PCAP-SAVEFILE(5) File Formats Manual PCAP-SAVEFILE(5) (NAME) pcap-savefile - libpcap (DESCRIPTION) : libpcap (savefiles) . libpcap libpcap . << >> (Savefiles) libpcap libpcap (per-file header) . : +--------------------------------------------------+ | Magic number | +------------------------+-------------------------+ | Major version | Minor version | +------------------------+-------------------------+ | Reserved1 | +--------------------------------------------------+ | Reserved2 | +--------------------------------------------------+ | Snapshot length | +--------------------------------------------------+ |Link-layer header type and additional information | +--------------------------------------------------+ (octet) . (byte order) . (magic number) 0xa1b2c3d4 . 0xa1b2c3d4 0xd4c3b2a1 . (byte-swapped) . 0xa1b23c4d ( ) 0xa1b23c4d 0x4d3cb2a1 (time stamps) . : (major version) 2 ( 0x00 0x02 0x02 0x00). (minor version) 4 ( 0x00 0x04 0x04 0x00). - pcap (SHOULD) 0 pcap (MUST) . "gmt to local correction" "time zone offset" . pcap . - pcap (SHOULD) 0 pcap (MUST) . "accuracy of timestamps" . pcap . << >> (snapshot length snaplen) (truncated) N N N . (link-layer header type) . : 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |FCS len|R|P| Reserved3 | Link-layer type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 0 31 . Link-layer type ( ): LINKTYPE_ pcap-linktype(7) . Reserved3 ( ): - (MUST) pcap (MUST NOT) pcap (SHOULD) . P ( ): (set) (Frame Check Sequence FCS) FCS . R ( ): - (MUST) pcap (MUST NOT) pcap (SHOULD) . FCS len ( ): ( ) FCS ( P ) P FCS FCS . FCS len 0 15 (Ethernet) FCS 2 FCS . (per-packet header) . : +----------------------------------------------+ | Time stamp, seconds value | +----------------------------------------------+ |Time stamp, microseconds or nanoseconds value | +----------------------------------------------+ | Length of captured packet data | +----------------------------------------------+ | Un-truncated length of the packet data | +----------------------------------------------+ (octet) . . (timestamp) 00:00:00 UTC . (snapshot length) . . (SEE ALSO) pcap(3PCAP) 6 Jan 2025 PCAP-SAVEFILE(5)