Wireshark · Display Filter Reference: Frame

Field name	Description	Type	Versions
comment	Comment	Character string	1.8.0 to 1.8.15
frame.bblog	Black Box Log	Character string	3.6.0 to 4.4.2
frame.bblog.dupacks	Duplicate Acknowledgements	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.errno	Error Number	Signed integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.event_flags	Event Flags	Unsigned integer (16 bits)	4.2.0 to 4.4.2
frame.bblog.event_flags_hdr	TCP header	Boolean	4.2.0 to 4.4.2
frame.bblog.event_flags_rxbuf	Receive buffer information	Boolean	4.2.0 to 4.4.2
frame.bblog.event_flags_stack	Stack specific information	Boolean	4.2.0 to 4.4.2
frame.bblog.event_flags_txbuf	Send buffer information	Boolean	4.2.0 to 4.4.2
frame.bblog.event_flags_verbose	Additional information	Boolean	4.2.0 to 4.4.2
frame.bblog.event_id	Event Identifier	Unsigned integer (8 bits)	4.2.0 to 4.4.2
frame.bblog.first_byte_in	Time of First Byte In	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.first_byte_out	Time of First Byte Out	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.flex_1	Flex 1	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.flex_2	Flex 2	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.iss	Initial Sending Sequence Number (ISS)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.pad_1	Padding	Unsigned integer (8 bits)	4.2.0 to 4.4.2
frame.bblog.pad_2	Padding	Unsigned integer (8 bits)	4.2.0 to 4.4.2
frame.bblog.pad_3	Padding	Unsigned integer (8 bits)	4.2.0 to 4.4.2
frame.bblog.payload_length	TCP Payload Length	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.rcv_adv	Receive Advanced (RCV.ADV)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.rcv_nxt	Receive Next (RCV.NXT)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.rcv_shift	Rcv.Wind.Shift	Unsigned integer (8 bits)	4.2.0 to 4.4.2
frame.bblog.rcv_up	Receive Urgent Pointer (RCV.UP)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.rcv_wnd	Receive Window (RCV.WND)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.rttvar	Round Trip Timer Variance (RTTVAR)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.rxb_acc	Receive Buffer ACC	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.rxb_ccc	Receive Buffer CCC	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.rxb_spare	Receive Buffer Spare	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.seg_qlen	Segment Queue Length	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.serial_nr	Serial Number	Unsigned integer (32 bits)	3.6.0 to 4.4.2
frame.bblog.snd_cwnd	Congestion Window	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.snd_max	Newest Sequence Number Sent (SND.MAX)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.snd_num_holes	Number of Holes	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.snd_nxt	Next Sequence Number (SND.NXT)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.snd_recover	Recovery Sequence Number (SND.RECOVER)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.snd_shift	Snd.Wind.Shift	Unsigned integer (8 bits)	4.2.0 to 4.4.2
frame.bblog.snd_ssthresh	Slowstart Threshold (SSTHREASH)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.snd_una	Oldest Unacknowledged Sequence Number (SND.UNA)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.snd_wnd	Send Window (SND.WND)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.srtt	Smoothed Round Trip Time (SRTT)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.starttime	Starttime	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.state	TCP State	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.t_flags	TCB Flags	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.t_flags2	TCB Flags2	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.t_flags2_ace_permit	Accurate ECN mode	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_drop_after_data	Drop connection after all data has been acknowledged	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_ecn_permit	ECN	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_ecn_snd_cwr	ECN CWR queued	