docbook/eug_src/EUG_chapter_work.xml

   1 <!-- EUG Chapter Work -->
   2 <!-- $Id$ -->
   3
   4 <chapter id="ChapterWork">
   5   <title>Working with captured packets</title>
   6
   7   <section id="ChWorkViewPacketsSection"><title>Viewing packets you have captured</title>
   8     <para>
   9       Once you have captured some packets, or you have opened a previously
  10       saved capture file, you can view the packets that are displayed in
  11       the packet list pane by simply clicking on that packet in the
  12       packet list pane, which will bring up the selected packet in the
  13       tree view and byte view panes.
  14     </para>
  15     <para>
  16       You can then expand any part of the tree view by clicking on the
  17       <command>plus</command> sign (the symbol itself may vary) to the left of
  18           that part of the payload,
  19       and you can select individual fields by clicking on them in the tree
  20       view pane. An example with a TCP packet selected is shown in
  21       <xref linkend="ChWorkSelPack1"/>. It also has the Acknowledgment number
  22         in the TCP header selected, which shows up in the byte view as the
  23         selected bytes.
  24         <figure id="ChWorkSelPack1">
  25           <title>Ethereal with a TCP packet selected for viewing</title>
  26           <graphic entityref="EtherealPacketSelected1" format="PNG"/>
  27         </figure>
  28     </para>
  29     <para>
  30       You can also select and view packets the same way, while Ethereal is
  31           capturing, if you selected "Update list of packets in real time" in the
  32           Ethereal Capture Preferences dialog box.
  33     </para>
  34     <para>
  35       In addition, you can view individual packets in a separate window as
  36       shown in <xref linkend="ChWorkPacketSepView"/>. Do this by selecting the
  37         packet you are interested in in the packet list pane, and then
  38         select "Show Packet in New Windows" from the Display menu. This
  39         allows you to easily compare two or more packets.
  40         <figure id="ChWorkPacketSepView">
  41           <title>Viewing a packet in a separate window</title>
  42           <graphic entityref="EtherealPacketSepView" format="PNG"/>
  43         </figure>
  44     </para>
  45     <para>
  46       Finally, you can bring up a pop-up menu over either the "Packet List",
  47       "Packet Details" or "Packet Bytes" pane by clicking your right mouse button.
  48     </para>
  49           <para>
  50           The following table gives an overview of which functions are available
  51           in the panes, where to find the corresponding function in the menu, and
  52           a short description of each item.
  53           </para>
  54         <table id="PopupMenuTable">
  55           <title>Function overview of the pop-up menus</title>
  56           <tgroup cols="6">
  57                 <colspec colnum="1" colwidth="80pt"/>
  58                 <colspec colnum="2" colwidth="20pt"/>
  59                 <colspec colnum="3" colwidth="20pt"/>
  60                 <colspec colnum="4" colwidth="20pt"/>
  61                 <colspec colnum="5" colwidth="80pt"/>
  62             <thead>
  63               <row>
  64                 <entry>Item</entry>
  65                 <entry>List</entry>
  66                 <entry>Details</entry>
  67                 <entry>Bytes</entry>
  68                 <entry>Menu</entry>
  69                 <entry>Description</entry>
  70               </row>
  71             </thead>
  72             <tbody>
  73               <row>
  74                 <entry><command>Follow TCP stream</command></entry>
  75                 <entry>X</entry>
  76                 <entry>X</entry>
  77                 <entry>X</entry>
  78                 <entry>Analyze</entry>
  79                 <entry>
  80             <para>View all the data on a TCP stream between a pair of nodes.</para>
  81                 </entry>
  82               </row>
  83               <row>
  84                 <entry><command>Decode As...</command></entry>
  85                 <entry>X</entry>
  86                 <entry>X</entry>
  87                 <entry>X</entry>
  88                 <entry>Analyze</entry>
  89                 <entry>
  90             <para>.</para>
  91                 </entry>
  92               </row>
  93               <row>
  94                 <entry><command>Display Filters...</command></entry>
  95                 <entry>X</entry>
  96                 <entry>X</entry>
  97                 <entry>X</entry>
  98                 <entry>Analyze</entry>
  99                 <entry>
 100             <para>Specify and manage filters.</para>
 101                 </entry>
 102               </row>
 103               <row>
 104                 <entry><command>Mark Packet</command></entry>
 105                 <entry>X</entry>
 106                 <entry>-</entry>
 107                 <entry>-</entry>
 108                 <entry>Edit</entry>
 109                 <entry>
 110             <para>Mark a packet.</para>
 111                 </entry>
 112               </row>
 113               <row>
 114                 <entry><command>Time Reference</command></entry>
 115                 <entry>X</entry>
 116                 <entry>-</entry>
 117                 <entry>-</entry>
 118                 <entry>Edit</entry>
 119                 <entry>
 120             <para>Set/reset and find time references.</para>
 121                 </entry>
 122               </row>
 123               <row>
 124                 <entry><command>Apply as Filter</command></entry>
 125                 <entry>X</entry>
 126                 <entry>X</entry>
 127                 <entry>-</entry>
 128                 <entry>Analyze</entry>
 129                 <entry>
 130             <para>.</para>
 131                 </entry>
 132               </row>
 133               <row>
 134                 <entry><command>Prepare a Filter</command></entry>
 135                 <entry>X</entry>
 136                 <entry>X</entry>
 137                 <entry>-</entry>
 138                 <entry>Analyze</entry>
 139                 <entry>
 140             <para>.</para>
 141                 </entry>
 142               </row>
 143               <row>
 144                 <entry><command>Coloring Rules...</command></entry>
 145                 <entry>X</entry>
 146                 <entry>-</entry>
 147                 <entry>-</entry>
 148                 <entry>View</entry>
 149                 <entry>
 150             <para>Colorize packets in the "Packet List" pane.</para>
 151                 </entry>
 152               </row>
 153               <row>
 154                 <entry><command>Print...</command></entry>
 155                 <entry>X</entry>
 156                 <entry>-</entry>
 157                 <entry>-</entry>
 158                 <entry>File</entry>
 159                 <entry>
 160             <para>Print packets.</para>
 161                 </entry>
 162               </row>
 163               <row>
 164                 <entry><command>Show Packet in New Window</command></entry>
 165                 <entry>X</entry>
 166                 <entry>-</entry>
 167                 <entry>-</entry>
 168                 <entry>View</entry>
 169                 <entry>
 170             <para>Display the selected packet in another window.</para>
 171                 </entry>
 172               </row>
 173               <row>
 174                 <entry><command>Resolve name</command></entry>
 175                 <entry>-</entry>
 176                 <entry>X</entry>
 177                 <entry>-</entry>
 178                 <entry>-</entry>
 179                 <entry>
 180             <para>Cause a name resolution to be performed for the selected packet,
 181                 but NOT for every packet in the capture.</para>
 182                 </entry>
 183               </row>
 184               <row>
 185                 <entry><command>Go to Corresponding Packet</command></entry>
 186                 <entry>-</entry>
 187                 <entry>X</entry>
 188                 <entry>-</entry>
 189                 <entry>Go</entry>
 190                 <entry>
 191             <para>If the selected field has a packet number in it, go to it. The
 192                 corresponding packet will often be a response which is requested by
 193                 this packet, or the request for which this packet is a response.
