What are some causes of the number of bytes on the wire exceeding the number of bytes being captured?

A difference between bytes on the wire and bytes captured can indicate that not everything is  being captured or that partial or malformed packets may be captured which could lead to  incorrect analysis. If there are regularly more bytes on the wire than captured it is possible that  the computer on which Wire shark is running is not able to keep up with the interface.

Learn more:

Keywords: bytes, wire, packets, wire shark

omg taking this same test i was stuck on the same question i was too lazy to read the book sadly i cant really give you an answer to this question too complex the answer will be in chapter 5 of the cay