frame "protocol"

The frame protocol isn't a real protocol itself, but used by Wireshark as a base for all the protocols on top of it. It shows information from capturing, such as the exact time a specific frame was captured. You could think of it as a pseudo dissector.

History

This feature has existed for a long time in Wireshark.

Protocol dependencies

This pseudo-protocol doesn't run atop other protocols.

Example traffic

All capture files include this pseudo-protocol, so specific examples aren't useful.

Wireshark

The frame dissector is fully functional.

Preference Settings

There are two configuration options Under Edit->Preferences->Frame. "Show File Offset" adds a file offset to the frame tree, and "Treat all frames as DOCSIS frames" forces each frame to be dissected as DOCSIS. See CaptureSetup/DOCSIS for more information.

Example capture file

All capture files include this pseudo-protocol, so specific examples aren't useful.

Display Filter

A complete list of frame display filter fields can be found in the display filter reference

Examples:

Capture Filter

A capture filter for the frame pseudo protocol wouldn't make sense, as it would have to accept all packets and reject no packets.

Discussion

Protocols/frame (last edited 2008-05-27 21:31:05 by GuyHarris)