Feature # 4: Viewing decoded packets

EtherPeek NX™

> ## Feature # 4: Viewing decoded packets

> #### Network traffic, decoded in detail

> Some network problems are revealed more quickly by looking at the detailed information contained in individual packets. Protocol decoders and the Packet Decode window allow you to open packets and look inside, pinpoint sources of problems, track down faulty hardware, and learn about and examine protocol structure and compliance.

> ### Packet decode window

> A Packet Decode window (or the decode pane of the Packets view) presents the detailed structure and contents of a single packet. EtherPeek NX can decode thousands of protocols and sub-protocols, and can display the individual elements of Ethernet packets, along with their meanings, expressed in plain English. This example demonstrates some of the features of packet decodes.

> To view the decode of a packet:

> 1. Open the Decode and Hex panes of the Packets view of a Capture window or Packet File window. Alternatively, you can double-click on any packet in the Packets view to open it in a separate Packet Decode window.
> 2. Notice the items in green at the top of the Decode view. This section includes information on the Flags, Status, Packet Length, and Timestamp of the packet. If packet slicing was in effect when this packet was captured, the Slice Length will also be shown here.
> 3. Notice the body of the Decode view. The information is laid out in the same order as it appears in the packet itself. Each protocol is nested or framed within the higher level protocols. Each line shows the ASCII representation of the packet data for a particular field within the packet and the interpretation of that data, based on the protocol. A quick glance at this section often reveals the source of trouble. Problems like a misconfigured client, or incompatible versions of the same protocol from different vendors can be easily understood when you can see and compare the packets themselves.
> 4. Notice the Hex view at the bottom of the packet decode window. This view shows the raw hex contents of the packet on the left, with the offset of the first character in each line ()optionally) shown at the far left. In alignment with this, line for line, the ASCII version of the raw packet data is shown on the right.

> Figure 4.1 Parts of a Packet Decode window

> 1. When you highlight an item in one part of the window, the same bytes of the packet are highlighted in all the other views or panes as well. The highlight matches in the Decode, Hex, and ASCII panes.
> 2. Click the Decode Previous or Decode Next buttons at the top of the window to step through the packets shown in the Packet List of the active Capture window or Packet File window.

WildPackets, Inc.
http://www.wildpackets.com
Voice: (800) 466-2447
Fax: (925) 937-2479
sales@wildpackets.com