Currently learning to use Wireshark.
When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane:
Frame
Linux Cooked Capture
Internet Protocol Version 4
User Datagram Protocol
When I click '"Frame" I see a list of the following elements:
Interface Id: 0
Encapsulation Type: Linux cooked-mode-capture
Arrival Time: Oct 25, 2018 15:53:08.775646000 IST
[Time shift for this packet: 0.00000000000 seconds]
Epoch Time: 1540479188.775656000 seconds
[Time delta from previous captured frame: 0.355555530000 seconds]
[Time delta from previous displayed frame: 0.00000000000 seconds]
Frame number: 12
Frame length: 45 bytes (360 bits)
Capture length: 45 bytes (360 bits) My question
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: sll:ethertype:ip:udp]
[Coloring Rule Name: UDP]
[Coloring Rule String: udp]
Naturally I wanted to know what "Frame" relates to so I did a quick google for the following:
"What does frame in Wireshark related to?"
This led me to the following source: https://wiki.wireshark.org/Protocols/frame which states:
The frame protocol is not a real protocol, but is is used by Wireshark as a base,
for all the other protocols on top of it. It shows information from capturing,
such as the exact time a specific frame was captured. You could think of it as a,
pseudo dissector.
I interpret the above statement as saying that "Frame" is not data that was actually being transmitted from point(A) to point(B) when I was taking the capture, but is some sore of container upon which Wireshark "builds" the captured data to show me.
My question: Is Frame an internal Wireshark used to assist the user to easily see some global information about the packet of interest and some Wireshark configuration data OR is Frame a networking protocol in and of itself?
To clarify, is this Wiresharks representation of the physical layer of the OSI protocol?
Additionally, as this may be useful to other readers in the future; feel free to comment on what each of the following mean (Note: I initially start out with my guess in the OP but will update as I learn more from the answers and other sources)
Interface Id: 0 (The ID of the interface on which the packet was captured?)
Encapsulation Type: Linux cooked-mode-capture (I have no idea what this is?)
Arrival Time: Oct 25, 2018 15:53:08.775646000 IST (The exact time the packet was captured at?)
[Time shift for this packet: 0.00000000000 seconds] (No idea?)
Epoch Time: 1540479188.775656000 seconds (No idea)?
[Time delta from previous captured frame: 0.355555530000 seconds] (Time difference between this captured "Frame" and the last captured "Frame"?)
[Time delta from previous displayed frame: 0.00000000000 seconds] (Time difference between this displayed frame and the last, 0 as this is the first packet in the capture?)
Frame number: 12 (This is the first packet in the capture so why does is have number 12?)
Frame length: 45 bytes (360 bits)
Capture length: 45 bytes (360 bits) My question
[Frame is marked: False] (No idea?)
[Frame is ignored: False] (No idea?)
[Protocols in frame: sll:ethertype:ip:udp] (Protocols found in this packet?)
[Coloring Rule Name: UDP] (The name of the rule set by the Wireshark user to color packets like this one)
[Coloring Rule String: udp] (Like aboe, relates to a user specified colouring rule in Wireshark config)
