Frame Size and Wireshark

Frame Size and Wireshark


This blog is a write up of what was discussed at our first AMA session:

https://www.youtube.com/watch?v=TM70jXEsFsk


In Wireshark, when you look at the frame sizes, by viewing the “Length” field, it reports a number to you. This is the frame length. You can view this by looking under the Frame section of Wireshark.

You can of course add this as a column in Wireshark.

Well, it’s lying to you. Everyone knows that ACKs are 14 Bytes, not 70!


What? Why? How?...


Well, this is actually quite simple. Wireshark is reporting the size of the frame, INCLUDING the radiotap header.


The radiotap header is added by the capturing device, and it gives you all sort of information about the frame when it was captured.


Different capturing devices, and software, do this differently. While there are standard formats for storing this information, different applications will do this differently. Also, it depends on which protocol you are capturing. So, essentially, different protocols have different frame sizes based on information that different applications store!!!


So, a capture made with one capturing device, may use different frame sizes than a capture made on a different tool. Also, these numbers depend on what protocol is being captured 802.11n, ac, ax, or be, etc.


This number is essentially the frame size in the pcap file, including the radiotap header.


Can you turn this off, or adjust it?


Simple answer: NO!


However, there is a little trick you can do, and that is to display the radiotap header size next to the length.


Simply add the Radiotap Header > Header Length as a column, and you can see what you need to see!


Then you can do a quick math sum, and work out the real size of the frame!

70-56 = 14 just like it should be!

See you next time!

===


 #General #WiFi #WirelessFrames #Wireshark 



===

About NC-Expert

NC-Expert is a privately-held California corporation and is well established within the Wireless, Security, and Collaboration industry certification training, courseware development, and consulting markets.

Led by its Founder and CEO, Rie Vainstein, NC-Expert has won numerous private contracts with Fortune level companies around the world. These customers have depended on NC-Expert to train, advise, and mentor their staff.

So remember, if you are looking for the best IT training just call us at (855) 941-2121 or contact us

NC-Expert Blog

Wi-Fi Myth Series - Myth #13: Mesh is ALWAYS The Best Solution

By Rie Morgan • September 10, 2026
Mesh Wi-Fi has developed quite the reputation: Need coverage in the far end of the building? Mesh. Can’t get Ethernet to an access point? Mesh. Dead spot upstairs? Mesh. Need Wi-Fi in the warehouse, courtyard, annex, garage, loading dock, or that mysterious conference room where RF signals apparently go to die? Mesh. And there’s a reason for the enthusiasm. Mesh networking can be extremely useful: it can extend connectivity into places where running cable is difficult, expensive, disruptive, or simply impossible. Modern mesh systems can dynamically select paths, recover from connectivity changes, and provide remarkably capable wireless backhaul... but that doesn’t mean mesh is automatically the best architecture. Sometimes the best mesh network is the one you don’t build!

Wi-Fi Myth Series - Myth #12: Auto Channel Selection ALWAYS Knows Best

By Rie Morgan • August 28, 2026
Automatic Channel Selection sounds like one of those features we should simply be able to trust: the APs monitor the RF environment, the Controller gathers data, an Algorithm considers interference, utilization, neighboring APs, channel availability, and other metrics, then Radio Resource Management (RRM) does its “thing” and selects the best channels. Wonderful! One less problem for the wireless engineer to worry about... except RF rarely cooperates with anything quite that neatly! Modern RRM systems are remarkably capable, and automatic channel selection can dramatically simplify the management of large wireless environments, but an algorithm can only make decisions based on the information it collects, the parameters it has been given, and the objectives it has been designed to optimize. That makes automation a powerful engineering tool. It does not make it the engineer.

Wi-Fi Myth Series - Myth #11: Interference Is Always Someone Else’s Wi-Fi

By Rie Morgan • August 20, 2026
When Wi-Fi performance suddenly deteriorates, interference is often the first culprit to be suspected and, when this (interference) enters the conversation, attention tends to turn immediately toward neighboring Wi-Fi networks. “Someone must have installed another AP.” “The office next door is probably using our channel.” “There are too many SSIDs around here.” Sometimes, this diagnosis is exactly right, but RF interference has a much larger cast of characters than just neighboring APs. In fact, some of the most frustrating wireless problems occur when the interfering device isn’t speaking 802.11 at all! The spectrum doesn’t particularly care whether the energy occupying it came from an enterprise AP, a Bluetooth headset, a microwave oven, or something considerably stranger. To a Wi-Fi radio trying to communicate, unwanted RF energy is simply unwanted RF energy. Wi-Fi Has to Share the Neighborhood The 2.4 GHz band has always been something of an RF “community center”. Wi-Fi operates alongside Bluetooth, Zigbee and other technologies, while various consumer, industrial, medical, and electronic devices may also generate energy within or around the same spectrum. Microwave ovens are perhaps the most famous example. Their emissions can interfere with 2.4 GHz Wi-Fi, particularly when clients are operating nearby. Bluetooth devices, cordless equipment, wireless cameras, sensors, and other transmitters can also contribute RF energy. Some interferers transmit continuously. Others appear periodically. Some hop frequencies. Others produce wideband noise. That last category can be particularly entertaining to troubleshoot... in the very specific sense of “entertaining” that wireless engineers use when they have been staring at spectrum analysis for three hours! The important point is that interference doesn’t need to understand Wi-Fi to disrupt it.