Can anyone tell me what the "Length" column in WireShark refers to?
I'm pretty sure it's the "size" of the entire frame on the wire. I did some calculations, but I didn't get the number that WireShark is reporting.
Does anyone know what the "length" includes? I read somewhere that the preamble (7 octets), start of frame delimiter (1 octet), and FCS (4 octets) aren't normally captured, but does this mean that WireShark still adds these numbers to get to the "length" calculation?
Best Answer
It's the count of the bytes that were captured for that particular frame; it'll match the number of bytes of raw data in the bottom section of the wireshark window.
The contents of the capture depend on how the capture was done, but typically a capture grabs from the start of the header to the end of the payload.
Click on the decoded protocol parts in the wireshark window, it will highlight which parts of the data are part of which protocol and what the different headers captured mean.