Skip to main content

Inspect Network Packet Details

Packet inspection explains one selected packet. TCP Viewer shows a decoded protocol tree next to the raw bytes, using bundled Wireshark libraries for deep field-level details.

Expand decoded fields, search the protocol tree, and inspect matching bytes.

1. Benefits​

  • ✅ Expand network, transport, and application protocol fields.
  • ✅ See the name, value, and meaning of decoded fields.
  • ✅ Match a selected field to its byte range in the hex view.
  • ✅ Search inside a large protocol tree.
  • ✅ Copy one field, a subtree, all details, or selected bytes.
  • ✅ Turn a useful protocol field into a packet table column.

2. Open the inspector​

  1. Start a capture or open a capture file.
  2. Select a packet in the table.
  3. Use the toolbar buttons to show the inspector on the right or below the table.
  4. Expand rows in the protocol tree to reach the field you need.
  5. Select a field to highlight its matching bytes.

TCP Viewer remembers the inspector placement and pane size. A bottom inspector is useful on a wide packet table. A right inspector keeps more vertical room for the packet list.

3. Search and copy details​

Right-click inside the protocol tree to:

  • Copy selected tree items.
  • Copy all tree items.
  • Copy selected bytes as hex and ASCII, a hex dump, UTF-8, ASCII, Base64, a hex stream, MIME data, a C string, a Go literal, or a C array.
  • Expand or collapse all rows.
  • Focus the inspector filter.

Use byte-copy formats carefully. Raw packet content can include tokens, credentials, cookies, or private application data.

4. Create a custom column​

If one field matters across many packets, add it to the table:

  1. Find and select the field in the protocol tree.
  2. Right-click and choose Create Column.
  3. Return to the packet table. TCP Viewer fills the field value for packets where it is available.

Custom and built-in columns can be shown or hidden from the table header menu. TCP Viewer keeps the column layout for later sessions. Restore the defaults from the same menu if the table becomes too busy.

5. When details are incomplete​

A packet may be truncated, malformed, encrypted, or unsupported. Use the Errors quick filter to find packets with decode issues. TCP Viewer still shows the captured bytes and any summary fields it can read.