 194                 </para>
 195                 </entry>
 196               </row>
 197               <row>
 198                 <entry><command>Export Selected Packet Bytes...</command></entry>
 199                 <entry>-</entry>
 200                 <entry>X</entry>
 201                 <entry>X</entry>
 202                 <entry>File->Export</entry>
 203                 <entry>
 204             <para>Export raw packet bytes to a binary file.</para>
 205                 </entry>
 206               </row>
 207               <row>
 208                 <entry><command>Protocol Preferences...</command></entry>
 209                 <entry>-</entry>
 210                 <entry>X</entry>
 211                 <entry>-</entry>
 212                 <entry>Edit</entry>
 213                 <entry>
 214             <para>The menu item takes you to the preferences dialog and selects
 215                 the page corresponding to the protocol if there are settings
 216                 associated with the highlighted field. More information on preferences
 217                 can be found in <xref linkend="ChCustProtocolsPrefPages"/>.
 218                 </para>
 219                 </entry>
 220               </row>
 221               <row>
 222                 <entry><command>Collapse All</command></entry>
 223                 <entry>-</entry>
 224                 <entry>X</entry>
 225                 <entry>-</entry>
 226                 <entry>View</entry>
 227                 <entry>
 228             <para>
 229               Ethereal keeps a list of all the protocol subtrees that are
 230               expanded, and uses it to ensure that the correct subtrees
 231               are expanded when you display a packet. This menu item
 232               collapses the tree view of all packets in the capture list.
 233                 </para>
 234                 </entry>
 235               </row>
 236               <row>
 237                 <entry><command>Expand All</command></entry>
 238                 <entry>-</entry>
 239                 <entry>X</entry>
 240                 <entry>-</entry>
 241                 <entry>View</entry>
 242                 <entry>
 243             <para>Expand all subtrees in all packets in the capture.
 244                 </para>
 245                 </entry>
 246               </row>
 247               <row>
 248                 <entry><command>Expand Tree</command></entry>
 249                 <entry>-</entry>
 250                 <entry>X</entry>
 251                 <entry>-</entry>
 252                 <entry>View</entry>
 253                 <entry>
 254             <para>Expand the currently selected subtree.
 255                 </para>
 256                 </entry>
 257               </row>
 258                 </tbody>
 259                 </tgroup>
 260         </table>
 261     <para>
 262       <figure id="ChWorkPacketListPanePopUpMenu">
 263         <title>Pop-up menu of "Packet List" pane</title>
 264         <graphic entityref="EtherealPacketPanePopupMenu" format="PNG"/>
 265       </figure>
 266       <variablelist>
 267         <varlistentry><term><command>Follow TCP Stream</command></term>
 268           <listitem>
 269             <para>
 270               This menu item is the same as the Analyze menu item of
 271               the same name. It allows you to view all the data on a TCP
 272               stream between a pair of nodes.
 273             </para>
 274           </listitem>
 275         </varlistentry>
 276         <varlistentry><term><command>Decode As...</command></term>
 277           <listitem>
 278             <para>
 279               This menu item is the same as the Analyze menu item of the
 280               same name.
 281             </para>
 282           </listitem>
 283         </varlistentry>
 284         <varlistentry><term><command>Display Filters...</command></term>
 285           <listitem>
 286             <para>
 287               This menu item is the same as the Analyze menu item of the same
 288               name. It allows you to specify and manage display filters.
 289             </para>
 290           </listitem>
 291         </varlistentry>
 292         <varlistentry><term><command>Mark Packet</command></term>
 293           <listitem>
 294             <para>
 295               This menu item is the same as the Edit menu item of the same
 296               name. It allows you to mark a packet.
 297             </para>
 298           </listitem>
 299         </varlistentry>
 300         <varlistentry><term><command>Time Reference</command></term>
 301           <listitem>
 302             <para>
 303               This menu item is the same as the Edit menu items of the same
 304               name. It allows you to set and work with time references.
 305             </para>
 306           </listitem>
 307         </varlistentry>
 308         <varlistentry><term><command>Apply as Filter</command></term>
 309           <listitem>
 310             <para>
 311               This menu item is the same as the Analyze menu items of the same
 312               name.
 313             </para>
 314           </listitem>
 315         </varlistentry>
 316         <varlistentry><term><command>Prepare a Filter</command></term>
 317           <listitem>
 318             <para>
 319               This menu item is the same as the Analyze menu items of the same
 320               name.
 321             </para>
 322           </listitem>
 323         </varlistentry>
 324         <varlistentry>
 325           <term><command>Coloring Rules...</command></term>
 326           <listitem>
 327             <para>
 328               This menu item is the same as the View menu item of the
 329               same name. It allows you to colorize packets in the packet
 330               list pane.
 331             </para>
 332           </listitem>
 333         </varlistentry>
 334         <varlistentry><term><command>Print...</command></term>
 335           <listitem>
 336             <para>
 337               This menu item is the same as the File menu item of the same
 338               name. It allows you to print packets.
 339             </para>
 340           </listitem>
 341         </varlistentry>
 342         <varlistentry>
 343           <term><command>Show Packet in New Window</command></term>
 344           <listitem>
 345             <para>
 346               This menu item is the same as the View menu item of the
 347               same name. It allows you to display the selected packet in
 348               another window.
