Lines Matching +full:magic +full:- +full:packet

20 .TH PCAP-SAVEFILE @MAN_FILE_FORMATS@ "16 Aug 2023"
22 pcap-savefile \- libpcap savefile format
33 start with a per-file header. The format of the per-file header is:
40 Magic number
50 Link-layer header type and additional information
54 The per-file header length is 24 octets.
56 All fields in the per-file header are in the byte order of the host
57 writing the file. Normally, the first field in the per-file header is a
58 4-byte magic number, with the value 0xa1b2c3d4. The magic number, when
65 values in the per-file and per-packet headers need to be byte-swapped.
67 If the magic number has the value 0xa1b23c4d (with the two nibbles of
68 the two lower-order bytes of the magic number swapped), which would be
77 A 2-byte file format major version number; the current version number is
80 A 2-byte file format minor version number; the current version number is
83 A 4-byte not used - SHOULD be filled with 0 by pcap file writers, and MUST
86 Some older pcap file writers stored non-zero values in this field.
88 A 4-byte not used - SHOULD be filled with 0 by pcap file writers, and MUST
91 writers stored non-zero values in this field.
93 A 4-byte number giving the "snapshot length" of the capture; packets
99 bytes of a packet longer than
103 A 4-byte number giving the link-layer header type for packets in the
111 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
112 |FCS len|R|P| Reserved3 | Link-layer type |
113 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
117 or writing the file, with bit 0 being the most-significant bit of the
118 field and bit 31 being the least-significant bit of the field.
120 Link-layer type (16 bits):
121 A 16-bit value giving the link-layer header type for packets in the file;
129 not used - MUST be set to zero by pcap writers, and MUST NOT be
130 interpreted by pcap readers; a reader SHOULD treat a non-zero value as
139 not used - MUST be set to zero by pcap writers, and MUST NOT be
140 interpreted by pcap readers; a reader SHOULD treat a non-zero value as
144 A 4-bit unsigned value giving the number of 16-bit (2-octet) words
145 of FCS that are appended to each packet, if the P bit is set; if the P
146 bit is not set, and the FCS length is not indicated by the link-layer
149 length value of 2, corresponding to a 4-octet FCS.
151 Following the per-file header are zero or more packets; each packet
152 begins with a per-packet header, which is immediately followed by the
153 raw packet data. The format of the per-packet header is:
162 Length of captured packet data
164 Un-truncated length of the packet data
168 The per-packet header length is 16 octets.
170 All fields in the per-packet header are in the byte order of the host
171 writing the file. The per-packet header begins with a time stamp giving
172 the approximate time the packet was captured; the time stamp consists of
173 a 4-byte value, giving the time in seconds since January 1, 1970,
174 00:00:00 UTC, followed by a 4-byte value, giving the time in
175 microseconds or nanoseconds since that second, depending on the magic
176 number in the file header. Following that are a 4-byte value giving the
177 number of bytes of captured data that follow the per-packet header and a
178 4-byte value giving the number of bytes that would have been present had
179 the packet not been truncated by the snapshot length. The two lengths
180 will be equal if the number of bytes of packet data are less than or