![What layer does wireshark capture packets at](https://cdn1.cdnme.se/5447227/9-3/2_64e61dfa9606ee7f98e9879b.png)
![what layer does wireshark capture packets at what layer does wireshark capture packets at](http://l.github.io/debian-handbook/html/ko-KR/images/wireshark.png)
Is Frame an internal Wireshark used to assist the user to easily see some global information about the packet of interest and some Wireshark configuration data OR is Frame a networking protocol in and of itself? I interpret the above statement as saying that "Frame" is not data that was actually being transmitted from point(A) to point(B) when I was taking the capture, but is some sore of container upon which Wireshark "builds" the captured data to show me. Such as the exact time a specific frame was captured. This led me to the following source: which states: The frame protocol is not a real protocol, but is is used by Wireshark as a base,įor all the other protocols on top of it. Naturally I wanted to know what "Frame" relates to so I did a quick google for the following: "What does frame in Wireshark related to?" When I click '"Frame" I see a list of the following elements: Interface Id: 0Įncapsulation Type: Linux cooked-mode-captureĬapture length: 45 bytes (360 bits) My question When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame
![What layer does wireshark capture packets at](https://cdn1.cdnme.se/5447227/9-3/2_64e61dfa9606ee7f98e9879b.png)