Packet-record term Snap length is the maximum number of bytes stored from each packet. A longer packet can be stored only in part. It is a recording limit, not proof that every packet reached the recording point. Read a packet record with its context A frame is a local-link unit; its payload here contains an IP packet. Source and destination state the direction of a particular row. The reply can reverse those roles, so read both addresses each time. A timestamp labels a record time. These synthetic offsets are measured from the stated UTC base; one microsecond is 0.000001 second. They are constructed values, not measured network latency. The complete table below lets you trace every supplied frame without opening a file. Synthetic packet table. Not a live capture. Not Wireshark output. Capture point: fictional interface lab0 on host desk. Clock label: 2026-01-01 00:00:00 UTC plus the offset. Display timezone is not claimed. Snap length on the card: 65535. This table is not every frame in the lab. Worked frame, paper only. It is not inside intro-demo.pcapng. Frame Offset Source MAC Destination MAC IPv4 source IPv4 destination Transport W1 0.000000 00:00:5e:00:53:10 00:00:5e:00:53:01 192.168.50.10 192.0.2.10 UDP 49152 to 9 Payload on the card: map 192.0.2.10 is documentation TEST-NET-1. The frame is a model of one packet toward gate. Activity rows. A1, A2, and A3 are the only frames serialized in intro-demo.pcapng. Frame Offset Ethernet IPv4 TCP A1 0.000000 desk to shelf 192.168.50.10 to 192.168.50.23 SYN 49152 to 9090 A2 0.000001 shelf to desk 192.168.50.23 to 192.168.50.10 SYN-ACK 9090 to 49152 A3 0.000002 desk to shelf 192.168.50.10 to 192.168.50.23 ACK 49152 to 9090 Absent: a frame that never reached lab0, including a frame between two other hosts. Predict before reading the check. Check: A2 is shelf 192.168.50.23 and desk 192.168.50.10. A missing row does not prove that no other packet existed.