An Interface Description Block, block type 1, describes one interface that packets were captured on. The first one in a section is interface 0, the next interface 1, and so on; packet and statistics blocks refer to an interface by that number. Its options also set the units of every timestamp from that interface.
Fields
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
0 | 4 | uint32 | Block Type | 1. |
4 | 4 | uint32 | Block Total Length | 20 with no options. |
8 | 2 | uint16 | LinkType | The link-layer type of the interface’s packets, a value from the LINKTYPE register shared with PCAP. |
10 | 2 | uint16 | Reserved | Written as 0; readers ignore it. |
12 | 4 | uint32 | SnapLen | The most bytes kept from any packet on this interface. 0 means no limit. |
16 | varies | – | Options | See below. |
| end − 4 | 4 | uint32 | Block Total Length | Repeated. |
Options
Besides the common options:
| Code | Name | Length | Repeats | Meaning |
|---|---|---|---|---|
| 2 | if_name | varies | no | UTF-8 name of the device used to capture, such as eth0. |
| 3 | if_description | varies | no | UTF-8 description of the device. |
| 4 | if_IPv4addr | 8 | yes | An IPv4 address of the interface (4 bytes) then its netmask (4 bytes), both in network byte order. |
| 5 | if_IPv6addr | 17 | yes | An IPv6 address (16 bytes) then its prefix length (1 byte). |
| 6 | if_MACaddr | 6 | no | The interface’s EUI-48 (MAC) address. |
| 7 | if_EUIaddr | 8 | no | The interface’s EUI-64 address. |
| 8 | if_speed | 8 | no | Interface speed in bits per second, a 64-bit number. Used when send and receive speeds are the same. |
| 9 | if_tsresol | 1 | no | Timestamp resolution. See below. Absent means microseconds. |
| 10 | if_tzone | 4 | no | Time zone. Obsolete and should not be written; use if_iana_tzname. |
| 11 | if_filter | 1 or more | no | The capture filter. The first byte says what kind of filter follows. See below. |
| 12 | if_os | varies | no | UTF-8 name of the operating system of the machine the interface is on, which can differ from the one in shb_os when capturing remotely. |
| 13 | if_fcslen | 1 | no | Length of the frame check sequence at the end of each packet, in bits. An Enhanced Packet Block’s own flags override it. |
| 14 | if_tsoffset | 8 | no | A signed 64-bit number of seconds added to every timestamp of this interface, so timestamps can be stored relative to a start time. Absent means 0. |
| 15 | if_hardware | varies | no | UTF-8 description of the interface hardware. |
| 16 | if_txspeed | 8 | no | Transmit speed in bits per second, when it differs from the receive speed. |
| 17 | if_rxspeed | 8 | no | Receive speed in bits per second, when it differs from the transmit speed. |
| 18 | if_iana_tzname | varies | no | UTF-8 name of the time zone from the IANA time zone database, such as Europe/Berlin. |
When the send and receive speeds are equal, writers use if_speed only.
When one direction’s speed is unknown, they leave out if_speed and that
direction’s option.
Timestamp resolution
The one byte of if_tsresol sets how long one unit of a timestamp is:
| Top bit | Low 7 bits | Unit | Examples |
|---|---|---|---|
| 0 | n | 10−n seconds | 06 microseconds (the default), 09 nanoseconds |
| 1 | n | 2−n seconds | 8A is 2−10, 1/1024 of a second |
A packet’s time in seconds is its 64-bit timestamp times the unit, plus
if_tsoffset, counted from 1 January 1970 00:00:00 UTC.
Filter
The draft says the first byte of if_filter identifies the kind of filter,
for example a libpcap filter string or BPF bytecode, but its table of codes is still
marked as to be done. Its own example uses 00 followed by the libpcap
filter text tcp port 23 and host 192.0.2.5. Other codes are not
confirmed here.