A capture file stores packets as bytes, starting with the header the link type names. The explorer reads each packet down the protocol stack, so its tree shows the link layer, the network layer, the transport and the application protocol, each as a node whose children are its header fields, and every byte of the packet belongs to one field. The same dissection is used for classic pcap and for pcapng. This page lists what is taken apart and what each node shows. Nothing here is part of the file format itself: a pcap file holds only the bytes.
How a packet is read
The packet list has one row for each packet: its number, its time in seconds since the first packet, the source and destination (hardware addresses at the link layer, IP addresses above it), the highest protocol found, the original length on the wire and an information line, as a network analyser shows it. A packet cut short by the snapshot length is read as far as its bytes go; the protocol that runs out of bytes is marked, and the information line says how much was captured.
Picking a packet opens its tree: for a pcap file the record header and the packet data, for a pcapng file the block and its fields, and under the packet data the protocol layers. Each field has a name, its value, a short text saying what it means (an enumerated value shows its name, flags show every bit) and a note with the definition. Bytes that no protocol reads are shown as bytes and marked.
Checksums
The IPv4 header checksum, the TCP, UDP, ICMP, ICMPv6 and IGMP checksums (the transport ones over the IP pseudo-header, with an IPv6 routing header’s final destination used where the header has one), the SCTP CRC-32C, the Ethernet frame check sequence, the 802.11 FCS and the 802.15.4 FCS are recomputed and shown as correct or incorrect, with the value that would have been right. A checksum is not judged when the packet was cut short, when it is a fragment, when the IP length field is 0 (segmentation offload) or when UDP over IPv4 leaves it at 0. A wrong checksum in a capture taken on the sending machine is usually checksum offload: the network card fills the field in after the capture software has seen the packet.
Link layers
These link types are read into fields: 0 and 108 (BSD and OpenBSD loopback), 1 and 274 (Ethernet), 6 (Token Ring), 9, 50, 51, 166 and 204 (PPP and PPPoE), 10 (FDDI), 100 and 123 (ATM), 101, 228 and 229 (raw IP), 104 and 205 (Cisco HDLC), 105 (802.11), 113 (Linux cooked v1), 119 (Prism), 127 (radiotap), 163 (AVS), 187, 201 and 254 (Bluetooth HCI), 189, 220 and 249 (USB), 191, 195, 215 and 230 (IEEE 802.15.4), 192 (PPI, then the link type it names), 227 (SocketCAN) and 276 (Linux cooked v2). Every other registered link type is named from the register and its packets are shown as bytes.
Ethernet
Destination, source (with the vendor of the address prefix where it is known and the multicast and locally administered bits) and the type or length. A type of 1500 or less is an IEEE 802.3 length and the payload starts with an LLC header. Padding and trailers after the payload are shown. With an FCS stated by the file, the frame check sequence is read and checked.
VLAN tags
802.1Q, 802.1ad and the old Q-in-Q types: priority code point, drop-eligible bit, VLAN identifier and the type of what follows, nested for stacked tags.
LLC, SNAP, STP, CDP, LLDP
DSAP, SSAP, the one- or two-byte control field, and for SNAP the OUI and protocol ID (an Ethernet type when the OUI is zero). Spanning tree BPDUs (protocol, version, type, flags, root and bridge identifiers, path cost, port, timers), Cisco Discovery Protocol and LLDP are read TLV by TLV.
802.11, radiotap, PPI, Prism, AVS
The radiotap header’s present words and every field of the first namespace (TSFT, flags, rate, channel, signal and noise, antenna, RX and TX flags, retries, XChannel, MCS, A-MPDU, VHT, timestamp, HE, HE-MU, L-SIG); the 802.11 frame control, duration, addresses (by the To DS and From DS bits), sequence control, QoS and HT control; the bodies of beacons, probes, authentication, association, disassociation and deauthentication frames with their information elements (SSID, rates, DS parameter set, TIM, country, RSN with its cipher and key management suites, HT and VHT capabilities, vendor elements); control frames; data frames with the CCMP, TKIP or WEP parameters (the payload is encrypted and is shown as bytes) or an LLC header.
PPP, Cisco HDLC, loopback, cooked capture
PPP address, control and protocol (one or two bytes), LCP, IPCP and IPv6CP packets with their options, PAP and CHAP; Cisco HDLC address, control and protocol; the loopback address family (in either byte order for link type 0); the Linux cooked header: packet type, address type, address length, address, protocol (and for version 2 the interface index).
Bluetooth, USB, CAN, IEEE 802.15.4
HCI command, event, ACL, SCO and ISO packets, with the opcode group and command, event code and handle; the Linux monitor header; USB URB headers (usbmon 48 and 64 bytes and USBPcap) with the setup packet; SocketCAN identifier, flags, length and data; the 802.15.4 frame control, sequence number, PAN identifiers, short and extended addresses and frame check sequence.
