The packet bytes pane shows the data of the current packet (selected in the “Packet List” pane) in a hexdump style.
The “Packet Bytes” pane shows a canonical hex dump of the packet data. Each line contains the data offset, sixteen hexadecimal bytes, and sixteen ASCII bytes. Non-printable bytes are replaced with a period (“.”).
Depending on the packet data, sometimes more than one page is available, e.g. when Wireshark has reassembled some packets into a single chunk of data. (See Section 7.8, “Packet Reassembly” for details). In this case you can see each data source by clicking its corresponding tab at the bottom of the pane.
The default mode for viewing will highlight the bytes for a field where the mouse pointer is hovering above. The highlight will follow the mouse cursor as it moves. If this highlighting is not required or wanted, there are two methods for deactivating the functionality:
- Temporary By holding down the Ctrl button while moving the mouse, the highlighted field will not change
- Permanently Using the context menu (right mouse click) the hover highlighting may be activated/deactivated. This setting is stored in the selected profile recent file.
Additional tabs typically contain data reassembled from multiple packets or decrypted data.