What do "Frame is {marked, ignored}" mean in the packet details?

answered 2018-01-12 03:21:41 +0000

Guy Harris
19890 ●3 ●660 ●207

Frame is marked: False

Wireshark allows you to "mark" a frame; see "Mark/Unmark Packet" in the "Edit" menu. "Frame is marked: False" means that the frame hasn't been "marked".

Frame is ignored: False

Wireshark also allows you to "ignore" a packet; se "Ignore/Unignore Packet" in the "Edit" menu. If you "ignore" a packet, it will be marked as "ignored", and the packets will all be redissected, with the "ignored" packet not being dissected, so that any information from that packet won't affect subsequent packets. "Frame is ignored: False" means that the frame hasn't been "ignored".

edit flag offensive delete link

Comments

Where the use cases are as follows:

You're trying to find the packets relevant to your situation, but there are many other packets as well. If you find one which is relevant you can mark it by hand, like a bookmark, so that you can get back to that packet easily.
As described, if a packet is throwing off the dissection of other packets somehow, or is (visually) disturbing the packet overview, you can set it as ignored so it will be skipped during dissection.

Jaap ( 2018-01-12 06:25:58 +0000 )edit

Many thanks to Guy and Jaap. Crystal clear and much appreciated!

Jay1971 ( 2018-01-12 13:16:47 +0000 )edit

add a comment

What do "Frame is {marked, ignored}" mean in the packet details?

1 Answer

Comments

Your Answer

Question Tools

Stats

What do "Frame is {marked, ignored}" mean in the packet details? edit

1 Answer

Comments

Your Answer

Question Tools

Stats

What do "Frame is {marked, ignored}" mean in the packet details?