What do "Frame is {marked, ignored}" mean in the packet details?
What does it mean when the log details state: "Frame is marked: False" and "Frame is ignored: False"?
1 Answer
- Sort by
oldest newest most voted
2
Frame is marked: False
Wireshark allows you to "mark" a frame; see "Mark/Unmark Packet" in the "Edit" menu. "Frame is marked: False" means that the frame hasn't been "marked".
Frame is ignored: False
Wireshark also allows you to "ignore" a packet; se "Ignore/Unignore Packet" in the "Edit" menu. If you "ignore" a packet, it will be marked as "ignored", and the packets will all be redissected, with the "ignored" packet not being dissected, so that any information from that packet won't affect subsequent packets. "Frame is ignored: False" means that the frame hasn't been "ignored".
Comments
Where the use cases are as follows:
- You're trying to find the packets relevant to your situation, but there are many other packets as well. If you find one which is relevant you can mark it by hand, like a bookmark, so that you can get back to that packet easily.
- As described, if a packet is throwing off the dissection of other packets somehow, or is (visually) disturbing the packet overview, you can set it as ignored so it will be skipped during dissection.
Many thanks to Guy and Jaap. Crystal clear and much appreciated!
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments