Chapter 3. Using Ethereal

Protocol Properties...

The menu item takes you to the protocol properties dialog if there are properties associated with the highlighted fields. More information on preferences can be found in Figure 3-29.

Match Selected

This menu item allows you to select all packets that have a matching value in the field selected in the tree view pane (middle pane).

Collapse All

Ethereal keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item collapses the tree view of all packets in the capture list.

Expand All

This menu item expands all subtrees in all packets in the capture.

Display Options

You can control the way that Ethereal displays a number of items. You manage these by selecting the Options menu item from the Display menu. When you do this, Ethereal pops up the Display Options dialog box, as shown in Figure 3-14.

Figure 3-14. Ethereal Display Options dialog box

The following are the items on this dialog box and their meanings:

64

Chapter 3. Using Ethereal

Time of day

Selecting this radio button tells Ethereal to display time stamps in time of day format. This field, Date and time of day, Seconds since beginning of capture and Seconds since previous frame are mutually exclusive.

Date and time of day

Selecting this radia button tells Ethereal to display the time stamps in date and time of day format. Time of day, this field, Seconds since beginning of capture and Seconds since previous frame are mutually exclusive.

Seconds since beginning of capture

Selecting this radio button tells Ethereal to display time stamps in seconds since beginning of capture format. Time of day, Date and time of day, this field, and Seconds since previous frame are mutually exclusive.

Seconds since previous frame

This radio button tells Ethereal to display time stamps in seconds since previous frame format. Time of day, Date and time of day, Seconds since beginning of capture and this field are mutually exclusive.

Automatic scrolling in live capture

This field, when selected, tells Ethereal to scroll the packet list pane when new packets are captured.

Enable MAC name resolution

This field, when selected, tells Ethereal to translate the first three octets of MAC addresses (the vendor identifier) into names (where it can) when displaying packets.

Enable network name resolution

This field, when selected, tells Ethereal to translate ip addresses into domain names (where it can) when displaying packets.

Note: If you select this option and your DNS server is unavailable then ethereal will be very slow as it times out waiting for responses from your DNS server.

Enable transport name resolution

This field, when selected, tells Ethereal to translate the transport layer addresses ( TCP/UDP port numbers) into well known service names (where it can) when displaying packets.

65