A snoop file starts with a header of 16 bytes. RFC 1761 defines it, for version 2 of
the format. All numbers in a snoop file are unsigned and big-endian, whatever machine
wrote it (RFC 1761 section 5). What RFC 1761 does not cover comes from illumos’s
sys/dlpi.h and Wireshark’s reader, wiretap/snoop.c, as
marked.
Fields
| Offset | Size | Type | Name | Description |
|---|---|---|---|---|
0 | 8 | bytes | Identification pattern | 73 6E 6F 6F 70 00 00 00: the text snoop and three zero bytes. |
8 | 4 | uint32 | Version number | 2 in files from Solaris. See versions. |
12 | 4 | uint32 | Datalink type | What every packet starts with: see datalink types. |
Versions
| Version | Written by |
|---|---|
| 1 | Early implementations. Obsolete, says RFC 1761; its layout is not described. |
| 2 | The format of RFC 1761: Solaris snoop, and Shomiti (later Finisar) Surveyor before 3.0, or 3.0 and later with an NDIS network card. |
| 3 | Shomiti Surveyor 3.0 and later with CMM2 capture hardware. |
| 4 | Shomiti Surveyor 3.0 and later with GAM hardware. |
| 5 | Shomiti Surveyor 3.0 and later with THG hardware. |
Versions 3 to 5 come from Wireshark’s reader. They use the same header and records, with a 16-byte Shomiti trailer in each record’s padding; see packet records.
Datalink types
RFC 1761 assigns 0 to 9 and leaves the rest unassigned. Solaris writes the media type
of the interface from its DLPI header (sys/dlpi.h), which uses the same
values for 0 to 9 and adds more. Types with the top bit set are Solaris’s private
ones.
| Value | RFC 1761 | Solaris name | Meaning |
|---|---|---|---|
| 0 | IEEE 802.3 | DL_CSMACD | IEEE 802.3 CSMA/CD; in practice Ethernet frames |
| 1 | IEEE 802.4 Token Bus | DL_TPB | Token-passing bus |
| 2 | IEEE 802.5 Token Ring | DL_TPR | Token-passing ring |
| 3 | IEEE 802.6 Metro Net | DL_METRO | Metropolitan area network |
| 4 | Ethernet | DL_ETHER | Ethernet; the usual value |
| 5 | HDLC | DL_HDLC | ISO HDLC |
| 6 | Character Synchronous | DL_CHAR | Character-synchronous protocol |
| 7 | IBM Channel-to-Channel | DL_CTCA | IBM channel-to-channel adapter |
| 8 | FDDI | DL_FDDI | FDDI; Wireshark reads the addresses bit-swapped |
| 9 | Other | DL_OTHER | Any other medium; Wireshark treats it as loopback |
10 (0x0A) | unassigned | DL_FRAME | Frame Relay LAPF |
11 (0x0B) | unassigned | DL_MPFRAME | Multi-protocol over Frame Relay |
12 (0x0C) | unassigned | DL_ASYNC | Character-asynchronous protocol |
13 (0x0D) | unassigned | DL_IPX25 | X.25 Classical IP |
14 (0x0E) | unassigned | DL_LOOP | Software loopback |
16 (0x10) | unassigned | DL_FC | Fibre Channel; Wireshark reads IP over Fibre Channel |
17 (0x11) | unassigned | DL_ATM | ATM |
18 (0x12) | unassigned | DL_IPATM | ATM Classical IP; packets start with a 4-byte ATM pseudo-header |
19 (0x13) | unassigned | DL_X25 | X.25 LAPB |
20 (0x14) | unassigned | DL_ISDN | ISDN |
21 (0x15) | unassigned | DL_HIPPI | HIPPI |
22 (0x16) | unassigned | DL_100VG | 100VG-AnyLAN Ethernet |
23 (0x17) | unassigned | DL_100VGTPR | 100VG-AnyLAN Token Ring |
24 (0x18) | unassigned | DL_ETH_CSMA | ISO 8802-3 and Ethernet |
25 (0x19) | unassigned | DL_100BT | 100BASE-T |
26 (0x1A) | unassigned | DL_IB | InfiniBand; Wireshark reads IP over InfiniBand |
0x80000001 | – | DL_IPV4 | IPv4 tunnel link |
0x80000002 | – | DL_IPV6 | IPv6 tunnel link |
0x80000003 | – | SUNW_DL_VNI | Virtual network interface |
0x80000004 | – | DL_WIFI | IEEE 802.11 |
0x80000005 | – | DL_IPNET | Solaris ipnet observability link; Wireshark reads it |
0x80000006 | – | SUNW_DL_IPMP | IPMP stub interface |
0x80000007 | – | DL_6TO4 | 6to4 tunnel link |
Wireshark reads only some of these: 0 and 4 (Ethernet), 2, 8, 9 and 14, 16, 18, 26 and the private 5. Shomiti files (versions 3 to 5) use the values their own way: Wireshark reads 0, 4, 10 and 12 as Ethernet, 2, 11, 13 and 14 as Token Ring, 8 as FDDI, 18 as 802.11 with a radio header and 19 as 10-gigabit Ethernet.
Example
00000000 73 6E 6F 6F 70 00 00 00 00 00 00 02 00 00 00 04 snoop...........Reading it: the identification pattern (marked); version 2; datalink type 4, Ethernet. The first packet record starts at offset 16.