 | 1 | initial version |
Also the link layer shows as "Ethernet", but I am connected via wifi, so it should appear IEEE 802.11, but I have seen here that wifi interfaces often present themselves as Ethernet interfaces, so they present Ethernet translated packets, to make it easy for the OS to manage them, or something like that...
Yes.
So, unless, as Jaap suggests, you capture in monitor mode, that's what the interface and its driver will do. You won't see 802.11 headers, which means you won't see the "receiver address" or "transmitter address"; if a frame is transmitted from a station with the MAC address XX:XX:XX:XX:XX:XX to a station with the MAC address YY:YY:YY:YY:YY:YY, the source address will be XX:XX:XX:XX:XX:XX and the destination address will be YY:YY:YY:YY:YY:YY, even though the frame may initially be sent to an AP with the MAC address ZZ:ZZ:ZZ:ZZ:ZZ:ZZ - ZZ:ZZ:ZZ:ZZ:ZZ:ZZ will be the "receiver address" of the frame, but YY:YY:YY:YY:YY will be the destination address of the frame.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
