PCAPNG file format: Packet blocks

Packets are stored in one of three blocks. Nearly every file uses the Enhanced Packet Block. The Simple Packet Block saves space when timestamps are not needed, and the old Packet Block survives only in early files.

Enhanced Packet Block

Block type 6. One packet, with the interface it came from and a timestamp.

Offset	Size	Type	Name	Description
`0`	4	uint32	Block Type	6.
`4`	4	uint32	Block Total Length	32 plus the padded packet data and options.
`8`	4	uint32	Interface ID	The number of the Interface Description Block in this section the packet was captured on, from 0.
`12`	4	uint32	Timestamp (upper)	The upper 32 bits of a 64-bit timestamp.
`16`	4	uint32	Timestamp (lower)	The lower 32 bits. The whole number counts units of the interface’s resolution since 1970, plus its `if_tsoffset`.
`20`	4	uint32	Captured Packet Length	Bytes of packet data stored, without padding: the smaller of the original length and the interface’s SnapLen.
`24`	4	uint32	Original Packet Length	The packet’s length on the wire. It should not be less than the captured length.
`28`	varies	bytes	Packet Data	The packet, starting with its link-layer header, padded to a multiple of 4.
…	varies	–	Options	See below.
end − 4	4	uint32	Block Total Length	Repeated.

Options, besides the common ones:

Code	Name	Length	Repeats	Meaning
2	`epb_flags`	4	no	A 32-bit flags word: see flags.
3	`epb_hash`	varies	yes	A hash of the packet (not of any capture header in front of it). The first byte names the algorithm: see hashes.
4	`epb_dropcount`	8	no	Packets lost on this interface between the previous packet and this one.
5	`epb_packetid`	8	no	An identifier that is the same for one packet seen on several interfaces, so copies can be matched.
6	`epb_queue`	4	no	The interface queue the packet was received on.
7	`epb_verdict`	varies	yes	What a filter decided to do with the packet. The first byte is the kind of verdict: see verdicts.
8	`epb_processid_threadid`	8	yes	The process ID then the thread ID (32 bits each) of a process and thread that could have received or sent the packet; 0 for either when it cannot be determined. If more than one could have, draft 06 says there should be one option for each.

Flags

Bit 0 is the least significant bit of the 32-bit epb_flags value, which is stored in the section’s byte order.

Bits	Name	Values
0–1	Direction	00 not known, 01 inbound, 10 outbound
2–4	Reception type	000 not given, 001 unicast, 010 multicast, 011 broadcast, 100 promiscuous
5–8	FCS length	Bytes of frame check sequence at the end of the packet; 0000 when not known. Overrides the interface’s `if_fcslen`, which is in bits.
9	Checksum not ready	The checksum was left to the network card (offloaded) and was not yet computed.
10	Checksum valid	The checksum was checked on receipt and was correct.
11	TCP segmentation offloaded	The packet is a large TCP segment that the card splits up.
12–15	Reserved	Must be 0.
16–23	Link-layer errors	Not assigned.
24	CRC error	The frame had a bad CRC.
25	Packet too long	–
26	Packet too short	–
27	Wrong inter-frame gap	–
28	Unaligned frame error	–
29	Start frame delimiter error	–
30	Preamble error	–
31	Symbol error	–

Hashes

First byte	Algorithm	Hash length
0	Two’s complement	Not given by the draft
1	XOR	Not given by the draft
2	CRC32	4 bytes
3	MD5	16 bytes
4	SHA-1	20 bytes
5	Toeplitz	4 bytes

Verdicts

First byte	Kind	Value after it
0	Hardware	A verdict from the network hardware, of any length.
1	Linux eBPF TC	8 bytes: a `TC_ACT_*` value from Linux’s `pkt_cls.h`.
2	Linux eBPF XDP	8 bytes: an `xdp_action` value from Linux’s `bpf.h`.

Simple Packet Block

Block type 3. A packet with no timestamp, no interface number and no options. It always belongs to the first interface of the section, so a file can use it only when all its packets come from interface 0.

Offset	Size	Type	Name	Description
`0`	4	uint32	Block Type	3.
`4`	4	uint32	Block Total Length	16 plus the padded packet data.
`8`	4	uint32	Original Packet Length	The packet’s length on the wire.
`12`	varies	bytes	Packet Data	The smaller of the original length and interface 0’s SnapLen, padded to a multiple of 4. There is no captured length field: a reader works it out from these two numbers (or from the block length).
end − 4	4	uint32	Block Total Length	Repeated.

Packet Block (obsolete)

Block type 2. The first packet block of pcapng, replaced by the Enhanced Packet Block. Writers must not use it; readers may still meet it in old files.

Offset	Size	Type	Name	Description
`0`	4	uint32	Block Type	2.
`4`	4	uint32	Block Total Length	–
`8`	2	uint16	Interface ID	The interface number.
`10`	2	uint16	Drops Count	Packets lost since the previous packet; `0xFFFF` means not known.
`12`	8	2 × uint32	Timestamp	Upper then lower 32 bits, as in the Enhanced Packet Block.
`20`	4	uint32	Captured Packet Length	–
`24`	4	uint32	Original Packet Length	–
`28`	varies	bytes	Packet Data	Padded to a multiple of 4.
…	varies	–	Options	`pack_flags` (code 2, 4 bytes, same as `epb_flags`) and `pack_hash` (code 3, same as `epb_hash`), and the common options.
end − 4	4	uint32	Block Total Length	Repeated.

Example

The first 32 bytes of a little-endian Enhanced Packet Block holding a 60-byte packet, at offset 0x30 of a file. The marked bytes are the block’s fields before the packet.

00000030  06 00 00 00 5C 00 00 00 00 00 00 00 24 0A 06 00  ....\.......$...
00000040  40 22 20 18 3C 00 00 00 3C 00 00 00 FF FF FF FF  @" .<...<.......

The start of an Enhanced Packet Block.

Reading it: type 6; total length 0x5C, 92 (28 bytes of fields, 60 of packet, 4 for the trailing length, no options); interface 0; timestamp upper 0x00060A24 and lower 0x18202240, together 1,700,000,000,123,456 microseconds (with the default resolution), which is 14 November 2023 22:13:20.123456 UTC; captured and original lengths 60. The packet data starts at 0x4C.

.PCAPNG File Format – Packet blocks