From the info, Wireshark capture "Live packet" from ethernet.
Can i know where these "live packet" is capture?
I am not familiar with network. Thanks in advance !!!!
asked 29 Sep '10, 20:02
I think "Live packet capture" in this case means that the network data is captured live from the network, as opposed to opening an existing, prerecorded (dead? :-)) trace file. That statement is probably there to tell you that Wireshark is not just an offline packet analysis tool, but that it can capture, too. Well, dumpcap does all the capturing work, but Wireshark is the "commanding officer" :-)
I can't describe the flow of capture downto the finest details, but I'd say it's like this: Network Cable -> Ethernet Card -> OS -> libPCAP/WinPCAP -> dumpcap.exe -> tempfile -> Wireshark
answered 30 Sep '10, 01:48