docbook/wsug_src/WSUG_chapter_use.xml

   1 <!-- WSUG Chapter Three -->
   2 <!-- $Id$ -->
   3
   4 <chapter id="ChapterUsing">
   5   <title>User Interface</title>
   6   <section id="ChUseIntroductionSection"><title>Introduction</title>
   7     <para>
   8       By now you have installed <application>Wireshark</application> and
   9       are most likely keen to get started capturing your first packets.  In
  10       the next chapters we will explore:
  11       <itemizedlist>
  12         <listitem>
  13           <para>
  14             How the Wireshark user interface works
  15           </para>
  16         </listitem>
  17         <listitem>
  18           <para>
  19             How to capture packets in <application>Wireshark</application>
  20           </para>
  21         </listitem>
  22         <listitem>
  23           <para>
  24             How to view packets in <application>Wireshark</application>
  25           </para>
  26         </listitem>
  27         <listitem>
  28           <para>
  29             How to filter packets in <application>Wireshark</application>
  30           </para>
  31         </listitem>
  32         <listitem>
  33           <para>
  34             ... and many other things!
  35           </para>
  36         </listitem>
  37       </itemizedlist>
  38     </para>
  39   </section>
  40
  41   <section id="ChUseStartSection"><title>Start Wireshark</title>
  42     <para>
  43         You can start Wireshark from your shell or window manager.
  44         <tip><title>Tip!</title>
  45         <para>
  46         When starting Wireshark it's possible to specify optional settings using
  47         the     command line. See <xref linkend="ChCustCommandLine"/> for details.
  48         </para>
  49         </tip>
  50         <note><title>Note!</title>
  51         <para>
  52         In the following chapters, a lot of screenshots from Wireshark will be shown.
  53         As Wireshark runs on many different platforms with many different window
  54         managers, different styles applied and there are different versions of the
  55         underlying GUI toolkit used, your screen might look different from the provided
  56         screenshots. But as there are no real differences in functionality, these
  57         screenshots should still be well understandable.
  58         </para>
  59         </note>
  60         </para>
  61   </section>
  62
  63   <section id="ChUseMainWindowSection"><title>The Main window</title>
  64         <para>
  65       Let's look at Wireshark's user interface. <xref linkend="ChUseFig01"/> shows
  66         Wireshark as you would usually see it after some packets are captured or loaded
  67         (how to do this will be described later).
  68         <figure id="ChUseFig01">
  69           <title>The Main window</title>
  70           <graphic scale="100" entityref="WiresharkThreePane1" format="PNG"/>
  71         </figure>
  72     </para>
  73     <para>
  74       Wireshark's main window consists of parts that are commonly known from many
  75           other GUI programs.
  76       <orderedlist>
  77         <listitem>
  78           <para>
  79             The <emphasis>menu</emphasis> (see <xref linkend="ChUseMenuSection"/>)
  80                 is used to start actions.
  81           </para>
  82         </listitem>
  83         <listitem>
  84           <para>
  85             The <emphasis>main toolbar</emphasis> (see <xref linkend="ChUseMainToolbarSection"/>)
  86                 provides quick access to frequently used items from the menu.
  87           </para>
  88         </listitem>
  89         <listitem>
  90           <para>
  91             The <emphasis>filter toolbar</emphasis> (see <xref linkend="ChUseFilterToolbarSection"/>)
  92                 provides a way to directly manipulate the currently used display filter
  93                 (see <xref linkend="ChWorkDisplayFilterSection"/>).
  94           </para>
  95         </listitem>
  96         <listitem>
  97           <para>
  98             The <emphasis>packet list pane</emphasis> (see <xref linkend="ChUsePacketListPaneSection"/>)
  99                 displays a summary of each packet captured.  By clicking on packets
 100                 in this pane you control what is displayed in the other two panes.
 101           </para>
 102         </listitem>
 103         <listitem>
 104           <para>
 105             The <emphasis>packet details pane</emphasis> (see <xref linkend="ChUsePacketDetailsPaneSection"/>)
 106                 displays the packet selected in the packet list pane in more detail.
 107           </para>
 108         </listitem>
 109         <listitem>
 110           <para>
 111             The <emphasis>packet bytes pane</emphasis> (see <xref linkend="ChUsePacketBytesPaneSection"/>)
 112                 displays the data from the packet selected in the packet list pane, and
 113                 highlights the field selected in the packet details pane.
 114           </para>
 115         </listitem>
 116         <listitem>
 117           <para>
 118             The <emphasis>statusbar</emphasis> (see <xref linkend="ChUseStatusbarSection"/>)
 119                 shows some detailed information about the current program state and
 120                 the captured data.
 121           </para>
 122         </listitem>
 123       </orderedlist>
 124           <tip><title>Tip!</title>
 125           <para>
 126           The layout of the main window can be customized by changing preference settings.
 127           See <xref linkend="ChCustPreferencesSection"/> for details!
 128           </para>
 129           </tip>
 130     </para>
 131
 132
 133     <section id="ChUseMainWindowNavSection"><title>Main Window Navigation</title>
 134         <para>
 135           Packet list and detail navigation can be done entirely from the
 136           keyboard.  <xref linkend="ChUseTabNav"/> shows a list of keystrokes
 137           that will let you quickly move around a capture file.  See
 138           <xref linkend="ChUseTabGo"/> for additional navigation keystrokes.
 139         </para>
 140         <table id="ChUseTabNav" frame="none">
 141
 142         <title>Keyboard Navigation</title>
 143           <tgroup cols="2">
 144             <colspec colnum="1" colwidth="72pt"/>
 145               <thead>
 146                 <row>
 147                   <entry>Accelerator</entry>
 148                   <entry>Description</entry>
 149                 </row>
 150               </thead>
 151               <tbody>
 152                 <row>
 153                   <entry>Tab, Shift+Tab</entry>
 154                   <entry><para>
 155                       Move between screen elements, e.g. from the toolbars
 156                       to the packet list to the packet detail.
 157                     </para></entry>
 158                 </row>
 159                 <row>
 160                   <entry>Down</entry>
 161                   <entry><para>
 162                       Move to the next packet or detail item.
 163                     </para></entry>
 164                 </row>
 165                 <row>
 166                   <entry>Up</entry>
 167                   <entry><para>
 168                       Move to the previous packet or detail item.
 169                     </para></entry>
 170                 </row>
 171                 <row>
 172                   <entry>Ctrl+Down, F8</entry>
 173                   <entry><para>
 174                       Move to the next packet, even if the packet
 175                       list isn't focused.
 176                     </para></entry>
 177                 </row>
 178                 <row>
 179                   <entry>Ctrl+Up, F7</entry>
 180                   <entry><para>
 181                       Move to the previous packet, even if the packet
 182                       list isn't focused.
 183                     </para></entry>
 184                 </row>
 185                 <row>
 186                   <entry>Ctrl+.</entry>
 187                   <entry><para>
 188                       Move to the next packet of the conversation
 189                       (TCP, UDP or IP)
 190                     </para></entry>
 191                 </row>
 192                 <row>
 193                   <entry>Ctrl+,</entry>
 194                   <entry><para>
 195                       Move to the previous packet of the conversation
 196                       (TCP, UDP or IP)
 197                     </para></entry>
 198                 </row>
 199                 <row>
 200                   <entry>Left</entry>
 201                   <entry><para>
 202                       In the packet detail, closes the selected tree item.
 203                       If it's already closed, jumps to the parent node.
 204                     </para></entry>
 205                 </row>
 206                 <row>
 207                   <entry>Right</entry>
 208                   <entry><para>
 209                       In the packet detail, opens the selected tree item.
 210                     </para></entry>
 211                 </row>
 212                 <row>
 213                   <entry>Shift+Right</entry>
 214                   <entry><para>
 215                       In the packet detail, opens the selected tree item
 216                       and all of its subtrees.
 217                     </para></entry>
 218                 </row>
 219                 <row>
 220                   <entry>Ctrl+Right</entry>
 221                   <entry><para>
 222                       In the packet detail, opens all tree items.
 223                     </para></entry>
 224                 </row>
 225                 <row>
 226                   <entry>Ctrl+Left</entry>
 227                   <entry><para>
 228                       In the packet detail, closes all tree items.
 229                     </para></entry>
 230                 </row>
 231                 <row>
 232                   <entry>Backspace</entry>
 233                   <entry><para>
 234                       In the packet detail, jumps to the parent node.
 235                     </para></entry>
 236                 </row>
 237                 <row>
 238                   <entry>Return, Enter</entry>
 239                   <entry><para>
 240                       In the packet detail, toggles the selected
 241                       tree item.
 242                     </para></entry>
 243                 </row>
 244               </tbody>
 245           </tgroup>
 246         </table>
 247         <para>
 248         Additionally, typing anywhere in the main window will start filling
 249         in a display filter.
 250         </para>
 251       </section>
 252   </section>
 253
 254   <section id="ChUseMenuSection"><title>The Menu</title>
 255     <para>
 256       The Wireshark menu sits on top of the Wireshark window.
 257       An example is shown in <xref linkend="ChUseWiresharkMenu"/>.
 258     </para>
 259         <note><title>Note!</title>
 260         <para>
 261         Menu items will be greyed out if the corresponding feature isn't
 262         available. For example, you cannot save a capture file if you didn't
 263         capture or load any data before.
 264         </para>
 265         </note>
 266     <para>
 267         <figure id="ChUseWiresharkMenu"><title>The Menu</title>
 268           <graphic entityref="WiresharkMenuOnly" format="PNG"/>
 269         </figure>
 270     </para>
 271     <para>
 272       It contains the following items:
 273       <variablelist>
 274         <varlistentry><term><command>File</command></term>
 275           <listitem>
 276             <para>
 277               This menu contains items to open and merge capture files,
 278                   save / print / export capture files in whole or in part,
 279                   and to quit from Wireshark. See <xref linkend="ChUseFileMenuSection"/>.
 280             </para>
 281           </listitem>
 282         </varlistentry>
 283         <varlistentry><term><command>Edit</command></term>
 284           <listitem>
 285             <para>
 286               This menu contains items to find a packet, time reference or mark one
 287                   or more packets, handle configuration profiles, and set your preferences;
 288               (cut, copy, and paste are not presently implemented).
 289                   See <xref linkend="ChUseEditMenuSection"/>.
 290             </para>
 291           </listitem>
 292         </varlistentry>
 293         <varlistentry><term><command>View</command></term>
 294           <listitem>
 295             <para>This menu controls the display of the captured data,
 296                 including colorization of packets, zooming the font,
 297                 showing a packet in a separate window, expanding and collapsing trees in packet details, ....
 298                 See <xref linkend="ChUseViewMenuSection"/>.
 299                 </para>
 300           </listitem>
 301         </varlistentry>
 302         <varlistentry><term><command>Go</command></term>
 303           <listitem>
 304             <para>This menu contains items to go to a specific packet.
 305                 See <xref linkend="ChUseGoMenuSection"/>.
 306                 </para>
 307           </listitem>
 308         </varlistentry>
 309         <varlistentry><term><command>Capture</command></term>
 310           <listitem>
 311             <para>This menu allows you to start and stop captures and to edit capture filters.
 312                 See <xref linkend="ChUseCaptureMenuSection"/>.
 313                 </para>
 314           </listitem>
 315         </varlistentry>
 316         <varlistentry><term><command>Analyze</command></term>
 317           <listitem>
 318             <para>
 319                   This menu contains items to manipulate display filters, enable or
 320                   disable the dissection of protocols, configure user specified decodes
 321                   and follow a TCP stream.
 322                   See <xref linkend="ChUseAnalyzeMenuSection"/>.
 323             </para>
 324           </listitem>
 325         </varlistentry>
 326         <varlistentry><term><command>Statistics</command></term>
 327           <listitem>
 328             <para>
 329               This menu contains items to display various statistic windows,
 330                   including a summary of the packets that have been captured,
 331                   display protocol hierarchy statistics and much more.
 332                   See <xref linkend="ChUseStatisticsMenuSection"/>.
 333             </para>
 334           </listitem>
 335         </varlistentry>
 336         <varlistentry><term><command>Telephony</command></term>
 337           <listitem>
 338             <para>
 339               This menu contains items to display various telephony related
 340                   statistic windows, including a media analysis, flow diagrams,
 341                   display protocol hierarchy statistics and much more.
 342                   See <xref linkend="ChUseTelephonyMenuSection"/>.
 343             </para>
 344           </listitem>
 345         </varlistentry>
 346         <varlistentry><term><command>Tools</command></term>
 347           <listitem>
 348             <para>
 349               This menu contains various tools available in Wireshark, such as
 350                   creating Firewall ACL Rules.
