I'm analyzing our network and have some confusion about the terms: this is the 2-packet output from source to destination.

from these i have to get some features as describe, pls make me clear...

1. packets with at least a bytes of TCP data payload: it seems tcp.len>0;

2. The minimum segment size (confusion is headers are included or or not)

3. The average segment size observed during the lifetime of the connection, the definition: is calculated as the value reported in the actual data bytes divided by the actual data pkts reported.

4. Total bytes in IP packets, should be ip_len value.

5. Total bytes in (Ethernet)

6. The total number of bytes sent

probably related to frame.len and frame.cap_len these two terms are describes as, also make me clear about these two terms.

• frame.cap_len: Frame length stored into the capture file
• frame.len: Frame length on the wire