A pcapng file is nothing but a run of blocks. Every block has the same frame, so a reader can step over any block it does not know. Most blocks end with a list of options. This page follows the IETF draft PCAP Now Generic (pcapng) Capture File Format (draft-ietf-opsawg-pcapng), checked against its revision 06 of 19 September 2026.
Block frame
Numbers are in the byte order of the section the block is in; see section header.
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
0 | 4 | uint32 | Block Type | What the block is: see block types. |
4 | 4 | uint32 | Block Total Length | The size of the whole block in bytes, from Block Type to the trailing length. Always a multiple of 4. A block with an empty body is 12 bytes. |
8 | varies | bytes | Block Body | The block’s fields and options, padded with zeros to a multiple of 4 bytes. |
| end − 4 | 4 | uint32 | Block Total Length | The same value again, so a reader can walk the file backwards. |
Every variable-length field, such as packet data, is padded with zero bytes to the next multiple of 4; its own length field never counts the padding. 64-bit numbers are not guaranteed to fall on an 8-byte boundary.
Sections
A file is one or more sections. Each section starts with a Section Header Block and runs to the next one or to the end of the file. Sections can be in different byte orders; this is how two captures can be joined by simply putting one file after the other. Interface numbers count from 0 in each section, in the order of the Interface Description Blocks in that section.
Block order rules: a Section Header Block comes first; an Interface Description Block must come before any block that refers to its interface number; other blocks can be in any order, and Custom Blocks can be anywhere after the first Section Header Block.
Block types
Block types with the top bit set (0x80000000 to 0xFFFFFFFF)
are for local use and are not portable. Everything else is assigned in the draft’s
register:
| Code | Block | Notes |
|---|---|---|
0x00000000 | Reserved | Draft 06 lists it as “Reserved ???”. |
0x00000001 | Interface Description Block | See interface description. |
0x00000002 | Packet Block | Obsolete; must not be written. See packet blocks. |
0x00000003 | Simple Packet Block | See packet blocks. |
0x00000004 | Name Resolution Block | See other blocks. |
0x00000005 | Interface Statistics Block | See other blocks. |
0x00000006 | Enhanced Packet Block | See packet blocks. |
0x00000007 | IRIG Timestamp Block | The same code is also used for a Socket Aggregation Event Block. Layout not in the draft. |
0x00000008 | ARINC 429 in AFDX Encapsulation Information Block | Layout not in the draft. |
0x00000009 | systemd Journal Export Block | One entry in the systemd journal export format. See other blocks. |
0x0000000A | Decryption Secrets Block | See other blocks. |
0x00000101 | Hone Project Machine Info Block | Hone Project; layout not in the draft. |
0x00000102 | Hone Project Connection Event Block | Hone Project; layout not in the draft. |
0x00000201 | Sysdig Machine Info Block | Blocks for Sysdig’s system-call captures. Layouts are defined by Sysdig, not in the draft. |
0x00000202 | Sysdig Process Info Block, version 1 | |
0x00000203 | Sysdig FD List Block | |
0x00000204 | Sysdig Event Block | |
0x00000205 | Sysdig Interface List Block | |
0x00000206 | Sysdig User List Block | |
0x00000207 | Sysdig Process Info Block, version 2 | |
0x00000208 | Sysdig Event Block with flags | |
0x00000209 | Sysdig Process Info Block, version 3 | |
0x00000210 | Sysdig Process Info Block, version 4 | |
0x00000211 | Sysdig Process Info Block, version 5 | |
0x00000212 | Sysdig Process Info Block, version 6 | |
0x00000213 | Sysdig Process Info Block, version 7 | As above. |
0x00000BAD | Custom Block, may be copied | See other blocks. |
0x40000BAD | Custom Block, do not copy | As above. |
0x0A0D0D0A | Section Header Block | See section header. |
0x0A0D0Axx, 0xxx0A0D0A, 0xxx0A0D0D | Reserved | Never assigned, so that a file damaged by an HTTP text-mode transfer is detected. |
0x0D0D0Axx | Reserved | Never assigned, so that a file damaged by an FTP text-mode transfer is detected. |
0x80000000–0xFFFFFFFF | Local use | Not portable between organisations. |
The draft also names experimental blocks that have no code yet: alternative packet blocks, compression, encryption, fixed length, directory, traffic statistics and monitoring, and event or security blocks.
Options
The options of a block are a list of entries, each with this layout:
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
0 | 2 | uint16 | Option Code | Which option. Codes with the top bit set (0x8000 and up) are for local use. |
2 | 2 | uint16 | Option Length | The length of the value in bytes, without padding. |
4 | varies | bytes | Option Value | The value, padded with zeros to a multiple of 4 bytes. |
The list ends with opt_endofopt. A reader must not rely on it being
there and stops at the end of the block anyway. Strings are UTF-8 and not
zero-terminated, but a reader treats a zero byte as the end of a string. An option of
fixed length with the wrong length is invalid; readers should report it and may skip
it. Option codes 2 and up mean different things in different blocks; each block’s page
lists its own.
These options can appear in any block that has options:
| Code | Name | Length | Repeats | Meaning |
|---|---|---|---|---|
| 0 | opt_endofopt | 0 | no | End of the option list. |
| 1 | opt_comment | varies | yes | A comment in UTF-8. Lines end with CR LF or LF. |
| 2988 | opt_custom | 4 or more | yes | Custom option holding a UTF-8 string; may be copied when the file is rewritten. |
| 2989 | opt_custom | 4 or more | yes | Custom option holding binary data; may be copied. |
| 19372 | opt_custom | 4 or more | yes | Custom option holding a UTF-8 string; should not be copied. |
| 19373 | opt_custom | 4 or more | yes | Custom option holding binary data; should not be copied. |
A custom option’s value is a 4-byte Private Enterprise Number (an IANA-assigned number naming the organisation, in the section’s byte order) followed by the custom data. Its length counts both.