 351                   See <xref linkend="ChUseToolsMenuSection"/>.
 352             </para>
 353           </listitem>
 354         </varlistentry>
 355         <varlistentry><term><command>Help</command></term>
 356           <listitem>
 357             <para>
 358               This menu contains items to help the user, e.g. access to some basic
 359                   help, a list of the supported protocols, manual pages, online access
 360                   to some of the webpages, and the usual about dialog.
 361                   See <xref linkend="ChUseHelpMenuSection"/>.
 362             </para>
 363           </listitem>
 364           </varlistentry>
 365         </variablelist>
 366       Each of these menu items is described in more detail in the sections
 367           that follow.
 368     </para>
 369         <tip><title>Tip!</title>
 370         <para>
 371         You can access menu items directly or by pressing the corresponding
 372         accelerator keys which are shown at the right side of the
 373         menu. For example, you can press the Control (or Strg in German) and the K
 374         keys together to open the capture dialog.
 375         </para>
 376         </tip>
 377   </section>
 378
 379   <section id="ChUseFileMenuSection"><title>The "File" menu</title>
 380     <para>
 381       The Wireshark file menu contains the fields shown in
 382       <xref linkend="ChUseTabFile"/>.
 383     </para>
 384     <figure id="ChUseWiresharkFileMenu">
 385       <title>The "File" Menu</title>
 386       <graphic entityref="WiresharkFileMenu" format="PNG"/>
 387     </figure>
 388     <table id="ChUseTabFile" frame="none"><title>File menu items</title>
 389       <tgroup cols="3">
 390         <colspec colnum="1" colwidth="72pt"/>
 391           <colspec colnum="2" colwidth="80pt"/>
 392             <thead>
 393               <row>
 394                 <entry>Menu Item</entry>
 395                 <entry>Accelerator</entry>
 396                 <entry>Description</entry>
 397               </row>
 398             </thead>
 399             <tbody>
 400               <row>
 401                 <entry><command>Open...</command></entry>
 402                 <entry>Ctrl+O</entry>
 403                 <entry><para>
 404                     This menu item brings up the file open dialog box that
 405                     allows you to load a capture file for viewing. It is
 406                     discussed in more detail in <xref linkend="ChIOOpen"/>.
 407                   </para></entry>
 408               </row>
 409               <row>
 410                 <entry><command>Open Recent</command></entry>
 411                 <entry></entry>
 412                 <entry><para>
 413                     This menu item shows a submenu containing the recently opened
 414                         capture files. Clicking on one of the submenu items will open the
 415                         corresponding capture file directly.
 416                   </para></entry>
 417               </row>
 418               <row>
 419                 <entry><command>Merge...</command></entry>
 420                 <entry></entry>
 421                 <entry><para>
 422                     This menu item brings up the merge file dialog box that
 423                     allows you to merge a capture file into the currently loaded one.
 424                         It is discussed in more detail in <xref linkend="ChIOMergeSection"/>.
 425                   </para></entry>
 426               </row>
 427               <!--<row>
 428                 <entry><command>Import...</command></entry>
 429                 <entry></entry>
 430                 <entry><para>
 431                     This menu item brings up the import file dialog box that
 432                     allows you to import a text file into a new temporary capture.
 433                         It is discussed in more detail in <xref linkend="ChIOImportSection"/>.
 434                   </para></entry>
 435               </row>-->
 436               <row>
 437                 <entry><command>Close</command></entry>
 438                 <entry>Ctrl+W</entry>
 439                 <entry><para>
 440                     This menu item closes the current capture. If you
 441                     haven't saved the capture, you will be asked to do so first
 442                          (this can be disabled by a preference setting).
 443                   </para></entry>
 444               </row>
 445               <row>
 446                 <entry><command>------</command></entry>
 447                 <entry></entry>
 448                 <entry></entry>
 449               </row>
 450               <row>
 451                 <entry><command>Save</command></entry>
 452                 <entry>Ctrl+S</entry>
 453                 <entry><para>
 454                     This menu item saves the current capture. If you
 455                     have not set a default capture file name (perhaps with
 456                     the -w &lt;capfile&gt; option), Wireshark pops up the
 457                     Save Capture File As dialog box (which is discussed
 458                     further in <xref linkend="ChIOSaveAs"/>).
 459                   </para><note>
 460                     <title>Note!</title>
 461                     <para>
 462                       If you have already saved the current capture, this
 463                       menu item will be greyed out.
 464                     </para>
 465                   </note><note>
 466                     <title>Note!</title>
 467                     <para>
 468                       You cannot save a live capture while the capture is in
 469                       progress.  You must stop the capture in order to
 470                       save.
 471                     </para>
 472                   </note></entry>
 473               </row>
 474               <row>
 475                 <entry><command>Save As...</command></entry>
 476                 <entry>Shift+Ctrl+S</entry>
 477                 <entry><para>
 478                     This menu item allows you to save the current capture
 479                     file to whatever file you would like. It pops up the
 480                     Save Capture File As dialog box (which is discussed
 481                     further in <xref linkend="ChIOSaveAs"/>).
 482                   </para></entry>
 483               </row>
 484               <row>
 485                 <entry><command>------</command></entry>
 486                 <entry></entry>
 487                 <entry></entry>
 488               </row>
 489               <row>
 490                 <entry><command>File Set > List Files</command></entry>
 491                 <entry></entry>
 492                 <entry><para>
 493                         This menu item allows you to show a list of files in a file set.
 494                         It pops up the Wireshark List File Set dialog box (which is
 495                         discussed further in <xref linkend="ChIOFileSetSection"/>).
 496                   </para></entry>
 497               </row>
 498               <row>
 499                 <entry><command>File Set > Next File</command></entry>
 500                 <entry></entry>
 501                 <entry><para>
 502                         If the currently loaded file is part of a file set, jump to the
 503                         next file in the set. If it isn't part of a file set or just the
 504                         last file in that set, this item is greyed out.
 505                   </para></entry>
 506               </row>
 507               <row>
 508                 <entry><command>File Set > Previous File</command></entry>
 509                 <entry></entry>
 510                 <entry><para>
 511                         If the currently loaded file is part of a file set, jump to the
 512                         previous file in the set. If it isn't part of a file set or just
 513                         the first file in that set, this item is greyed out.
 514                   </para></entry>
 515               </row>
 516               <row>
 517                 <entry><command>------</command></entry>
 518                 <entry></entry>
 519                 <entry></entry>
 520               </row>
 521               <row>
 522                 <entry><command>Export > File...</command></entry>
 523                 <entry></entry>
 524                 <entry><para>
 525                     This menu item allows you to export all (or some) of the packets in
 526                     the capture file to file.
 527                     It pops up the Wireshark Export dialog box (which is discussed further in
 528                     <xref linkend="ChIOExportSection"/>).
 529                   </para></entry>
 530               </row>
 531               <row>
 532                 <entry><command>Export > Selected Packet Bytes...</command></entry>
 533                 <entry>Ctrl+H</entry>
 534                 <entry><para>
 535                     This menu item allows you to export the currently selected bytes
 536                         in the packet bytes pane to a binary file. It pops up the
 537                         Wireshark Export dialog box (which is discussed further in
 538                     <xref linkend="ChIOExportSelectedDialog"/>)
 539                   </para></entry>
 540               </row>
 541               <row>
 542                 <entry><command>Export > Objects > HTTP</command></entry>
 543                 <entry></entry>
 544                 <entry><para>
 545                     This menu item allows you to export all or some of the captured HTTP objects
 546                     into local files. It pops up the Wireshark HTTP object list (which is discussed
 547                     further in <xref linkend="ChIOExportObjectsDialog"/>)
 548                 </para></entry>
 549               </row>
 550               <row>
 551                 <entry><command>Export > Objects > DICOM</command></entry>
 552                 <entry></entry>
 553                 <entry><para>
 554                     This menu item allows you to export all or some of the captured DICOM objects
 555                     into local files. It pops up the Wireshark DICOM object list (which is discussed
 556                     further in <xref linkend="ChIOExportObjectsDialog"/>)
 557                 </para></entry>
 558               </row>
 559               <row>
 560                 <entry><command>------</command></entry>
 561                 <entry></entry>
 562                 <entry></entry>
 563               </row>
 564               <row>
 565                 <entry><command>Print...</command></entry>
 566                 <entry>Ctrl+P</entry>
 567                 <entry><para>
 568                     This menu item allows you to print all (or some) of the packets in
 569                     the capture file. It pops up the Wireshark Print dialog
 570                     box (which is discussed further in
 571                     <xref linkend="ChIOPrintSection"/>).
 572                   </para></entry>
 573               </row>
 574               <row>
 575                 <entry><command>------</command></entry>
 576                 <entry></entry>
 577                 <entry></entry>
 578               </row>
 579               <row>
 580                 <entry><command>Quit</command></entry>
 581                 <entry>Ctrl+Q</entry>
 582                 <entry><para>
 583                     This menu item allows you to quit from Wireshark.
 584                         Wireshark will ask to save your capture file if you haven't previously saved
 585                         it (this can be disabled by a preference setting).
 586                   </para></entry>
 587               </row>
 588             </tbody>
 589       </tgroup>
 590     </table>
 591   </section>
 592
 593   <section id="ChUseEditMenuSection"><title>The "Edit" menu</title>
 594     <para>
 595       The Wireshark Edit menu contains the fields shown in
 596       <xref linkend="ChUseTabEdit"/>.
 597     </para>
 598     <figure id="ChUseWiresharkEditMenu">
 599       <title>The "Edit" Menu</title>
 600       <graphic entityref="WiresharkEditMenu" format="PNG"/>
 601     </figure>
 602     <table id="ChUseTabEdit" frame="none">
 603       <title>Edit menu items</title>
 604       <tgroup cols="3">
 605         <colspec colnum="1" colwidth="72pt"/>
 606           <colspec colnum="2" colwidth="80pt"/>
 607             <thead>
 608               <row>
 609                 <entry>Menu Item</entry>
 610                 <entry>Accelerator</entry>
 611                 <entry>Description</entry>
 612               </row>
 613             </thead>
 614             <tbody>
 615               <row>
 616                 <entry><command>Copy > Description</command></entry>
 617                 <entry>Shift+Ctrl+D</entry>
 618                 <entry><para>
 619                         This menu item will copy the description of the selected item
 620                         in the detail view to the clipboard.
 621                   </para></entry>
 622               </row>
 623               <row>
 624                 <entry><command>Copy > Fieldname</command></entry>
 625                 <entry>Shift+Ctrl+F</entry>
 626                 <entry><para>
 627                         This menu item will copy the fieldname of the selected item
 628                         in the detail view to the clipboard.
 629                   </para></entry>
 630               </row>
 631               <row>
 632                 <entry><command>Copy > Value</command></entry>
 633                 <entry>Shift+Ctrl+V</entry>
 634                 <entry><para>
 635                         This menu item will copy the value of the selected item
 636                         in the detail view to the clipboard.
 637                   </para></entry>
 638               </row>
 639               <row>
 640                 <entry><command>Copy > As Filter</command></entry>
 641                 <entry>Shift+Ctrl+C</entry>
 642                 <entry><para>
 643                         This menu item will use the selected item in the detail view to
 644                         create a display filter. This display filter is then copied to
 645                         the clipboard.
 646                   </para></entry>
 647               </row>
 648               <row>
 649                 <entry><command>------</command></entry>
 650                 <entry></entry>
 651                 <entry></entry>
 652               </row>
 653               <row>
 654                 <entry><command>Find Packet...</command></entry>
 655                 <entry>Ctrl+F</entry>
 656                 <entry><para>
 657                     This menu item brings up a dialog box that allows you
 658                     to find a packet by many criteria.
 659                     There is further information on finding packets in
 660                     <xref linkend="ChWorkFindPacketSection"/>.
 661                   </para></entry>
 662               </row>
 663               <row>
 664                 <entry><command>Find Next</command></entry>
 665                 <entry>Ctrl+N</entry>
 666                 <entry><para>
 667                     This menu item tries to find the next packet matching the
 668                         settings from "Find Packet...".
 669                   </para></entry>
 670               </row>
 671               <row>
 672                 <entry><command>Find Previous</command></entry>
 673                 <entry>Ctrl+B</entry>
 674                 <entry><para>
 675                     This menu item tries to find the previous packet matching the
 676                         settings from "Find Packet...".
