This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

Could someone please tell me at which layer does wireshark capture packets interms of OSI network model?

asked 22 Sep '14, 19:07

iamvicky's gravatar image

iamvicky
11112
accept rate: 0%

edited 23 Sep '14, 11:20

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118


Well, captures are done from the wire, but the lowest OSI layer you get in a frame is layer 2. In most cases that means Ethernet these days. It does not capture things like autonegitiation or preambles etc, just the frames.

permanent link

answered 22 Sep '14, 20:11

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thanks Jasper! So, does that mean either wireshark captures packets only at layer 2 or it captures from layer 2 till layer 7?

(23 Sep '14, 03:56) iamvicky

It captures layer 2 and above...

The "and above" part is a result of L3-L7 being encapsulated within the L2 frame.

(25 Sep '14, 06:09) smp
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×248

question asked: 22 Sep '14, 19:07

question was seen: 7,452 times

last updated: 25 Sep '14, 06:09

p​o​w​e​r​e​d by O​S​Q​A