tags:

views:

21

answers:

1
Q: 

What are the units of winpcap captured packets, Layer 2 frames or layer 3 packets?

Just a wondering while developing a network traffic inspection program, no context is relevant!

+1  A: 

It captures the entire Layer 2 frame. The layer 2 frame contains layers 3-7 PDUs assuming the frame is based on some protocol.

dbasnett  2010-09-18 12:02:57
Oh,thanks. And I am still have a question,that when open the device,the examples given by winpcap developer's pack specified the snap length as 65536, but the max frame size is 1500 bytes.So I think it si by ip packets.
Liu  2010-09-18 13:09:07

related questions

Of Memory Management, Heap Corruption, and C++
How do I make a GUI?
Alpha blending sprites in Nintendo DS Homebrew
Thread safe lazy contruction of a singleton in C++
Interview Programming Questions - In house Exam
Link issues (VC6)
What are the barriers to understanding pointers and what can be done to overcome them?
Why are professors or schools picking Java over C++ to teach to students?
What is the best way to create a sparse array in C++
C/C++ library for reading MIDI signals from a USB MIDI device
How do you pack a visual studio c++ project for release?
How to set up unit testing for Visual Studio C++
How do I configure and communicate with a serial port?
Lightweight IDE for Linux
Mapping Stream data to data structures in C#
CPU throttling in C++
Asynchronous multi-direction server-client communication over the same open socket?
Exceptions in C++
Heap corruption under Win32; how to locate?
Build for Windows NT 4.0 using Visual Studio 2005?
C++: Should I use nested classes in this case?
BerkeleyDB Concurrency
GTK implementation of MessageBox
Is gettimeofday() guaranteed to be of microsecond resolution?
How to use the C socket API in C++ on z/OS