 677                   </para></entry>
 678               </row>
 679               <row>
 680                 <entry><command>------</command></entry>
 681                 <entry></entry>
 682                 <entry></entry>
 683               </row>
 684               <row>
 685                 <entry><command>Mark Packet (toggle)</command></entry>
 686                 <entry>Ctrl+M</entry>
 687                 <entry><para>
 688                     This menu item "marks" the currently selected packet. See
 689                         <xref linkend="ChWorkMarkPacketSection"/> for details.
 690                   </para></entry>
 691               </row>
 692               <row>
 693                 <entry><command>Find Next Mark</command></entry>
 694                 <entry>Shift+Ctrl+N</entry>
 695                 <entry><para>
 696                     Find the next marked packet.
 697                   </para></entry>
 698               </row>
 699               <row>
 700                 <entry><command>Find Previous Mark</command></entry>
 701                 <entry>Shift+Ctrl+B</entry>
 702                 <entry><para>
 703                     Find the previous marked packet.
 704                   </para></entry>
 705               </row>
 706               <row>
 707                 <entry><command>Mark All Displayed Packets</command></entry>
 708                 <entry></entry>
 709                 <entry><para>
 710                     This menu item "marks" all displayed packets.
 711                   </para></entry>
 712               </row>
 713               <row>
 714                 <entry><command>Unmark All Packets</command></entry>
 715                 <entry></entry>
 716                 <entry><para>This menu item "unmarks" all marked packets.
 717                   </para></entry>
 718               </row>
 719               <row>
 720                 <entry><command>------</command></entry>
 721                 <entry></entry>
 722                 <entry></entry>
 723               </row>
 724               <row>
 725                 <entry><command>Ignore Packet (toggle)</command></entry>
 726                 <entry>Ctrl+X</entry>
 727                 <entry><para>
 728                     This menu item marks the currently selected packet as ignored.
 729                     See <xref linkend="ChWorkIgnorePacketSection"/> for details.
 730                   </para></entry>
 731               </row>
 732               <row>
 733                 <entry><command>Ignore All Displayed Packets</command></entry>
 734                 <entry>Shift-Ctrl-Alt-X</entry>
 735                 <entry><para>
 736                     This menu item marks all displayed packets as ignored.
 737                   </para></entry>
 738               </row>
 739               <row>
 740                 <entry><command>Un-Ignore All Packets</command></entry>
 741                 <entry>Shift-Ctrl-X</entry>
 742                 <entry><para>
 743                     This menu item unmarks all ignored packets.
 744                   </para></entry>
 745               </row>
 746               <row>
 747                 <entry><command>------</command></entry>
 748                 <entry></entry>
 749                 <entry></entry>
 750               </row>
 751               <row>
 752                 <entry><command>Set Time Reference (toggle)</command></entry>
 753                 <entry>Ctrl+T</entry>
 754                 <entry><para>
 755                     This menu item set a time reference on the currently selected
 756                         packet. See <xref linkend="ChWorkTimeReferencePacketSection"/> for more information
 757                       about the time referenced packets.
 758                   </para></entry>
 759               </row>
 760               <row>
 761                 <entry><command>Find Next Reference</command></entry>
 762                 <entry></entry>
 763                 <entry><para>
 764                     This menu item tries to find the next time referenced packet.
 765                   </para></entry>
 766               </row>
 767               <row>
 768                 <entry><command>Find Previous Reference</command></entry>
 769                 <entry></entry>
 770                 <entry><para>
 771                     This menu item tries to find the previous time referenced packet.
 772                   </para></entry>
 773               </row>
 774               <row>
 775                 <entry><command>------</command></entry>
 776                 <entry></entry>
 777                 <entry></entry>
 778               </row>
 779               <row>
 780                 <entry><command>Configuration Profiles...</command></entry>
 781                 <entry>Shift-Ctrl-A</entry>
 782                 <entry><para>
 783                     This menu item brings up a dialog box for handling configuration
 784                     profiles.  More detail is provided in
 785                     <xref linkend="ChCustConfigProfilesSection"/>.
 786                 </para></entry>
 787               </row>
 788               <row>
 789                 <entry><command>Preferences...</command></entry>
 790                 <entry>Shift+Ctrl+P</entry>
 791                 <entry><para>
 792                     This menu item brings up a dialog box that allows
 793                     you to set preferences for many parameters that control
 794                     Wireshark.  You can also save your preferences so Wireshark
 795                     will use them the next time you start it. More detail
 796                     is provided in <xref linkend="ChCustPreferencesSection"/>.
 797                   </para></entry>
 798               </row>
 799             </tbody>
 800       </tgroup>
 801     </table>
 802   </section>
 803
 804   <section id="ChUseViewMenuSection"><title>The "View" menu</title>
 805     <para>
 806       The Wireshark View menu contains the fields shown in
 807       <xref linkend="ChUseTabView"/>.
 808     </para>
 809     <figure id="ChUseWiresharkViewMenu">
 810       <title>The "View" Menu</title>
 811       <graphic entityref="WiresharkViewMenu" format="PNG"/>
 812     </figure>
 813     <table id="ChUseTabView" frame="none">
 814       <title>View menu items</title>
 815       <tgroup cols="3">
 816         <colspec colnum="1" colwidth="72pt"/>
 817           <colspec colnum="2" colwidth="80pt"/>
 818             <thead>
 819               <row>
 820                 <entry>Menu Item</entry>
 821                 <entry>Accelerator</entry>
 822                 <entry>Description</entry>
 823               </row>
 824             </thead>
 825             <tbody>
 826               <row>
 827                 <entry><command>Main Toolbar</command></entry>
 828                 <entry></entry>
 829                 <entry><para>
 830                     This menu item hides or shows the main toolbar, see
 831                   <xref linkend="ChUseMainToolbarSection"/>.
 832                   </para></entry>
 833               </row>
 834               <row>
 835                 <entry><command>Filter Toolbar</command></entry>
 836                 <entry></entry>
 837                 <entry><para>
 838                     This menu item hides or shows the filter toolbar, see
 839                   <xref linkend="ChUseFilterToolbarSection"/>.
 840                   </para></entry>
 841               </row>
 842               <row>
 843                 <entry><command>Wireless Toolbar (Windows only)</command></entry>
 844                 <entry></entry>
 845                 <entry><para>
 846                     This menu item hides or shows the wireless toolbar. See
 847                     the AirPcap documentation for more information.
 848                   </para></entry>
 849               </row>
 850               <row>
 851                 <entry><command>Statusbar</command></entry>
 852                 <entry></entry>
 853                 <entry><para>
 854                     This menu item hides or shows the statusbar, see
 855                   <xref linkend="ChUseStatusbarSection"/>.
 856                   </para></entry>
 857               </row>
 858               <row>
 859                 <entry><command>------</command></entry>
 860                 <entry></entry>
 861                 <entry></entry>
 862               </row>
 863               <row>
 864                 <entry><command>Packet List</command></entry>
 865                 <entry></entry>
 866                 <entry><para>
 867                     This menu item hides or shows the packet list pane, see
 868                   <xref linkend="ChUsePacketListPaneSection"/>.
 869                   </para></entry>
 870               </row>
 871               <row>
 872                 <entry><command>Packet Details</command></entry>
 873                 <entry></entry>
 874                 <entry><para>
 875                     This menu item hides or shows the packet details pane, see
 876                   <xref linkend="ChUsePacketDetailsPaneSection"/>.
 877                   </para></entry>
 878               </row>
 879               <row>
 880                 <entry><command>Packet Bytes</command></entry>
 881                 <entry></entry>
 882                 <entry><para>
 883                     This menu item hides or shows the packet bytes pane, see
 884                   <xref linkend="ChUsePacketBytesPaneSection"/>.
 885                   </para></entry>
 886               </row>
 887               <row>
 888                 <entry><command>------</command></entry>
 889                 <entry></entry>
 890                 <entry></entry>
 891               </row>
 892               <row>
 893                 <entry><command>Time Display Format > Date and Time of Day:  1970-01-01 01:02:03.123456</command></entry>
 894                 <entry></entry>
 895                 <entry><para>
 896               Selecting this tells Wireshark to display the
 897               time stamps in date and time of day format, see
 898                   <xref linkend="ChWorkTimeFormatsSection"/>.
 899                   <note><title>Note!</title>
 900                   <para>
 901                   The fields "Time of Day", "Date and Time of
 902               Day", "Seconds Since Beginning of Capture", "Seconds Since
 903               Previous Captured Packet" and "Seconds Since Previous
 904               Displayed Packet" are mutually exclusive.
 905                   </para>
 906                   </note>
 907                   </para></entry>
 908               </row>
 909               <row>
 910                 <entry><command>Time Display Format > Time of Day:  01:02:03.123456</command></entry>
 911                 <entry></entry>
 912                 <entry><para>
 913               Selecting this tells Wireshark to display time
 914               stamps in time of day format, see
 915                   <xref linkend="ChWorkTimeFormatsSection"/>.
 916                   </para></entry>
 917               </row>
 918               <row>
 919                 <entry><command>Time Display Format > Seconds Since Epoch (1970-01-01):  1234567890.123456</command></entry>
 920                 <entry></entry>
 921                 <entry><para>
 922               Selecting this tells Wireshark to display time stamps in
 923               seconds since 1970-01-01 00:00:00, see
 924                   <xref linkend="ChWorkTimeFormatsSection"/>.
 925                   </para></entry>
 926               </row>
 927               <row>
 928                 <entry><command>Time Display Format > Seconds Since Beginning of Capture:  123.123456</command></entry>
 929                 <entry></entry>
 930                 <entry><para>
 931               Selecting this tells Wireshark to display time
 932               stamps in seconds since beginning of capture format, see
 933                   <xref linkend="ChWorkTimeFormatsSection"/>.
 934                   </para></entry>
 935               </row>
 936               <row>
 937                 <entry><command>Time Display Format > Seconds Since Previous Captured Packet:  1.123456</command></entry>
 938                 <entry></entry>
 939                 <entry><para>
 940               Selecting this tells Wireshark to display time stamps in
 941               seconds since previous captured packet format, see
 942                   <xref linkend="ChWorkTimeFormatsSection"/>.
 943                   </para></entry>
 944               </row>
 945               <row>
 946                 <entry><command>Time Display Format > Seconds Since Previous Displayed Packet:  1.123456</command></entry>
 947                 <entry></entry>
 948                 <entry><para>
 949               Selecting this tells Wireshark to display time stamps in
 950               seconds since previous displayed packet format, see
 951                   <xref linkend="ChWorkTimeFormatsSection"/>.
 952                   </para></entry>
 953               </row>
 954               <row>
 955                 <entry><command>Time Display Format > ------</command></entry>
 956                 <entry></entry>
 957                 <entry></entry>
 958               </row>
 959               <row>
 960                 <entry><command>Time Display Format > Automatic (File Format Precision)</command></entry>
 961                 <entry></entry>
 962                 <entry><para>
 963               Selecting this tells Wireshark to display time stamps with the
 964                   precision given by the capture file format used, see
 965                   <xref linkend="ChWorkTimeFormatsSection"/>.
 966                   <note><title>Note!</title>
 967                   <para>
 968                   The fields "Automatic", "Seconds" and "...seconds" are mutually exclusive.
 969                   </para>
 970                   </note>
 971                   </para></entry>
 972               </row>
 973               <row>
 974                 <entry><command>Time Display Format > Seconds:  0</command></entry>
 975                 <entry></entry>
 976                 <entry><para>
 977               Selecting this tells Wireshark to display time stamps with a precision of one second, see
 978                   <xref linkend="ChWorkTimeFormatsSection"/>.
 979                   </para></entry>
 980               </row>
 981               <row>
 982                 <entry><command>Time Display Format > ...seconds:  0....</command></entry>
 983                 <entry></entry>
 984                 <entry><para>
 985               Selecting this tells Wireshark to display time stamps with a precision of one second,
 986               decisecond, centisecond, millisecond, microsecond or nanosecond, see
 987                   <xref linkend="ChWorkTimeFormatsSection"/>.
 988                   </para></entry>
 989               </row>
 990               <row>
 991                 <entry><command>Time Display Format > Display Seconds with hours and minutes</command></entry>
 992                 <entry></entry>
 993                 <entry><para>
 994               Selecting this tells Wireshark to display time stamps in seconds,
 995               with hours and minutes.
 996                   </para></entry>
 997               </row>
 998               <row>
 999                 <entry><command>Name Resolution > Resolve Name</command></entry>
1000                 <entry></entry>
1001                 <entry><para>
1002                 This item allows you to trigger a name resolve of the current packet
1003                 only, see <xref linkend="ChAdvNameResolutionSection"/>.
