Viewing a conversation


To open up a conversation for viewing, simply double-click on it in the capture window. Once the conversation window is open, it will follow the selection in the main capture window. It is not possible to compare two conversations at the same time.

The conversation window is split into three main sections, they are covered below:

Payload

This section displays data that was contained within the packets that were captures. Most of the time, this data can be displayed as text. The first tab simply dumps the text that was captured directly (with some color coding so you can see where it came from). The third tab is similar, but it breaks up the conversation into the parts that each side contributed.

Finally, the middle tab can display any image data that is contained in the payload.

Packets

This section lists each individual packet in the conversation. Each one is listed with its absolute timestamp as well as the time that passed since the last packet. At end end of the list box are the sequence and acknowledgment numbers. Nothing is done at this time to inspect the meaning or integrity of these numbers.

Graphs

Many aspects of the conversation can be displayed here. When "Both Hosts" is selected, the graph is colored red for packets from the client and blue for server responses. When "All w/Flags" is selected, the color scheme is the same as the colors of the flags in the packet listing.