Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
We know we can use Wireshark for capture packets, we know Wireshark is based on the network interface adapter.
This is a list of packets captured by Wireshark:
Is Wireshark based on the network interface adapter, so all the packets are data frames (Layer 2's PDU)? Or all the packets are bits, converted to the list by Wireshark?
Wireshark captures network frames from (somewhat) in between the NIC driver and the operating system (or "the stack"). Anything that uses a valid frame should show up.
The common Ethernet frames are a bunch of bytes (shown in the lower section) that have a certain format to allow clean layer separation. The section in the middle shows the layering.
Ethernet II, Src ...
is the data link layer (2) frame using MAC addresses for forwarding.
Internet Protocol Version 4, Src ...
is the encapsulated network layer (3) packet using IP addresses for forwarding.
Data (xxx bytes)
is the data transported by IP, apparently Wireshark is unable to interpret. Wireshark understands a very large number of protocols and can display the details in an easily readable way.
They are frames as made available by the operating system and hardware; it's not done by Wireshark.