1004                   </para></entry>
1005               </row>
1006               <row>
1007                 <entry><command>Name Resolution > Enable for MAC Layer</command></entry>
1008                 <entry></entry>
1009                 <entry><para>
1010                 This item allows you to control whether or not
1011                 Wireshark translates MAC addresses into names, see
1012                   <xref linkend="ChAdvNameResolutionSection"/>.
1013                   </para></entry>
1014               </row>
1015               <row>
1016                 <entry><command>Name Resolution > Enable for Network Layer</command></entry>
1017                 <entry></entry>
1018                 <entry><para>
1019                 This item allows you to control whether or not
1020                 Wireshark translates network addresses into names, see
1021                   <xref linkend="ChAdvNameResolutionSection"/>.
1022                   </para></entry>
1023               </row>
1024               <row>
1025                 <entry><command>Name Resolution > Enable for Transport Layer</command></entry>
1026                 <entry></entry>
1027                 <entry><para>
1028                 This item allows you to control whether or not
1029                 Wireshark translates transport addresses into names, see
1030                   <xref linkend="ChAdvNameResolutionSection"/>.
1031                   </para></entry>
1032               </row>
1033               <row>
1034                 <entry><command>Colorize Packet List</command></entry>
1035                 <entry></entry>
1036                 <entry><para>
1037                 This item allows you to control whether or not Wireshark should colorize
1038                 the packet list.</para>
1039                 <note><title>Note!</title><para>
1040                 Enabling colorization will slow down the display
1041                 of new packets while capturing / loading capture files.
1042                   </para></note></entry>
1043               </row>
1044               <row>
1045                 <entry><command>Auto Scroll in Live Capture</command></entry>
1046                 <entry></entry>
1047                 <entry><para>
1048                 This item allows you to specify that Wireshark
1049                 should scroll the packet list pane as new packets come
1050                 in, so you are always looking at the last packet.  If you
1051                 do not specify this, Wireshark simply adds new packets onto
1052                 the end of the list, but does not scroll the packet list
1053                 pane.
1054                   </para></entry>
1055               </row>
1056               <row>
1057                 <entry><command>------</command></entry>
1058                 <entry></entry>
1059                 <entry></entry>
1060               </row>
1061               <row>
1062                 <entry><command>Zoom In</command></entry>
1063                 <entry>Ctrl++</entry>
1064                 <entry><para>
1065                   Zoom into the packet data (increase the font size).
1066                   </para></entry>
1067               </row>
1068               <row>
1069                 <entry><command>Zoom Out</command></entry>
1070                 <entry>Ctrl+-</entry>
1071                 <entry><para>
1072                   Zoom out of the packet data (decrease the font size).
1073                   </para></entry>
1074               </row>
1075               <row>
1076                 <entry><command>Normal Size</command></entry>
1077                 <entry>Ctrl+=</entry>
1078                 <entry><para>
1079                   Set zoom level back to 100% (set font size back to normal).
1080                   </para></entry>
1081               </row>
1082               <row>
1083                 <entry><command>Resize All Columns</command></entry>
1084                 <entry></entry>
1085                 <entry><para>
1086                   Resize all column widths so the content will fit into it.
1087                   </para>
1088                   <note><title>Note!</title><para>
1089                   Resizing may take a significant amount of time, especially if a
1090                   large capture file is loaded.
1091                   </para></note>
1092                   </entry>
1093               </row>
1094               <row>
1095                 <entry><command>Displayed Columns</command></entry>
1096                 <entry></entry>
1097                 <entry><para>
1098                   This menu items folds out with a list of all configured columns.
1099                   These columns can now be shown or hidden in the packet list.
1100                   </para>
1101                   </entry>
1102               </row>
1103               <row>
1104                 <entry><command>------</command></entry>
1105                 <entry></entry>
1106                 <entry></entry>
1107               </row>
1108               <row>
1109                 <entry><command>Expand Subtrees</command></entry>
1110                 <entry></entry>
1111                 <entry><para>
1112                     This menu item expands the currently selected subtree in the
1113                     packet details tree.
1114                   </para></entry>
1115               </row>
1116               <row>
1117                 <entry><command>Expand All</command></entry>
1118                 <entry></entry>
1119                 <entry><para>
1120                     Wireshark keeps a list of all the protocol subtrees
1121                     that are expanded, and uses it to ensure that the
1122                     correct subtrees are expanded when you display a packet.
1123                     This menu item expands all subtrees in all packets in
1124                     the capture.
1125                   </para></entry>
1126               </row>
1127               <row>
1128                 <entry><command>Collapse All</command></entry>
1129                 <entry></entry>
1130                 <entry><para>
1131                     This menu item collapses the tree view of all packets
1132                     in the capture list.
1133                   </para></entry>
1134               </row>
1135               <row>
1136                 <entry><command>------</command></entry>
1137                 <entry></entry>
1138                 <entry></entry>
1139               </row>
1140               <row>
1141                 <entry><command>Colorize Conversation</command></entry>
1142                 <entry></entry>
1143                 <entry><para>
1144                     This menu item brings up a submenu that allows you
1145                     to color packets in the packet list pane based
1146                     on the addresses of the currently selected packet.
1147                     This makes it easy to distinguish packets
1148                     belonging to different conversations.
1149                   <xref linkend="ChCustColorizationSection"/>.
1150                   </para></entry>
1151               </row>
1152               <row>
1153                 <entry><command>Colorize Conversation > Color 1-10</command></entry>
1154                 <entry></entry>
1155                 <entry><para>
1156                     These menu items enable one of the ten temporary color
1157                     filters based on the currently selected conversation.
1158                   </para></entry>
1159               </row>
1160               <row>
1161                 <entry><command>Colorize Conversation > Reset coloring</command></entry>
1162                 <entry></entry>
1163                 <entry><para>
1164                     This menu item clears all temporary coloring rules.
1165                   </para></entry>
1166               </row>
1167               <row>
1168                 <entry><command>Colorize Conversation > New Coloring Rule...</command></entry>
1169                 <entry></entry>
1170                 <entry><para>
1171                     This menu item opens a dialog window in which a new
1172                     permanent coloring rule can be created based on the
1173                     currently selected conversation.
1174                   </para></entry>
1175               </row>
1176               <row>
1177                 <entry><command>Coloring Rules...</command></entry>
1178                 <entry></entry>
1179                 <entry><para>
1180                     This menu item brings up a dialog box that allows you
1181                     to color packets in the packet list pane according to
1182                     filter expressions you choose. It can be very useful
1183                     for spotting certain types of packets, see
1184                   <xref linkend="ChCustColorizationSection"/>.
1185                   </para></entry>
1186               </row>
1187               <row>
1188                 <entry><command>------</command></entry>
1189                 <entry></entry>
1190                 <entry></entry>
1191               </row>
1192               <row>
1193                 <entry><command>Show Packet in New Window</command></entry>
1194                 <entry></entry>
1195                 <entry><para>
1196                     This menu item brings up the selected packet in a
1197                     separate window. The separate window shows only the
1198                     tree view and byte view panes.
1199                   </para></entry>
1200               </row>
1201               <row>
1202                 <entry><command>Reload</command></entry>
1203                 <entry>Ctrl-R</entry>
1204                 <entry><para>
1205                     This menu item allows you to reload the current
1206                     capture file.
1207                   </para></entry>
1208               </row>
1209             </tbody>
1210       </tgroup>
1211     </table>
1212   </section>
1213
1214   <section id="ChUseGoMenuSection"><title>The "Go" menu</title>
1215     <para>
1216       The Wireshark Go menu contains the fields shown in
1217       <xref linkend="ChUseTabGo"/>.
1218     </para>
1219     <figure id="ChUseWiresharkGoMenu">
1220       <title>The "Go" Menu</title>
1221       <graphic entityref="WiresharkGoMenu" format="PNG"/>
1222     </figure>
1223     <table id="ChUseTabGo" frame="none">
1224       <title>Go menu items</title>
1225       <tgroup cols="3">
1226         <colspec colnum="1" colwidth="72pt"/>
1227           <colspec colnum="2" colwidth="80pt"/>
1228             <thead>
1229               <row>
1230                 <entry>Menu Item</entry>
1231                 <entry>Accelerator</entry>
1232                 <entry>Description</entry>
1233               </row>
1234             </thead>
1235             <tbody>
1236               <row>
1237                 <entry><command>Back</command></entry>
1238                 <entry>Alt+Left</entry>
1239                 <entry><para>
1240                     Jump to the recently visited packet in the packet
1241                         history, much like the page history in a web browser.
1242                   </para></entry>
1243               </row>
1244               <row>
1245                 <entry><command>Forward</command></entry>
1246                 <entry>Alt+Right</entry>
1247                 <entry><para>
1248                     Jump to the next visited packet in the packet
1249                         history, much like the page history in a web browser.
1250                   </para></entry>
1251               </row>
1252               <row>
1253                 <entry><command>Go to Packet...</command></entry>
1254                 <entry>Ctrl-G</entry>
1255                 <entry><para>
1256                     Bring up a dialog box that allows you
1257                     to specify a packet number, and then goes to that packet. See
1258                         <xref linkend="ChWorkGoToPacketSection"/> for details.
1259                   </para></entry>
1260               </row>
1261               <row>
1262                 <entry><command>Go to Corresponding Packet</command></entry>
1263                 <entry></entry>
1264                 <entry><para>
1265                     Go to the corresponding packet of the currently
1266                         selected protocol field. If the selected field doesn't correspond
1267                         to a packet, this item is greyed out.
1268                   </para></entry>
1269               </row>
1270               <row>
1271                 <entry><command>------</command></entry>
1272                 <entry></entry>
1273                 <entry></entry>
1274               </row>
1275               <row>
1276                 <entry><command>Previous Packet</command></entry>
1277                 <entry>Ctrl+Up</entry>
1278                 <entry><para>
1279                     Move to the previous packet in the list.  This can be
1280                     used to move to the previous packet even if the packet
1281                     list doesn't have keyboard focus.
1282                   </para></entry>
1283               </row>
1284               <row>
1285                 <entry><command>Next Packet</command></entry>
1286                 <entry>Ctrl+Down</entry>
1287                 <entry><para>
1288                     Move to the next packet in the list.  This can be
1289                     used to move to the previous packet even if the packet
1290                     list doesn't have keyboard focus.
1291                   </para></entry>
1292               </row>
1293               <row>
1294                 <entry><command>First Packet</command></entry>
1295                 <entry>Ctrl+Home</entry>
1296                 <entry><para>
1297                     Jump to the first packet of the capture file.
1298                   </para></entry>
1299               </row>
1300               <row>
1301                 <entry><command>Last Packet</command></entry>
1302                 <entry>Ctrl+End</entry>
1303                 <entry><para>
1304                     Jump to the last packet of the capture file.
1305                   </para></entry>
1306               </row>
1307             </tbody>
1308       </tgroup>
1309     </table>
1310   </section>
1311
1312   <section id="ChUseCaptureMenuSection"><title>The "Capture" menu</title>
1313     <para>
1314       The Wireshark Capture menu contains the fields shown in
1315       <xref linkend="ChUseTabCap"/>.
1316     </para>
1317     <figure id="ChUseWiresharkCaptureMenu">
1318       <title>The "Capture" Menu</title>
1319       <graphic entityref="WiresharkCaptureMenu" format="PNG"/>
1320     </figure>
1321     <table id="ChUseTabCap" frame="none">
1322       <title>Capture menu items</title>
1323       <tgroup cols="3">
1324         <colspec colnum="1" colwidth="72pt"/>
1325           <colspec colnum="2" colwidth="80pt"/>
1326             <thead>
1327               <row>
1328                 <entry>Menu Item</entry>
1329                 <entry>Accelerator</entry>
1330                 <entry>Description</entry>
1331               </row>
1332             </thead>
1333             <tbody>
1334               <row>
1335                 <entry><command>Interfaces...</command></entry>
1336                 <entry></entry>
1337                 <entry><para>
1338                     This menu item brings up a dialog box that shows what's going on
1339                         at the network interfaces Wireshark knows of, see
1340                         <xref linkend="ChCapInterfaceSection"/>) .
1341                   </para></entry>
1342               </row>
1343               <row>
1344                 <entry><command>Options...</command></entry>
1345                 <entry>Ctrl+K</entry>
1346                 <entry><para>
1347                     This menu item brings up the Capture Options
1348                     dialog box (discussed further in
1349                     <xref linkend="ChCapCaptureOptions"/>) and allows you to
1350                       start capturing packets.
1351                   </para></entry>
1352               </row>
1353               <row>
1354                 <entry><command>Start</command></entry>
1355                 <entry></entry>
1356                 <entry><para>
1357                     Immediately start capturing packets with the same settings than
1358                         the last time.
