Packet Tracer operating modes reflect the network time scheme.
In Realtime Mode, your network runs in a model of real time, within the limits of the protocol models used. The network responds to your actions immediately as they would in a real device. For example, as soon as you make an Ethernet connection, the link lights for that connection will appear, showing the connection state (see the "Connections/Links" page for details). Whenever you type a command in the CLI (such as ping or show), the result or response is generated in real time and you see it as such. All network activity, particularly the flow of PDUs across the network, happens in the Packet Tracer model of real time.
In Simulation Mode, you can "freeze" time -- you have direct control over time related to the flow of PDUs. You can see the network run step by step, or event by event, however quickly or slowly you like. You can set up scenarios, such as sending a ping packet from one device to another. However, nothing "runs" until you capture it (the first time through, as with a protocol sniffer) or play it (re-playing the captured events as an animation). When you capture or play the simulation, you will see graphical representations of packets traveling from one device to another. You can pause the simulation, or step forward or backward in time, investigating many types of information on specific PDUs and devices at specific times. However, other aspects of the network will still run in real time. For example, if you turn off a port, its link light will respond immediately by turning red.