We know we can use Wireshark for capture packets, we know Wireshark is based on the network interface adapter.

This is a list of packets captured by Wireshark:

enter image description here

Is Wireshark based on the network interface adapter, so all the packets are data frames (Layer 2's PDU)? Or all the packets are bits, converted to the list by Wireshark?

2 Answers 2


Wireshark captures network frames from (somewhat) in between the NIC driver and the operating system (or "the stack"). Anything that uses a valid frame should show up.

The common Ethernet frames are a bunch of bytes (shown in the lower section) that have a certain format to allow clean layer separation. The section in the middle shows the layering.

Ethernet II, Src ...

is the data link layer (2) frame using MAC addresses for forwarding.

Internet Protocol Version 4, Src ...

is the encapsulated network layer (3) packet using IP addresses for forwarding.

Data (xxx bytes)

is the data transported by IP, apparently Wireshark is unable to interpret. Wireshark understands a very large number of protocols and can display the details in an easily readable way.


They are frames as made available by the operating system and hardware; it's not done by Wireshark.

  • do you mean the packages all are frames, and the packages is copy from operating system by Wireshark? Sep 8, 2018 at 11:21
  • Yes, packet sniffing software receives the most raw thing available from the hardware; which is a whole frame, given to Wireshark via the operating system.
    – jonathanjo
    Sep 8, 2018 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.