Time</B><BR>
	  This is the time at which the packet was logged from the network.
	  The time is shown as hours:minutes:seconds from midnight,
	  plus, in principle, microseconds. The accuracy of the latter
	  depends on the system clock.
	<LI><B>Protocol</B><BR>
	  This shows the protocol (for instance, <I>tcp</I> or <I>udp</I>)
	  plus possible some extra information (for instance, <I>arp
	  who-has</I> and <I>arp is-at</I>).
	<LI><B>Source</B><BR>
	  This is the packet's source. Unless disabled from the global
	  setup page, IP addresses are converted to names, and ports
	  to services. Note that name lookup is done asynchronously
	  so as not to hold up execution of the monitor. Hence, the
	  first few times an address appears it will not be decoded.
	<LI><B>Destination</B><BR>
	  This is the packet's destination. The same comments apply.
	<LI><B>Info</B><BR>
	  This column contains miscellaneous other information, for
	  instance IP fragment size and offset values.
	<LI><B>Size</B><BR>
	  The size column contains two values, the total packet size
	  and the data size. See the comments <A HREF="index-4.6.html"
	  here</A> about the interpretation of packet and data size.
        </LI>
      </UL>
    </P>
    <P>
      Below the main display are shown the total number of accepted
      packets, and the total network traffic and data in bytes.
      These apply to the total time for which the <I>sniffer</I>
      or <I>replayer</I> has been running.
    </P>
    <P>
      Double-clicking on a packet brings up a
      <A HREF="index-6.html#details">packet details display</A>.
      Alternatively, right-clicking brings up a menu containing a <I>Show
      Details</I> item and, if the packet contains TCP/IP data, an option to
      show the contents of the <A HREF="index-6.html#tcpip">TCP/IP data
      stream</A>.
    </P>
    <P>
      Since the update of this page can present a serious load
      on the processor, it is <I>paused</I> if the number of
      packets received in a second exceeds a certain value, and remains
      <I>paused</I> until the number of packets has fallen below
      this value for some number of seconds. During this time
      the bottom-most line of the list will contain periods and 
      <I>Paused</I> will be shown in the status bar. The packet
      count and reset time values can be set on the
      <A HREF="index-4.10.html">global setup</A> page.
    </P>
    <P>
      <A HREF="index-4.8.html">Next</A>
      <A HREF="index-4.6.html">Previous</A>
      <A HREF="index.html#toc4">Table of Contents</A>
    </P>
    <P>
      <HR size="3" noshade>
    </P>
  </BODY>
</HTML>