1359                   </para></entry>
1360               </row>
1361               <row>
1362                 <entry><command>Stop</command></entry>
1363                 <entry>Ctrl+E</entry>
1364                 <entry><para>
1365                     This menu item stops the currently running capture, see
1366                         <xref linkend="ChCapStopSection"/>) .
1367                   </para></entry>
1368               </row>
1369               <row>
1370                 <entry><command>Restart</command></entry>
1371                 <entry></entry>
1372                 <entry><para>
1373                     This menu item stops the currently running capture and starts
1374                         again with the same options, this is just for convenience.
1375                   </para></entry>
1376               </row>
1377               <row>
1378                 <entry><command>Capture Filters...</command></entry>
1379                 <entry></entry>
1380                 <entry><para>
1381                     This menu item brings up a dialog box that allows you to
1382                     create and edit capture filters. You can name filters,
1383                     and you can save them for future use. More detail on
1384                     this subject is provided in
1385                     <xref linkend="ChWorkDefineFilterSection"/>
1386                   </para></entry>
1387               </row>
1388             </tbody>
1389       </tgroup>
1390     </table>
1391   </section>
1392
1393   <section id="ChUseAnalyzeMenuSection"><title>The "Analyze" menu</title>
1394     <para>
1395       The Wireshark Analyze menu contains the fields shown in
1396       <xref linkend="ChUseAnalyze"/>.
1397     </para>
1398     <figure id="ChUseWiresharkAnalyzeMenu">
1399       <title>The "Analyze" Menu</title>
1400       <graphic entityref="WiresharkAnalyzeMenu" format="PNG"/>
1401     </figure>
1402     <table id="ChUseAnalyze" frame="none"><title>Analyze menu items</title>
1403       <tgroup cols="3">
1404         <colspec colnum="1" colwidth="72pt"/>
1405           <colspec colnum="2" colwidth="80pt"/>
1406             <thead>
1407               <row>
1408                 <entry>Menu Item</entry>
1409                 <entry>Accelerator</entry>
1410                 <entry>Description</entry>
1411               </row>
1412             </thead>
1413             <tbody>
1414               <row>
1415                 <entry><command>Display Filters...</command></entry>
1416                 <entry></entry>
1417                 <entry><para>
1418                     This menu item brings up a dialog box that allows you
1419                     to create and edit display filters. You can name
1420                     filters, and you can save them for future use. More
1421                     detail on this subject is provided in
1422                     <xref linkend="ChWorkDefineFilterSection"/>
1423                   </para></entry>
1424               </row>
1425               <row>
1426                 <entry><command>Display Filter Macros...</command></entry>
1427                 <entry></entry>
1428                 <entry><para>
1429                     This menu item brings up a dialog box that allows you
1430                     to create and edit display filter macros. You can name
1431                     filter macros, and you can save them for future use. More
1432                     detail on this subject is provided in
1433                     <xref linkend="ChWorkDefineFilterMacrosSection"/>
1434                   </para></entry>
1435               </row>
1436               <row>
1437                 <entry><command>------</command></entry>
1438                 <entry></entry>
1439                 <entry></entry>
1440               </row>
1441               <row>
1442                 <entry><command>Apply as Column</command></entry>
1443                 <entry></entry>
1444                 <entry><para>
1445                     This menu item adds the selected protocol item in the packet details
1446                     pane as a column to the packet list.
1447                   </para></entry>
1448               </row>
1449               <row>
1450                 <entry><command>Apply as Filter > ...</command></entry>
1451                 <entry></entry>
1452                 <entry><para>
1453                         These menu items will change the current display filter and apply
1454                         the changed filter immediately. Depending on the chosen menu item,
1455                         the current display filter string will be replaced or appended to
1456                         by the selected protocol field in the packet details pane.
1457                   </para></entry>
1458               </row>
1459               <row>
1460                 <entry><command>Prepare a Filter > ...</command></entry>
1461                 <entry></entry>
1462                 <entry><para>
1463                         These menu items will change the current display filter but won't
1464                         apply the changed filter. Depending on the chosen menu item,
1465                         the current display filter string will be replaced or appended to
1466                         by the selected protocol field in the packet details pane.
1467                   </para></entry>
1468               </row>
1469               <row>
1470                 <entry><command>------</command></entry>
1471                 <entry></entry>
1472                 <entry></entry>
1473               </row>
1474               <row>
1475                 <entry><command>Enabled Protocols...</command></entry>
1476                 <entry>Shift+Ctrl+R</entry>
1477                 <entry><para>
1478                         This menu item allows the user to enable/disable protocol
1479                         dissectors, see <xref linkend="ChAdvEnabledProtocols"/>
1480                   </para></entry>
1481               </row>
1482               <row>
1483                 <entry><command>Decode As...</command></entry>
1484                 <entry></entry>
1485                 <entry><para>
1486                     This menu item allows the user to force Wireshark to
1487                     decode certain packets as a particular protocol, see
1488                         <xref linkend="ChAdvDecodeAs"/>
1489                   </para></entry>
1490               </row>
1491               <row>
1492                 <entry><command>User Specified Decodes...</command></entry>
1493                 <entry></entry>
1494                 <entry><para>
1495                     This menu item allows the user to force Wireshark to
1496                     decode certain packets as a particular protocol, see
1497                         <xref linkend="ChAdvDecodeAsShow"/>
1498                   </para></entry>
1499               </row>
1500               <row>
1501                 <entry><command>------</command></entry>
1502                 <entry></entry>
1503                 <entry></entry>
1504               </row>
1505               <row>
1506                 <entry><command>Follow TCP Stream</command></entry>
1507                 <entry></entry>
1508                 <entry><para>
1509                     This menu item brings up a separate window and displays
1510                     all the TCP segments captured that are on the same TCP
1511                     connection as a selected packet, see
1512                     <xref linkend="ChAdvFollowTCPSection"/>
1513                   </para></entry>
1514               </row>
1515               <row>
1516                 <entry><command>Follow UDP Stream</command></entry>
1517                 <entry></entry>
1518                 <entry><para>
1519                         Same functionality as "Follow TCP Stream" but
1520                         for UDP streams.
1521                   </para></entry>
1522               </row>
1523               <row>
1524                 <entry><command>Follow SSL Stream</command></entry>
1525                 <entry></entry>
1526                 <entry><para>
1527                         Same functionality as "Follow TCP Stream" but for SSL streams.
1528                         XXX - how to provide the SSL keys?
1529                   </para></entry>
1530               </row>
1531               <row>
1532                 <entry><command>Expert Info</command></entry>
1533                 <entry></entry>
1534                 <entry><para>
1535                         Open a dialog showing some expert information about the captured
1536                         packets in a log style display.
1537                         The amount of information will depend on the protocol and varies
1538                         from  very detailed to none existing. This is currently a work in
1539                         progress. XXX - add a new section about this and link from here
1540                   </para></entry>
1541               </row>
1542               <row>
1543                 <entry><command>Expert Info Composite</command></entry>
1544                 <entry></entry>
1545                 <entry><para>
1546                         Same information as in "Expert Info" but trying to group items
1547                         together for faster analysis.
1548                   </para></entry>
1549               </row>
1550               <row>
1551                 <entry><command>Conversation Filter > ...</command></entry>
1552                 <entry></entry>
1553                 <entry><para>
1554                         In this menu you will find conversation filter for various
1555                         protocols.
1556                   </para></entry>
1557               </row>
1558             </tbody>
1559       </tgroup>
1560     </table>
1561   </section>
1562
1563   <section id="ChUseStatisticsMenuSection"><title>The "Statistics" menu</title>
1564     <para>
1565       The Wireshark Statistics menu contains the fields shown in
1566       <xref linkend="ChUseStatistics"/>.
1567     </para>
1568     <figure id="ChUseWiresharkStatisticsMenu">
1569       <title>The "Statistics" Menu</title>
1570       <graphic entityref="WiresharkStatisticsMenu" format="PNG"/>
1571     </figure>
1572     <para>
1573         All menu items will bring up a new window showing specific statistical
1574         information.
1575     </para>
1576     <table id="ChUseStatistics" frame="none">
1577       <title>Statistics menu items</title>
1578       <tgroup cols="3">
1579         <colspec colnum="1" colwidth="72pt"/>
1580           <colspec colnum="2" colwidth="80pt"/>
1581             <thead>
1582               <row>
1583                 <entry>Menu Item</entry>
1584                 <entry>Accelerator</entry>
1585                 <entry>Description</entry>
1586               </row>
1587             </thead>
1588             <tbody>
1589               <row>
1590                 <entry><command>Summary</command></entry>
1591                 <entry></entry>
1592                 <entry><para>
1593                     Show information about the data captured, see <xref
1594                         linkend="ChStatSummary"/>.
1595                   </para></entry>
1596               </row>
1597               <row>
1598                 <entry><command>Protocol Hierarchy</command></entry>
1599                 <entry></entry>
1600                 <entry><para>
1601                     Display a hierarchical tree of protocol statistics, see <xref
1602                         linkend="ChStatHierarchy"/>.
1603                   </para></entry>
1604               </row>
1605               <row>
1606                 <entry><command>Conversations</command></entry>
1607                 <entry></entry>
1608                 <entry><para>
1609                     Display a list of conversations (traffic between two endpoints),
1610                         see <xref linkend="ChStatConversationsWindow"/>.
1611                   </para></entry>
1612               </row>
1613               <row>
1614                 <entry><command>Endpoints</command></entry>
1615                 <entry></entry>
1616                 <entry><para>
1617                     Display a list of endpoints (traffic to/from an address), see
1618                         <xref linkend="ChStatEndpointsWindow"/>.
1619                   </para></entry>
1620               </row>
1621               <row>
1622                 <entry><command>Packet Lengths...</command></entry>
1623                 <entry></entry>
1624                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1625               </row>
1626               <row>
1627                 <entry><command>IO Graphs</command></entry>
1628                 <entry></entry>
1629                 <entry><para>
1630                     Display user specified graphs (e.g. the number of packets in the
1631                         course of time), see <xref linkend="ChStatIOGraphs"/>.
1632                   </para></entry>
1633               </row>
1634               <row>
1635                 <entry><command>------</command></entry>
1636                 <entry></entry>
1637                 <entry></entry>
1638               </row>
1639               <row>
1640                 <entry><command>Conversation List</command></entry>
1641                 <entry></entry>
1642                 <entry><para>
1643                     Display a list of conversations, obsoleted by the combined window
1644                         of Conversations above, see
1645                         <xref linkend="ChStatConversationListWindow"/>.
1646                   </para></entry>
1647               </row>
1648               <row>
1649                 <entry><command>Endpoint List</command></entry>
1650                 <entry></entry>
1651                 <entry><para>
1652                     Display a list of endpoints, obsoleted by the combined window
1653                         of Endpoints above, see
1654                         <xref linkend="ChStatEndpointListWindow"/>.
1655                   </para></entry>
1656               </row>
1657               <row>
1658                 <entry><command>Service Response Time</command></entry>
1659                 <entry></entry>
1660                 <entry><para>
1661                         Display the time between a request and the corresponding response, see
1662                         <xref linkend="ChStatSRT"/>.
1663                   </para></entry>
1664               </row>
1665               <row>
1666                 <entry><command>------</command></entry>
1667                 <entry></entry>
1668                 <entry></entry>
1669               </row>
1670               <row>
1671                 <entry><command>ANCP...</command></entry>
1672                 <entry></entry>
1673                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1674               </row>
1675               <row>
1676                 <entry><command>BOOTP-DHCP...</command></entry>
1677                 <entry></entry>
1678                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1679               </row>
1680               <row>
1681                 <entry><command>Colledtd...</command></entry>
1682                 <entry></entry>
1683                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1684               </row>
1685               <row>
1686                 <entry><command>Compare...</command></entry>
1687                 <entry></entry>
1688                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1689               </row>
1690               <row>
1691                 <entry><command>Flow Graph...</command></entry>
1692                 <entry></entry>
1693                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1694               </row>
1695               <row>
1696                 <entry><command>HTTP</command></entry>
1697                 <entry></entry>
1698                 <entry><para>HTTP request/response statistics, see <xref linkend="ChStatXXX"/></para></entry>
1699               </row>
1700               <row>
1701                 <entry><command>IP Addresses...</command></entry>
1702                 <entry></entry>
1703                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1704               </row>
1705               <row>
1706                 <entry><command>IP Destinations...</command></entry>
1707                 <entry></entry>
1708                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1709               </row>
1710               <row>
1711                 <entry><command>IP Protocol Types...</command></entry>
1712                 <entry></entry>
1713                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1714               </row>
1715               <row>
1716                 <entry><command>ONC-RPC Programs</command></entry>
1717                 <entry></entry>
1718                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1719               </row>
1720               <row>
1721                 <entry><command>TCP Stream Graph</command></entry>
1722                 <entry></entry>
1723                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1724               </row>
1725               <row>
1726                 <entry><command>UDP Multicast Streams</command></entry>
1727                 <entry></entry>
1728                 <entry><para>See <xref linkend="ChStatXXX"/></para></entry>
1729               </row>
1730               <row>
1731                 <entry><command>WLAN Traffic</command></entry>
1732                 <entry></entry>
1733                 <entry><para>See <xref linkend="ChStatWLANTraffic"/></para></entry>
1734               </row>
1735             </tbody>
1736       </tgroup>
1737     </table>
1738   </section>
1739
1740   <section id="ChUseTelephonyMenuSection"><title>The "Telephony" menu</title>
1741     <para>
1742       The Wireshark Telephony menu contains the fields shown in
1743       <xref linkend="ChUseTelephony"/>.
