Skip to content

GitLab

  • Projects
  • Groups
  • Snippets
  • Help
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
  • Sign in / Register
wireshark
wireshark
  • Project overview
    • Project overview
    • Details
    • Activity
    • Releases
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 1,300
    • Issues 1,300
    • List
    • Boards
    • Labels
    • Service Desk
    • Milestones
    • Iterations
  • Merge requests 94
    • Merge requests 94
  • Requirements
    • Requirements
    • List
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Operations
    • Operations
    • Incidents
    • Environments
  • Analytics
    • Analytics
    • CI/CD
    • Code Review
    • Insights
    • Issue
    • Repository
    • Value Stream
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Members
    • Members
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Wireshark Foundation
  • wiresharkwireshark
  • Wiki
    • Protocols
  • frame

Last edited by Chuck Craft Nov 08, 2020
Page history

frame

frame "protocol"

The frame protocol isn't a real protocol itself, but used by Wireshark as a base for all the protocols on top of it. It shows information from capturing, such as the exact time a specific frame was captured. You could think of it as a pseudo dissector.

History

This feature has existed for a long time in Wireshark.

Protocol dependencies

This pseudo-protocol doesn't run atop other protocols.

Example traffic

All capture files include this pseudo-protocol, so specific examples aren't useful.

Wireshark

The frame dissector is fully functional.

Preference Settings

Configuration options are under Edit-> Preferences...-> Protocols-> Frame.

201108_frame_preferences
"Show File Offset" adds a file offset to the frame tree, and "Treat all frames as DOCSIS frames" forces each frame to be dissected as DOCSIS. See CaptureSetup/DOCSIS for more information.

Preferences are also available by right clicking on a packet:

201108_frame_preferences_2a

Example capture file

All capture files include this pseudo-protocol, so specific examples aren't useful.

Display Filter

A complete list of frame display filter fields can be found in the display filter reference

Examples:

Show only the frames from number 20 to 40:

 frame.number >= 20 && frame.number <= 40 

Hide all frames:

 not frame 

Capture Filter

A capture filter for the frame pseudo protocol wouldn't make sense, as it would have to accept all packets and reject no packets.

External links

  • there are no external links

Discussion


Imported from https://wiki.wireshark.org/Protocols/frame on 2020-08-11 23:19:47 UTC

Clone repository
  • 29West
  • 2dParityFEC
  • 3GPP
  • AARP
  • ACN
  • ACSE
  • AH
  • AIM
  • ALCAP
  • AMQP
  • ANCP
  • ANSI
  • APIPA
  • ARP
  • ASN1_plugin
View All Pages