Reading the live traffic

Every row is one exchange: a UDP datagram with its reply, a CoAP request with all its blocks and the response, a whole TCP/HTTP/TLS connection from opening to closing, or a whole DTLS session from the handshake over all its messages until it is closed. The newest message is on top. The page shows the messages that arrive while it is open; reloading it starts with an empty list.

Connections and DTLS sessions that are still running are marked LIVE and updated with every new packet. A session that is quiet for 10 minutes stays open on the server; if it continues later, it gets a new row.

Time: When the server received the message, in your local time. Hover for the full date.
Message: Your payload as text. Bytes that are not printable characters are shown as ·. For HTTP this is the request body, for CoAP the payload of all blocks.
Protocol: The protocol and the server port the message was sent to, for CoAP and HTTP also method, response code and number of blocks.
Sender: The public IP address and port the message came from. With mobile networks this is usually the operator's address (NAT), not your device's own IP. It can change between connections.
Size: Payload: your data (↑ uplink) and reply data (↓ downlink). On air: all bytes of all IP packets of the exchange, including protocol headers, connection setup, acknowledgements and replies. +x % or n× payload: how much more than the payload was transferred (from 100 % on shown as a factor, e.g. 4.2× payload). The bar shows the share of payload in everything that was transferred.

Click a row for the details:

Overhead: On air minus payload: what the protocols cost for your message.
TCP handshake: Time for one complete round trip over the network (server to device and back), measured during the TCP connection setup. A good indicator of the latency of your connection.
TTL: The IP time-to-live value on arrival. The device's start value (often 64 or 255) minus this is roughly the number of routers on the way.
Packets and retransmissions: Each IP packet with direction, size and timing. Retransmissions are packets that had to be sent again, e.g. because of packet loss.
Text / Hex: Switch between the text view and a hex dump of the exact bytes. Copy copies the current view.
DTLS / TLS: For encrypted messages: the handshake result (and why it failed), PSK identity, cipher suite, the cipher suites your device offered, and for DTLS sessions the list of all messages with their replies. The packet list shows each handshake message (ClientHello, ServerHello, Finished, …) and retransmissions.

To find your messages, type part of your sender IP or of your payload into the search field at the top.