 349             </para>
 350           </listitem>
 351         </varlistentry>
 352         </variablelist>
 353     </para>
 354     <para>
 355       <figure id="ChWorkPacketDetailsPanePopUpMenu">
 356         <title>Pop-up menu of "Packet Details" pane</title>
 357         <graphic entityref="EtherealDetailsPanePopupMenu" format="PNG"/>
 358       </figure>
 359       <variablelist>
 360         <varlistentry><term><command>Follow TCP Stream</command></term>
 361           <listitem>
 362             <para>
 363               This menu item is the same as the Analyze menu item of the
 364               same name. It allows you to view all the data on a TCP stream
 365               between a pair of nodes.
 366             </para>
 367           </listitem>
 368         </varlistentry>
 369         <varlistentry><term><command>Decode As...</command></term>
 370           <listitem>
 371             <para>
 372               This menu item is the same as the Analyze menu item of the
 373               same name.
 374             </para>
 375           </listitem>
 376         </varlistentry>
 377         <varlistentry><term><command>Display Filters...</command></term>
 378           <listitem>
 379             <para>
 380               This menu item is the same as the Analyze menu item of the same
 381               name.  It allows you to specify and manage filters.
 382             </para>
 383           </listitem>
 384         </varlistentry>
 385         <varlistentry><term><command>Resolve Name</command></term>
 386           <listitem>
 387             <para>
 388               This menu item causes name resolution to be performed for
 389               the selected packet, but NOT every packet in the capture.
 390             </para>
 391           </listitem>
 392         </varlistentry>
 393         <varlistentry><term><command>Go to Corresponding Packet</command></term>
 394           <listitem>
 395             <para>
 396               If the selected field has a corresponding packet, go to it.
 397                   Corresponding packets will usually be a request/response packet pair
 398                   or such.
 399             </para>
 400           </listitem>
 401         </varlistentry>
 402         <varlistentry><term><command>Export Selected Packet Bytes...</command></term>
 403           <listitem>
 404             <para>
 405               This menu item is the same as the File menu item of the same
 406               name. It allows you to export raw packet bytes to a binary file.
 407             </para>
 408           </listitem>
 409         </varlistentry>
 410         <varlistentry><term><command>Protocol Properties...</command></term>
 411           <listitem>
 412             <para>
 413               The menu item takes you to the properties dialog and selects the
 414                   page corresponding to the protocol if there are properties
 415                   associated with the highlighted field.
 416               More information on preferences can be found in
 417               <xref linkend="ChCustGUIPrefPage"/>.
 418               </para>
 419           </listitem>
 420         </varlistentry>
 421         <varlistentry><term><command>Apply as Filter</command></term>
 422           <listitem>
 423             <para>
 424               This menu item is the same as the Analyze menu items of the same
 425               name.
 426             </para>
 427           </listitem>
 428         </varlistentry>
 429         <varlistentry><term><command>Prepare a Filter</command></term>
 430           <listitem>
 431             <para>
 432               This menu item is the same as the Analyze menu items of the same
 433               name.
 434             </para>
 435           </listitem>
 436         </varlistentry>
 437         <varlistentry><term><command>Collapse All</command></term>
 438           <listitem>
 439             <para>
 440               Ethereal keeps a list of all the protocol subtrees that are
 441               expanded, and uses it to ensure that the correct subtrees
 442               are expanded when you display a packet. This menu item
 443               collapses the tree view of all packets in the capture list.
 444             </para>
 445           </listitem>
 446         </varlistentry>
 447         <varlistentry><term><command>Expand All</command></term>
 448           <listitem>
 449             <para>
 450               This menu item expands all subtrees in all packets in the
 451               capture.
 452             </para>
 453           </listitem>
 454         </varlistentry>
 455         <varlistentry><term><command>Expand Tree</command></term>
 456           <listitem>
 457             <para>
 458               This menu item expands the currently selected subtree.
 459             </para>
 460           </listitem>
 461         </varlistentry>
 462       </variablelist>
 463     </para>
 464     <para>
 465       <figure id="ChWorkPacketBytesPanePopUpMenu">
 466         <title>Pop-up menu of "Packet Bytes" pane</title>
 467         <graphic entityref="EtherealBytesPanePopupMenu" format="PNG"/>
 468       </figure>
 469       <variablelist>
 470         <varlistentry><term><command>Follow TCP Stream</command></term>
 471           <listitem>
 472             <para>
 473               This menu item is the same as the Analyze menu item of the
 474               same name. It allows you to view all the data on a TCP stream
 475               between a pair of nodes.
 476             </para>
 477           </listitem>
 478         </varlistentry>
 479         <varlistentry><term><command>Decode As...</command></term>
 480           <listitem>
 481             <para>
 482               This menu item is the same as the Analyze menu item of the
 483               same name.
 484             </para>
 485           </listitem>
 486         </varlistentry>
 487         <varlistentry><term><command>Display Filters...</command></term>
 488           <listitem>
 489             <para>
 490               This menu item is the same as the Analyze menu item of the same
 491               name.  It allows you to specify and manage filters.
 492             </para>
 493           </listitem>
 494         </varlistentry>
 495         <varlistentry><term><command>Export Selected Packet Bytes...</command></term>
 496           <listitem>
 497             <para>
 498               This menu item is the same as the File menu item of the same
 499               name. It allows you to export raw packet bytes to a binary file.
 500             </para>
 501           </listitem>
 502         </varlistentry>
 503       </variablelist>
 504     </para>
 505   </section>
 506
 507   <section id="ChWorkDisplayFilterSection"><title>Filtering packets while viewing</title>
 508     <para>
 509       Ethereal has two filtering languages: One used when capturing
 510       packets, and one used when displaying packets.  In this section we
 511       explore that second type of filter: Display filters.  The first one
 512       has already been dealt with in <xref linkend="ChCapCaptureFilterSection"/>.
 513     </para>
 514     <para>
 515       Display filters allow you to concentrate on the packets you are
 516       interested in.  They allow you to select packets by:
 517         <itemizedlist>
 518           <listitem><para>Protocol</para></listitem>
 519           <listitem><para>The presence of a field</para></listitem>
 520           <listitem><para>The values of fields</para></listitem>
 521           <listitem><para>A comparison between fields</para></listitem>
 522           <listitem><para>... and a lot more!</para></listitem>
 523       </itemizedlist>
 524     </para>
 525     <para>
 526       To select packets based on protocol type, simply type the protocol you
 527       are interested in in the <command>Filter:</command> field in the filter
 528           toolbar of the Ethereal window and press enter to initiate
 529       the filter. <xref linkend="ChWorkTCPFilter"/> shows an example of what
 530         happens when you type <command>tcp</command> in the filter field.