1744     </para>
1745     <figure id="ChUseWiresharkTelephonyMenu">
1746       <title>The "Telephony" Menu</title>
1747       <graphic entityref="WiresharkTelephonyMenu" format="PNG"/>
1748     </figure>
1749     <para>
1750         All menu items will bring up a new window showing specific telephony
1751         related statistical information.
1752     </para>
1753     <table id="ChUseTelephony" frame="none">
1754       <title>Telephony menu items</title>
1755       <tgroup cols="3">
1756         <colspec colnum="1" colwidth="72pt"/>
1757           <colspec colnum="2" colwidth="80pt"/>
1758             <thead>
1759               <row>
1760                 <entry>Menu Item</entry>
1761                 <entry>Accelerator</entry>
1762                 <entry>Description</entry>
1763               </row>
1764             </thead>
1765             <tbody>
1766               <row>
1767                 <entry><command>IAX2</command></entry>
1768                 <entry></entry>
1769                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1770               </row>
1771               <row>
1772                 <entry><command>SMPP Operations...</command></entry>
1773                 <entry></entry>
1774                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1775               </row>
1776               <row>
1777                 <entry><command>SCTP</command></entry>
1778                 <entry></entry>
1779                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1780               </row>
1781               <row>
1782                 <entry><command>ANSI</command></entry>
1783                 <entry></entry>
1784                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1785               </row>
1786               <row>
1787                 <entry><command>GSM</command></entry>
1788                 <entry></entry>
1789                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1790               </row>
1791               <row>
1792                 <entry><command>H.225...</command></entry>
1793                 <entry></entry>
1794                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1795               </row>
1796               <row>
1797                 <entry><command>ISUP Messages...</command></entry>
1798                 <entry></entry>
1799                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1800               </row>
1801               <row>
1802                 <entry><command>LTE MAC...</command></entry>
1803                 <entry></entry>
1804                 <entry><para>See <xref linkend="ChTelLTEMACTraffic"/></para></entry>
1805               </row>
1806               <row>
1807                 <entry><command>LTE RLC...</command></entry>
1808                 <entry></entry>
1809                 <entry><para>See <xref linkend="ChTelLTERLCTraffic"/></para></entry>
1810               </row>
1811               <row>
1812                 <entry><command>MTP3</command></entry>
1813                 <entry></entry>
1814                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1815               </row>
1816               <row>
1817                 <entry><command>RTP</command></entry>
1818                 <entry></entry>
1819                 <entry><para>See <xref linkend="ChTelRTPAnalysis"/></para></entry>
1820               </row>
1821               <row>
1822                 <entry><command>SIP...</command></entry>
1823                 <entry></entry>
1824                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1825               </row>
1826               <row>
1827                 <entry><command>UCP Messages...</command></entry>
1828                 <entry></entry>
1829                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1830               </row>
1831               <row>
1832                 <entry><command>VoIP Calls...</command></entry>
1833                 <entry></entry>
1834                 <entry><para>See <xref linkend="ChTelVoipCalls"/></para></entry>
1835               </row>
1836               <row>
1837                 <entry><command>WAP-WSP...</command></entry>
1838                 <entry></entry>
1839                 <entry><para>See <xref linkend="ChTelXXX"/></para></entry>
1840               </row>
1841             </tbody>
1842       </tgroup>
1843     </table>
1844   </section>
1845
1846   <section id="ChUseToolsMenuSection"><title>The "Tools" menu</title>
1847     <para>
1848       The Wireshark Tools menu contains the fields shown in
1849       <xref linkend="ChUseTools"/>.
1850     </para>
1851     <figure id="ChUseWiresharkToolsMenu">
1852       <title>The "Tools" Menu</title>
1853       <graphic entityref="WiresharkToolsMenu" format="PNG"/>
1854     </figure>
1855     <table id="ChUseTools" frame="none">
1856       <title>Tools menu items</title>
1857       <tgroup cols="3">
1858         <colspec colnum="1" colwidth="72pt"/>
1859           <colspec colnum="2" colwidth="80pt"/>
1860             <thead>
1861               <row>
1862                 <entry>Menu Item</entry>
1863                 <entry>Accelerator</entry>
1864                 <entry>Description</entry>
1865               </row>
1866             </thead>
1867             <tbody>
1868               <row>
1869                 <entry><command>Firewall ACL Rules</command></entry>
1870                 <entry></entry>
1871                 <entry><para>
1872                   This allows you to create command-line ACL rules for many different
1873                         firewall products, including Cisco IOS, Linux Netfilter (iptables),
1874                         OpenBSD pf and Windows Firewall (via netsh).  Rules for MAC addresses,
1875                         IPv4 addresses, TCP and UDP ports, and IPv4+port combinations are
1876                         supported.
1877                         </para><para>
1878                         It is assumed that the rules will be applied to an outside interface.
1879                   </para></entry>
1880               </row>
1881               <row>
1882                 <entry><command>Lua</command></entry>
1883                 <entry></entry>
1884                 <entry><para>
1885                     These options allow you to work with the Lua interpreter optionally
1886                     build into Wireshark, see <xref linkend="wsluarm_intro"/>.
1887                   </para></entry>
1888               </row>
1889             </tbody>
1890       </tgroup>
1891     </table>
1892   </section>
1893
1894   <section id="ChUseHelpMenuSection"><title>The "Help" menu</title>
1895     <para>
1896       The Wireshark Help menu contains the fields shown in
1897       <xref linkend="ChUseHelp"/>.
1898     </para>
1899     <figure id="ChUseWiresharkHelpMenu">
1900       <title>The "Help" Menu</title>
1901       <graphic entityref="WiresharkHelpMenu" format="PNG"/>
1902     </figure>
1903     <table id="ChUseHelp" frame="none">
1904       <title>Help menu items</title>
1905       <tgroup cols="3">
1906         <colspec colnum="1" colwidth="72pt"/>
1907           <colspec colnum="2" colwidth="80pt"/>
1908             <thead>
1909               <row>
1910                 <entry>Menu Item</entry>
1911                 <entry>Accelerator</entry>
1912                 <entry>Description</entry>
1913               </row>
1914             </thead>
1915             <tbody>
1916               <row>
1917                 <entry><command>Contents</command></entry>
1918                 <entry>F1</entry>
1919                 <entry><para>
1920                     This menu item brings up a basic help system.
1921                   </para></entry>
1922               </row>
1923               <row>
1924                 <entry><command>FAQ's</command></entry>
1925                 <entry></entry>
1926                 <entry><para>
1927                     This menu item starts a Web browser showing various FAQ's.
1928                   </para></entry>
1929               </row>
1930               <row>
1931                 <entry><command>Manual Pages > ...</command></entry>
1932                 <entry></entry>
1933                 <entry><para>
1934                     This menu item starts a Web browser showing one of the locally
1935                         installed html manual pages.
1936                   </para></entry>
1937               </row>
1938               <row>
1939                 <entry><command>------</command></entry>
1940                 <entry></entry>
1941                 <entry></entry>
1942               </row>
1943               <row>
1944                 <entry><command>Wireshark Online > ...</command></entry>
1945                 <entry></entry>
1946                 <entry><para>
1947                     This menu item starts a Web browser showing the chosen
1948                         webpage from:
1949                         <ulink url="&WiresharkWebSite;">&WiresharkWebSite;</ulink>.
1950                   </para></entry>
1951               </row>
1952               <row>
1953                 <entry><command>------</command></entry>
1954                 <entry></entry>
1955                 <entry></entry>
1956               </row>
1957               <row>
1958                 <entry><command>Supported Protocols (slow!)</command></entry>
1959                 <entry></entry>
1960                 <entry><para>
1961                     This menu item brings up a dialog box showing the supported
1962                         protocols and protocol fields.
1963                   </para></entry>
1964               </row>
1965               <row>
1966                 <entry><command>------</command></entry>
1967                 <entry></entry>
1968                 <entry></entry>
1969               </row>
1970               <row>
1971                 <entry><command>About Wireshark</command></entry>
1972                 <entry></entry>
1973                 <entry><para>
1974                     This menu item brings up an information window that
1975                     provides some information on Wireshark, such as the plugins, the
1976                         used folders, ...
1977                   </para></entry>
1978               </row>
1979             </tbody>
1980       </tgroup>
1981     </table>
1982         <note><title>Note!</title>
1983         <para>
1984         Calling a Web browser might be unsupported in your version of Wireshark.
1985         If this is the case, the corresponding menu items will be hidden.
1986         </para>
1987         </note>
1988         <note><title>Note!</title>
1989         <para>
1990         If calling a Web browser fails on your machine, maybe because just nothing
1991         happens or the browser is started but no page is shown, have a look at the
1992         web browser setting in the preferences dialog.
1993         </para>
1994         </note>
1995   </section>
1996
1997   <section id="ChUseMainToolbarSection"><title>The "Main" toolbar</title>
1998     <para>
1999       The main toolbar provides quick access to frequently used items from the
2000           menu. This toolbar cannot be customized by the user, but it can be hidden
2001           using the View menu, if the space on the screen is needed to show even
2002           more packet data.
2003     </para>
2004     <para>
2005         As in the menu, only the items useful in the current program state will
2006         be available. The others will be greyed out (e.g. you cannot save a capture
2007         file if you haven't loaded one).
2008     <figure id="ChUseWiresharkMainToolbar">
2009       <title>The "Main" toolbar</title>
2010       <graphic entityref="WiresharkMainToolbar" format="PNG"/>
2011     </figure>
2012     </para>
2013     <table id="ChUseMainToolbar" frame="none">
2014       <title>Main toolbar items</title>
2015       <tgroup cols="4">
2016         <colspec colnum="1" colwidth="40pt"/>
2017           <colspec colnum="2" colwidth="80pt"/>
2018           <colspec colnum="3" colwidth="80pt"/>
2019             <thead>
2020               <row>
2021                 <entry>Toolbar Icon</entry>
2022                 <entry>Toolbar Item</entry>
2023                 <entry>Corresponding Menu Item</entry>
2024                 <entry>Description</entry>
2025               </row>
2026             </thead>
2027             <tbody>
2028               <row>
2029                 <entry><graphic entityref="WiresharkToolbarCaptureInterfaces" format="PNG"/></entry>
2030                 <entry><command>Interfaces...</command></entry>
2031                 <entry>Capture/Interfaces...</entry>
2032                 <entry><para>
2033                     This item brings up the Capture Interfaces List
2034                     dialog box (discussed further in
2035                     <xref linkend="ChCapCapturingSection"/>).
2036                   </para>
2037                   </entry>
2038               </row>
2039               <row>
2040                 <entry><graphic entityref="WiresharkToolbarCaptureOptions" format="PNG"/></entry>
2041                 <entry><command>Options...</command></entry>
2042                 <entry>Capture/Options...</entry>
2043                 <entry><para>
2044                     This item brings up the Capture Options
2045                     dialog box (discussed further in
2046                     <xref linkend="ChCapCapturingSection"/>) and allows you to
2047                       start capturing packets.
2048                   </para>
2049                   </entry>
2050               </row>
2051               <row>
2052                 <entry><graphic entityref="WiresharkToolbarCaptureStart" format="PNG"/></entry>
2053                 <entry><command>Start</command></entry>
2054                 <entry>Capture/Start</entry>
2055                 <entry><para>
2056                     This item starts capturing packets with the options form
2057                         the last time.
