|menu:Main Toolbar[] ||This menu item hides or shows the main toolbar, see <<ChUseMainToolbarSection>>.
|menu:Filter Toolbar[] ||This menu item hides or shows the filter toolbar, see <<ChUseFilterToolbarSection>>.
|menu:Wireless Toolbar[]||This menu item hides or shows the wireless toolbar. May not be present on some platforms.
|menu:Statusbar[] ||This menu item hides or shows the statusbar, see <<ChUseStatusbarSection>>.
|menu:Packet List[] ||This menu item hides or shows the packet list pane, see <<ChUsePacketListPaneSection>>.
|menu:Packet Details[] ||This menu item hides or shows the packet details pane, see <<ChUsePacketDetailsPaneSection>>.
|menu:Packet Bytes[] ||This menu item hides or shows the packet bytes pane, see <<ChUsePacketBytesPaneSection>>.
|menu:Time Display Format[Date and Time of Day: 1970-01-01 01:02:03.123456]|| Selecting this tells Wireshark to display the time stamps in date and time of day format, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Time of Day: 01:02:03.123456]||Selecting this tells Wireshark to display time stamps in time of day format, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Seconds Since Epoch (1970-01-01): 1234567890.123456]||Selecting this tells Wireshark to display time stamps in seconds since 1970-01-01 00:00:00, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Seconds Since Beginning of Capture: 123.123456]||Selecting this tells Wireshark to display time stamps in seconds since beginning of capture format, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Seconds Since Previous Captured Packet: 1.123456]||Selecting this tells Wireshark to display time stamps in seconds since previous captured packet format, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Seconds Since Previous Displayed Packet: 1.123456]||Selecting this tells Wireshark to display time stamps in seconds since previous displayed packet format, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Automatic (File Format Precision)]||Selecting this tells Wireshark to display time stamps with the precision given by the capture file format used, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Seconds: 0]||Selecting this tells Wireshark to display time stamps with a precision of one second, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[...seconds: 0....]||Selecting this tells Wireshark to display time stamps with a precision of one second, decisecond, centisecond, millisecond, microsecond or nanosecond, see <<ChWorkTimeFormatsSection>>.
|menu:Time Display Format[Display Seconds with hours and minutes]||Selecting this tells Wireshark to display time stamps in seconds, with hours and minutes.
|menu:Name Resolution[Resolve Name]||This item allows you to trigger a name resolve of the current packet only, see <<ChAdvNameResolutionSection>>.
|menu:Name Resolution[Enable for MAC Layer]||This item allows you to control whether or not Wireshark translates MAC addresses into names, see <<ChAdvNameResolutionSection>>.
|menu:Name Resolution[Enable for Network Layer]||This item allows you to control whether or not Wireshark translates network addresses into names, see <<ChAdvNameResolutionSection>>.
|menu:Name Resolution[Enable for Transport Layer]||This item allows you to control whether or not Wireshark translates transport addresses into names, see <<ChAdvNameResolutionSection>>.
|menu:Colorize Packet List[]||This item allows you to control whether or not Wireshark should colorize the packet list.
Enabling colorization will slow down the display of new packets while capturing / loading capture files.
|menu:Auto Scroll in Live Capture[] | |This item allows you to specify that Wireshark should scroll the packet list pane as new packets come in, so you are always looking at the last packet. If you do not specify this, Wireshark simply adds new packets onto the end of the list, but does not scroll the packet list pane.
|menu:Zoom Out[] |kbd:[Ctrl+-] | Zoom out of the packet data (decrease the font size).
|menu:Normal Size[] |kbd:[Ctrl+=] | Set zoom level back to 100% (set font size back to normal).
|menu:Resize All Columns[] |kbd:[Shift+Ctrl+R] | Resize all column widths so the content will fit into it.
Resizing may take a significant amount of time, especially if a large capture file is loaded.
|menu:Displayed Columns[] | |This menu items folds out with a list of all configured columns. These columns can now be shown or hidden in the packet list.
|menu:Expand Subtrees[] |kbd:[Shift+→]|This menu item expands the currently selected subtree in the packet details tree.
|menu:Collapse Subtrees[] |kbd:[Shift+←]|This menu item collapses the currently selected subtree in the packet details tree.
|menu:Expand All[] |kbd:[Ctrl+→] |Wireshark keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item expands all subtrees in all packets in the capture.
|menu:Collapse All[] |kbd:[Ctrl+←] |This menu item collapses the tree view of all packets in the capture list.
|menu:Colorize Conversation[] | |This menu item brings up a submenu that allows you to color packets in the packet list pane based on the addresses of the currently selected packet. This makes it easy to distinguish packets belonging to different conversations. <<ChCustColorizationSection>>.
