In this case study, it is 60 bytes in which the ARP is used to find the physical link-layer address of a router interface or host when its logical IP address is given. Furthermore, the frame size also determine according to the used application in the network. Hence, the frame size changes according to MTU in a given network type. For example, the MTU for the Asynchronous Transfer Mode (ATM) is 53 bytes, the MTU in the Ethernet and IPv4 network is 1500 bytes and there is other network types use of jumbo frames that reach to 9000 bytes. The frame size is measured with the Maximum Transmission Unit (MTU) and this unit is determined according to the used network type. The section of details shows that the frame number is 60 bytes, the network type which is Ethernet II, the protocol type is IPv4 and payload content is ARP. 2 shows Wireshark interface displaying the three windows the summary, details and byte panel, with different characteristics of network's traffic in readable manner. Beside the promiscuous mode, it may be enable the port mirroring to any points of the network when the promiscuous mode does not coverage all network. important note here, to run the Wireshark tool, it sets the NIC to promiscuous mode for enabling the sniffer to see all traffic on that interface, not just the traffic that addressed to one of the configured interfaces.

Wireshark sniff network traffic