Packet View

Packet View

The Packet View displays the decoded packet data along with its raw contents. The view is composed of two panels, a Status Bar and an optional Description Panel for when the packet contents are still encrypted. (see figure below). At the top of the Packet View, the Title bar shows details such as the security keys and network addresses used to decrypt the packet. Below the Title bar, the First panel contains a tree; the tree is a hierarchical representation of all the decoded fields of the packet currently selected on the Traffic View. Finally, the second panel is the Bytes panel; this panel displays the hexadecimal and ASCII representations for each byte of the packet.

The panels are linked together so if you select a tree node, the corresponding bytes for the field will be highlighted on the Bytes panel and the other way around. Finally, the status bar of the view indicates the offset and length values relative to the full packet, to the selected fields of the tree node, or to the selected panel cells.

In the Title bar there’s a lock icon (see the figure below), when clicked it shows the optional panel that shows the key for decrypting the packed data or if not accessible allows the user to type in the decryption key.

The <strong>Packet View</strong>

Each panel in the Packet View has its own context menu. Through the tree context menu you can copy (Ctrl+C) the selected field in the default format or in additional formats by using the Copy As options, also, you can create or edit filters (see Creating Quick Filters). The context menu in the Bytes panel allows copying the selected bytes and also you can navigate to the parent field of the selection by pressing the Esc key.

You are not restricted to only one Packet View instance at a time, you can open as many as you need. Just double click on a packet in the Traffic View to launch its Packet View.

Testing Decryption

The Title bar will always display the row color in the form of a colored circle on the top left and the packet information as it is displayed in the Traffic View (see Traffic View for more information. Whenever a packet is encrypted, regardless of whether they were decrypted or not, an expansion button will appear on the top right. If the packet was decrypted the security keys used for decryption and the related addresses will be listed, if the packet could not be decrypted and the missing item is known, you will be provided with auto-complete text boxes to enter either the missing security key or address relationship. After providing the missing items, a Redecode button will appear. Click the button to decode the packet again, if the decryption is successful, you will be asked if the complete capture must be re-decoded or not.

Creating Quick Filters

From this view you can create filters using the values of the displayed field values on the tree nodes. Just right click on a tree node and move your mouse cursor over the Create Filter menu item. Depending on the data type of the packet field you selected, different options will appear. Select one of the options and then the filter will be created and applied. Except for the option for the IsPresent operator, the filter created will have a compound condition the will have a condition with the operator of the option selected and a condition with the IsPresent operator.

Use the filter toolbar to edit or remove your newly created filter (see Filtering Packets for details).

Comparing Packets

The Compare Packets window show two packets as in the Packet View, this window compares the packets and highlight the differences between them. To do so, select 2 packets in the Traffic View or Results View (you can press and hold the Ctrl key to select multiple packets), right click on one of the selected packets and select the Compare Packets menu item on the context menu. The Compare Packets window will appear highlighting the differences between both packets in red (see the figure below). The fields with different values will be already expanded on the tree representation although, only OTA fields will be compared.

Check the ‘Include Frame Information’ checkbox at the top of the window to include the sniffer’s Frame Information (non OTA fields) in the packet comparison. The checkbox below it synchronizes the scroll bars of both packets.

The Packet Compare window

Note that is recommended to disable the Auto Scroll option before selecting the packets to be compared from the Traffic View.