|menu:Colorize Conversation[Color 1-10] | |These menu items enable one of the ten temporary color filters based on the currently selected conversation.
|menu:Colorize Conversation[Reset coloring] | |This menu item clears all temporary coloring rules.
|menu:Colorize Conversation[New Coloring Rule...] | |This menu item opens a dialog window in which a new permanent coloring rule can be created based on the currently selected conversation.
|menu:Coloring Rules...[] | |This menu item brings up a dialog box that allows you to color packets in the packet list pane according to filter expressions you choose. It can be very useful for spotting certain types of packets, see <<ChCustColorizationSection>>.
|menu:Show Packet in New Window[] | |This menu item brings up the selected packet in a separate window. The separate window shows only the tree view and byte view panes.
|menu:Reload[] |kbd:[Ctrl+R] |This menu item allows you to reload the current capture file.
|menu:Go to Packet...[] |kbd:[Ctrl+G] |Bring up a window frame that allows you to specify a packet number, and then goes to that packet. See <<ChWorkGoToPacketSection>> for details.
|menu:Go to Corresponding Packet[] | |Go to the corresponding packet of the currently selected protocol field. If the selected field doesn’t correspond to a packet, this item is greyed out.
|menu:Previous Packet[] |kbd:[Ctrl+↑]|Move to the previous packet in the list. This can be used to move to the previous packet even if the packet list doesn’t have keyboard focus.
|menu:Next Packet[] |kbd:[Ctrl+↓]|Move to the next packet in the list. This can be used to move to the previous packet even if the packet list doesn’t have keyboard focus.
|menu:Previous Packet In Conversation[] |kbd:[Ctrl+,] |Move to the previous packet in the current conversation. This can be used to move to the previous packet even if the packet list doesn’t have keyboard focus.
|menu:Next Packet In Conversation[] |kbd:[Ctrl+.] |Move to the next packet in the current conversation. This can be used to move to the previous packet even if the packet list doesn’t have keyboard focus.
|menu:Interfaces...[] |kbd:[Ctrl+I] |This menu item brings up a dialog box that shows what’s going on at the network interfaces Wireshark knows of, see <<ChCapInterfaceSection>>) .
|menu:Options...[] |kbd:[Ctrl+K] |This menu item brings up the Capture Options dialog box (discussed further in <<ChCapCaptureOptions>>) and allows you to start capturing packets.
|menu:Start[] |kbd:[Ctrl+E] |Immediately start capturing packets with the same settings than the last time.
|menu:Stop[] |kbd:[Ctrl+E] |This menu item stops the currently running capture, see <<ChCapStopSection>>) .
|menu:Restart[] |kbd:[Ctrl+R] |This menu item stops the currently running capture and starts again with the same options, this is just for convenience.
|menu:Capture Filters...[] | |This menu item brings up a dialog box that allows you to create and edit capture filters. You can name filters, and you can save them for future use. More detail on this subject is provided in <<ChWorkDefineFilterSection>>
|menu:Display Filters...[] ||This menu item brings up a dialog box that allows you to create and edit display filters. You can name filters, and you can save them for future use. More detail on this subject is provided in <<ChWorkDefineFilterSection>>
|menu:Display Filter Macros...[] ||This menu item brings up a dialog box that allows you to create and edit display filter macros. You can name filter macros, and you can save them for future use. More detail on this subject is provided in <<ChWorkDefineFilterMacrosSection>>
|menu:Apply as Column[] ||This menu item adds the selected protocol item in the packet details pane as a column to the packet list.
|menu:Apply as Filter[...] ||These menu items will change the current display filter and apply the changed filter immediately. Depending on the chosen menu item, the current display filter string will be replaced or appended to by the selected protocol field in the packet details pane.
|menu:Prepare a Filter[...] ||These menu items will change the current display filter but won’t apply the changed filter. Depending on the chosen menu item, the current display filter string will be replaced or appended to by the selected protocol field in the packet details pane.
|menu:Enabled Protocols...[] |kbd:[Shift+Ctrl+E]|This menu item allows the user to enable/disable protocol dissectors, see <<ChAdvEnabledProtocols>>
|menu:Decode As...[] ||This menu item allows the user to force Wireshark to decode certain packets as a particular protocol, see <<ChAdvDecodeAs>>
|menu:User Specified Decodes...[] ||This menu item allows the user to force Wireshark to decode certain packets as a particular protocol, see <<ChAdvDecodeAsShow>>
|menu:Follow[TCP Stream] ||This menu item brings up a separate window and displays all the TCP segments captured that are on the same TCP connection as a selected packet, see <<ChAdvFollowStreamSection>>
|menu:Follow[UDP Stream] ||Same functionality as “Follow TCP Stream” but for UDP streams.
