What does "raw packet data" field mean in Wireshark?

2
votes

figure 1

enter image description here

As you can see in first figure, what does that Raw packet data mean? What is the difference between normal tcp packet in figure 2?

FYI, I'm using Wireshark 2.2.0.

1
tcpwireshark
It's wireshark.org/docs/wsug_html_chunked/…. I know exactly how to check what's in the packet, when I click the "Raw packet data", it contains all the tcp packet. – jerrypy

1 Answers

2
votes

Basically when you are capturing packets on an interface you have an associated link type to it (ethernet, 802.11, 802.15.4, etc).

Raw packet is used when you dont have any, the first bytes captured are directly the IPv6 or IPv4 header.

Raw IP; the packet begins with an IPv4 or IPv6 header, with the "version" field of the header indicating whether it's an IPv4 or IPv6 header.

From http://www.tcpdump.org/linktypes.html