That's a pretty broad question and there's not enough space here to completely answer it. So, let's look at this from a high level with some direction on how to do your own investigating from there.
Ethernet Frame Analysis:
Wireshark works by decoding a buffer of Ethernet Frames and showing them in its display. Basically the format seen is what is delivered above the MAC layer, or Ethernet frames. That's handy because the underlying hardware does not matter: copper, fiber, wireless. Wireshark can read frames in or write them out to storage as files in PCAP format. If you capture some packets using Wireshark and store them in a file, you can go back to it later and pick it apart.
- TCP/IP Illustrated, Volume 1 by Richard Stevens is a classic.
Although there have been many improvements, it provides the
- Wikipedia articles offer a rich source for frame format, protocols and are pretty well kept up to date.
The details for capturing frames vary based on the system, with different affects on that system. If you're working on an embedded system, you can offload a frame buffer, transform it into PCAP and load it into Wireshark for analysis. If you're working on a server or laptop, Wireshark can interface directly with NICs to capture frames. In most cases this is fine, but under heavy network traffic load frames can be lost. In those cases an logic analyzer or other separate hardware can capture all of the frames in internal buffers for offload later.
If you're working on a server, laptop, etc. you can be pretty sure that copies are made for all frames that Wireshark sees. Generally that's fine, but can impact performance for applications that require high bandwidth.
Here is a good overview of the subject:
Practical Packet Analysis, 2nd ed, Chris Sanders, 2011
If you want to dig deeper, then you need to dig into the OS, into drivers or into the software or firmware of an embedded system. In that case, you'll have to be looking for something specific.