WLAN Analysis with Wireshark (Frame Section, Part 5)

In each of previously saved Wireshark capture files, identical number of frames and time-span are included. In the column of "No." that should describe total frames being collected, where 106,879 is the case in the following example.

In the second column, that shows the exact time where these frame are collected, July, 18, 2019 was the date of this exercise.

Under the menu of "View > Time Display Format" we can select "Seconds Since Beginning of Capture," it should be 46 (seconds). That means we spent around 46 seconds to collect the packets.

When you take Capture File Properties under the menu of Statistics, the given result should match the statement displayed above.

Under the menu of "View > Time Display Format" we can select "Seconds Since Beginning of Capture," it should be 46 (seconds). That means we spent around 46 seconds to collect the packets.

The column of "Time" is extremely helpful, when we filter certain packets for data analysis. For example, we would like to only watch Beacon Frame, thus, in the filter row, we put "wlan.fc.type_subtype == 0x0008" In the menu, we click "View > Time Display Format" and then select "Seconds Since Previous Displayed Packets"

You should be able to see, less than 0.01 seconds, a beacon frame is flipping around in the air. But, be aware, they are not coming from the same STA, as the source MAC is different.

That should pretty much conclude our discussion on "Frame Section."