3.7. The “View” Menu
Prev | Chapter 3. User Interface | Next

## 3.7. The “View” Menu

The Wireshark View menu contains the fields shown in Table 3.4, “View menu items”.

Figure 3.5. The “View” Menu

Table 3.4. View menu items

Menu Item | Accelerator | Description
--- | --- | ---
Main Toolbar |  | This menu item hides or shows the main toolbar, see Section 3.16, “The “Main” Toolbar”.
Filter Toolbar |  | This menu item hides or shows the filter toolbar, see Section 3.17, “The “Filter” Toolbar”.
Wireless Toolbar |  | This menu item hides or shows the wireless toolbar. May not be present on some platforms.
Statusbar |  | This menu item hides or shows the statusbar, see Section 3.22, “The Statusbar”.
Packet List |  | This menu item hides or shows the packet list pane, see Section 3.18, “The “Packet List” Pane”.
Packet Details |  | This menu item hides or shows the packet details pane, see Section 3.19, “The “Packet Details” Pane”.
Packet Bytes |  | This menu item hides or shows the packet bytes pane, see Section 3.20, “The “Packet Bytes” Pane”.
Packet Diagram |  | This menu item hides or shows the packet diagram pane. See Section 3.21, “The “Packet Diagram” Pane”.
Time Display Format → Date and Time of Day: 1970-01-01 01:02:03.123456 |  | Selecting this tells Wireshark to display the time stamps in date and time of day format, see Section 6.12, “Time Display Formats And Time References”. The fields “Time of Day”, “Date and Time of Day”, “Seconds Since First Captured Packet”, “Seconds Since Previous Captured Packet” and “Seconds Since Previous Displayed Packet” are mutually exclusive.
Time Display Format → Time of Day: 01:02:03.123456 |  | Selecting this tells Wireshark to display time stamps in time of day format, see Section 6.12, “Time Display Formats And Time References”.
Time Display Format → Seconds Since Epoch (1970-01-01): 1234567890.123456 |  | Selecting this tells Wireshark to display time stamps in seconds since 1970-01-01 00:00:00, see Section 6.12, “Time Display Formats And Time References”.
Time Display Format → Seconds Since First Captured Packet: 123.123456 |  | Selecting this tells Wireshark to display time stamps in seconds since first captured packet format, see Section 6.12, “Time Display Formats And Time References”.
Time Display Format → Seconds Since Previous Captured Packet: 1.123456 |  | Selecting this tells Wireshark to display time stamps in seconds since previous captured packet format, see Section 6.12, “Time Display Formats And Time References”.
Time Display Format → Seconds Since Previous Displayed Packet: 1.123456 |  | Selecting this tells Wireshark to display time stamps in seconds since previous displayed packet format, see Section 6.12, “Time Display Formats And Time References”.
Time Display Format → Automatic (File Format Precision) |  | Selecting this tells Wireshark to display time stamps with the precision given by the capture file format used, see Section 6.12, “Time Display Formats And Time References”. The fields “Automatic”, “Seconds” and “…​seconds” are mutually exclusive.
Time Display Format → Seconds: 0 |  | Selecting this tells Wireshark to display time stamps with a precision of one second, see Section 6.12, “Time Display Formats And Time References”.
Time Display Format → …​seconds: 0…​. |  | Selecting this tells Wireshark to display time stamps with a precision of one second, decisecond, centisecond, millisecond, microsecond or nanosecond, see Section 6.12, “Time Display Formats And Time References”.
Time Display Format → Display Seconds with hours and minutes |  | Selecting this tells Wireshark to display time stamps in seconds, with hours and minutes.
Name Resolution → Edit Resolved Name |  | This item allows you to manually enter names to resolve IP addresses in the current packet, see Section 7.9, “Name Resolution”.
Name Resolution → Enable for MAC Layer |  | This item allows you to control whether or not Wireshark translates MAC addresses into names, see Section 7.9, “Name Resolution”.
Name Resolution → Enable for Network Layer |  | This item allows you to control whether or not Wireshark translates network addresses into names, see Section 7.9, “Name Resolution”.
Name Resolution → Enable for Transport Layer |  | This item allows you to control whether or not Wireshark translates transport addresses into names, see Section 7.9, “Name Resolution”.
Zoom In | Ctrl++ or Ctrl+= | Zoom into the packet data (increase the font size).
Zoom Out | Ctrl+- | Zoom out of the packet data (decrease the font size).
Normal Size | Ctrl+0 | Set zoom level back to 100% (set font size back to normal).
Expand Subtrees | Shift+→ | This menu item expands the currently selected subtree in the packet details tree.
Collapse Subtrees | Shift+← | This menu item collapses the currently selected subtree in the packet details tree.
Expand All | Ctrl+→ | Wireshark keeps a list of all the protocol subtrees that are expanded, and uses it to ensure that the correct subtrees are expanded when you display a packet. This menu item expands all subtrees in all packets in the capture.
Collapse All | Ctrl+← | This menu item collapses the tree view of all packets in the capture list.
Colorize Packet List |  | This item allows you to control whether or not Wireshark should colorize the packet list. Enabling colorization will slow down the display of new packets while capturing or loading capture files.
Colorize Conversation |  | This menu item brings up a submenu that allows you to color packets in the packet list pane based on the addresses of the currently selected packet. This makes it easy to distinguish packets belonging to different conversations. See Section 11.3, “Packet colorization”.
Colorize Conversation → Color 1-10 |  | These menu items enable one of the ten temporary color filters based on the currently selected conversation.
Colorize Conversation → Reset coloring |  | This menu item clears all temporary coloring rules.
Colorize Conversation → New Coloring Rule…​ |  | This menu item opens a dialog window in which a new permanent coloring rule can be created based on the currently selected conversation.
Coloring Rules…​ |  | This menu item brings up a dialog box that allows you to color packets in the packet list pane according to filter expressions you choose. It can be very useful for spotting certain types of packets, see Section 11.3, “Packet colorization”.
Resize All Columns | Shift+Ctrl+R | Resize all column widths so the content will fit into it. Resizing may take a significant amount of time, especially if a large capture file is loaded.
Internals |  | Information about various internal data structures. See Table 3.5, “Internals menu items” below for more information.
Show Packet in New Window |  | Shows the selected packet in a separate window. The separate window shows only the packet details and bytes of that packet, and will continue to do so even if another packet is selected in the main window. See Figure 6.2, “Viewing a packet in a separate window” for details.
Redissect Packets |  | This menu item redissects the current packets. This can be useful if name resolution or decryption information has changed.
Reload as File Format/Capture | Shift+Ctrl+F | This menu item allows you to switch between viewing the list of frames contained in the current capture file (normal mode) and viewing its internal structure, if supported for the current file type.
Reload | Ctrl+R | This menu item allows you to reload the current capture file.

Table 3.5. Internals menu items

Menu Item | Description
--- | ---
Conversation Hash Tables | Shows the tuples (address and port combinations) used to identify each conversation.
Dissector Tables | Shows tables of subdissector relationships.
Supported Protocols | Displays supported protocols and protocol fields.

Prev | Up | Next
3.6. The “Edit” Menu | Home | 3.8. The “Go” Menu