Frame Size and Wireshark

Frame Size and Wireshark


This blog is a write up of what was discussed at our first AMA session:

https://www.youtube.com/watch?v=TM70jXEsFsk


In Wireshark, when you look at the frame sizes, by viewing the “Length” field, it reports a number to you. This is the frame length. You can view this by looking under the Frame section of Wireshark.

You can of course add this as a column in Wireshark.

Well, it’s lying to you. Everyone knows that ACKs are 14 Bytes, not 70!


What? Why? How?...


Well, this is actually quite simple. Wireshark is reporting the size of the frame, INCLUDING the radiotap header.


The radiotap header is added by the capturing device, and it gives you all sort of information about the frame when it was captured.


Different capturing devices, and software, do this differently. While there are standard formats for storing this information, different applications will do this differently. Also, it depends on which protocol you are capturing. So, essentially, different protocols have different frame sizes based on information that different applications store!!!


So, a capture made with one capturing device, may use different frame sizes than a capture made on a different tool. Also, these numbers depend on what protocol is being captured 802.11n, ac, ax, or be, etc.


This number is essentially the frame size in the pcap file, including the radiotap header.


Can you turn this off, or adjust it?


Simple answer: NO!


However, there is a little trick you can do, and that is to display the radiotap header size next to the length.


Simply add the Radiotap Header > Header Length as a column, and you can see what you need to see!


Then you can do a quick math sum, and work out the real size of the frame!

70-56 = 14 just like it should be!

See you next time!

===


 #General #WiFi #WirelessFrames #Wireshark 



===

About NC-Expert

NC-Expert is a privately-held California corporation and is well established within the Wireless, Security, and Collaboration industry certification training, courseware development, and consulting markets.

Led by its Founder and CEO, Rie Vainstein, NC-Expert has won numerous private contracts with Fortune level companies around the world. These customers have depended on NC-Expert to train, advise, and mentor their staff.

So remember, if you are looking for the best IT training just call us at (855) 941-2121 or contact us

NC-Expert Blog

Wi-Fi Myth Series - Myth #18: 6 GHz Means RF Design Doesn’t Matter Anymore

By Rie Morgan • October 20, 2026
 More spectrum, fewer headaches? If only RF engineering were that simple. There's something undeniably exciting about 6 GHz Wi-Fi... after years of squeezing increasingly demanding networks into the crowded 2.4 GHz and 5 GHz bands, engineers finally have access to a substantial amount of additional spectrum. More channels. Less legacy interference. Wider channel options. It's almost enough to make a Wi-Fi engineer believe that life is about to get easier! Well, almost... because somewhere between the marketing presentations and the real-world deployment, a dangerous assumption has emerged: with all that extra spectrum, careful RF design isn't nearly as important anymore. Unfortunately, nobody informed the laws of physics.

Wi-Fi Myth Series - Myth #17: Wi-Fi Security Ends with WPA3

By Rie Morgan • October 14, 2026
 Protecting the wireless connection is only part of protecting the network. WPA3 was a welcome advancement in wireless security. Stronger authentication, improved protection against password guessing, and more robust cryptographic mechanisms gave Wi-Fi engineers plenty of reasons to celebrate. And rightly so. But, somewhere along the way, an interesting assumption crept into the conversation: if a network uses WPA3, it must be secure. Well… not quite. WPA3 is an important security mechanism, but it isn't a complete security strategy. It protects specific aspects of wireless communication, but not every device, user, configuration, or operational decision involved in running a wireless network. And, as experienced Wi-Fi engineers know, trouble rarely confines itself to one convenient layer of the network.

Wi-Fi Myth Series - Myth #16: The Controller Knows Best

By Rie Morgan • October 7, 2026
A beautiful dashboard doesn't necessarily mean a beautiful network. There is something wonderfully reassuring about a wireless LAN controller dashboard: everything is neatly organized; access points are green; clients are connected; channel assignments look sensible; the controller reports that Radio Resource Management (RRM) is optimizing the environment; and the health score is sitting comfortably in the high nineties.... life is good. Uhmm... except that users are complaining about dropped calls, sluggish applications, and mysterious connectivity problems. But the dashboard says everything is fine! Welcome to Wi-Fi Myth #16: The Controller Knows Best. Modern wireless controllers are remarkably sophisticated. They collect enormous amounts of information, automate complex decisions, and provide visibility that engineers could only dream of a couple of decades ago. But there's an important distinction between collecting information and understanding what's actually happening in the RF environment... and that's where things get interesting.