Can somebody explain me this?
On almost any modern system, tcpdump will be capturing IP over Ethernet, meaning that the data actually captured by libpcap consists of Ethernet frames containing IP packets.
In: Technology
Well, tcpdump is a program that uses the libpcap library to capture network data. IP packets are layer 3, probably what you want captured, but libpcap is layer 2, so it’s going to capture ethernet frames on ethernet; or something even more obscure if you’re not using ethernet. Since for certain network settings, IP packets can be longer than ethernet frames, you might get data that you don’t exactly understand if you presume there is a 1-to-1-and-onto relationship between max frame size and packet length.
I don’t know that you’ll understand this explanation, because it also presumes you know something about how network protocols work. Perhaps you should share the actual real question you had that caused google to give you this bit of technobabble. That could probably be more directly explained than using this intermediate representation of your question.
Is it what the sentence means, why you can do it or how it works technically?
What is the question exactly?
You can use software to capture the networking traffic that your computer sends and receive.
Most of the time it is IP packets send over ethernet. The frame is the name used in ethernet for the data that is sent over it so like a packet for IP but on a bit lower level.
Latest Answers