Question about sniffers and linux

[salinarl]

Hello to everyone,
I am new to kernel internals, and I would like to know how can a sniffer
read whole packets, I mean including the link layer header. In the receive
path, this happens, I think,  in the net_rx_action(), but in the transmit
path?
I know that there is a function called dev_queue_xmit_nit() for this, but
how can a driver add a link layer header to a packet before this function
gets called? The hard_start_xmit() of the driver is, in fact, called after
the dev_queue_xmit_nit(), (in the function dev_queue_xmit() ).
I think I'm missing something important about the subject, but I hope someone 
will answer me, anyway.
Thank you in advance,

Lanfranco