LayerView: Low Level View.

LayerView's Low Level View shows you a detailed breakdown of every packet which your NIC sends and receives. Depending on your network setup, it may also show network traffic to and from other computers on the network too.

The Low Level View can be accessed by clicking the Low Level toolbar button: or by opening the View menu and selecting Low Level. It is also the default view.

The Low Level View can be split into three component parts:

1. The Packet List

The Packet List provides a summary list of every packet captured.
You can select a packet from this list to analyze in depth. Your selection affects the protocol breakdown and raw dump views described below.
The columns in the list are as follows:
Packet # - The unique number LayerView assigned to the packet (in time order)
Time - The system time (incl. milliseconds) when the packet was captured
Protocol - A summary of the low-layer protocols used in the packet
Src MAC - The ethernet hardware address (MAC address) of the sender
Dst MAC - The MAC address of the receiver
Src IP - For IPv4 / IPv6 packets, the source IP given in the packet
Dst IP - For IPv4 / IPv6 packets, the destination IP given in the packet
Src Port - For TCP / UDP packets, the source port given in the packet
Dst Port - For TCP / UDP packets, the destination port given in the packet

For further options relating to a specific packet, such as to follow a TCP or UDP stream, right-click the packet to display a context menu.

2. The Protocol Breakdown Lists

The Protocol Breakdown Lists show which protocols are in use and give a detailed analysis of the data they contain.
The four lists refer to, from left to right:
  • The Link Layer (for example Ethernet)
  • The Network Layer (for example IPv4)
  • The Transport Layer (for example TCP)
  • The Application Layer (for example HTTP)
For example in the above analysis you can see that an HTTP query was sent to IP address 209.85.227.104 (Network Layer) to port 80 (Transport Layer), and that the HTTP version used was 1.1 (Application Layer).
When a particular data item is selected from the Link, Network or Transport Layer lists, the location of the option selected will be highlighted in the Raw Dump view below.

3. The Raw Dump View

The Raw Dump View shows the entire packet contents in both hex-dump and text formats.
Both the hex-dump and text can be selected and copied to the clipboard.
When a data item is selected from the Protocol Breakdown lists, the location of the selected item is shown in red.