6.2. Pop-up Menus
Prev | Chapter 6. Working With Captured Packets | Next

## 6.2. Pop-up Menus

You can open a pop-up menu over the “Packet List”, its column heading, “Packet Details”, or “Packet Bytes” by clicking your right mouse button on the corresponding item.

### 6.2.1. Pop-up Menu Of The “Packet List” Column Header

Figure 6.3. Pop-up menu of the “Packet List” column header

The following table gives an overview of which functions are available in this header, where to find the corresponding function in the main menu, and a description of each item.

Table 6.1. The menu items of the “Packet List” column header pop-up menu

Item | Description
--- | ---
Align Left | Left-align values in this column.
Align Center | Center-align values in this column.
Align Right | Right-align values in this column.
Column Preferences…​ | Open the “Preferences” dialog for this column.
Edit Column | Open the column editor toolbar for this column.
Resize To Contents | Resize the column to fit its values.
Resolve Names | If this column contains addresses, resolve them.
No., Time, Source, et al. | Show or hide a column by selecting its item.
Remove Column | Remove this column, similar to deleting it in the “Preferences” dialog.

### 6.2.2. Pop-up Menu Of The “Packet List” Pane

Figure 6.4. Pop-up menu of the “Packet List” pane

The following table gives an overview of which functions are available in this pane, where to find the corresponding function in the main menu, and a short description of each item.

Table 6.2. The menu items of the “Packet List” pop-up menu

Item | Corresponding main menu item | Description
--- | --- | ---
Mark Packet (toggle) | Edit | Mark or unmark a packet.
Ignore Packet (toggle) | Edit | Ignore or inspect this packet while dissecting the capture file.
Set Time Reference (toggle) | Edit | Set or reset a time reference.
Time Shift | Edit | Opens the “Time Shift” dialog, which allows you to adjust the timestamps of some or all packets.
Packet Comment…​ | Edit | Opens the “Packet Comment” dialog, which lets you add a comment to a single packet. Note that the ability to save packet comments depends on your file format. E.g., pcapng supports comments, pcap does not.
Edit Resolved Name |  | Allows you to enter a name to resolve for the selected address.
Apply as Filter | Analyze | Immediately replace or append the current display filter based on the most recent packet list or packet details item selected. The first submenu item shows the filter and subsequent items show the different ways that the filter can be applied.
Prepare as Filter | Analyze | Change the current display filter based on the most recent packet list or packet details item selected, but don’t apply it. The first submenu item shows the filter and subsequent items show the different ways that the filter can be changed.
Conversation Filter |  | Apply a display filter with the address information from the selected packet. For example, the IP menu entry will set a filter to show the traffic between the two IP addresses of the current packet.
Colorize Conversation |  | Create a new colorizing rule based on address information from the selected packet.
SCTP |  | Allows you to analyze and prepare a filter for this SCTP association.
Follow → TCP Stream | Analyze | Open a window that displays all the TCP segments captured that are on the same TCP connection as a selected packet. See Section 7.2, “Following Protocol Streams”.
Follow → UDP Stream | Analyze | Same functionality as “Follow TCP Stream” but for UDP “streams”.
Follow → DCCP Stream | Analyze | Same functionality as “Follow TCP Stream” but for DCCP streams.
Follow → TLS Stream | Analyze | Same functionality as “Follow TCP Stream” but for TLS or SSL streams. See the wiki page on TLS for instructions on providing TLS keys.
Follow → HTTP Stream | Analyze | Same functionality as “Follow TCP Stream” but for HTTP streams.
Copy → Summary as Text |  | Copy the summary fields as displayed to the clipboard as tab-separated text.
Copy → …​as CSV |  | Copy the summary fields as displayed to the clipboard as comma-separated text.
Copy → …​as YAML |  | Copy the summary fields as displayed to the clipboard as YAML data.
Copy → As Filter |  | Prepare a display filter based on the currently selected item and copy that filter to the clipboard.
Copy → Bytes as Hex + ASCII Dump |  | Copy the packet bytes to the clipboard in full “hexdump” format.
Copy → …​as Hex Dump |  | Copy the packet bytes to the clipboard in “hexdump” format without the ASCII portion.
Copy → …​as Printable Text |  | Copy the packet bytes to the clipboard as ASCII text, excluding non-printable characters.
Copy → …​as a Hex Stream |  | Copy the packet bytes to the clipboard as an unpunctuated list of hex digits.
Copy → …​as Raw Binary |  | Copy the packet bytes to the clipboard as raw binary. The data is stored in the clipboard using the MIME type “application/octet-stream”.
Protocol Preferences |  | Adjust the preferences for the selected protocol.
Decode As…​ | Analyze | Change or apply a new relation between two dissectors.
Show Packet in New Window | View | Shows the selected packet in a separate window. The separate window shows only the packet details and bytes. See Figure 6.2, “Viewing a packet in a separate window” for details.

### 6.2.3. Pop-up Menu Of The “Packet Details” Pane

Figure 6.5. Pop-up menu of the “Packet Details” pane

The following table gives an overview of which functions are available in this pane, where to find the corresponding function in the main menu, and a short description of each item.

