My question is simple: How do packet analyzer softwares, like Wireshark, sniff and analyze the network traffic? Is it just by copying each frame on the link and decode the payload and other fields to the user?

I know this question might be redundant but I really want to understand the technical method behind that since most blogs and webpages explain the general overview without considering the scientific methods.

Thank you.

  • That's really how it works. The software taps into the stream in the network stack, and it applies standard methods to decode the traffic stream.
    – Ron Maupin
    Jan 11, 2016 at 19:44
  • Thank you Ron. Does it mean that it listens to the network via your NIC card?
    – Mido Ka
    Jan 11, 2016 at 19:46
  • It taps into the network stack in some fashion that is specific to each OS. That is beyond the scope of this site, and you could ask on the SE site specific to your configuration.
    – Ron Maupin
    Jan 11, 2016 at 19:49
  • Get some background documentation here Jan 12, 2016 at 14:11

2 Answers 2


Sniffing is different from analyzing - in general software like Wireshark relies on a different piece of software (or hardware) to deliver the actual packets to it, commonly in a format called "PCAP".

Parsing is pretty simple - most protocols are documented - although it's extremely time consuming to develop parsers for every protocol you might see (particularly at L4 and above). Once a packet is parsed, analyses are done based on that data, which is well formed and not unlike analysis performed on any other kind of structured data.

As to how those files get created, sometimes it is as simple as asking an OS to copy all the packets the host receives to a file in PCAP format, while other times it is an extremely complex operation performed in hardware to peek into and copy a light or electron stream on a physical wire. A common case is to use a span/mirror on a network device to copy all packets out to a port specifically for the purpose of online/offline analysis.


That's a pretty broad question and there's not enough space here to completely answer it. So, let's look at this from a high level with some direction on how to do your own investigating from there.

Ethernet Frame Analysis:

Wireshark works by decoding a buffer of Ethernet Frames and showing them in its display. Basically the format seen is what is delivered above the MAC layer, or Ethernet frames. That's handy because the underlying hardware does not matter: copper, fiber, wireless. Wireshark can read frames in or write them out to storage as files in PCAP format. If you capture some packets using Wireshark and store them in a file, you can go back to it later and pick it apart.

  • TCP/IP Illustrated, Volume 1 by Richard Stevens is a classic. Although there have been many improvements, it provides the fundamentals.
  • Wikipedia articles offer a rich source for frame format, protocols and are pretty well kept up to date.


The details for capturing frames vary based on the system, with different affects on that system. If you're working on an embedded system, you can offload a frame buffer, transform it into PCAP and load it into Wireshark for analysis. If you're working on a server or laptop, Wireshark can interface directly with NICs to capture frames. In most cases this is fine, but under heavy network traffic load frames can be lost. In those cases an logic analyzer or other separate hardware can capture all of the frames in internal buffers for offload later.

If you're working on a server, laptop, etc. you can be pretty sure that copies are made for all frames that Wireshark sees. Generally that's fine, but can impact performance for applications that require high bandwidth.

Here is a good overview of the subject: Practical Packet Analysis, 2nd ed, Chris Sanders, 2011

If you want to dig deeper, then you need to dig into the OS, into drivers or into the software or firmware of an embedded system. In that case, you'll have to be looking for something specific.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.