PCAPNG : Relation b/w frame length (bytes) and Data length ( bytes)?

183 Views Asked by At

I have some PCAPNG file, one UDP packet has Frame length 187 Bytes (1496 bits) and Data length 472 Bytes. All other packets fame length is greater than data length.

Please correct me if I'm wrong. My basic understanding is Frame length should be greater than data length because frame length includes data length.

1) Whether this packet is captured correctly ?

2) In which case this could happen ?

1

There are 1 best solutions below

0
On

I found its related to fragmented packet. This case occurs when packet reassembled.