.SNOOP File Format

Solaris snoop capture

Introduction

A snoop file is a packet capture written by snoop, the network capture command of Sun’s Solaris, now Oracle Solaris. It does the same job as a PCAP file from tcpdump: each packet is stored with the time it was seen. The format is described in RFC 1761.

Captures taken on Solaris systems, and on some network equipment that adopted the format, are still met in this form. Wireshark reads them directly.

Structure

All values are big-endian. The file starts with a 16-byte header: the identification pattern snoop followed by three zero bytes, the version number, 2, and the data link type, such as 4 for Ethernet.

Packet records follow. Each starts with a 24-byte header giving the packet’s original length, the number of bytes included, the total length of this record, the number of packets dropped so far, and the time in seconds and microseconds. The packet bytes follow, padded so that the next record starts on a 4-byte boundary.

  1. 0File header snoop and zeros, version, link type16 bytes
  2. 16Packet record one per packetrepeated
    1. +0Record header original and included length, record length, drops, time24 bytes
    2. +24Packet data then paddingvaries
The layout of a snoop file.

Links

Software

  • snoop – the packet capture command built into Oracle Solaris (Solaris)
  • Wireshark and TShark – free network analyser that reads snoop files and converts them with editcap (Windows, macOS, Linux)

Reference

  • RFC 1761 – Snoop Version 2 Packet Capture File Format