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_ecn_snd_ece	ECN ECE queued	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_first_bytes_complete	First bytes in/out	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_log_auto	Connection auto-logging	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_plpmtu_blackhole	PMTU blackhole detection	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_plpmtu_maxsegsnt	Last segment sent was a full segment	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags2_plpmtu_pmtud	Path MTU discovery	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_ack_now	Ack now	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_be_in_cong_recovery	Currently in congestion avoidance	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_be_in_fast_recovery	Currently in fast recovery	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_delayed_ack	Delayed ack	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_force_data	Force data	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_goodput_in_progress	Goodput measurement in progress	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_last_idle	Connection was previously idle	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_listen_queue_overflow	Listen queue overflow	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_lost_rtx_detection	Lost retransmission detection	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_more_to_come	More to come	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_need_fin	Need FIN	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_need_syn	Need SYN	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_no_delay	No delay	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_no_opt	No options	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_no_push	No push	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_prev_valid	Saved values for bad retransmission valid	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_received_timestamp	Peer has requested Timestamp	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_received_window_scale	Peer has requested Window Scaling	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_request_timestamp	Have or will request Timestamps	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_request_window_scale	Have or will request Window Scaling	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_sack_permitted	SACK permitted	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_sent_fin	Sent FIN	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_signature	MD5 signature required	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_tfo	TFO	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_toe	TOE	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_tso	TSO	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_unused_0	Unused 1	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_unused_1	Unused 2	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_wake_socket_receive	Wakeup receive socket	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_was_in_cong_recovery	Was in congestion avoidance	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_was_in_fast_recovery	Was in fast recovery	Boolean	4.2.0 to 4.4.2
frame.bblog.t_flags_zero_recv_window_sent	Sent a RCV.WND = 0 in response	Boolean	4.2.0 to 4.4.2
frame.bblog.ticks	Ticks	Unsigned integer (32 bits)	3.6.0 to 4.4.2
frame.bblog.txb_acc	Send Buffer ACC	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.txb_ccc	Send Buffer CCC	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.bblog.txb_spare	Send Buffer Spare	Unsigned integer (32 bits)	4.2.0 to 4.4.2
frame.cap_len	Frame length stored into the capture file	Unsigned integer (32 bits)	1.0.0 to 4.4.2
frame.cb_copy	Copying	Boolean	3.6.0 to 4.4.2
frame.cb_pen	Private Enterprise Number	Unsigned integer (32 bits)	3.6.0 to 4.4.2
frame.coloring_rule.name	Coloring Rule Name	Character string	1.0.0 to 4.4.2
frame.coloring_rule.string	Coloring Rule String	Character string	1.0.0 to 4.4.2
frame.comment	Comment	Character string	1.10.0 to 4.4.2
