Pcap File Format
Classification: Comprehensive Technology
Transfer http://songwensheng.javaeye.com/blog/674686
Pcap File Format: The pcap file format is the format in which bpf saves the original data packet. Many software applications are used, such as tcpdump and wireshark,
Understanding the pcap format can enhance understanding of the original data packets, and you can also manually construct any data packets for testing. The pcap file format is:
File Header in 24 bytes
The data packet header + the data packet header is 16 bytes followed by the data packet
Data packet header + data packet ......
The format of the file header is defined in pcap. h.
Struct pcap_file_header {
Bpf_u_int32 magic;
U_short version_major;
U_short version_minor;
Bpf_int32 thiszone;/* gmt to local correction */
Bpf_u_int32;/* accuracy of timestamps */
Bpf_u_int32 snaplen;/* max length saved portion of each pkt */
Bpf_u_int32 linktype;/* data link type (LINKTYPE _*)*/
};
Let's take a look at the meaning of each field:
Magic: 4-byte pcap File ID: d4 c3 b2 a1"
Major: 2-byte master version # define PCAP_VERSION_MAJOR 2
Minor: 2-byte version # define PCAP_VERSION_MINOR 4
Thiszone: The 4-byte time zone is not used. Currently, all values are 0.
Sigfigs: The 4-byte exact timestamp is not used and is currently 0
Snaplen: the maximum length of a 4-byte packet capture. If you want to capture the entire packet, set it to 0x0000ffff (65535 ),
Tcpdump-s 0 sets this parameter. The default value is 68 bytes.
Linktype: 4-byte link types are generally 1: ethernet | magic | major | minor | thiszone | sigfigs | snaplen | linktype |
| D4 c3 b2 a1 | 02 00 | 04 00 | 00 00 00 00 | 00 00 00 00 | ff 00 00 00 | 01 00 00 00 | data Header Format
Struct pcap_pkthdr {
Struct timeval ts;/* time stamp */
Bpf_u_int32 caplen;/* length of portion present */
Bpf_u_int32 len;/* length this packet (off wire )*/
};
Struct timeval {
Long TV _sec;/* seconds (XXX shocould be time_t )*/
Suseconds_t TV _usec;/* and microseconds */
};
Ts: 8-byte packet capture time 4 bytes indicates the number of seconds, 4 bytes indicates the number of microseconds
Caplen: the length of the 4-byte stored package (up to snaplen, for example, 68 bytes)
Len: the actual length of a 4-byte data packet. If the file does not store the complete data packet, it may be better to understand the pcap file format than caplen, and then you can manually construct any data packet, you can use the hexadecimal editor to open and modify the downloaded package.