 531     </para>
 532     <note>
 533       <title>Note!</title>
 534       <para>
 535         All protocol and field names are entered in lowercase.  Also, don't
 536         forget to press enter after entering the filter expression.
 537       </para>
 538     </note>
 539     <figure id="ChWorkTCPFilter"><title>Filtering on the TCP protocol</title>
 540       <graphic entityref="EtherealFilterTCP" format="JPG"/>
 541     </figure>
 542     <para>
 543         As you might have noticed, only packets of the TCP protocol are displayed
 544         now (e.g. packets 1-10 are hidden). The packet numbering will remain as
 545         before, so the first packet shown is now packet number 11.
 546     </para>
 547     <note>
 548       <title>Note!</title>
 549       <para>
 550           When using a display filter, all packets remain in the capture file.
 551           The display filter only changes the display of the capture file and
 552           not its content!
 553       </para>
 554     </note>
 555     <para>
 556       You can filter on any protocol that Ethereal understands.
 557       You can also filter on any field that a dissector adds to the tree
 558       view, but only if the dissector has added an abbreviation for the
 559       field. A list of such fields is available in the Ethereal in the
 560       <command>Add Expression...</command> dialog box.  You can find more
 561       information on the <command>Add Expression...</command> dialog box
 562       in <xref linkend="ChWorkFilterAddExpressionSection"/>.
 563     </para>
 564     <para>
 565       For example, to narrow the packet list pane down to only those
 566       packets to or from the IP address 192.168.0.1, use
 567       <command>ip.addr==192.168.0.1</command>.
 568     </para>
 569     <note>
 570       <title>Note!</title>
 571       <para>
 572         To remove the filter, click on the <command>Clear</command> button
 573         to the right of the filter field.
 574       </para>
 575     </note>
 576     </section>
 577
 578     <section id="ChWorkBuildDisplayFilterSection">
 579       <title>Building display filter expressions</title>
 580       <para>
 581         Ethereal provides a simple but powerful display filter language that you
 582         can build quite complex filter expressions with.  You can compare
 583         values in packets as well as combine expressions into more
 584         specific expressions.  The following sections provide more
 585         information on doing this.
 586       </para>
 587       <section>
 588         <title>Display filter fields</title>
 589         <para>
 590         Every field in the packet details pane can be used as a filter
 591         string, this will result in showing only the packets where this field
 592         exists. For example: the
 593         filter string: <command>tcp</command> will show all packets containing the
 594         tcp protocol.
 595         </para>
 596         <para>
 597         There is a complete list of all filter fields available
 598         through the menu item "Help/Supported Protocols" in the page "Display Filter
 599         Fields" of the upcoming dialog.
 600         </para>
 601         <para>
 602         XXX - add some more info here and a link to the statusbar info.
 603         </para>
 604       </section>
 605       <section>
 606         <title>Comparing values</title>
 607         <para>
 608           You can build display filters that compare values using a number
 609           of different comparison operators.  They are shown in
 610           <xref linkend="DispCompOps"/>.
 611         </para>
 612         <tip><title></title>
 613         <para>
 614         You can use English and C-like terms in the same way, they can even be
 615         mixed in a filter string!
 616         </para>
 617         </tip>
 618         <table id="DispCompOps">
 619           <title>Display Filter comparison operators</title>
 620           <tgroup cols="3">
 621                 <colspec colnum="1" colwidth="50pt"/>
 622                 <colspec colnum="2" colwidth="50pt"/>
 623             <thead>
 624               <row>
 625                 <entry>English</entry>
 626                 <entry>C-like</entry>
 627                 <entry>Description and example</entry>
 628               </row>
 629             </thead>
 630             <tbody>
 631               <row>
 632                 <entry>eq</entry>
 633                 <entry><programlisting>==</programlisting></entry>
 634                 <entry><para>
 635                     <command>Equal</command></para><para>
 636                     <programlisting>ip.addr==10.0.0.5</programlisting>
 637                   </para></entry>
 638               </row>
 639               <row>
 640                 <entry>ne</entry>
 641                 <entry><programlisting>!=</programlisting></entry>
 642                 <entry><para>
 643                     <command>Not equal</command></para><para>
 644                     <programlisting>ip.addr!=10.0.0.5</programlisting>
 645                   </para></entry>
 646               </row>
 647               <row>
 648                 <entry>gt</entry>
 649                 <entry><programlisting>&gt;</programlisting></entry>
 650                 <entry><para>
 651                     <command>Greater than</command></para><para>
 652                     <programlisting>frame.pkt_len &gt; 10</programlisting>
 653                   </para></entry>
 654               </row>
 655               <row>
 656                 <entry>lt</entry>
 657                 <entry><programlisting>&lt;</programlisting></entry>
 658                 <entry><para><command>Less than</command></para><para>
 659                     <programlisting>frame.pkt_len &lt; 128</programlisting>
 660                   </para></entry>
 661               </row>
 662               <row>
 663                 <entry>ge</entry>
 664                 <entry><programlisting>&gt;=</programlisting></entry>
 665                 <entry><para>
 666                     <command>Greater than or equal to</command></para><para>
 667                     <programlisting>frame.pkt_len ge 0x100</programlisting>
 668                   </para></entry>
 669               </row>
 670               <row>
 671                 <entry>le</entry>
 672                 <entry><programlisting>&lt;=</programlisting></entry>
 673                 <entry><para>
 674                     <command>Less than or equal to</command></para><para>
 675                     <programlisting>frame.pkt_len &lt;= 0x20</programlisting>
 676                   </para></entry>
 677               </row>
 678             </tbody>
 679           </tgroup>
 680         </table>
 681         <para>
 682           In addition, all protocol fields are typed.
 683           <xref linkend="ChWorkFieldTypes"/> provides a list of the types and
 684             example of how to express them.
