3 ms·
Wireshark works at the data link layer (L2).
by thelittleone 3y ago
Wireshark works at the data link layer (L2).
- vitus 3y agoWell... ethhdr only has 14 bytes: 6 for dest mac address, 6 for source mac address, 2 for ethertype (e.g. IPv4 vs IPv6). Any bad checksums that Wireshark can detect are predominantly at the transport layer (L4; TCP / UDP). You'd have to explicitly turn on FCS, which I don't know if you can even do on, say, Windows.