An attack hitbox is considered “active” for however many frames it lasts and can theoretically do its attack. Before this, some startup time is almost always required, and after this comes recovery time.