Network layer
ARP and RARP
Hardware type, protocol type, address sizes, opcode and the four addresses, with the information line a request, reply or announcement gets.
IPv4
Version and header length, DSCP and ECN, total length, identification, flags and fragment offset, time to live, protocol, header checksum, source, destination and every option (end, no-op, record route, source routes, timestamp, router alert, stream ID and others by name). A later fragment shows its data as bytes; a first fragment is read as far as it goes.
IPv6
Version, traffic class, flow label, payload length, next header, hop limit, source and destination, and the extension headers: hop-by-hop and destination options (with their options), routing (including the segment routing header’s segments), fragment, authentication, and ESP as an opaque payload.
ICMP, ICMPv6 and IGMP
Type, code, checksum and the message: echo identifier and sequence, unreachable reasons and next-hop MTU, time exceeded, redirect gateway, parameter problem pointer, timestamps, router advertisements, and the quoted original datagram of an error. ICMPv6 adds Neighbor Discovery (router and neighbour solicitation and advertisement, redirect, with the source and target link-layer address, prefix information, MTU, route, recursive DNS server and DNS search list options) and multicast listener messages including version 2 records. IGMP covers the version 1, 2 and 3 queries and reports.
Tunnels
IPv4 and IPv6 inside IP, GRE, ESP and AH headers, MPLS label stacks, PPPoE discovery tags, and over UDP: VXLAN, Geneve and GTP-U. The inner packet is read as part of the outer, and the summary columns show the innermost protocol.
Transport layer
TCP
Ports, sequence and acknowledgment numbers, data offset, the nine flags, window, checksum, urgent pointer and every option: maximum segment size, window scale, SACK permitted, SACK blocks, timestamps, alternate checksum, user timeout, MD5, TCP-AO, Multipath TCP subtype, Fast Open cookie and experimental options. The information line gives the flags, the numbers, the window, the payload length and the options. The sequence numbers are shown as they are, not relative to the start of the stream.
UDP and SCTP
UDP source and destination port, length and checksum. SCTP ports, verification tag, CRC-32C, and each chunk (DATA, INIT, SACK and the others) with its flags and length.
Application protocols
An application protocol is chosen by the well-known port, then by looking at the bytes. A TCP segment that carries the middle of a message is shown as stream data; the Conversations tab follows a whole stream.
DNS and mDNS
Transaction ID, flags (query or response, opcode, authoritative, truncated, recursion, authentic data, checking disabled, response code), the counts, the questions and every resource record: name (compression pointers followed), type, class (with the multicast DNS cache-flush and unicast-response bits), time to live and data. Record data is taken apart for A, AAAA, NS, CNAME, PTR, MX, SOA, TXT, SRV, NAPTR, CAA, URI, DS, DNSKEY, RRSIG, NSEC, NSEC3, TLSA, SSHFP, SVCB and HTTPS, OPT (with its EDNS options) and TSIG; other types show their bytes under the type name. DNS over TCP is read through its length prefix.
DHCP and BOOTP
Every fixed field (operation, hardware type and length, hops, transaction ID, seconds, flags, the four addresses, client hardware address, server name and boot file), the magic cookie and each option by name, with the message type, address lists, times, strings, the parameter request list, client identifier, FQDN, classless routes and relay agent sub-options decoded.
NTP
Leap indicator, version, mode, stratum, poll, precision, root delay and dispersion, reference ID, the four timestamps as dates, and the key identifier and digest.
HTTP, SSDP and RTSP
The request or status line, each header field and the start of the body as text. SSDP is the same format over UDP port 1900.
TLS and QUIC
TLS and DTLS records (content type, version, length), alerts, and the handshake messages sent in the clear: Client Hello and Server Hello with the cipher suites, compression methods and extensions (server name, supported groups, signature algorithms, ALPN, supported versions, key shares and others by name), certificates as bytes, and the key exchange messages. After the keys change a record is encrypted and is shown as bytes. QUIC long headers show the version and connection IDs, token and length; QUIC’s packet numbers and payloads are protected and are shown as bytes.
SSH
The protocol version exchange banner, and the binary packets of the key exchange (packet length, padding length, message code, the algorithm name lists of a key exchange init message).
Statistics and streams
The explorer works out, over the first 500,000 packets, the conversations and endpoints at the Ethernet, IPv4, IPv6, TCP and UDP layers, a protocol hierarchy, a packet length distribution, packets over time and the number of checksums that were right and wrong. A TCP stream is followed by ordering its segments by sequence number, dropping retransmitted data and marking gaps, and is shown as text and as hexadecimal, up to 1 MB.