OSI Layer for Network Traffic Monitoring

312-49v10 By islever Editorial Last updated

Network Forensics

Short answer

A You are monitoring at the Network layer (Layer 3) because the investigation involves analyzing traffic through a router, which operates primarily at this layer using IP addresses.

Question

You have been called in to help with an investigation of an alleged network intrusion. After questioning the members of the company IT department, you search through the server log files to find any trace of the intrusion. After that you decide to telnet into one of the company routers to see if there is any evidence to be found. While connected to the router, you see some unusual activity and believe that the attackers are currently connected to that router. You start up an ethereal session to begin capturing traffic on the router that could be used in the investigation. At what layer of the OSI model are you monitoring while watching traffic to and from the router?
  1. Network Correct Answer
  2. Transport
  3. Data Link
  4. Session

Key Takeaways

The trap lies in confusing packet capture (Data Link) with router-based monitoring (Network).

This question tests the understanding of network forensics and the OSI model layers involved in traffic capture. The correct answer is A because the question asks about monitoring at the router level, which operates at Layer 3.

Common mistake: Many learners select C (Data Link) because they associate Wireshark/Ethereal with Layer 2 captures, ignoring the specific context of 'monitoring' via a router.

Expert Analysis

Why the Answer Is Correct

The question specifies that you are monitoring traffic to and from a router. Routers are Layer 3 (Network) devices that operate based on IP addresses. While the tool (Ethereal/Wireshark) captures packets at the Data Link layer, the act of monitoring the flow of data as it traverses the routing infrastructure focuses on the Network layer where IP headers and routing decisions occur. The source key identifies A as correct, aligning with the device's primary operational layer.

Why the Other Options Are Wrong

Option C (Data Link) is the most common distractor because packet sniffers inherently read frames at Layer 2. However, the question asks what layer you are monitoring while watching traffic in the context of a router investigation. Option B (Transport) deals with ports and protocols like TCP/UDP, which is higher than the router's main function. Option D (Session) is even higher and not relevant to basic router monitoring.

Community Comment Notes

Comments show a split between A and C. One user argues for A by stating, "Capture takes place at data link, while monitoring takes place at whatever layer your target operates." Another user supports C, noting, "Capturing you do at datalink layer." The consensus leans towards A when considering the router's role in the OSI model.

Exam Strategy

When questions mention routers or IP-based forwarding, think Layer 3. If they mention switches, MAC addresses, or raw frame capture on an endpoint, think Layer 2. Pay attention to whether the question asks about the tool's capability or the device's operational layer.

Frequently Asked Questions

Why isn't the answer Data Link if we use Wireshark?

Wireshark captures at Layer 2, but the question asks about monitoring via a router, which functions at Layer 3. The context shifts focus to the routing device's layer.

Does Ethereal capture at the same layer as monitoring?

Ethereal captures frames at Layer 2. However, 'monitoring' in a router context implies observing the IP traffic flow, which is a Layer 3 activity.

More 312-49v10 FAQ →

Community Votes

A
67%
C
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. aqeel1506 👍 1
    The correct answer is C. When using Ethereal (now known as Wireshark) to capture traffic on a router, you are monitoring at the Data Link layer (Layer 2) of the OSI model. This layer is responsible for framing, error control, and flow control of data transmitted over a network. At the Data Link layer, you can see packet headers, MAC addresses, and other information related to the local network segment. This allows you to monitor and analyze traffic to and from the router, including potential attacker activity. A. Network (Layer 3): This layer is responsible for routing and addressing, but you're not monitoring at this layer with Ethereal. B. Transport (Layer 4): This layer is responsible for reliable data transfer, but you're not monitoring at this layer with Ethereal. D. Session (Layer 5): This layer is responsible for establishing, managing, and terminating connections, but you're not monitoring at this layer with Ethereal.
  2. 044f354 👍 1 Answered A
    Follow the LITERAL phrasing of the question: At what layer of the OSI model are you monitoring while watching traffic to and from the router? Capture takes place at data link, while monitoring takes place at whatever layer your target operates. Wireshark captures traffic at the Data Link Layer (Layer 2), the act of monitoring depends on the layer at which the device (in this case, the router) operates. A router operates at the Network Layer (Layer 3), so you are monitoring traffic at the Network Layer when analyzing the router's activity. A. Network: Correct – Routers operate at the Network layer (Layer 3). B. Transport: Incorrect – Deals with end-to-end communication protocols like TCP/UDP, not routers. C. Data Link: Incorrect – Manages direct node-to-node data transfer, relevant for switches, not routers. D. Session: Incorrect – Manages sessions between applications, (Layer 5).
  3. 4bd3116 👍 1 Answered A
    The Answer is right. The OSI model's network layer (Layer 3) includes IP addresses and routing information.
  4. ala76nl 👍 1 Answered C
    Capturing you do at datalink layer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Analyzing Password-Protected Packed Malware

S-grade

Steganalysis for Steganography Attack Detection

S-grade

File Sector Allocation and Fragmentation in Forensics

S-grade

Which Tor Relay Should Investigators Focus On to Trace Data Origin?

S-grade

← Back to 312-49v10 Study Guide