In which layer of the OSI model does a sniffer operate?

The Network layer (Layer 3) handles IP routing and logical addressing; sniffers do not operate here because they capture frames before IP processing occurs.

The Session layer (Layer 5) manages dialog control between applications and has no role in raw packet capture at the hardware/frame level.

The Presentation layer (Layer 6) handles data formatting and encryption/decryption, which is above the frame-capture level where sniffing takes place.

The Data Link layer (Layer 2) is where sniffers operate because they interact with the network interface card at the frame level, reading all frames traversing the wire regardless of destination MAC address. Placing the NIC in promiscuous mode allows the sniffer to capture every frame on the segment, including those not addressed to the host. This raw frame capture is inherently a Layer 2 function.