|menu:Follow[SSL Stream] ||Same functionality as “Follow TCP Stream” but for SSL streams. See the wiki page on link:{wireshark-wiki-url}SSL[SSL] for instructions on providing SSL keys.
|menu:Follow[HTTP Stream] ||Same functionality as “Follow TCP Stream” but for HTTP streams.
|menu:Expert Info[] ||Open a dialog showing some expert information about the captured packets. The amount of information will depend on the protocol and varies from very detailed to non-existent. XXX - add a new section about this and link from here
|menu:Conversation Filter[...] ||In this menu you will find conversation filter for various protocols.
|menu:Firewall ACL Rules[]|| This allows you to create command-line ACL rules for many different firewall products, including Cisco IOS, Linux Netfilter (iptables), OpenBSD pf and Windows Firewall (via netsh). Rules for MAC addresses, IPv4 addresses, TCP and UDP ports, and IPv4+port combinations are supported.
It is assumed that the rules will be applied to an outside interface.
|menu:Lua[]|| These options allow you to work with the Lua interpreter optionally build into Wireshark. See the “Lua Support in Wireshark” in the Wireshark Developer’s Guide.
|menu:About Wireshark[]|| This menu item brings up an information window that provides various detailed information items on Wireshark, such as how it’s built, the plugins loaded, the used folders, ...
|image:wsug_graphics/toolbar/capture_interfaces_24.png[{toolbar-icon-attrs}] |btn:[Interfaces...]|menu:Capture[Interfaces...]| This item brings up the Capture Interfaces List dialog box (discussed further in <<ChCapCapturingSection>>).
|image:wsug_graphics/toolbar/capture_options_24.png[{toolbar-icon-attrs}] |btn:[Options...]|menu:Capture[Options...]| This item brings up the Capture Options dialog box (discussed further in <<ChCapCapturingSection>>) and allows you to start capturing packets.
|image:wsug_graphics/toolbar/capture_start_24.png[{toolbar-icon-attrs}] |btn:[Start]|menu:Capture[Start]| This item starts capturing packets with the options from the last time.
|image:wsug_graphics/toolbar/capture_stop_24.png[{toolbar-icon-attrs}] |btn:[Stop]|menu:Capture[Stop]| This item stops the currently running live capture process <<ChCapCapturingSection>>).
|image:wsug_graphics/toolbar/capture_restart_24.png[{toolbar-icon-attrs}] |btn:[Restart]|menu:Capture[Restart]| This item stops the currently running live capture process and restarts it again, for convenience.
|image:wsug_graphics/toolbar/stock_open_24.png[{toolbar-icon-attrs}] |btn:[Open...]|menu:File[Open...]| This item brings up the file open dialog box that allows you to load a capture file for viewing. It is discussed in more detail in <<ChIOOpen>>.
|image:wsug_graphics/toolbar/stock_save_as_24.png[{toolbar-icon-attrs}] |btn:[Save As...]|menu:File[Save As...]| This item allows you to save the current capture file to whatever file you would like. It pops up the Save Capture File As dialog box (which is discussed further in <<ChIOSaveAs>>).
|image:wsug_graphics/toolbar/stock_close_24.png[{toolbar-icon-attrs}] |btn:[Close]|menu:File[Close]|This item closes the current capture. If you have not saved the capture, you will be asked to save it first.
|image:wsug_graphics/toolbar/stock_refresh_24.png[{toolbar-icon-attrs}] |btn:[Reload]|menu:View[Reload]| This item allows you to reload the current capture file.
|image:wsug_graphics/toolbar/stock_print_24.png[{toolbar-icon-attrs}] |btn:[Print...]|menu:File[Print...]| This item allows you to print all (or some of) the packets in the capture file. It pops up the Wireshark Print dialog box (which is discussed further in <<ChIOPrintSection>>).
|image:wsug_graphics/toolbar/stock_search_24.png[{toolbar-icon-attrs}] |btn:[Find Packet...]|menu:Edit[Find Packet...]|This item brings up a dialog box that allows you to find a packet. There is further information on finding packets in <<ChWorkFindPacketSection>>.
|image:wsug_graphics/toolbar/stock_left_arrow_24.png[{toolbar-icon-attrs}] |btn:[Go Back]|menu:Go[Go Back]|This item jumps back in the packet history. Hold down the Alt key (Option on macOS) to go back in the selection history.
