.PCAPNG

Introduction

pcapng is the successor to the PCAP capture format, and the default format of Wireshark. Like PCAP it records network packets with the time each was seen, but it can also record several network interfaces in one file, each with its own link type, and carry comments, name resolution, statistics and the keys needed to decrypt TLS traffic.

The format is built from blocks that a reader can skip if it does not understand them, so new kinds of information can be added without breaking older software.

Structure

Every block has the same frame: a 4-byte block type, a 4-byte total length, the body, and the total length again, so the file can be read backwards as well as forwards. Bodies are padded to a multiple of 4 bytes, and most blocks end with options, each a code, a length and a value.

The file starts with a Section Header Block, type 0x0A0D0D0A. Its first field is the byte-order magic 0x1A2B3C4D, which tells a reader whether the section is big- or little-endian, followed by the version, 1.0. An Interface Description Block (type 1) follows for each interface, giving its link type and snapshot length. Packets are then stored in Enhanced Packet Blocks (type 6), each naming its interface and giving a 64-bit timestamp, the captured and original lengths and the packet bytes. Other blocks hold name resolution (type 4), interface statistics (type 5) and decryption secrets.

Links