Sniffer® Portable Professional User's Guide - NetScout

Chapter 8
162 Sniffer Portable Professional
The Expert Detail pane is a collection of information tables for the
data selected by the other panes. The content of the Expert Detail
pane will vary, depending on what items are selected in the various
other panes.
Postcapture Decode Display
The Decode tab provides classic, line-by-line protocol interpretation of
network data. When you display the contents of the capture buffer or a
capture file, Sniffer Portable Professional interprets and decodes the
higher-level protocols within the captured packets using its protocol
interpreters. The Decode tab shows the results of this protocol analysis.
It displays packets in three color-coded viewing panes: summary, detail,
and hex:
The summary pane shows an overview of the packets captured in
line-by-line summarized format.
The detail pane displays the detailed contents of the packet
currently selected in the summary pane. Each layer of the protocol
is interpreted and displayed.
You can display the detailed protocol layers in three different views
— fully expanded decode, one-line summary, or a mixture of the
two.
By default, Sniffer Portable Professional expands underlying
protocol layers in the detail pane. To save viewing space, click the
minus (-) sign in front of the protocol sublayer line. To expand the
protocol display again, click the plus (+) sign.
The hex pane shows the selected packet in hexadecimal and ASCII
(or EBCDIC) format.
When you select a packet on the summary pane, or a detailed
protocol field in the detail pane, the equivalent hexadecimal octets
in the packet are highlighted in the hex pane. This quickly shows
you the correspondence between the protocol field and its
equivalent bytes in the packet.
Figure 8-2 shows a sample Decode display.