 685             <table id="ChWorkFieldTypes">
 686               <title>Display Filter Field Types</title>
 687               <tgroup cols="2">
 688                 <thead>
 689                   <row>
 690                     <entry>Type</entry>
 691                     <entry>Example</entry>
 692                   </row>
 693                 </thead>
 694                 <tbody>
 695                   <row>
 696                     <entry>
 697                       Unsigned integer (8-bit, 16-bit, 24-bit, 32-bit)
 698                     </entry>
 699                     <entry><para>
 700                         You can express integers in decimal, octal, or
 701                         hexadecimal. The following display filters are
 702                         equivalent:
 703                         <programlisting>
 704 ip.len le 1500
 705 ip.len le 02734
 706 ip.len le 0x436
 707                         </programlisting>
 708                       </para></entry>
 709                   </row>
 710                   <row>
 711                     <entry>
 712                       Signed integer (8-bit, 16-bit, 24-bit, 32-bit)
 713                     </entry>
 714                     <entry></entry>
 715                   </row>
 716                   <row>
 717                     <entry>Boolean</entry>
 718                     <entry><para>
 719                         A boolean field is present in the protocol decode
 720                         only if its value is true. For example,
 721                         <command>tcp.flags.syn</command> is present, and
 722                         thus true, only if the SYN flag is present in a
 723                         TCP segment header.</para><para>
 724                         Thus the filter expression
 725                         <command>tcp.flags.syn</command> will select only
 726                         those packets for which this flag exists, that is,
 727                         TCP segments where the segment header contains the
 728                         SYN flag. Similarly, to find source-routed token
 729                         ring packets, use a filter expression of
 730                         <command>tr.sr</command>.
 731                       </para></entry>
 732                   </row>
 733                   <row>
 734                     <entry>Ethernet address (6 bytes)</entry>
 735                     <entry>eth.addr == ff:ff:ff:ff:ff:ff</entry>
 736                   </row>
 737                   <row>
 738                     <entry>IPv4 address</entry>
 739                     <entry>ip.addr == 192.168.0.1</entry>
 740                   </row>
 741                   <row>
 742                     <entry>IPv6 address</entry>
 743                     <entry>  </entry>
 744                   </row>
 745                   <row>
 746                     <entry>IPX network number</entry>
 747                     <entry>  </entry>
 748                   </row>
 749                   <row>
 750                     <entry>String (text)</entry>
 751                     <entry> </entry>
 752                   </row>
 753                   <row>
 754                     <entry>
 755                       Double-precision floating point number
 756                     </entry>
 757                     <entry>  </entry>
 758                   </row>
 759                 </tbody>
 760               </tgroup>
 761             </table>
 762         </para>
 763       </section>
 764       <section>
 765         <title>Combining expressions</title>
 766         <para>
 767           You can combine filter expressions in Ethereal using the
 768           logical operators shown in <xref linkend="FiltLogOps"/>
 769         </para>
 770         <table id="FiltLogOps">
 771           <title>Display Filter Logical Operations</title>
 772           <tgroup cols="3">
 773                 <colspec colnum="1" colwidth="50pt"/>
 774                 <colspec colnum="2" colwidth="50pt"/>
 775             <thead>
 776               <row>
 777                 <entry>English</entry>
 778                 <entry>C-like</entry>
 779                 <entry>Description and example</entry>
 780               </row>
 781             </thead>
 782             <tbody>
 783               <row>
 784                 <entry>and</entry>
 785                 <entry>&amp;&amp;</entry>
 786                 <entry><para>
 787                     <command>Logical AND</command></para><para>
 788                     <programlisting>ip.addr==10.0.0.5 and tcp.flags.fin</programlisting>
 789                   </para></entry>
 790               </row>
 791               <row>
 792                 <entry>or</entry>
 793                 <entry>||</entry>
 794                 <entry><para>
 795                     <command>Logical OR</command></para><para>
 796                     <programlisting>ip.addr==10.0.0.5 or ip.addr==192.1.1.1</programlisting>
 797                   </para></entry>
 798               </row>
 799               <row>
 800                 <entry>xor</entry>
 801                 <entry>^^</entry>
 802                 <entry><para>
 803                     <command>Logical XOR</command></para><para>
 804                     <programlisting>tr.dst[0:3] == 0.6.29 xor tr.src[0:3] == 0.6.29</programlisting>
 805                   </para></entry>
 806               </row>
 807               <row>
 808                 <entry>not</entry>
 809                 <entry>!</entry>
 810                 <entry><para>
 811                     <command>Logical NOT</command></para><para>
 812                     <programlisting>not llc</programlisting>
 813                   </para></entry>
 814               </row>
 815               <row>
 816                 <entry>[...]</entry>
 817                 <entry></entry>
 818                 <entry><para>
 819                     <command>Substring Operator</command></para><para>
 820                     Ethereal allows you to select subsequences of a
 821                     sequence in rather elaborate ways.  After a label you
 822                     can place a pair of brackes [] containing a comma
 823                     separated list of range specifiers. </para><para>
 824                     <programlisting>eth.src[0:3] == 00:00:83</programlisting></para><para>
 825                     The example above uses the n:m format to specify a
 826                     single range.  In this case n is the beginning offset
 827                     and m is the length of the range
 828                     being specified.</para><para>
 829                     <programlisting>
 830 eth.src[1-2] == 00:83
 831                     </programlisting></para><para>
 832                     The example above uses the n-m format to specify a
 833                     single range. In this case n is the beginning offset
 834                     and m is the ending offset. </para><para>
 835                     <programlisting>eth.src[:4] == 00:00:83:00</programlisting></para><para>
 836                     The example above uses the :m format, which takes
 837                     everything from the beginning of a sequence to offset m.
 838                     It is equivalent to 0:m</para><para>
 839                     <programlisting>eth.src[4:] == 20:20</programlisting></para><para>
 840                     The example above uses the n: format, which takes
 841                     everything from offset n to the end of the
 842                     sequence. </para><para>
 843                     <programlisting>eth.src[2] == 83</programlisting></para><para>
 844                     The example above uses the n format to specify a
 845                     single range.  In this case the element in the
 846                     sequence at offset n is selected.  This is equivalent
 847                     to n:1.</para><para>
 848                     <programlisting>eth.src[0:3,1-2,:4,4:,2] ==
 849 00:00:83:00:83:00:00:83:00:20:20:83</programlisting></para><para>
 850                     Ethereal allows you to string together single ranges
 851                     in a comma separated list to form compound ranges as
 852                     shown above.
 853                   </para></entry>
 854               </row>
 855             </tbody>
 856           </tgroup>
 857         </table>
 858       </section>
 859       <section><title>A common mistake</title>
 860           <para>
 861           Often people use a filter string to display something like
 862           <command>ip.addr == 1.2.3.4</command> which will display all packets
 863           containing the IP address 1.2.3.4.
 864           </para>
 865           <para>
 866           Then they use <command>ip.addr != 1.2.3.4</command> to see all packets
 867           not containing the IP address 1.2.3.4 in it. Unfortunately, this does
 868           <command>not</command> do the expected.
