2

Currently learning to use Wireshark.

When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane:

Frame
Linux Cooked Capture
Internet Protocol Version 4
User Datagram Protocol

When I click '"Frame" I see a list of the following elements:

Interface Id: 0
Encapsulation Type: Linux cooked-mode-capture
Arrival Time: Oct 25, 2018 15:53:08.775646000 IST
[Time shift for this packet: 0.00000000000 seconds]
Epoch Time: 1540479188.775656000 seconds 
[Time delta from previous captured frame: 0.355555530000 seconds]
[Time delta from previous displayed frame: 0.00000000000 seconds]
Frame number: 12
Frame length: 45 bytes (360 bits)
Capture length: 45 bytes (360 bits) My question
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: sll:ethertype:ip:udp]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]

Naturally I wanted to know what "Frame" relates to so I did a quick google for the following:

"What does frame in Wireshark related to?" 

This led me to the following source: https://wiki.wireshark.org/Protocols/frame which states:

The frame protocol is not a real protocol, but is is used by Wireshark as a base,
for all the other protocols on top of it. It shows information from capturing,
such as the exact time a specific frame was captured. You could think of it as a,
pseudo dissector.

I interpret the above statement as saying that "Frame" is not data that was actually being transmitted from point(A) to point(B) when I was taking the capture, but is some sore of container upon which Wireshark "builds" the captured data to show me.

My question: Is Frame an internal Wireshark used to assist the user to easily see some global information about the packet of interest and some Wireshark configuration data OR is Frame a networking protocol in and of itself?

To clarify, is this Wiresharks representation of the physical layer of the OSI protocol?

Additionally, as this may be useful to other readers in the future; feel free to comment on what each of the following mean (Note: I initially start out with my guess in the OP but will update as I learn more from the answers and other sources)

Interface Id: 0 (The ID of the interface on which the packet was captured?)

Encapsulation Type: Linux cooked-mode-capture (I have no idea what this is?)

Arrival Time: Oct 25, 2018 15:53:08.775646000 IST (The exact time the packet was captured at?)

[Time shift for this packet: 0.00000000000 seconds] (No idea?)

Epoch Time: 1540479188.775656000 seconds (No idea)?

[Time delta from previous captured frame: 0.355555530000 seconds] (Time difference between this captured "Frame" and the last captured "Frame"?)

[Time delta from previous displayed frame: 0.00000000000 seconds] (Time difference between this displayed frame and the last, 0 as this is the first packet in the capture?)

Frame number: 12 (This is the first packet in the capture so why does is have number 12?)

Frame length: 45 bytes (360 bits)

Capture length: 45 bytes (360 bits) My question

[Frame is marked: False] (No idea?)

[Frame is ignored: False] (No idea?)

[Protocols in frame: sll:ethertype:ip:udp] (Protocols found in this packet?)

[Coloring Rule Name: UDP] (The name of the rule set by the Wireshark user to color packets like this one)

[Coloring Rule String: udp] (Like aboe, relates to a user specified colouring rule in Wireshark config)
5

In this context, Frame refers to the metadata that Wireshark gathers about the data it sees. It's derived from, but not a part of, any common protocol like Ethernet.

In other contexts, "Frame" is also used to denote a layer 2 protocol data unit.

  • I appreciate your reply. Thank you. The initial confusion I had actually came from the fact that I had heard of Frames before and associated them with the Data Link Layer. From your answer I now understand that Frame can be used in different contexts, in this case "Frame" happens to be the term Wireshark uses for a collection of packet meta-data it displays in the 'packet details' window, and that the word "Frame" is completely unrelated to any protocol etc... in this context. – MarkMark Oct 25 '18 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.