Protocol Data Unit (PDU)
Definition
The named unit of data at each OSI layer: a frame at Layer 2, a packet at Layer 3, a segment at Layer 4, and a message or datagram at Layer 7. Investigators use these terms to specify precisely which layer of a capture they are analysing.
- Layer 2 name
- Frame
- Layer 3 name
- Packet
- Layer 4 name
- Segment
- Layer 7 name
- Message or datagram
Common questions
Why does it matter whether an investigator calls something a packet versus a frame?+
Each layer's PDU carries different header information and different artefacts of evidentiary value, a frame carries MAC addresses while a packet carries IP addresses, so precise terminology prevents confusion when documenting exactly what evidence was captured or altered.
Does every OSI layer boundary correspond to a distinct file or object in a packet capture tool?+
Not exactly; a capture tool like Wireshark displays the full frame but decodes it into nested layers on screen, so the PDU terms describe logical encapsulation levels within one captured unit rather than separate stored files.
Related terms
- DNS Query Log
- A record maintained by a DNS resolver listing each domain name query, the requesting IP address, the response, and the timestamp. DNS...
- Encapsulation
- The process by which each OSI layer wraps the payload from the layer above it inside its own header (and sometimes trailer)....
- PCAP (Packet Capture File)
- A binary file format that stores raw network traffic captured from a network interface. Tools such as Wireshark, tcpdump, and Zeek read...
- Server Name Indication (SNI)
- A TLS extension sent in plaintext in the Client Hello message that identifies the hostname the client intends to reach. SNI is...
- TCP Three-Way Handshake
- The connection establishment sequence in TCP: the client sends SYN, the server responds SYN-ACK, and the client completes with ACK. The timestamps...