My question is simple: How do packet analyzer softwares, like Wireshark, sniff and analyze the network traffic? Is it just by copying each frame on the link and decode the payload and other fields to the user?
I know this question might be redundant but I really want to understand the technical method behind that since most blogs and webpages explain the general overview without considering the scientific methods.
Thank you.
Sniffing is different from analyzing - in general software like Wireshark relies on a different piece of software (or hardware) to deliver the actual packets to it, commonly in a format called "PCAP".
Parsing is pretty simple - most protocols are documented - although it's extremely time consuming to develop parsers for every protocol you might see (particularly at L4 and above). Once a packet is parsed, analyses are done based on that data, which is well formed and not unlike analysis performed on any other kind of structured data.
As to how those files get created, sometimes it is as simple as asking an OS to copy all the packets the host receives to a file in PCAP format, while other times it is an extremely complex operation performed in hardware to peek into and copy a light or electron stream on a physical wire. A common case is to use a span/mirror on a network device to copy all packets out to a port specifically for the purpose of online/offline analysis.
That's a pretty broad question and there's not enough space here to completely answer it. So, let's look at this from a high level with some direction on how to do your own investigating from there.
Ethernet Frame Analysis:
Wireshark works by decoding a buffer of Ethernet Frames and showing them in its display. Basically the format seen is what is delivered above the MAC layer, or Ethernet frames. That's handy because the underlying hardware does not matter: copper, fiber, wireless. Wireshark can read frames in or write them out to storage as files in PCAP format. If you capture some packets using Wireshark and store them in a file, you can go back to it later and pick it apart.
Sniffing:
The details for capturing frames vary based on the system, with different affects on that system. If you're working on an embedded system, you can offload a frame buffer, transform it into PCAP and load it into Wireshark for analysis. If you're working on a server or laptop, Wireshark can interface directly with NICs to capture frames. In most cases this is fine, but under heavy network traffic load frames can be lost. In those cases an logic analyzer or other separate hardware can capture all of the frames in internal buffers for offload later.
If you're working on a server, laptop, etc. you can be pretty sure that copies are made for all frames that Wireshark sees. Generally that's fine, but can impact performance for applications that require high bandwidth.
Here is a good overview of the subject: Practical Packet Analysis, 2nd ed, Chris Sanders, 2011
If you want to dig deeper, then you need to dig into the OS, into drivers or into the software or firmware of an embedded system. In that case, you'll have to be looking for something specific.