|image:wsug_graphics/toolbar/stock_right_arrow_24.png[{toolbar-icon-attrs}] |btn:[Go Forward]|menu:Go[Go Forward]|This item jumps forward in the packet history. Hold down the Alt key (Option on macOS) to go forward in the selection history.
|image:wsug_graphics/toolbar/stock_jump_to_24.png[{toolbar-icon-attrs}] |btn:[Go to Packet...]|menu:Go[Go to Packet...]| This item brings up a dialog box that allows you to specify a packet number to go to that packet.
|image:wsug_graphics/toolbar/stock_top_24.png[{toolbar-icon-attrs}] |btn:[Go To First Packet]|menu:Go[First Packet]| This item jumps to the first packet of the capture file.
|image:wsug_graphics/toolbar/stock_bottom_24.png[{toolbar-icon-attrs}] |btn:[Go To Last Packet]|menu:Go[Last Packet]| This item jumps to the last packet of the capture file.
|image:wsug_graphics/toolbar/colorize_24.png[{toolbar-icon-attrs}] |btn:[Colorize]|menu:View[Colorize]| Colorize the packet list (or not).
|image:wsug_graphics/toolbar/autoscroll_24.png[{toolbar-icon-attrs}] |btn:[Auto Scroll in Live Capture]|menu:View[Auto Scroll in Live Capture]| Auto scroll packet list while doing a live capture (or not).
|image:wsug_graphics/toolbar/stock_zoom_in_24.png[{toolbar-icon-attrs}] |btn:[Zoom In]|menu:View[Zoom In]| Zoom into the packet data (increase the font size).
|image:wsug_graphics/toolbar/stock_zoom_in_24.png[{toolbar-icon-attrs}] |btn:[Zoom Out]|menu:View[Zoom Out]| Zoom out of the packet data (decrease the font size).
|image:wsug_graphics/toolbar/stock_zoom_1_24.png[{toolbar-icon-attrs}] |btn:[Normal Size]|menu:View[Normal Size]| Set zoom level back to 100%.
|image:wsug_graphics/toolbar/resize_columns_24.png[{toolbar-icon-attrs}] |btn:[Resize Columns]|menu:View[Resize Columns]| Resize columns, so the content fits into them.
|image:wsug_graphics/toolbar/capture_filter_24.png[{toolbar-icon-attrs}] |btn:[Capture Filters...]|menu:Capture[Capture Filters...]| This item brings up a dialog box that allows you to create and edit capture filters. You can name filters, and you can save them for future use. More detail on this subject is provided in <<ChWorkDefineFilterSection>>.
|image:wsug_graphics/toolbar/display_filter_24.png[{toolbar-icon-attrs}] |btn:[Display Filters...]|menu:Analyze[Display Filters...]| This item brings up a dialog box that allows you to create and edit display filters. You can name filters, and you can save them for future use. More detail on this subject is provided in <<ChWorkDefineFilterSection>>.
|image:wsug_graphics/toolbar/stock_colorselector_24.png[{toolbar-icon-attrs}]|btn:[Coloring Rules...]|menu:View[Coloring Rules...]| This item brings up a dialog box that allows you to color packets in the packet list pane according to filter expressions you choose. It can be very useful for spotting certain types of packets. More detail on this subject is provided in <<ChCustColorizationSection>>.
|image:wsug_graphics/toolbar/stock_preferences_24.png[{toolbar-icon-attrs}] |btn:[Preferences...]|menu:Edit[Preferences]| This item brings up a dialog box that allows you to set preferences for many parameters that control Wireshark. You can also save your preferences so Wireshark will use them the next time you start it. More detail is provided in <<ChCustPreferencesSection>>
|image:wsug_graphics/toolbar/stock_help_24.png[{toolbar-icon-attrs}] |btn:[Help]|menu:Help[Contents]| This item brings up help dialog box.
|image:wsug_graphics/toolbar/display_filter_24.png[{toolbar-icon-attrs}]|btn:[Filter:]|Brings up the filter construction dialog, described in <<FiltersDialog>>.
||_Filter input_|The area to enter or edit a display filter string, see <<ChWorkBuildDisplayFilterSection>>. A syntax check of your filter string is done while you are typing. The background will turn red if you enter an incomplete or invalid string, and will become green when you enter a valid string. You can click on the pull down arrow to select a previously-entered filter string from a list. The entries in the pull down list will remain available even after a program restart.
|image:wsug_graphics/toolbar/stock_add_24.png[{toolbar-icon-attrs}] |btn:[Expression...]|The middle button labeled “Add Expression...” opens a dialog box that lets you edit a display filter from a list of protocol fields, described in <<ChWorkFilterAddExpressionSection>>