About

A frame or packet frame is the data unit of ethernet that is transmitted between network points with:

• addressing
• and necessary protocol control information.

A frame is usually transmitted serial bit by bit and contains a header field and a trailer field that “frame” the data.

Example of Frame with the TCP protocol

TCP/IP sends a TCP packet known as segment:

• which is carried in one or more IP packets by the IP protocol
• which are each carried in one or more Ethernet packet known as frame by the ethernet

Below is a frame created by a HTTP Request. There was only one frame but you may have more than one that needs to be reassembled.

Frame: Number = 88, Captured Frame Length = 788, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-1E-14-59-51-C3],SourceAddress:[5C-26-0A-1B-D2-2C]
- Ipv4: Src = 192.168.2.57, Dest = 139.156.77.131, Next Protocol = TCP, Packet ID = 11656, Total IP Length = 774
  - Versions: IPv4, Internet Protocol; Header Length = 20
     Version:      (0100....) IPv4, Internet Protocol
     HeaderLength: (....0101) 20 bytes (0x5)
  - DifferentiatedServicesField: DSCP: 0, ECN: 0
     DSCP: (000000..) Differentiated services codepoint 0
     ECT:  (......0.) ECN-Capable Transport not set
     CE:   (.......0) ECN-CE not set
    TotalLength: 774 (0x306)
    Identification: 11656 (0x2D88)
  + FragmentFlags: 16384 (0x4000)
    TimeToLive: 128 (0x80)
    NextProtocol: TCP, 6(0x6)
    Checksum: 11881 (0x2E69)
    SourceAddress: 192.168.2.57
    DestinationAddress: 139.156.77.131
- Tcp: Flags=...AP..., SrcPort=14364, DstPort=9704, PayloadLen=734, Seq=3055629494 - 3055630228, Ack=1760871807, Win=260 (scale factor 0x8) = 66560
    SrcPort: 14364
    DstPort: 9704
    SequenceNumber: 3055629494 (0xB62134B6)
    AcknowledgementNumber: 1760871807 (0x68F4C57F)
  - DataOffset: 80 (0x50)
     DataOffset: (0101....) 20 bytes
     Reserved:   (....000.)
     NS:         (.......0) Nonce Sum not significant
  - Flags: ...AP...
     CWR:    (0.......) CWR not significant
     ECE:    (.0......) ECN-Echo not significant
     Urgent: (..0.....) Not Urgent Data
     Ack:    (...1....) Acknowledgement field significant
     Push:   (....1...) Push Function
     Reset:  (.....0..) No Reset
     Syn:    (......0.) Not Synchronize sequence numbers
     Fin:    (.......0) Not End of data
    Window: 260 (scale factor 0x8) = 66560
    Checksum: 0xBBE7, Disregarded
    UrgentPointer: 0 (0x0)
    TCPPayload: SourcePort = 14364, DestinationPort = 9704
- Http: Request, POST /analytics/saw.dll, Query:Dashboard&_scid=9z2VRJDKCss
    Command: POST
  - URI: /analytics/saw.dll?Dashboard&_scid=9z2VRJDKCss
     Location: /analytics/saw.dll
   - Parameters: 0x1
      Dashboard&_scid: 9z2VRJDKCss 
    ProtocolVersion: HTTP/1.1
    Host:  sz0057.app.gen.local:9704
    UserAgent:  Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
    Accept:  text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language:  nl,en;q=0.7,en-us;q=0.3
    Accept-Encoding:  gzip, deflate
    Connection:  keep-alive
    Referer:  http://sz0057.app.gen.local:9704/analytics/saw.dll?Dashboard&_scid=9z2VRJDKCss
  - Cookie:  sawU=gerar600; nQuireID=794db595dmj5cbfmat5rvmbv069jssheqv8f0p2zOr07UFe9W00; sawP=; JSESSIONID=0a3e851825e8290e2fc48c68421da24a9083afec5a56
      sawU: gerar600
      nQuireID: 794db595dmj5cbfmat5rvmbv069jssheqv8f0p2zOr07UFe9W00
      sawP: 
      JSESSIONID: 0a3e851825e8290e2fc48c68421da24a9083afec5a56

  - ContentType:  application/x-www-form-urlencoded
     MediaType:  application/x-www-form-urlencoded
    ContentLength:  71
    HeaderEnd: CRLF
  - payload: HttpContentType =  application/x-www-form-urlencoded
     NQUser: gerar600
     NQPassword: gerar600
     saveLangPref: true
     icharset: us-ascii

Capture

You can capture packet frame with network sniffer, such as wireshark