Wireshark-users: Re: [Wireshark-users] Capture cellular modem traffic
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 19 Mar 2008 10:28:23 -0700
Eli Greenhut wrote:
Does the traffic captured by wireShark is before the driver or after the driver? 

Before the driver.
On Windows, Wireshark uses WinPcap to capture packets, and, on various UN*Xes, it uses libpcap. WinPcap includes its own driver, which connects to the networking code above the network device driver (it plugs into the "top half" of the NDIS mechanism, and networking drivers plug into the "bottom half"), and the mechanisms libpcap uses either plug into the networking code above the network device drivers or get packets supplied by the driver.
You won't, for example, see raw GSM/UMTS/cdmaOne/cdma2000/etc. radio traffic, if that's what you're trying to see.