1) after adding the field and choosing the number. Click on the Left column in the overview above on the field you just added. Then you can change them. Yep annoying. (You can reorder field by dragging them arround there too)
2) Select the Src Port or Dst Port with the attribute 'unresolved'
3) A TCP link starts with a Syn, the response should be Syn+Ack and the final acceptance = Ack on that.
4) Relative offsets in the Up & down stream. During Syn these number are synchronised. And the max difference between the Seq# and the Ack# is the sending window, or "data underway".
If they are equal there is no data underway and nothing is missing.
5) Rightclick on a packet. You can choose: Colorize Conversation to let them spring out in color, or you can filter them or you can follow the stream (which effectively takes all the data out of the packets and shows it)..
Hope it helps.
