Because packet analyzers capture entire data link frames from the wire, you can use their sophisticated software modules to decode these frames and the encapsulated packets, enabling you to examine them for protocol and application problems. (See Figure 21.2 for a sample decode window.) The fact that software analyzers are not hard-coded into chips makes them extremely flexible; you can evaluate and purchase different ones as you need them, install them on a laptop, and use the one that seems to best suit the problem at hand.
Figure 21.2. Decoding the reply packet for an ARP (Address Resolution Protocol) exchange.