[General boards] [Fall 2018 courses] [Summer 2018 courses] [Winter 2018 courses] [Older or newer terms]

Clarification needed on using "on wire" or "captured" packet size


Until now I had the notion that the actual size of the packet on the link is referred to as “on wire length”.

For example, a given packet on wireshark reports:

Frame 99804: 1161 bytes on wire (9288 bits), 96 bytes captured (768 bits)

The true size of the packet would be 1161B (on wire), whereas the size of the packet saved in the pcap file is 96B (captured) because we don’t save the data payload.

For the assignment, we are looking at the true size (referred to as “on link” or “on wire”) of the packet frame which would mean using the “on wire” length as reported by wireshark and NOT the “captured” length.

However in the following post (Arp packet size), the question of using “capture” length is asked twice and the answer both times is “yes”. This would lead to the conclusion of using the “captured” length and I believe this is incorrect (and could possible result in others making the same mistake as the post is viewd 175 times). Professor @shirali , can you please confirm?

Thank you


NEED clarification. Thanks


The instructor has also said in some other post that capture length was not needed but frame length and sometimes a header was needed. So i am also unclear but i am sticking with my assumption and clarifying that in my report as frankly we don’t have time to keep recalculating so much data due to how vague the instructions are. I say go ahead with your assumption


We need the frame size, i.e., the size on the link.