The blocks that carry no packets: names for addresses, counters for each interface, keys for decrypting the traffic, system log entries, and blocks of an organisation’s own. All use the block frame and, where they have options, the option list.
Name Resolution Block
Block type 4. Names for network addresses seen in the capture, as a list of records, then options. The record list must end with an end record.
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
8 | varies | – | Records | Each: record type (uint16), value length (uint16, without padding), value padded to a multiple of 4. |
| … | varies | – | Options | See below. |
| Record type | Name | Length | Value |
|---|---|---|---|
0x0000 | nrb_record_end | 0 | End of the records. Always present, always last. |
0x0001 | nrb_record_ipv4 | 6 or more | A 4-byte IPv4 address, then one or more names, each UTF-8 and ended by a zero byte. |
0x0002 | nrb_record_ipv6 | 18 or more | A 16-byte IPv6 address, then zero-terminated names. |
0x0003 | nrb_record_eui48 | 8 or more | A 6-byte EUI-48 (MAC) address, then zero-terminated names. |
0x0004 | nrb_record_eui64 | 10 or more | An 8-byte EUI-64 address, then zero-terminated names. |
A reader skips record types it does not know. Options:
| Code | Name | Length | Repeats | Meaning |
|---|---|---|---|---|
| 2 | ns_dnsname | varies | no | UTF-8 name of the DNS server used for the lookups. |
| 3 | ns_dnsIP4addr | 4 | no | The DNS server’s IPv4 address. |
| 4 | ns_dnsIP6addr | 16 | no | The DNS server’s IPv6 address. |
Interface Statistics Block
Block type 5. Counters for one interface at one moment, usually written at the end of a capture.
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
8 | 4 | uint32 | Interface ID | The interface the counters are for. |
12 | 8 | 2 × uint32 | Timestamp | When the counters were taken: upper then lower 32 bits, in the interface’s timestamp units. |
20 | varies | – | Options | The counters, below. All are 64-bit and may not be 8-byte aligned. |
| Code | Name | Length | Meaning |
|---|---|---|---|
| 2 | isb_starttime | 8 | When the capture started on this interface (timestamp format). |
| 3 | isb_endtime | 8 | When the capture ended on this interface. |
| 4 | isb_ifrecv | 8 | Packets received from the physical interface since the capture started. |
| 5 | isb_ifdrop | 8 | Packets the interface dropped for lack of resources. |
| 6 | isb_filteraccept | 8 | Packets the capture filter accepted. |
| 7 | isb_osdrop | 8 | Packets the operating system dropped. |
| 8 | isb_usrdeliv | 8 | Packets delivered to the capturing program. |
None of these options repeats.
Decryption Secrets Block
Block type 10 (0x0A). Keys that let a reader decrypt traffic in the
capture, such as a TLS key log. It should come before the packets it unlocks.
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
8 | 4 | uint32 | Secrets Type | What the secrets are; see below. |
12 | 4 | uint32 | Secrets Length | Bytes of secrets data, without padding. |
16 | varies | bytes | Secrets Data | Padded to a multiple of 4. |
| … | varies | – | Options | Only the common options; none of its own. |
| Secrets Type | As text | Name | Data |
|---|---|---|---|
0x544C534B | TLSK | TLS Key Log | Lines in the NSS key log format (SSLKEYLOGFILE), ended by LF or CR LF. |
0x5353484B | SSHK | SSH Key Log | Lines of a cookie, a key type (SHARED_SECRET or PRIVATE_KEY) and the key in hex, separated by spaces. |
0x57474B4C | WGKL | WireGuard Key Log | Lines of name = key, the key being 32 bytes in Base64; names LOCAL_STATIC_PRIVATE_KEY, REMOTE_STATIC_PUBLIC_KEY, LOCAL_EPHEMERAL_PRIVATE_KEY, PRESHARED_KEY. |
0x5A4E574B | ZNWK | ZigBee NWK Key | A 16-byte AES-128 network key, the 2-byte PAN ID (little-endian), then 2 bytes of padding. |
0x5A415053 | ZAPS | ZigBee APS Key | A 16-byte AES-128 application support key, the PAN ID, then the low and high node short addresses (2 bytes each, little-endian). |
0x55414B4C | UAKL | OPC UA Key Log | Lines of key: value giving, per secure channel and token, the server and client IVs, keys and signature lengths in hex. |
0x45535053 | ESPS | ESP Security Association keys | CSV (RFC 4180) with the columns Protocol, Src IP, Dest IP, SPI, Encryption, Encryption Key, Authentication, Authentication Key, SN, ESN High Bits. |
systemd Journal Export Block
Block type 9. One entry from the Linux systemd journal, in the journal’s export
format (field lines NAME=value, ended by an empty line), padded to a
multiple of 4. It lets a capture carry the system log alongside the packets. The
block has no fields besides the entry; see
the journal format for the entries
themselves.
Custom Block
Block type 0x00000BAD or 0x40000BAD. Data defined by one
organisation, named by its Private Enterprise Number. Custom blocks can be anywhere
after the first Section Header Block, any number of times.
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
8 | 4 | uint32 | Private Enterprise Number | The IANA-assigned number of the organisation that defined the data, in the section’s byte order. |
12 | varies | bytes | Custom Data | Padded to a multiple of 4. |
| … | varies | – | Options | Custom options only. |
The two codes differ only in what a program that rewrites the file should do:
0x00000BAD may be copied into the new file; 0x40000BAD
should not be, because it depends on other blocks (for example on interface numbers,
which change when files are merged).