 869           </para>
 870           <para>
 871         Instead, that expression will even be true for packets where either
 872         source or destination IP address equals 1.2.3.4. The reason for this,
 873         is that the expression <command>ip.addr != 1.2.3.4</command> must be read as "the
 874         packet contains a field named ip.addr with a value
 875         different from 1.2.3.4". As an IP datagram contains both a source and
 876         a destination address, the expression will evaluate to true whenever
 877         at least one of the two addresses differs from 1.2.3.4.
 878           </para>
 879           <para>
 880         If you want to
 881         filter out all packets containing IP datagrams to or from IP address
 882         1.2.3.4, then the correct filter is <command>!(ip.addr == 1.2.3.4)</command> as it
 883         reads "show me all the packets for which it is not true
 884         that a field named ip.addr exists with a value of 1.2.3.4", or in
 885         other words, "filter out all packets for which there are
 886         no occurrences of a field named ip.addr with the value 1.2.3.4".
 887           </para>
 888       </section>
 889   </section>
 890
 891   <section id="ChWorkFilterAddExpressionSection">
 892   <title>The "Filter Expression" dialog box</title>
 893     <para>
 894       When you are accustomed to Ethereal's filtering system and know what
 895       labels you wish to use in your filters it can be very quick to
 896       simply type a filter string.  However if you are new to Ethereal or
 897       are working with a slightly unfamiliar protocol it can be very
 898       confusing to try to figure out what to type.  The Filter Expression
 899       dialog box helps with this.
 900     </para>
 901     <tip><title>Tip!</title>
 902         <para>
 903       The "Filter Expression" dialog box is an excellent way to learn how to
 904           write Ethereal display filter strings.
 905         </para>
 906     </tip>
 907     <figure id="ChWorkFilterAddExpression1">
 908       <title>The "Filter Expression" dialog box</title>
 909       <graphic entityref="EtherealFilterAddExpression" format="PNG"/>
 910     </figure>
 911     <para>
 912       When you first bring up the Filter Expression dialog box you are shown a
 913       tree list of field names, organized by protocol, and a box for
 914       selecting a relation.
 915     </para>
 916     <variablelist>
 917       <varlistentry><term><command>Field Name</command></term>
 918         <listitem>
 919           <para>
 920             Select a protocol field from the protocol field tree.
 921             Every protocol with filterable fields is listed at the
 922             top level.  By clicking on the "+" next to a protocol name
 923             you can get a list of the field names available for filtering
 924             for that protocol.
 925           </para>
 926         </listitem>
 927       </varlistentry>
 928       <varlistentry><term><command>Relation</command></term>
 929         <listitem>
 930           <para>
 931             Select a relation from the list of available relation.
 932             The <command>is present</command> is a unary relation which
 933             is true if the selected field is present in a packet.  All
 934             other listed relations are binary relations which require additional
 935             data (e.g. a <command>Value</command> to match) to complete.
 936           </para>
 937         </listitem>
 938       </varlistentry>
 939     </variablelist>
 940     <para>
 941       When you select a field from the field name list and select a
 942       binary relation (such as the equality relation ==) you will be
 943       given the opportunity to enter a value, and possibly some range
 944       information.
 945     </para>
 946     <variablelist>
 947       <varlistentry><term><command>Value</command></term>
 948         <listitem>
 949           <para>
 950             You may enter an appropriate value in the
 951             <command>Value</command> text box.  The <command>Value</command>
 952             will also indicate the type of value for the
 953             <command>field name</command> you have selected (like
 954             character string).
 955           </para>
 956         </listitem>
 957       </varlistentry>
 958       <varlistentry><term><command>Predefined values</command></term>
 959         <listitem>
 960           <para>
 961           Some of the protocol fields have predefined values available, much like
 962           enum's in C. If the selected protocol field has such values defined, you
 963           can choose it here.
 964           </para>
 965         </listitem>
 966       </varlistentry>
 967       <varlistentry><term><command>Range</command></term>
 968         <listitem>
 969           <para>
 970           XXX - add an explanation here!
 971           </para>
 972         </listitem>
 973       </varlistentry>
 974       <varlistentry><term><command>OK</command></term>
 975         <listitem>
 976           <para>
 977             When you have built a satisfactory expression click
 978             <command>OK</command> and a filter string will be
 979             built for you.
 980           </para>
 981         </listitem>
 982       </varlistentry>
 983       <varlistentry><term><command>Cancel</command></term>
 984         <listitem>
 985           <para>
 986             You can leave the <command>Add Expression...</command> dialog
 987             box without any effect by clicking the <command>Cancel</command>
 988           </para>
 989         </listitem>
 990       </varlistentry>
 991     </variablelist>
 992   </section>
 993
 994   <section id="ChWorkDefineFilterSection"><title>Defining and saving filters</title>
 995     <para>
 996       You can define filters with Ethereal and give them labels for
 997       later use.  This can save time in remembering and retyping some of
 998       the more complex filters you use.
 999     </para>
1000     <para>
1001       To define a new filter or edit an existing filter, select the
1002       <command>Capture Filters...</command> menu item from the Capture menu
1003           or the <command>Display Filters...</command> menu item from the Analyze
1004           menu. Ethereal will then pop up the Filters dialog as shown in
1005           <xref linkend="FiltersDialog"/>.
1006     </para>
1007         <note>
1008           <title>Note!</title>
1009           <para>
1010                 The mechanisms for defining and saving capture filters and display
1011                 filters are almost identical. So both will be described here,
1012                 differences between these two will be marked as such.
1013           </para>
1014         </note>
1015         <warning><title>Warning!</title>
1016         <para>
1017         You must use <command>Save</command> to save your filters permanently.
1018         <command>Ok</command> or <command>Apply</command> will not save the filters,
1019         so they will be lost when you close Ethereal.
1020         </para>
1021         </warning>
1022     <figure id="FiltersDialog">
1023       <title>The "Capture Filters" and "Display Filters" dialog boxes</title>
1024       <graphic entityref="EtherealFilters" format="PNG"/>
1025     </figure>
1026     <para>
1027       <variablelist>
1028         <varlistentry><term><command>New</command></term>
1029           <listitem>
1030             <para>
1031               This button adds a new filter to the list of filters. The currently
1032                   entered values from Filter name and Filter string will be used. If
1033                   any of these fields are empty, it will be set to "new".
