Look at some ethernet frames


I downloaded a file. While doing so, I captured the datastream (i.e., all packets that came and went) using Wireshark then saved it. The result was two files. First of course, the downloaded copy of my target file. Second, the "capture file" containing the history of packet exchanges that accomplished that download job. Please download the capture file, which is named frame-exercise1.pcap. Then, open it in Wireshark. You will see the frames that were in my datastream. (The capture file is available in the alternative form of a zip file, for client software that has trouble reckoning with "pcap" files. Download that and unzip before using if preferred.)

The 3 main components of the interface are the packet list pane (top), the packet details pane (middle), and the packet bytes pane (bottom). In the packet list pane add a column that will show the size of each packet-- Edit/Preferences/User Interface/Columns/Add. Set Title to the word "Size" and Format to "Packet length (bytes)" from the dropdown list. Select the new column within the column list, and move it up so it's the second column. You can sort packets in the packet list pane by clicking on any column title. So now you can sort them by size.

The assignment to perform:

Print out this page. Fill in the blanks below with the requested answers. Turn in your completed printout.


1. The number of frames in this datastream was ____________________


2. Their average length/size (in bytes) was  ____________________


3. The most common frame size was ____________________


4. The maximum frame size was ____________________


5. For any of the max-sized frames, the size of  its ethernet payload portion was ____________________


6. For that frame, the size of the balance (non-ethernet-payload) of the packet was ____________________


7. For that frame (and all the others like it) Wireshark names its highest-level payload (see the packet details pane). It's ____________________


8. The oberved value of the maximum frame size is interesting. It could not be any larger because: