.PCAP

libpcap packet capture

Introduction

A PCAP file is a recording of network traffic. It is the format written by tcpdump and the libpcap library, and nearly every network tool can read it. Each packet is stored exactly as it was captured, with the time it was seen.

The format is simple and has hardly changed since the late 1980s. Its successor, pcapng (.pcapng), is now Wireshark’s default and can also record the interfaces, comments and statistics of a capture.

Software

Structure

The file starts with a 24-byte global header. Its first field is the magic number 0xA1B2C3D4, written in the byte order of the machine that made the capture. A reader that sees D4 C3 B2 A1 knows the rest of the file is little-endian. The magic number 0xA1B23C4D means the timestamps are in nanoseconds rather than microseconds. The rest of the header gives the version, 2.4, the snapshot length, which is the most bytes kept from any one packet, and the link-layer type, such as 1 for Ethernet.

Packet records follow until the end of the file. Each is a 16-byte header, giving the timestamp in seconds and fractions, the number of bytes saved and the packet’s original length, then the saved bytes of the packet.

  1. 0Global header magic, version, snapshot length, link type24 bytes
  2. 24Packet record one per captured packetrepeated
    1. +0Record header seconds, fraction, saved length, original length16 bytes
    2. +16Packet data the captured bytessaved length
A PCAP file: one header, then packet records.