2058                   </para>
2059                   </entry>
2060               </row>
2061               <row>
2062                 <entry><graphic entityref="WiresharkToolbarCaptureStop" format="PNG"/></entry>
2063                 <entry><command>Stop</command></entry>
2064                 <entry>Capture/Stop</entry>
2065                 <entry><para>
2066                     This item stops the currently running live capture process
2067                         <xref linkend="ChCapCapturingSection"/>).
2068                   </para>
2069                   </entry>
2070               </row>
2071               <row>
2072                 <entry><graphic entityref="WiresharkToolbarCaptureRestart" format="PNG"/></entry>
2073                 <entry><command>Restart</command></entry>
2074                 <entry>Capture/Restart</entry>
2075                 <entry><para>
2076                     This item stops the currently running live capture process
2077                         and restarts it again, for convenience.
2078                   </para>
2079                   </entry>
2080               </row>
2081               <row>
2082                 <entry><command>------</command></entry>
2083                 <entry></entry>
2084                 <entry></entry>
2085               </row>
2086               <row>
2087                 <entry><graphic entityref="WiresharkToolbarOpen" format="PNG"/></entry>
2088                 <entry><command>Open...</command></entry>
2089                 <entry>File/Open...</entry>
2090                 <entry><para>
2091                     This item brings up the file open dialog box that
2092                     allows you to load a capture file for viewing. It is
2093                     discussed in more detail in <xref linkend="ChIOOpen"/>.
2094                   </para></entry>
2095               </row>
2096               <row>
2097                 <entry><graphic entityref="WiresharkToolbarSaveAs" format="PNG"/></entry>
2098                 <entry><command>Save As...</command></entry>
2099                 <entry>File/Save As...</entry>
2100                 <entry><para>
2101                     This item allows you to save the current capture file to whatever
2102                         file you would like. It pops up the Save Capture File As dialog
2103                         box (which is discussed further in <xref linkend="ChIOSaveAs"/>).
2104                         </para>
2105                         <note><title>Note!</title>
2106                         <para>
2107                         If you currently have a temporary capture file, the Save icon
2108                         <inlinegraphic entityref="WiresharkToolbarSave" format="PNG"/> will be
2109                         shown instead.
2110                   </para></note>
2111                   </entry>
2112               </row>
2113               <row>
2114                 <entry><graphic entityref="WiresharkToolbarClose" format="PNG"/></entry>
2115                 <entry><command>Close</command></entry>
2116                 <entry>File/Close</entry>
2117                 <entry><para>
2118                     This item closes the current capture. If you
2119                     have not saved the capture, you will be asked to save it first.
2120                   </para></entry>
2121               </row>
2122               <row>
2123                 <entry><graphic entityref="WiresharkToolbarReload" format="PNG"/></entry>
2124                 <entry><command>Reload</command></entry>
2125                 <entry>View/Reload</entry>
2126                 <entry><para>
2127                     This item allows you to reload the current capture file.
2128                   </para></entry>
2129               </row>
2130               <row>
2131                 <entry><graphic entityref="WiresharkToolbarPrint" format="PNG"/></entry>
2132                 <entry><command>Print...</command></entry>
2133                 <entry>File/Print...</entry>
2134                 <entry><para>
2135                     This item allows you to print all (or some of) the packets in
2136                     the capture file. It pops up the Wireshark Print dialog
2137                     box (which is discussed further in
2138                     <xref linkend="ChIOPrintSection"/>).
2139                   </para></entry>
2140               </row>
2141               <row>
2142                 <entry><command>------</command></entry>
2143                 <entry></entry>
2144                 <entry></entry>
2145               </row>
2146               <row>
2147                 <entry><graphic entityref="WiresharkToolbarFind" format="PNG"/></entry>
2148                 <entry><command>Find Packet...</command></entry>
2149                 <entry>Edit/Find Packet...</entry>
2150                 <entry><para>
2151                     This item brings up a dialog box that allows you
2152                     to find a packet. There is further information on finding packets
2153                         in <xref linkend="ChWorkFindPacketSection"/>.
2154                   </para></entry>
2155               </row>
2156               <row>
2157                 <entry><graphic entityref="WiresharkToolbarGoBack" format="PNG"/></entry>
2158                 <entry><command>Go Back</command></entry>
2159                 <entry>Go/Go Back</entry>
2160                 <entry><para>
2161                     This item jumps back in the packet history.
2162                   </para></entry>
2163               </row>
2164               <row>
2165                 <entry><graphic entityref="WiresharkToolbarGoForward" format="PNG"/></entry>
2166                 <entry><command>Go Forward</command></entry>
2167                 <entry>Go/Go Forward</entry>
2168                 <entry><para>
2169                     This item jumps forward in the packet history.
2170                   </para></entry>
2171               </row>
2172               <row>
2173                 <entry><graphic entityref="WiresharkToolbarGoTo" format="PNG"/></entry>
2174                 <entry><command>Go to Packet...</command></entry>
2175                 <entry>Go/Go to Packet...</entry>
2176                 <entry><para>
2177                     This item brings up a dialog box that allows you
2178                     to specify a packet number to go to that packet.
2179                   </para></entry>
2180               </row>
2181               <row>
2182                 <entry><graphic entityref="WiresharkToolbarGoFirst" format="PNG"/></entry>
2183                 <entry><command>Go To First Packet</command></entry>
2184                 <entry>Go/First Packet</entry>
2185                 <entry><para>
2186                     This item jumps to the first packet of the capture file.
2187                   </para></entry>
2188               </row>
2189               <row>
2190                 <entry><graphic entityref="WiresharkToolbarGoLast" format="PNG"/></entry>
2191                 <entry><command>Go To Last Packet</command></entry>
2192                 <entry>Go/Last Packet</entry>
2193                 <entry><para>
2194                     This item jumps to the last packet of the capture file.
2195                   </para></entry>
2196               </row>
2197               <row>
2198                 <entry><command>------</command></entry>
2199                 <entry></entry>
2200                 <entry></entry>
2201               </row>
2202               <row>
2203                 <entry><graphic entityref="WiresharkToolbarColorize" format="PNG"/></entry>
2204                 <entry><command>Colorize</command></entry>
2205                 <entry>View/Colorize</entry>
2206                 <entry><para>
2207                   Colorize the packet list (or not).
2208                   </para></entry>
2209               </row>
2210               <row>
2211                 <entry><graphic entityref="WiresharkToolbarAutoScroll" format="PNG"/></entry>
2212                 <entry><command>Auto Scroll in Live Capture</command></entry>
2213                 <entry>View/Auto Scroll in Live Capture</entry>
2214                 <entry><para>
2215                   Auto scroll packet list while doing a live capture (or not).
2216                   </para></entry>
2217               </row>
2218               <row>
2219                 <entry><command>------</command></entry>
2220                 <entry></entry>
2221                 <entry></entry>
2222               </row>
2223               <row>
2224                 <entry><graphic entityref="WiresharkToolbarZoomIn" format="PNG"/></entry>
2225                 <entry><command>Zoom In</command></entry>
2226                 <entry>View/Zoom In</entry>
2227                 <entry><para>
2228                   Zoom into the packet data (increase the font size).
2229                   </para></entry>
2230               </row>
2231               <row>
2232                 <entry><graphic entityref="WiresharkToolbarZoomOut" format="PNG"/></entry>
2233                 <entry><command>Zoom Out</command></entry>
2234                 <entry>View/Zoom Out</entry>
2235                 <entry><para>
2236                   Zoom out of the packet data (decrease the font size).
2237                   </para></entry>
2238               </row>
2239               <row>
2240                 <entry><graphic entityref="WiresharkToolbarZoom100" format="PNG"/></entry>
2241                 <entry><command>Normal Size</command></entry>
2242                 <entry>View/Normal Size</entry>
2243                 <entry><para>
2244                   Set zoom level back to 100%.
2245                   </para></entry>
2246               </row>
2247               <row>
2248                 <entry><graphic entityref="WiresharkToolbarResizeColumns" format="PNG"/></entry>
2249                 <entry><command>Resize Columns</command></entry>
2250                 <entry>View/Resize Columns</entry>
2251                 <entry><para>
2252                   Resize columns, so the content fits into them.
2253                   </para></entry>
2254               </row>
2255               <row>
2256                 <entry><command>------</command></entry>
2257                 <entry></entry>
2258                 <entry></entry>
2259               </row>
2260               <row>
2261                 <entry><graphic entityref="WiresharkToolbarCaptureFilters" format="PNG"/></entry>
2262                 <entry><command>Capture Filters...</command></entry>
2263                 <entry>Capture/Capture Filters...</entry>
2264                 <entry><para>
2265                     This item brings up a dialog box that allows you to
2266                     create and edit capture filters. You can name filters,
2267                     and you can save them for future use. More detail on
2268                     this subject is provided in
2269                     <xref linkend="ChWorkDefineFilterSection"/>.
2270                   </para></entry>
2271               </row>
2272               <row>
2273                 <entry><graphic entityref="WiresharkToolbarDisplayFilters" format="PNG"/></entry>
2274                 <entry><command>Display Filters...</command></entry>
2275                 <entry>Analyze/Display Filters...</entry>
2276                 <entry><para>
2277                     This item brings up a dialog box that allows you
2278                     to create and edit display filters. You can name
2279                     filters, and you can save them for future use. More
2280                     detail on this subject is provided in
2281                     <xref linkend="ChWorkDefineFilterSection"/>.
2282                   </para></entry>
2283               </row>
2284               <row>
2285                 <entry><graphic entityref="WiresharkToolbarColoringRules" format="PNG"/></entry>
2286                 <entry><command>Coloring Rules...</command></entry>
2287                 <entry>View/Coloring Rules...</entry>
2288                 <entry><para>
2289                     This item brings up a dialog box that allows you
2290                     color packets in the packet list pane according to
2291                     filter expressions you choose. It can be very useful
2292                     for spotting certain types of packets. More
2293                     detail on this subject is provided in
2294                     <xref linkend="ChCustColorizationSection"/>.
2295                   </para></entry>
2296               </row>
2297               <row>
2298                 <entry><graphic entityref="WiresharkToolbarPreferences" format="PNG"/></entry>
2299                 <entry><command>Preferences...</command></entry>
2300                 <entry>Edit/Preferences</entry>
2301                 <entry><para>
2302                     This item brings up a dialog box that allows
2303                     you to set preferences for many parameters that control
2304                     Wireshark.  You can also save your preferences so Wireshark
2305                     will use them the next time you start it. More detail
2306                     is provided in <xref linkend="ChCustPreferencesSection"/>
2307                   </para></entry>
2308               </row>
2309               <row>
2310                 <entry><command>------</command></entry>
2311                 <entry></entry>
2312                 <entry></entry>
2313               </row>
2314               <row>
2315                 <entry><graphic entityref="WiresharkToolbarHelp" format="PNG"/></entry>
2316                 <entry><command>Help</command></entry>
2317                 <entry>Help/Contents</entry>
2318                 <entry><para>
2319                     This item brings up help dialog box.
2320                   </para></entry>
2321               </row>
2322             </tbody>
2323       </tgroup>
2324     </table>
2325   </section>
2326
2327   <section id="ChUseFilterToolbarSection"><title>The "Filter" toolbar</title>
2328     <para>
2329       The filter toolbar lets you quickly edit and apply display filters. More information on
2330             display filters is available in <xref linkend="ChWorkDisplayFilterSection"/>.
2331     <figure id="ChUseWiresharkFilterToolbar">
2332       <title>The "Filter" toolbar</title>
2333       <graphic entityref="WiresharkFilterToolbar" format="PNG"/>
2334     </figure>
2335     <table id="ChUseFilterToolbar" frame="none">
2336       <title>Filter toolbar items</title>
2337       <tgroup cols="3">
2338         <colspec colnum="1" colwidth="40pt"/>
2339           <colspec colnum="2" colwidth="80pt"/>
2340             <thead>
2341               <row>
2342                 <entry>Toolbar Icon</entry>
2343                 <entry>Toolbar Item</entry>
2344                 <entry>Description</entry>
2345               </row>
2346             </thead>
2347             <tbody>
2348               <row>
2349                 <entry><graphic entityref="WiresharkToolbarDisplayFilters" format="PNG"/></entry>
2350                 <entry><command>Filter:</command></entry>
2351                 <entry><para>
2352             Brings up the filter construction dialog, described in <xref linkend="FiltersDialog"/>.
2353                   </para>
2354                   </entry>
2355               </row>
2356               <row>
2357                 <entry></entry>
2358                 <entry>Filter input</entry>
2359                 <entry>
2360           <para>
2361             The area to enter or edit a display filter string,
2362                 see <xref linkend="ChWorkBuildDisplayFilterSection"/>
2363                 . A syntax check of your filter string is done while you are typing.
