.PCAPNG File Format – Section header

PCAP Next Generation capture

Every pcapng file starts with a Section Header Block, and every new section starts with another. It fixes the byte order of all the blocks in its section and says which version of the format they follow.

Fields

OffsetSizeTypeNameDescription
04uint32Block Type0x0A0D0D0A. The bytes read the same both ways round, so a reader can find the block before it knows the byte order. The carriage-return and line-feed bytes also show up damage from a text-mode transfer that changed line endings.
44uint32Block Total Length28 with no options.
84uint32Byte-Order Magic0x1A2B3C4D. Stored as 4D 3C 2B 1A the section is little-endian; as 1A 2B 3C 4D it is big-endian.
122uint16Major Version1. A different major version means the reader cannot read the section.
142uint16Minor Version0. Some writers put 2; readers treat 2 as 0, since nothing changed, but writers must not write it.
168int64Section LengthThe length of the section in bytes, not counting this block; a multiple of 4. −1 (FF FF FF FF FF FF FF FF) means not given, and then the only way to skip the section is block by block.
24varies–OptionsSee below.
end − 44uint32Block Total LengthRepeated.

Options

Besides the common options (end of options, comment and custom), a Section Header Block can have:

CodeNameLengthRepeatsMeaning
2shb_hardwarevariesnoUTF-8 description of the hardware the section was made on, such as x86 Personal Computer.
3shb_osvariesnoUTF-8 name of the operating system.
4shb_userapplvariesnoUTF-8 name of the program that wrote the section, such as dumpcap V0.99.7.

Example

The start of a little-endian file: a Section Header Block with no options (the first 28 bytes, marked), then an Interface Description Block for Ethernet.

00000000  0A 0D 0D 0A 1C 00 00 00 4D 3C 2B 1A 01 00 00 00  ........M<+.....
00000010  FF FF FF FF FF FF FF FF 1C 00 00 00 01 00 00 00  ................
00000020  14 00 00 00 01 00 00 00 00 00 04 00 14 00 00 00  ................
A Section Header Block and an Interface Description Block.

Reading it: block type 0A 0D 0D 0A; total length 0x1C, 28; byte-order magic 4D 3C 2B 1A, so little-endian; version 1.0; section length −1, not given; no options; the length 28 again. At 0x1C an Interface Description Block starts: type 1, length 20, link type 1 (Ethernet), reserved 0, snapshot length 0x00040000 (262,144), no options, length 20.