Ask Your Question

What do "Frame is {marked, ignored}" mean in the packet details?

asked 2018-01-11 23:04:54 +0000

updated 2018-01-12 05:32:09 +0000

Guy Harris gravatar image

What does it mean when the log details state: "Frame is marked: False" and "Frame is ignored: False"?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2018-01-12 03:21:41 +0000

Guy Harris gravatar image

Frame is marked: False

Wireshark allows you to "mark" a frame; see "Mark/Unmark Packet" in the "Edit" menu. "Frame is marked: False" means that the frame hasn't been "marked".

Frame is ignored: False

Wireshark also allows you to "ignore" a packet; se "Ignore/Unignore Packet" in the "Edit" menu. If you "ignore" a packet, it will be marked as "ignored", and the packets will all be redissected, with the "ignored" packet not being dissected, so that any information from that packet won't affect subsequent packets. "Frame is ignored: False" means that the frame hasn't been "ignored".

edit flag offensive delete link more


Where the use cases are as follows:

  1. You're trying to find the packets relevant to your situation, but there are many other packets as well. If you find one which is relevant you can mark it by hand, like a bookmark, so that you can get back to that packet easily.
  2. As described, if a packet is throwing off the dissection of other packets somehow, or is (visually) disturbing the packet overview, you can set it as ignored so it will be skipped during dissection.
Jaap gravatar imageJaap ( 2018-01-12 06:25:58 +0000 )edit

Many thanks to Guy and Jaap. Crystal clear and much appreciated!

Jay1971 gravatar imageJay1971 ( 2018-01-12 13:16:47 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2018-01-11 23:04:54 +0000

Seen: 92 times

Last updated: Jan 12