If I look at a packet, how can I tell what the link-layer protocol is? Where is it shown in wireshark?? Many thanks.. Sorry if this is an obvious question. asked 14 Dec '12, 11:41  smc20 |
One Answer:
I would say it is the first layer of the packet you should look at ;-) Regards answered 14 Dec '12, 12:52  Kurt Knochner ♦ |
Thanks. In this case; it says:
Frame 2831: 128 bytes on wire (1024 bits), 128 bytes captured (1024 bits)
So i'm guessing that's the Link-Layer. Thanks Kurt :)
erm, no. :-) The link layer protocol is: ethernet, ppp, hdlc, etc. In Wireshark it is the first layer shown after the 'Frame layer'. The link layer protocol is the protocol that is spoken on the physical medium (cable, air).
Ahh okay :-) Thanks. I bet I seem stupid. Better to ask though, right?
No problem. I recommend this book:
HINT: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.
Note also that some link layers don't show up as what they really are - PPP might show up as Ethernet on Windows or as "Linux cooked-mode capture" on Linux, and 802.11 might show up as Ethernet, for example.
Some link layers might also provide "metadata" that shows up as a layer after "Frame" but before the link layer, such as the various forms of radio information metadata for 802.11.