Wireshark Field Guide · Layered Encapsulation

Frame · Packet · Port

This page explains how application data becomes a message, a TCP segment or UDP datagram, an IP packet, an Ethernet frame, and finally bits on the wire. It also maps each concept to the English field names you will see in Wireshark.

Remember: A Frame is a one-hop link-layer container. A Packet usually means a network-layer IP packet. TCP Segment and UDP Datagram are transport-layer data units. A Port is a logical transport-layer number used to identify an application endpoint; it is not another kind of packet.

1. TCP/IP Layers and PDUs

THE LAYER MAP

Application layerApplication

Message

HTTP requests, DNS queries, SSH data, and other application-protocol content.

GET /
Host: net.wujun.org

Transport layerTransport

TCP Segment / UDP Datagram

Ports, sequence numbers, acknowledgments, flags, and windows appear here.

51234 → 443
TCP · SYN / ACK

Network layerInternet layer

IP Packet / IP Datagram

Source and destination IP, TTL / Hop Limit, and Protocol / Next Header.

192.168.1.2 → 45.62.125.222
IPv4 · TTL 64

Data-link layerLink

Ethernet Frame

Source and destination MAC, EtherType, VLAN tag, and FCS; valid for one link hop.

MAC A → gateway MAC
Ethernet II · FCS

Physical layerPhysical

Bits

Electrical signals, optical pulses, or radio signals. The NIC encodes the frame onto the medium.

10101010 01010101
copper / fiber / radio

Terminology: “Packet” is often used as a general word for network traffic. Strictly, an IP Packet is a network-layer PDU; Frame, Segment, and Datagram identify the layer more precisely.

2. Encapsulation: Headers Are Added Layer by Layer

ENCAPSULATION

Application data is ready

STEP 0 / 4

Application → TCP

HTTP DATA

TCP → IP

TCP SEGMENT

IP → Link

IP PACKET

Link → Medium

ETH FRAME

Click Next to see what each layer adds.

3. Frame / Packet / Segment Field Map

WIRESHARK TERMS

PDU	Layer	Important fields	Address / identifier	Scope
Ethernet Frame	Data link	Destination MAC, Source MAC, EtherType, VLAN, FCS	MAC address	One hop: current link to next hop
IP Packet	Network	Source/Destination IP, TTL, Protocol, fragmentation fields	IP address	End-to-end path; forwarded hop by hop
TCP Segment	Transport	Source/Destination Port, Seq, Ack, Flags, Window, Options	Port + 4-tuple	Reliable byte stream between endpoints
UDP Datagram	Transport	Source/Destination Port, Length, Checksum	Port + 5-tuple	Message-preserving datagram delivery
Application Message	Application	HTTP method, DNS Question, TLS Handshake, and so on	Hostname, URL, application identifiers	Defined by the application protocol

Where is the Port?TCP and UDP headers each contain a 16-bit Source Port and a 16-bit Destination Port. The operating system uses them to demultiplex transport data to the correct socket. IP only identifies the next protocol, such as TCP or UDP.

4. Wireshark Display Names

FILTER CHEAT SHEET

These are the field names and display filters you are likely to use when inspecting a capture. The exact tree wording can vary slightly by Wireshark version and dissector.

Concept	Wireshark field	Useful display filter	What to inspect
Ethernet Frame	`eth.src` `eth.dst` `eth.type`	`eth` `eth.type == 0x0800`	MAC addresses, EtherType, frame length
VLAN	`vlan.id` `vlan.priority`	`vlan` `vlan.id == 10`	VLAN ID, PCP priority, tagged path
IPv4	`ip.src` `ip.dst` `ip.ttl` `ip.proto`	`ip.addr == 192.168.1.2` `ip.ttl < 5`	source/destination IP, TTL, protocol, fragmentation
IPv6	`ipv6.src` `ipv6.dst` `ipv6.hlim` `ipv6.nxt`	`ipv6` `ipv6.hlim < 5`	addresses, Hop Limit, extension headers
TCP	`tcp.srcport` `tcp.dstport` `tcp.seq` `tcp.ack` `tcp.flags` `tcp.window_size_value`	`tcp.port == 443` `tcp.flags.syn == 1` `tcp.analysis.retransmission`	handshake, sequence/ack, window, retransmissions, SACK
UDP	`udp.srcport` `udp.dstport` `udp.length` `udp.checksum`	`udp.port == 53` `udp.dstport == 53`	DNS/DHCP ports, datagram length, checksum
DNS	`dns.qry.name` `dns.qry.type` `dns.flags.response` `dns.a`	`dns` `dns.qry.name contains "wujun"`	query name/type, response flag, answers, TTL
HTTP	`http.request.method` `http.host` `http.response.code`	`http` `http.request` `http.response.code == 200`	request/response, Host, status, headers
TLS	`tls.handshake.type` `tls.handshake.extensions_server_name` `tls.handshake.extensions_alpn_str`	`tls` `tls.handshake`	ClientHello, SNI, ALPN, certificate, version

5. What Changes Across a Router?

ONE PACKET'S JOURNEY

Example: a phone accesses https://net.wujun.org. This is a teaching model; proxies, tunnels, load balancers, IPv6, QUIC, and firewall policy can change the details.

Phone192.168.1.2
source port 51234

creates TCP segment

Home RouterNAT / NAPT
192.168.1.1

rewrites IP / port

ISP Routerprovider link
next-hop MAC

new Frame

Internet RouterTTL decreases
route lookup

TTL − 1

Server45.62.125.222
TCP :443

delivers to socket

Usually changes

Frame source/destination MAC: a new link-layer frame is built for every hop.
IPv4 TTL / IPv6 Hop Limit: normally decremented by each layer-3 forwarding hop.
NAT source IP / source port: the edge device stores a translation mapping and reverses it for the reply.
IPv4 header checksum: recalculated after TTL changes.

Usually stays the same

Destination IP and destination port: ordinary routing does not change them; NAT and load balancing are exceptions.
TCP Seq / Ack and application data: ordinary routers do not interpret or reorder them.
TCP/UDP protocol: IP uses the protocol number to demultiplex to TCP or UDP.
MAC addresses are not end-to-end identifiers.

6. Ports and the Five-Tuple

PORTS & SOCKETS

What is a port?

A port is a 16-bit logical transport-layer number from 0 to 65535. It is not a physical connector and not an IP address. Ports let many applications share one host address.

client socket
192.168.1.2:51234

server socket
45.62.125.222:443

The five-tuple

Firewalls, NAT devices, and connection tables commonly identify a flow with:

source IP · source port · destination IP · destination port · protocol
192.168.1.2:51234
→ 45.62.125.222:443 · TCP

Many clients can connect to the same server port 443.
The server port alone is not a unique connection identifier.
UDP also uses ports, but it does not create TCP-style connection state.

7. Quick Memory Table

REMEMBER THIS

Term	One-line definition	Typical question
Frame	One-hop link-layer container with MAC addresses and FCS.	Which switch port should receive it?
Packet	Network-layer IP data unit forwarded by routers using the destination IP.	Which next hop? Has TTL expired?
Segment	TCP transport-layer unit carrying ports, sequence numbers, and acknowledgments.	Which socket? Was it retransmitted?
Datagram	UDP transport-layer unit that preserves message boundaries but is not reliable by itself.	Is the port listening? Does the application retry?
Port	Logical transport-layer number used for process multiplexing and demultiplexing.	Is the service listening? Is the firewall allowing it?