This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

In which layer wireshark exactly captures the packets ?

0

I am having a small question regarding wireshark , In which Layer wireshark works.

I.e , on which Layer wireshark capturing the data ?

Because I am not getting Ethernet header checksum in my capture , Any Idea ?

Thanks

asked 28 Nov '13, 21:03

si98765's gravatar image

si98765
11115
accept rate: 0%

edited 28 Nov '13, 21:07


2 Answers:

1

It generally captures at the link layer.

That does not, however, mean that the FCS is included (I assume by "Ethernet header checksum" you mean the Ethernet FCS; it is a checksum on the entire packet, not the header). It usually isn't, as the driver usually doesn't configure the Ethernet adapter to provide the FCS of incoming packets to the host (and outgoing packets are captured before the adapter sees the packet and adds the FCS). Sometimes it's provided, but usually it isn't.

answered 29 Nov '13, 01:32

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

0

See the answer and the comments to a similar question

http://ask.wireshark.org/questions/22956/where-exactly-wireshark-does-captures-packets

Regards
Kurt

answered 29 Nov '13, 06:28

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%