This is our old Q&A Site. Please post any new questions and answers at


Could someone please tell me at which layer does wireshark capture packets interms of OSI network model?

asked 22 Sep '14, 19:07

iamvicky's gravatar image

accept rate: 0%

edited 23 Sep '14, 11:20

Jim%20Aragon's gravatar image

Jim Aragon

Well, captures are done from the wire, but the lowest OSI layer you get in a frame is layer 2. In most cases that means Ethernet these days. It does not capture things like autonegitiation or preambles etc, just the frames.

permanent link

answered 22 Sep '14, 20:11

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Thanks Jasper! So, does that mean either wireshark captures packets only at layer 2 or it captures from layer 2 till layer 7?

(23 Sep '14, 03:56) iamvicky

It captures layer 2 and above...

The "and above" part is a result of L3-L7 being encapsulated within the L2 frame.

(25 Sep '14, 06:09) smp
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 22 Sep '14, 19:07

question was seen: 8,550 times

last updated: 25 Sep '14, 06:09

p​o​w​e​r​e​d by O​S​Q​A