When using Wireshark on my MacBook, I see all my packages wrapped inside Ethernet II frames, although I'm connected wirelessly, which I already figured must be because they are translated from 802.11 somewhere along the way.

But what I wondered was, why they are translated in the first place? Are they only translated for Wireshark? Who does the translation? The NIC, or the kernel, or some OS daemon? Isn't there some information lost (I know 802.11 carries a lot more information than 802.3)?

2 Answers 2


IEEE 802.11 wi-fi uses the same framing as Ethernet (with some additions) and usually that's Ethernet II.

802.11 frames can be somewhat larger (2304 bytes payload) than Ethernet's (1500 bytes payload) but very often both are bridged together and use Ethernet's MTU.


Because 802.11a/b/n/g are standards defined on physical layer, framing staying same as in ethernet on above layers. Wireshark usually captures at the link layer so it's why you see Ethernet frames. Is how encapsulation work in OSI standard. Hope that picture below would help you to understand: enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.