Until now I had the notion that the actual size of the packet on the link is referred to as “on wire length”.
For example, a given packet on wireshark reports:
Frame 99804: 1161 bytes on wire (9288 bits), 96 bytes captured (768 bits)
The true size of the packet would be 1161B (on wire), whereas the size of the packet saved in the pcap file is 96B (captured) because we don’t save the data payload.
For the assignment, we are looking at the true size (referred to as “on link” or “on wire”) of the packet frame which would mean using the “on wire” length as reported by wireshark and NOT the “captured” length.
However in the following post (Arp packet size), the question of using “capture” length is asked twice and the answer both times is “yes”. This would lead to the conclusion of using the “captured” length and I believe this is incorrect (and could possible result in others making the same mistake as the post is viewd 175 times). Professor @shirali , can you please confirm?