In Wireshark, what is the difference between a frame and a packet?

• A. A frame is the link-layer capture unit; a packet is the data unit dissected across network layers; frames contain packets and framing header metadata.
• B. A frame is the entire capture file; a packet is any part of data.
• C. A frame is a high-level protocol; a packet is low-level.
• D. A frame and a packet are synonyms; no difference.

Answer: (A)

Frames are the data-link-layer units captured on the wire. They include the link-layer header (such as MAC destination and source), and the trailer (like the CRC), plus the payload. The payload is typically a network-layer packet, such as an IP datagram, which Wireshark then dissects into higher-layer protocols (TCP/UDP and beyond). So a frame contains a packet and the framing metadata from the data-link layer.

This distinction fits the idea that a frame is the on-wire unit at the link layer, while a packet is the data unit at the network layer inside that frame. A practical example: an Ethernet frame carries an IP packet, which in turn carries a TCP segment. In Wireshark, you’ll see Frame as the top-level capture unit, then Ethernet, then IP, then TCP, showing how the frame holds the packet and the frame’s framing information.