2364                 The background will turn red if you enter an incomplete or invalid
2365                 string, and will become green when you enter a valid string. You can
2366                 click on the pull down arrow to select a previously-entered filter
2367                 string from a list. The entries in the pull down list will remain
2368                 available even after a program restart.
2369           </para>
2370           <note><title>Note!</title>
2371           <para>
2372                 After you've changed something in this field, don't forget to press
2373                 the Apply button (or the Enter/Return key), to apply this filter
2374                 string to the display.
2375           </para>
2376           </note>
2377           <note><title>Note!</title>
2378           <para>
2379                 This field is also where the current filter in effect is displayed.
2380           </para>
2381           </note>
2382                   </entry>
2383               </row>
2384               <row>
2385                 <entry><graphic entityref="WiresharkToolbarAdd" format="PNG"/></entry>
2386                 <entry><command>Expression...</command></entry>
2387                 <entry><para>
2388             The middle button labeled "Add Expression..." opens a dialog box that lets
2389                 you edit a display filter from a list of protocol fields, described in
2390                  <xref linkend="ChWorkFilterAddExpressionSection"/>
2391                   </para>
2392                   </entry>
2393               </row>
2394               <row>
2395                 <entry><graphic entityref="WiresharkToolbarClear" format="PNG"/></entry>
2396                 <entry><command>Clear</command></entry>
2397                 <entry><para>
2398             Reset the current display filter and clears the edit area.
2399                   </para>
2400                   </entry>
2401               </row>
2402               <row>
2403                 <entry><graphic entityref="WiresharkToolbarApply" format="PNG"/></entry>
2404                 <entry><command>Apply</command></entry>
2405                 <entry><para>
2406             Apply the current value in the edit area as the new display filter.
2407                   <note><title>Note!</title>
2408                   <para>
2409                         Applying a display filter on large capture files might take quite a long time!
2410                   </para>
2411                   </note>
2412                   </para>
2413                   </entry>
2414               </row>
2415             </tbody>
2416       </tgroup>
2417     </table>
2418     </para>
2419   </section>
2420
2421   <section id="ChUsePacketListPaneSection"><title>The "Packet List" pane</title>
2422     <para>
2423       The packet list pane displays all the packets in the current capture
2424           file.
2425     <figure id="ChUseWiresharkListPane">
2426       <title>The "Packet List" pane</title>
2427       <graphic entityref="WiresharkListPane" format="PNG"/>
2428     </figure>
2429         Each line in the packet list corresponds to one packet in the capture
2430         file. If you select a line in this pane, more details will be displayed in
2431         the "Packet Details" and "Packet Bytes" panes.
2432     </para>
2433     <para>
2434         While dissecting a packet, Wireshark will place information from the
2435         protocol dissectors into the columns. As higher level protocols might
2436         overwrite information from lower levels, you will typically see the
2437         information from the highest possible level only.
2438     </para>
2439     <para>
2440         For example, let's look at a packet containing TCP inside IP inside
2441         an Ethernet packet. The Ethernet dissector will write its data (such as
2442         the Ethernet addresses), the IP dissector will overwrite this by its own
2443         (such as the IP addresses), the TCP dissector will overwrite the IP
2444         information, and so on.
2445     </para>
2446     <para>
2447         There are a lot of different columns available. Which columns are
2448         displayed can be selected by preference settings, see
2449         <xref linkend="ChCustPreferencesSection"/>.
2450     </para>
2451     <para>
2452         The default columns will show:
2453         <itemizedlist>
2454         <listitem>
2455           <para><command>No.</command>
2456           The number of the packet in the capture file. This number won't change,
2457           even if a display filter is used.
2458           </para>
2459         </listitem>
2460         <listitem>
2461           <para><command>Time</command>
2462           The timestamp of the packet. The presentation format of this timestamp
2463           can be changed, see <xref linkend="ChWorkTimeFormatsSection"/>.
2464           </para>
2465         </listitem>
2466         <listitem>
2467           <para><command>Source</command>
2468           The address where this packet is coming from.
2469           </para>
2470         </listitem>
2471         <listitem>
2472           <para><command>Destination</command>
2473           The address where this packet is going to.
2474           </para>
2475         </listitem>
2476         <listitem>
2477           <para><command>Protocol</command>
2478           The protocol name in a short (perhaps abbreviated) version.
2479           </para>
2480         </listitem>
2481         <listitem>
2482           <para><command>Info</command>
2483           Additional information about the packet content.
2484           </para>
2485         </listitem>
2486         </itemizedlist>
2487     </para>
2488     <para>
2489         There is a context menu (right mouse click) available, see details in
2490         <xref linkend="ChWorkPacketListPanePopUpMenu"/>.
2491     </para>
2492   </section>
2493
2494   <section id="ChUsePacketDetailsPaneSection"><title>The "Packet Details" pane</title>
2495     <para>
2496       The packet details pane shows the current packet (selected in the "Packet List"
2497           pane) in a more detailed form.
2498     <figure id="ChUseWiresharkDetailsPane">
2499       <title>The "Packet Details" pane</title>
2500       <graphic entityref="WiresharkDetailsPane" format="PNG"/>
2501     </figure>
2502     </para>
2503     <para>
2504         This pane shows the protocols and protocol fields of the packet selected
2505         in the "Packet List" pane. The protocols and fields of the packet are
2506         displayed using a tree, which can be expanded and collapsed.
2507     </para>
2508     <para>
2509         There is a context menu (right mouse click) available, see details in
2510         <xref linkend="ChWorkPacketDetailsPanePopUpMenu"/>.
2511     </para>
2512     <para>
2513         Some protocol fields are specially displayed.
2514     </para>
2515         <itemizedlist>
2516         <listitem>
2517     <para>
2518         <command>Generated fields</command>
2519         Wireshark itself will generate additional protocol fields which are
2520         surrounded by brackets. The information in these fields is derived from the
2521         known context to other packets in the capture file. For example, Wireshark
2522         is doing a sequence/acknowledge analysis of each TCP stream,
2523         which is displayed in the [SEQ/ACK analysis] fields of the TCP protocol.
2524     </para>
2525         </listitem>
2526         <listitem>
2527     <para>
2528         <command>Links</command>
2529         If Wireshark detected a relationship to another packet in the capture file,
2530         it will generate a link to that packet. Links are underlined and displayed
2531         in blue. If double-clicked, Wireshark jumps to the corresponding packet.
2532     </para>
2533         </listitem>
2534         </itemizedlist>
2535   </section>
2536
2537   <section id="ChUsePacketBytesPaneSection"><title>The "Packet Bytes" pane</title>
2538     <para>
2539       The packet bytes pane shows the data of the current packet (selected in the "Packet List"
2540           pane) in a hexdump style.
2541     <figure id="ChUseWiresharkBytesPane">
2542       <title>The "Packet Bytes" pane</title>
2543       <graphic entityref="WiresharkBytesPane" format="PNG"/>
2544     </figure>
2545     </para>
2546     <para>
2547         As usual for a hexdump, the left side shows the offset in the packet data,
2548         in the middle the packet data is shown in a hexadecimal representation and
2549         on the right the corresponding ASCII characters (or . if not appropriate)
2550         are displayed.
2551     </para>
2552     <para>
2553         Depending on the packet data, sometimes more than one page is available,
2554         e.g. when Wireshark has reassembled some packets into a single chunk of
2555         data, see <xref linkend="ChAdvReassemblySection"/>. In this case there are
2556         some additional tabs shown at the bottom of the pane to let you select
2557         the page you want to see.
2558     <figure id="ChUseWiresharkBytesPaneTabs">
2559       <title>The "Packet Bytes" pane with tabs</title>
2560       <graphic entityref="WiresharkBytesPaneTabs" format="PNG"/>
2561     </figure>
2562     </para>
2563         <note><title>Note!</title>
2564         <para>
2565         The additional pages might contain data picked from multiple packets.
2566         </para>
2567         </note>
2568     <para>
2569         The context menu (right mouse click) of the tab labels will show a list of
2570         all available pages. This can be helpful if the size in the pane is too
2571         small for all the tab labels.
2572     </para>
2573   </section>
2574
2575   <section id="ChUseStatusbarSection"><title>The Statusbar</title>
2576     <para>
2577       The statusbar displays informational messages.
2578     </para>
2579     <para>
2580       In general, the left side will show context related information, the
2581       middle part will show the current number of packets, and the right side will
2582       show the selected configuration profile.  Drag the handles between the text
2583       areas to change the size.
2584     </para>
2585     <para>
2586       <figure id="ChUseWiresharkStatusbarEmpty">
2587         <title>The initial Statusbar</title>
2588         <graphic entityref="WiresharkStatusbarEmpty" format="PNG"/>
2589       </figure>
2590       This statusbar is shown while no capture file is loaded, e.g. when
2591       Wireshark is started.
2592     </para>
2593     <para>
2594       <figure id="ChUseWiresharkStatusbarLoaded">
2595         <title>The Statusbar with a loaded capture file</title>
2596         <graphic entityref="WiresharkStatusbarLoaded" format="PNG"/>
2597       </figure>
2598     </para>
2599     <itemizedlist>
2600       <listitem>
2601         <para>
2602           <command>The colorized bullet</command> on the left shows the highest expert
2603           info level found in the currently loaded capture file.  Hovering the mouse
2604           over this icon will show a textual description of the expert info level,
2605           and clicking the icon will bring up the Expert Infos dialog box.
2606           For a detailed description of expert info, see <xref linkend="ChAdvExpert"/>.
2607         </para>
2608       </listitem>
2609       <listitem>
2610         <para>
2611           <command>The left side</command> shows information about the capture file, its
2612           name, its size and the elapsed time while it was being captured.
2613         </para>
2614       </listitem>
2615       <listitem>
2616         <para>
2617           <command>The middle part</command> shows the current number of packets in the capture file.
2618           The following values are displayed:
2619           <itemizedlist mark="bullet">
2620             <listitem>
2621               <para><emphasis>Packets:</emphasis> the number of captured packets</para>
2622             </listitem>
2623             <listitem>
2624               <para><emphasis>Displayed:</emphasis> the number of packets currently being
2625               displayed</para>
2626             </listitem>
2627             <listitem>
2628               <para><emphasis>Marked:</emphasis> the number of marked packets</para>
2629             </listitem>
2630             <listitem>
2631               <para><emphasis>Dropped:</emphasis> the number of dropped packets (only displayed
2632               if Wireshark was unable to capture all packets)</para>
2633             </listitem>
2634             <listitem>
2635               <para><emphasis>Ignored:</emphasis> the number of ignored packets (only displayed
2636               if packets are ignored)</para>
2637             </listitem>
2638           </itemizedlist>
2639         </para>
2640       </listitem>
2641       <listitem>
2642         <para>
2643           <command>The right side</command> shows the selected configuration profile.
2644           Clicking in this part of the statusbar will bring up a menu with all available
2645           configuration profiles, and selecting from this list will change the configuration profile.
2646         </para>
2647       </listitem>
2648     </itemizedlist>
2649     <para>
2650       <figure id="ChUseWiresharkStatusbarProfile">
2651         <title>The Statusbar with a configuration profile menu</title>
2652         <graphic entityref="WiresharkStatusbarProfile" format="PNG"/>
2653       </figure>
2654       For a detailed description of configuration profiles, see
2655       <xref linkend="ChCustConfigProfilesSection"/>.
2656     </para>
2657     <para>
2658       <figure id="ChUseWiresharkStatusbarSelected">
2659         <title>The Statusbar with a selected protocol field</title>
2660         <graphic entityref="WiresharkStatusbarSelected" format="PNG"/>
2661       </figure>
2662       This is displayed if you have selected a protocol field from the
2663       "Packet Details" pane.
2664     </para>
2665     <tip><title>Tip!</title>
2666     <para>
2667       The value between the brackets (in this example
2668       <command>arp.opcode</command>) can be used as a display filter string,
2669       representing the selected protocol field.
2670     </para>
2671     </tip>
2672     <para>
2673       <figure id="ChUseWiresharkStatusbarFilter">
2674         <title>The Statusbar with a display filter message</title>
2675         <graphic entityref="WiresharkStatusbarFilter" format="PNG"/>
2676       </figure>
2677       This is displayed if you are trying to use a display filter which
2678       may have unexpected results.  For a detailed description, see
2679       <xref linkend="ChWorkBuildDisplayFilterMistake"/>.
2680     </para>
2681
2682   </section>
2683
2684 </chapter>
2685 <!-- End of WSUG Chapter 3 -->