# Navigating Wireshark

Wireshark is the industry standard for network protocol analysis. It allows you to see what's happening on your network at a microscopic level. It is the de facto standard across many commercial and non-profit enterprises, government agencies, and educational institutions.

## The GUI Layout
When you open a packet capture (PCAP) in Wireshark, the interface is divided into three main panes:

1.  **Packet List Pane (Top):** This pane displays a summary of each packet captured. By default, it shows the packet number, time, source IP address, destination IP address, protocol, length, and detailed information. Clicking on a packet in this pane controls what is displayed in the other two panes.
2.  **Packet Details Pane (Middle):** This pane shows the current packet, broken down layer by layer, closely mirroring the OSI and TCP/IP models. You can expand each layer (e.g., Ethernet II, IPv4, TCP) to see the specific hex values and how Wireshark interprets them.
3.  **Packet Bytes Pane (Bottom):** This pane displays the raw, uninterpreted data of the selected packet in hexadecimal and ASCII format. When you select a field in the *Details Pane*, the corresponding bytes are highlighted in the *Bytes Pane*.

## Basic Navigation and Sorting
*   **Time Column:** By default, the Time column shows the seconds since the beginning of the capture. You can change this via `View -> Time Display Format` to show the actual Time of Day (e.g., `14:32:05.123`).
*   **Sorting:** You can click on the headers in the Packet List pane to sort by Source IP, Destination IP, Protocol, or Length. This is useful for quickly finding the largest packets or sorting traffic by protocol.
*   **Finding Packets:** You can use `Ctrl+F` (or `Cmd+F`) to search for specific strings, hex values, or display filters within the current capture.

## Color Coding
Wireshark uses color-coding to help you quickly identify different types of traffic.
*   **Green:** Typically, HTTP or routing traffic.
*   **Light Blue:** UDP traffic (like DNS lookups).
*   **Dark Blue/Purple:** TCP traffic.
*   **Black/Red:** Packets with errors, warnings, or bad checksums (e.g., a TCP Retransmission or out-of-order packet).

*Note: You can customize these coloring rules in `View -> Coloring Rules`.*