1034             </para>
1035           </listitem>
1036         </varlistentry>
1037         <varlistentry><term><command>Delete</command></term>
1038           <listitem>
1039           <para>
1040           This button deletes the selected filter. It will be greyed out, if no
1041           filter is selected.
1042           </para>
1043           </listitem>
1044         </varlistentry>
1045         <varlistentry><term><command>Filter</command></term>
1046           <listitem>
1047             <para>
1048                 You can select a filter from this list (which will fill in the
1049                 filter name and filter string in the fields down the bottom of the
1050                 dialog box).
1051             </para>
1052           </listitem>
1053         </varlistentry>
1054         <varlistentry><term><command>Filter name:</command></term>
1055           <listitem>
1056             <para>
1057                 You can change the name of the currently selected filter here.
1058             </para>
1059                 <note><title>Note!</title>
1060                 <para>
1061                 The filter name will only be used in this dialog to identify the
1062                 filter for your convenience, it will not be used elsewhere. You can
1063                 add multiple filters with the same name, but this is not very useful.
1064                 </para>
1065                 </note>
1066           </listitem>
1067         </varlistentry>
1068         <varlistentry><term><command>Filter string:</command></term>
1069           <listitem>
1070             <para>
1071                 You can change the filter string of the currently selected filter here.
1072                 Display Filter only: the string will be syntax checked while you are
1073                 typing.
1074             </para>
1075           </listitem>
1076         </varlistentry>
1077         <varlistentry><term><command>Add Expression...</command></term>
1078           <listitem>
1079             <para>
1080               Display Filter only: This button brings up the Add Expression
1081                   dialog box which assists in building filter strings.  You can find
1082                   more information about the Add Expression dialog in
1083               <xref linkend="ChWorkFilterAddExpressionSection"/>
1084             </para>
1085           </listitem>
1086         </varlistentry>
1087         <varlistentry><term><command>OK</command></term>
1088           <listitem>
1089             <para>
1090               Display Filter only: This button applies the selected filter to the
1091                   current display and closes the dialog.
1092             </para>
1093           </listitem>
1094         </varlistentry>
1095         <varlistentry><term><command>Apply</command></term>
1096           <listitem>
1097             <para>
1098               Display Filter only: This button applies the selected filter to the
1099                   current display, and keeps the dialog open.
1100             </para>
1101           </listitem>
1102         </varlistentry>
1103         <varlistentry><term><command>Save</command></term>
1104           <listitem>
1105             <para>
1106               Save the current settings in this dialog. The file location and
1107                   format is explained in <xref linkend="AppFiles"/>.
1108             </para>
1109           </listitem>
1110         </varlistentry>
1111         <varlistentry><term><command>Close</command></term>
1112           <listitem>
1113             <para>
1114               Close this dialog. This will discard unsaved settings.
1115             </para>
1116           </listitem>
1117         </varlistentry>
1118       </variablelist>
1119     </para>
1120   </section>
1121
1122   <section id="ChWorkFindPacketSection"><title>Finding packets</title>
1123     <para>
1124       You can easily find packets once you have captured some packets or
1125       have read in a previously saved capture file. Simply select the
1126       <command>Find Packet...</command> menu item from the
1127       <command>Edit</command> menu.  Ethereal will pop up the dialog box
1128       shown in <xref linkend="ChWorkFindPacketDialog"/>.
1129     </para>
1130         <section><title>The "Find Packet" dialog box</title>
1131     <figure id="ChWorkFindPacketDialog">
1132       <title>The "Find Packet" dialog box</title>
1133       <graphic entityref="EtherealFindPacket" format="PNG"/>
1134     </figure>
1135     <para>
1136         You might first select the kind of thing to search for:
1137         <itemizedlist>
1138                 <listitem>
1139                         <para>
1140                 <command>Display filter</command>
1141                         </para>
1142                         <para>
1143                         Simply enter a display filter string into the
1144                         <command>Filter:</command> field, select a direction, and click on OK.
1145                         </para>
1146                         <para>
1147                         For example, to find the three way handshake for a connection from
1148                         host 192.168.0.1, use the following filter string:
1149                         <programlisting>ip.addr==192.168.0.1 and tcp.flags.syn</programlisting>
1150                         For more details on display filters, see <xref linkend="ChWorkDisplayFilterSection"/>
1151                         </para>
1152                 </listitem>
1153                 <listitem>
1154                         <para>
1155                 <command>Hex Value</command>
1156                         </para>
1157                         <para>
1158                         Search for a specific byte sequence in the packet data.
1159                         </para>
1160                         <para>
1161                         For example, use "00:00" to find the next packet including two
1162                         null bytes in the packet data.
1163                         </para>
1164                 </listitem>
1165                 <listitem>
1166                         <para>
1167                 <command>String</command>
1168                         </para>
1169                         <para>
1170                         Find a string in the packet data, with various options.
1171                         </para>
1172                 </listitem>
1173         </itemizedlist>
1174     </para>
1175     <para>
1176         The value to be found will by syntax checked while you type it in. If the
1177         syntax check of your value succeeded, the background of the entry field
1178         will turn green, if it fails, it will turn red.
1179         </para>
1180     <para>
1181         You can choose the direction to be searched for:
1182         <itemizedlist>
1183                 <listitem>
1184                 <para><command>Up</command></para>
1185                         <para>Search upwards in the packet list (decreasing packet numbers).</para>
1186                 </listitem>
1187         </itemizedlist>
1188         <itemizedlist>
1189                 <listitem>
1190                 <para><command>Down</command></para>
1191                         <para>Search downwards in the packet list (increasing packet numbers).</para>
1192                 </listitem>
1193         </itemizedlist>
1194         </para>
1195   </section>
1196   <section><title>The "Find Next" command</title>
1197     <para>
1198         "Find Next" will continue searching with the same options like in the last
1199         "Find Packet" run.
1200         </para>
1201   </section>
1202   <section><title>The "Find Previous" command</title>
1203     <para>
1204         "Find Previous" will do the same thing as "Find Next", but with reverse
1205         search direction.
1206         </para>
1207   </section>
1208   </section>
1209
1210   <section id="ChWorkGoToPacketSection"><title>Go to a specific packet</title>
1211   <para>
1212   You can easily jump to specific packets with one of the menu items in the
1213   Go menu.
1214   </para>
1215   <section><title>The "Go to Packet" dialog box</title>
1216     <figure id="ChWorkGoToPacketDialog">
1217       <title>The "Go To Packet" dialog box</title>
1218       <graphic entityref="EtherealGoToPacket" format="PNG"/>
1219     </figure>
1220     <para>
1221         This dialog box will let you enter a packet number. When you press
1222         <command>OK</command>, Ethereal will jump to that packet.
