Re: What level does Ethereal capture packets?

Guy Harris <[email protected]> Thu, 27 Jul 2006 18:31:09 -0700

Newsgroups	gmane.network.ethereal.user
Message-ID	<[email protected]>

On Jul 27, 2006, at 5:27 PM, Ulf Lamping wrote:

> What I would guess is that WinPcap is capturing "high above" the  
> USB driver, at the NDIS network level.

Yes.  It includes an NDIS transport layer driver.  However, if the  
mobile phone looks like a modem on a serial port, it's probably using  
the Network Monitor driver rather than the WinPcap driver (at least  
if the laptop is running NT/W2K/WP), which is still above the USB  
driver.