TechKnowSurge
CompTIA Network+ 1.1 Cisco CCNA 1.13 Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.8
TechKnowSurge Catalog Videos DEMO: Ethernet Frame (Wireshark)
VideoNetworkFree

DEMO: Ethernet Frame (Wireshark)

Wireshark is used to capture and inspect live network traffic, revealing the internal structure of Ethernet frames including Layer 2 headers, source and destination MAC addresses, and upper-layer protocol information.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireshark is a widely used network protocol analyzer that allows engineers and administrators to capture packets directly from a network interface and inspect their contents in detail. When a frame is selected from the capture list, Wireshark breaks it down into its component layers, making it possible to examine the Ethernet header fields — destination MAC address, source MAC address, and EtherType — that define how the frame is addressed and what protocol is carried in its payload. In a standard Ethernet II frame without VLAN tagging, the Layer 2 header contains three primary fields, and Wireshark displays each one clearly alongside its decoded value. The EtherType field in this context identifies IPv4 as the encapsulated protocol, which connects directly to the Layer 3 and Layer 4 information also visible within the same captured frame. Hands-on exploration of live or previously captured traffic in Wireshark is one of the most effective ways to build a concrete understanding of how Ethernet framing works in practice.

What you'll learn

What's covered

Ethernet Frames in Wireshark

Aligned to

CompTIA Network+
1.1 Explain concepts related to the Open Systems Interconnection (OSI) reference model.
Cisco CCNA
1.13 Describe switching concepts
Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis

Key terms

Ethernet Frame
The Layer 2 data unit used on Ethernet networks, containing a preamble, source and destination MAC addresses, an EtherType field identifying the Layer 3 protocol, a payload (typically an IP packet), and a 4-byte FCS for error detection. Switches use the MAC addresses in Ethernet frames to make forwarding decisions.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Data Link Layer
Layer 2 of the OSI model responsible for node-to-node data transfer and error detection on a single network segment.
Wireshark
Wireshark is an open-source network protocol analyzer that captures and interactively displays packet-level traffic, used by security professionals for network forensics, vulnerability research, and incident investigation.
Encapsulation
The process of wrapping data with protocol headers as it passes down the layers of the OSI model.
Internet Protocol
IP
The principal communications protocol for routing packets across network boundaries.

Transcript

We can peer inside of these Ethernet frames and take a look and see what they look like. I've got Wireshark pulled up here, and you can see I've already captured data. If I click through this top section, I'm just clicking through the different frames that were sent through this network card. Down below, the middle section here is where we can actually get more granular and see what's involved inside, what different headers there are and what's involved in this frame.

If I look at it, I see the Ethernet 2 right here. That's the frame right there that will take a look at the Ethernet frame and see what's involved in that. It also has the layer 3 right here, the information from the layer 3, and the information from the layer 4.

I'm just going to open up this layer 2 information right here. Let's take a quick glance at it. You can see that it has the destination of my working laptop, so that's where this frame is going to. We see the source of the demo laptop, and so that's what it's coming from. And then we also see that this is a type IP version 4. Now, I don't have any tags in here because I'm not doing any tagging with this, so we don't see all of the information in here, but we see all the information that is from the Ethernet header.

I'd recommend opening up Wireshark and playing around with it, and see what kind of traffic you have and identify the different components.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →