This selects whether captured packets are forwarded to the capture destination using Layer 2 or Layer 3 connectivity. An admin picks L2 mode to send captured frames to a destination MAC address on the local segment, or L3 mode to route them via IP to a destination elsewhere on the network. For example, an admin capturing traffic to a remote analysis server on a different subnet would choose the L3 mode so captured packets can be routed over IP.