Start

The Start menu item and button bar are used to start the capture of packets and the reconstruction of sessions.

Note: This item will not be available until the storage location has been set and an input device has been selected.

Session reconstruction begins as soon as a complete session has been captured. Sessions can be selected and viewed as soon as they appear in the tree. The session tree cannot be saved until the capture has been Stopped. Therefore it is recommended that you wait until the capture has been stopped and the session tree has been saved before browsing sessions. Performance of session browsing will also be better when not competing with the capture of packets.

When capturing packets from a network device, the capture will not end until the Stop menu item has been selected. Capture statistics will be displayed at the bottom of the window while session capturing is enabled and the LED in the bottom left corner will flash green.

When capturing from a PCAP file, the capture session will end automatically when the end of the file has been reached. The session can be terminated before the end of the file is reached by selecting the Stop menu item. Sessions can be browsed during capture, just as when capturing from a device. Performance tends to be slower, because packets are read faster from the hard drive and less processor is available for browsing sessions.

Several device or file captures can be chained together into one session tree. Remember to save the session tree again, anytime that information has been added.