| |
At what layer in the protocol stack is the sniffing being done?
It is done at level 2, data link layer. Captured data includes the Ethernet header, but not the additional Ethernet frame fields. These fields, for example a check sum field after the frame, are stripped by the hardware layer.
|
|
|
