Lines Matching +full:not +full:- +full:swapped

20 .TH PCAP-SAVEFILE @MAN_FILE_FORMATS@ "16 Aug 2023"
22 pcap-savefile \- libpcap savefile format
33 start with a per-file header.  The format of the per-file header is:
50 Link-layer header type and additional information
54 The per-file header length is 24 octets.
56 All fields in the per-file header are in the byte order of the host
57 writing the file.  Normally, the first field in the per-file header is a
58 4-byte magic number, with the value 0xa1b2c3d4.  The magic number, when
65 values in the per-file and per-packet headers need to be byte-swapped.
68 the two lower-order bytes of the magic number swapped), which would be
77 A 2-byte file format major version number; the current version number is
80 A 2-byte file format minor version number; the current version number is
83 A 4-byte not used - SHOULD be filled with 0 by pcap file writers, and MUST
86 Some older pcap file writers stored non-zero values in this field.
88 A 4-byte not used - SHOULD be filled with 0 by pcap file writers, and MUST
91 writers stored non-zero values in this field.
93 A 4-byte number giving the "snapshot length" of the capture; packets
103 A 4-byte number giving the link-layer header type for packets in the
111 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
112 |FCS len|R|P|     Reserved3     |        Link-layer type        |
113 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
117 or writing the file, with bit 0 being the most-significant bit of the
118 field and bit 31 being the least-significant bit of the field.
120 Link-layer type (16 bits):
121 A 16-bit value giving the link-layer header type for packets in the file;
129 not used - MUST be set to zero by pcap writers, and MUST NOT be
130 interpreted by pcap readers; a reader SHOULD treat a non-zero value as
135 length value is present and, if not set, indicates that the FCS value is
139 not used - MUST be set to zero by pcap writers, and MUST NOT be
140 interpreted by pcap readers; a reader SHOULD treat a non-zero value as
144 A 4-bit unsigned value giving the number of 16-bit (2-octet) words
146 bit is not set, and the FCS length is not indicated by the link-layer
149 length value of 2, corresponding to a 4-octet FCS.
151 Following the per-file header are zero or more packets; each packet
152 begins with a per-packet header, which is immediately followed by the
153 raw packet data.  The format of the per-packet header is:
164 Un-truncated length of the packet data
168 The per-packet header length is 16 octets.
170 All fields in the per-packet header are in the byte order of the host
171 writing the file.  The per-packet header begins with a time stamp giving
173 a 4-byte value, giving the time in seconds since January 1, 1970,
174 00:00:00 UTC, followed by a 4-byte value, giving the time in
176 number in the file header.  Following that are a 4-byte value giving the
177 number of bytes of captured data that follow the per-packet header and a
178 4-byte value giving the number of bytes that would have been present had
179 the packet not been truncated by the snapshot length.  The two lengths