What the detail pane shows#

Select a frame in the packet list, and the workspace loads its details into the pane on the right. The pane carries up to five tabs across the top. Each tab is a different way to read the same frame. Layered View and Raw Data are always present. Sequence, Stream, and Certificate appear only when the selected frame supports them.

Tabs in the detail pane#

Tab	What it shows	When it is available
Layered View	A protocol-by-protocol breakdown of the frame, layer by layer.	Always.
Raw Data	A hex dump with offset, hex, and ASCII columns.	Always.
Sequence	A timeline of the TCP conversation the frame is part of.	Only when the frame has a TCP stream ID.
Stream	The reassembled payload the two sides of a TCP conversation exchanged.	Only for a live-captured TCP frame.
Certificate	Decoded X.509 certificate details from a TLS handshake.	Only when the frame contains TLS certificates.

Switch between tabs#

Select any tab at the top of the pane to change the view. The selected tab stays with the current frame. When you select a different frame, the pane keeps the same tab if the new frame supports it. If the new frame does not support it, for example a UDP frame after a TCP one, the pane falls back to Layered View.

The pane is empty when you select no frame. It shows a brief 'Loading packet details' state while the workspace decodes the details.

When to use each tab#

• Use Layered View when you need to read individual fields (TTL, port, flag bits, certificate validity).
• Use Raw Data when you want to verify the actual bytes, copy a region, or jump to a specific offset.
• Use Sequence when you want to see how a TCP conversation unfolded in time, including handshake, data transfer, and teardown.
• Use Stream when you want to read the payload a TCP conversation carried, reassembled into one readable exchange.
• Use Certificate when you inspect a TLS handshake and want to read the certificate chain without a manual decode of the bytes.