frame.comment.expert	Formatted comment	Label	1.12.0 to 4.4.2
frame.dlt	WTAP_ENCAP	Signed integer (16 bits)	1.8.0 to 1.8.15
frame.drop_count	Drop Count	Unsigned integer (64 bits)	3.6.0 to 4.4.2
frame.encap_type	Encapsulation type	Signed integer (16 bits)	1.10.0 to 4.4.2
frame.file_off	File Offset	Signed integer (64 bits)	1.0.0 to 4.4.2
frame.hash	Hash Algorithm	Character string	4.2.0 to 4.4.2
frame.hash.value	Hash Value	Byte sequence	4.2.0 to 4.4.2
frame.ignored	Frame is ignored	Boolean	1.4.0 to 4.4.2
frame.incomplete	Incomplete dissector	Label	2.0.0 to 4.4.2
frame.interface_description	Interface description	Character string	2.4.0 to 4.4.2
frame.interface_id	Interface id	Unsigned integer (32 bits)	1.8.0 to 4.4.2
frame.interface_name	Interface name	Character string	2.4.0 to 4.4.2
frame.interface_queue	Interface queue	Unsigned integer (32 bits)	3.4.0 to 4.4.2
frame.len	Frame length on the wire	Unsigned integer (32 bits)	1.0.0 to 4.4.2
frame.len_lt_caplen	Frame length is less than captured length	Label	3.4.16, 3.6.8 to 4.4.2
frame.link_nr	Link Number	Unsigned integer (16 bits)	1.0.0 to 4.4.2
frame.marked	Frame is marked	Boolean	1.0.0 to 4.4.2
frame.md5_hash	Frame MD5 Hash	Character string	1.2.0 to 4.4.2
frame.number	Frame Number	Unsigned integer (32 bits)	1.0.0 to 4.4.2
frame.offset_shift	Time shift for this packet	Time offset	1.8.0 to 4.4.2
frame.p2p_dir	Point-to-Point Direction	Signed integer (8 bits)	1.0.0 to 4.4.2
frame.p_prot_data	Number of per-protocol-data	Unsigned integer (32 bits)	1.10.0 to 1.12.13
frame.packet_flags	Packet flags	Unsigned integer (32 bits)	1.10.0 to 4.4.2
frame.packet_flags_crc_error	CRC error	Boolean	1.10.0 to 4.4.2
frame.packet_flags_direction	Direction	Unsigned integer (32 bits)	1.10.0 to 4.4.2
frame.packet_flags_fcs_length	FCS length	Unsigned integer (32 bits)	1.10.0 to 4.4.2
frame.packet_flags_packet_too_error	Packet too long error	Boolean	1.10.0 to 4.4.2
frame.packet_flags_packet_too_short_error	Packet too short error	Boolean	1.10.0 to 4.4.2
frame.packet_flags_preamble_error	Preamble error	Boolean	1.10.0 to 4.4.2
frame.packet_flags_reception_type	Reception type	Unsigned integer (32 bits)	1.10.0 to 4.4.2
frame.packet_flags_reserved	Reserved	Unsigned integer (32 bits)	1.10.0 to 4.4.2
frame.packet_flags_start_frame_delimiter_error	Start frame delimiter error	Boolean	1.10.0 to 4.4.2
frame.packet_flags_symbol_error	Symbol error	Boolean	1.10.0 to 4.4.2
frame.packet_flags_unaligned_frame_error	Unaligned frame error	Boolean	1.10.0 to 4.4.2
frame.packet_flags_wrong_inter_frame_gap_error	Wrong interframe gap error	Boolean	1.10.0 to 4.4.2
frame.packet_id	Packet id	Unsigned integer (64 bits)	3.4.0 to 4.4.2
frame.pcaplog.data	Data	Byte sequence	4.0.0 to 4.2.9
frame.pcaplog.data_length	Data Length	Unsigned integer (32 bits)	4.0.0 to 4.2.9
frame.pcaplog.data_type	Date Type	Unsigned integer (32 bits)	4.0.0 to 4.2.9
frame.pkt_len	Frame length on the wire	Unsigned integer (32 bits)	1.0.0 to 1.0.16
frame.protocols	Protocols in frame	Character string	1.0.0 to 4.4.2
frame.ref_time	This is a Time Reference frame	Label	1.0.0 to 4.4.2
frame.section_number	Section number	Unsigned integer (32 bits)	4.0.0 to 4.4.2
frame.time	Arrival Time	Date and time	1.0.0 to 4.4.2
frame.time_delta	Time delta from previous captured frame	Time offset	1.0.0 to 4.4.2
frame.time_delta_displayed	Time delta from previous displayed frame	Time offset	1.0.0 to 4.4.2
frame.time_epoch	Epoch Arrival Time	Date and time	1.4.0 to 4.4.2
frame.time_invalid	Arrival Time: Fractional second out of range (0-1000000000)	Label	1.0.0 to 4.4.2
frame.time_relative	Time since reference or first frame	Time offset	1.0.0 to 4.4.2
frame.time_relative_capture_start	Time since start of capturing	Time offset	4.2.0 to 4.4.2
frame.time_utc	UTC Arrival Time	Date and time	4.2.0 to 4.4.2
frame.verdict	Verdict	Character string	3.4.0 to 4.4.2
frame.verdict.ebpf_tc	eBPF TC	Signed integer (64 bits)	3.4.0 to 4.4.2
frame.verdict.ebpf_xdp	eBPF XDP	Signed integer (64 bits)	3.4.0 to 4.4.2
frame.verdict.hw	Hardware	Byte sequence	3.4.0 to 4.4.2
frame.verdict.unknown	Unknown	Byte sequence	3.4.0 to 4.4.2