Table 6.3. The menu items of the “Packet Details” pop-up menu

Item | Corresponding main menu item | Description
--- | --- | ---
Expand Subtrees | View | Expand the currently selected subtree.
Collapse Subtrees | View | Collapse the currently selected subtree.
Expand All | View | Expand all subtrees in all packets in the capture.
Collapse All | View | Wireshark keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item collapses the tree view of all packets in the capture list.
Edit Resolved Name | View | Allows you to enter a name to resolve for the selected address.
Apply as Column |  | Use the selected protocol item to create a new column in the packet list.
Apply as Filter | Analyze | Immediately replace or append the current display filter based on the most recent packet list or packet details item selected. The first submenu item shows the filter and subsequent items show the different ways that the filter can be applied.
Prepare as Filter | Analyze | Change the current display filter based on the most recent packet list or packet details item selected, but don’t apply it. The first submenu item shows the filter and subsequent items show the different ways that the filter can be changed.
Colorize with Filter |  | This menu item uses a display filter with the information from the selected protocol item to build a new colorizing rule.
Follow → TCP Stream | Analyze | Open a window that displays all the TCP segments captured that are on the same TCP connection as a selected packet. See Section 7.2, “Following Protocol Streams”.
Follow → UDP Stream | Analyze | Same functionality as “Follow TCP Stream” but for UDP “streams”.
Follow → TLS Stream | Analyze | Same functionality as “Follow TCP Stream” but for TLS or SSL streams. See the wiki page on TLS for instructions on providing TLS keys.
Follow → HTTP Stream | Analyze | Same functionality as “Follow TCP Stream” but for HTTP streams.
Copy → All Visible Items | Edit | Copy the packet details as displayed.
Copy → All Visible Selected Tree Items | Edit | Copy the selected packet detail and its children as displayed.
Copy → Description | Edit | Copy the displayed text of the selected field to the system clipboard.
Copy → Fieldname | Edit | Copy the name of the selected field to the system clipboard.
Copy → Value | Edit | Copy the value of the selected field to the system clipboard.
Copy → As Filter | Edit | Prepare a display filter based on the currently selected item and copy it to the clipboard.
Copy → Bytes as Hex + ASCII Dump |  | Copy the packet bytes to the clipboard in full “hexdump” format.
Copy → …​as Hex Dump |  | Copy the packet bytes to the clipboard in “hexdump” format without the ASCII portion.
Copy → …​as Printable Text |  | Copy the packet bytes to the clipboard as ASCII text, excluding non-printable characters.
Copy → …​as a Hex Stream |  | Copy the packet bytes to the clipboard as an unpunctuated list of hex digits.
Copy → …​as Raw Binary |  | Copy the packet bytes to the clipboard as raw binary. The data is stored in the clipboard using the MIME type “application/octet-stream”.
Copy → …​as Escaped String |  | Copy the packet bytes to the clipboard as C-style escape sequences.
Export Packet Bytes…​ | File | This menu item is the same as the File menu item of the same name. It allows you to export raw packet bytes to a binary file.
Wiki Protocol Page |  | Open the wiki page for the selected protocol in your web browser.
Filter Field Reference |  | Open the filter field reference web page for the selected protocol in your web browser.
Protocol Preferences |  | Adjust the preferences for the selected protocol.
Decode As…​ | Analyze | Change or apply a new relation between two dissectors.
Go to Linked Packet | Go | If the selected field has a corresponding packet such as the matching request for a DNS response, go to it.
Show Linked Packet in New Window | Go | If the selected field has a corresponding packet such as the matching request for a DNS response, show the selected packet in a separate window. See Figure 6.2, “Viewing a packet in a separate window” for details.

### 6.2.4. Pop-up Menu Of The “Packet Bytes” Pane

Figure 6.6. Pop-up menu of the “Packet Bytes” pane

The following table gives an overview of which functions are available in this pane along with a short description of each item.

Table 6.4. The menu items of the “Packet Bytes” pop-up menu

Item | Description
--- | ---
Copy Bytes as Hex + ASCII Dump | Copy the packet bytes to the clipboard in full “hexdump” format.
…​as Hex Dump | Copy the packet bytes to the clipboard in “hexdump” format without the ASCII portion.
…​as Printable Text | Copy the packet bytes to the clipboard as ASCII text, excluding non-printable characters.
…​as a Hex Stream | Copy the packet bytes to the clipboard as an unpunctuated list of hex digits.
…​as Raw Binary | Copy the packet bytes to the clipboard as raw binary. The data is stored in the clipboard using the MIME type “application/octet-stream”.
…​as Escaped String | Copy the packet bytes to the clipboard as C-style escape sequences.
Show bytes as hexadecimal | Display the byte data as hexadecimal digits.
Show bytes as bits | Display the byte data as binary digits.
Show text based on packet | Show the “hexdump” data with text.
…​as ASCII | Use ASCII encoding when displaying “hexdump” text.
…​as EBCDIC | Use EBCDIC encoding when displaying “hexdump” text.

### 6.2.5. Pop-up Menu Of The “Packet Diagram” Pane

Figure 6.7. Pop-up menu of the “Packet Diagram” pane

The following table gives an overview of which functions are available in this pane along with a short description of each item.

Table 6.5. The menu items of the “Packet Diagram” pop-up menu

Item | Description
--- | ---
Show Field Values | Display current value for each field on the packet diagram.
Save Diagram As…​ | Save the packet diagram to an image file (PNG, BMP, JPEG).
Copy as Raster Image | Copy the packet diagram to the clipboard in raster (ARGB32) format.

Prev | Up | Next
Chapter 6. Working With Captured Packets | Home | 6.3. Filtering Packets While Viewing