Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Capture cellular modem traffic

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 19 Mar 2008 10:28:23 -0700
Eli Greenhut wrote:

Does the traffic captured by wireShark is before the driver or after the driver?

Before the driver.

On Windows, Wireshark uses WinPcap to capture packets, and, on various UN*Xes, it uses libpcap. WinPcap includes its own driver, which connects to the networking code above the network device driver (it plugs into the "top half" of the NDIS mechanism, and networking drivers plug into the "bottom half"), and the mechanisms libpcap uses either plug into the networking code above the network device drivers or get packets supplied by the driver.

You won't, for example, see raw GSM/UMTS/cdmaOne/cdma2000/etc. radio traffic, if that's what you're trying to see.