1223         </para>
1224   </section>
1225   <section><title>The "Go to Corresponding Packet" command</title>
1226     <para>
1227         If a protocol field is selected, which points to another packet in the
1228         capture file, this command will jump to that packet.
1229         </para>
1230     <note><title>Note!</title>
1231     <para>
1232         As these protocol fields now work like links (just as in your
1233         Web browser), it's easier simply to double-click on the field to jump
1234         to the corresponding field.
1235     </para>
1236     </note>
1237   </section>
1238   <section><title>The "Go to First Packet" command</title>
1239     <para>
1240         This command will simply jump to the first packet displayed.
1241         </para>
1242   </section>
1243   <section><title>The "Go to Last Packet" command</title>
1244     <para>
1245         This command will simply jump to the last packet displayed.
1246         </para>
1247   </section>
1248   </section>
1249
1250   <section id="ChWorkMarkPacketSection"><title>Marking packets</title>
1251     <para>
1252         You can mark packets in the "Packet List" pane. A marked packet will
1253         be shown with black background, regardless of the coloring rules set.
1254         Marking a packet can be useful to find it later while analyzing in a large
1255         capture file.
1256     </para>
1257     <warning><title>Warning!</title>
1258     <para>
1259         The packet marks are not stored in the capture file or anywhere else,
1260         so all packet marks will be lost if you close the capture file.
1261     </para>
1262     </warning>
1263     <para>
1264         You can use packet marking to control the output of packets when
1265         saving/exporting/printing. To do so, an option in the packet range is
1266         available, see <xref linkend="ChIOPacketRangeSection"/>.
1267     </para>
1268     <para>
1269         There are three functions to manipulate the marked state of a packet:
1270         <itemizedlist>
1271                 <listitem>
1272                 <para>
1273                         <command>Mark packet</command> toggle the marked state of a single packet.
1274                 </para>
1275                 </listitem>
1276                 <listitem>
1277                 <para>
1278                         <command>Mark all packets</command> set the mark state of all packets.
1279                 </para>
1280                 </listitem>
1281                 <listitem>
1282                 <para>
1283                         <command>Unmark all packets</command> reset the mark state of all packets.
1284                 </para>
1285                 </listitem>
1286         </itemizedlist>
1287         These mark function are available from the "Edit" menu, and the "Mark packet"
1288         function is also available from the pop-up menu of the "Packet List" pane.
1289     </para>
1290   </section>
1291
1292   <section id="ChWorkTimeFormatsSection"><title>Time display formats and time
1293   references</title>
1294         <para>
1295         While packets are captured, each packet is timestamped. These timestamps
1296         will be saved to the capture file, so they will be available for later
1297         analysis.
1298         </para>
1299         <para>
1300         When the packets are displayed, the presentation of these timestamps can
1301         be chosen by the user. There are four presentation formats available:
1302         <itemizedlist>
1303         <listitem><para><command>Time of Day</command>, e.g. 20:02:48.863096
1304                 The absolute time of the day when the packet was captured.</para>
1305         </listitem>
1306         <listitem><para><command>Date and Time of Day</command>, e.g. 2004-06-22 20:02:48.863096
1307                 The absolute date and time of the day when the packet was captured.</para>
1308         </listitem>
1309         <listitem><para><command>Seconds Since Beginning of Capture</command>, e.g. 123.299139
1310                 The time relative to the start of the capture file or the first
1311                 "Time Reference" before this packet (see <xref
1312                 linkend="ChWorkTimeReferencePacketSection"/>).</para>
1313         </listitem>
1314         <listitem><para><command>Seconds Since Previous Packet</command>, e.g. 1.162423
1315                 The time relative to the previous packet.</para>
1316         </listitem>
1317         </itemizedlist>
1318         The time format can be selected from the View menu, see
1319         <xref linkend="ChUseEtherealViewMenu"/>.
1320         </para>
1321         <para>
1322         XXX - how is the GMT / localtime thing handled.
1323         </para>
1324   <section id="ChWorkTimeReferencePacketSection">
1325   <title>Packet time referencing</title>
1326     <para>
1327         The user can set time references to packets. A time reference is the
1328         starting point for all subsequent packet time calculations. It will be
1329         useful, if you want to see the time values relative to a special packet,
1330         e.g. the start of a new request. It's possible to set multiple time
1331         references in the capture file.
1332     </para>
1333     <warning><title>Warning!</title>
1334     <para>
1335         The time references will not be saved permanently and will be lost when
1336         you close the capture file.
1337         </para>
1338     </warning>
1339     <note><title>Note!</title>
1340     <para>
1341         Time referencing will only be useful, if the time display format is set to
1342         "Seconds Since Beginning of Capture". If one of the other time display
1343         formats are used, time referencing will have no effect (and will make no
1344         sense either).
1345         </para>
1346     </note>
1347     <para>
1348         To work with time references, choose one of the "Time Reference" items
1349         in the "Edit" menu , see <xref linkend="ChUseEditMenuSection"/>, or from
1350         the pop-up menu of the "Packet List" pane.
1351         </para>
1352         <itemizedlist>
1353         <listitem><para><command>Set Time Reference (toggle)</command>
1354                 Toggles the time reference state of the currently selected
1355                 packet to on or off.</para>
1356         </listitem>
1357         <listitem><para><command>Find Next</command>
1358                 Find the next time referenced packet in the "Packet List" pane.
1359                 </para>
1360         </listitem>
1361         <listitem><para><command>Find Previous</command>
1362                 Find the previous time referenced packet in the "Packet List"
1363                 pane.
1364                 </para>
1365         </listitem>
1366         </itemizedlist>
1367     <para>
1368     <figure id="ChWorkTimeReference">
1369       <title>Ethereal showing a time referenced packet</title>
1370       <graphic entityref="EtherealTimeReference" format="PNG"/>
1371     </figure>
1372         </para>
1373         <para>
1374         A time referenced packet will be marked with the string *REF* in the Time
1375         column (see packet number 10). All subsequent packets will show the time
1376         since the last time reference.
1377         </para>
1378   </section>
1379   </section>
1380
1381 </chapter>
1382 <!-- End of EUG Chapter Work -->
1383