PCAP (named after libpcap / winpcap) is a popular format for saving network traffic grabbed by network sniffers. It is typically produced by tools like tcpdump or Wireshark.
This page hosts a formal specification of .pcap / .pcapdump file format using Kaitai Struct. This specification can be automatically translated into a variety of programming languages to get a parsing library.
// Code generated by kaitai-struct-compiler from a .ksy source file. DO NOT EDIT.
import (
"github.com/kaitai-io/kaitai_struct_go_runtime/kaitai"
"bytes"
)
/**
* PCAP (named after libpcap / winpcap) is a popular format for saving
* network traffic grabbed by network sniffers. It is typically
* produced by tools like [tcpdump](https://www.tcpdump.org/) or
* [Wireshark](https://www.wireshark.org/).
* @see <a href="https://wiki.wireshark.org/Development/LibpcapFileFormat">Source</a>
*/
type Pcap_Linktype int
const (
Pcap_Linktype__NullLinktype Pcap_Linktype = 0
Pcap_Linktype__Ethernet Pcap_Linktype = 1
Pcap_Linktype__ExpEthernet Pcap_Linktype = 2
Pcap_Linktype__Ax25 Pcap_Linktype = 3
Pcap_Linktype__Pronet Pcap_Linktype = 4
Pcap_Linktype__Chaos Pcap_Linktype = 5
Pcap_Linktype__Ieee8025 Pcap_Linktype = 6
Pcap_Linktype__ArcnetBsd Pcap_Linktype = 7
Pcap_Linktype__Slip Pcap_Linktype = 8
Pcap_Linktype__Ppp Pcap_Linktype = 9
Pcap_Linktype__Fddi Pcap_Linktype = 10
Pcap_Linktype__RedbackSmartedge Pcap_Linktype = 32
Pcap_Linktype__PppHdlc Pcap_Linktype = 50
Pcap_Linktype__PppEther Pcap_Linktype = 51
Pcap_Linktype__SymantecFirewall Pcap_Linktype = 99
Pcap_Linktype__AtmRfc1483 Pcap_Linktype = 100
Pcap_Linktype__Raw Pcap_Linktype = 101
Pcap_Linktype__CHdlc Pcap_Linktype = 104
Pcap_Linktype__Ieee80211 Pcap_Linktype = 105
Pcap_Linktype__AtmClip Pcap_Linktype = 106
Pcap_Linktype__Frelay Pcap_Linktype = 107
Pcap_Linktype__Loop Pcap_Linktype = 108
Pcap_Linktype__Enc Pcap_Linktype = 109
Pcap_Linktype__NetbsdHdlc Pcap_Linktype = 112
Pcap_Linktype__LinuxSll Pcap_Linktype = 113
Pcap_Linktype__Ltalk Pcap_Linktype = 114
Pcap_Linktype__Econet Pcap_Linktype = 115
Pcap_Linktype__Ipfilter Pcap_Linktype = 116
Pcap_Linktype__Pflog Pcap_Linktype = 117
Pcap_Linktype__CiscoIos Pcap_Linktype = 118
Pcap_Linktype__Ieee80211Prism Pcap_Linktype = 119
Pcap_Linktype__AironetHeader Pcap_Linktype = 120
Pcap_Linktype__IpOverFc Pcap_Linktype = 122
Pcap_Linktype__Sunatm Pcap_Linktype = 123
Pcap_Linktype__Rio Pcap_Linktype = 124
Pcap_Linktype__PciExp Pcap_Linktype = 125
Pcap_Linktype__Aurora Pcap_Linktype = 126
Pcap_Linktype__Ieee80211Radiotap Pcap_Linktype = 127
Pcap_Linktype__Tzsp Pcap_Linktype = 128
Pcap_Linktype__ArcnetLinux Pcap_Linktype = 129
Pcap_Linktype__JuniperMlppp Pcap_Linktype = 130
Pcap_Linktype__JuniperMlfr Pcap_Linktype = 131
Pcap_Linktype__JuniperEs Pcap_Linktype = 132
Pcap_Linktype__JuniperGgsn Pcap_Linktype = 133
Pcap_Linktype__JuniperMfr Pcap_Linktype = 134
Pcap_Linktype__JuniperAtm2 Pcap_Linktype = 135
Pcap_Linktype__JuniperServices Pcap_Linktype = 136
Pcap_Linktype__JuniperAtm1 Pcap_Linktype = 137
Pcap_Linktype__AppleIpOverIeee1394 Pcap_Linktype = 138
Pcap_Linktype__Mtp2WithPhdr Pcap_Linktype = 139
Pcap_Linktype__Mtp2 Pcap_Linktype = 140
Pcap_Linktype__Mtp3 Pcap_Linktype = 141
Pcap_Linktype__Sccp Pcap_Linktype = 142
Pcap_Linktype__Docsis Pcap_Linktype = 143
Pcap_Linktype__LinuxIrda Pcap_Linktype = 144
Pcap_Linktype__IbmSp Pcap_Linktype = 145
Pcap_Linktype__IbmSn Pcap_Linktype = 146
Pcap_Linktype__User0 Pcap_Linktype = 147
Pcap_Linktype__User1 Pcap_Linktype = 148
Pcap_Linktype__User2 Pcap_Linktype = 149
Pcap_Linktype__User3 Pcap_Linktype = 150
Pcap_Linktype__User4 Pcap_Linktype = 151
Pcap_Linktype__User5 Pcap_Linktype = 152
Pcap_Linktype__User6 Pcap_Linktype = 153
Pcap_Linktype__User7 Pcap_Linktype = 154
Pcap_Linktype__User8 Pcap_Linktype = 155
Pcap_Linktype__User9 Pcap_Linktype = 156
Pcap_Linktype__User10 Pcap_Linktype = 157
Pcap_Linktype__User11 Pcap_Linktype = 158
Pcap_Linktype__User12 Pcap_Linktype = 159
Pcap_Linktype__User13 Pcap_Linktype = 160
Pcap_Linktype__User14 Pcap_Linktype = 161
Pcap_Linktype__User15 Pcap_Linktype = 162
Pcap_Linktype__Ieee80211Avs Pcap_Linktype = 163
Pcap_Linktype__JuniperMonitor Pcap_Linktype = 164
Pcap_Linktype__BacnetMsTp Pcap_Linktype = 165
Pcap_Linktype__PppPppd Pcap_Linktype = 166
Pcap_Linktype__JuniperPppoe Pcap_Linktype = 167
Pcap_Linktype__JuniperPppoeAtm Pcap_Linktype = 168
Pcap_Linktype__GprsLlc Pcap_Linktype = 169
Pcap_Linktype__GpfT Pcap_Linktype = 170
Pcap_Linktype__GpfF Pcap_Linktype = 171
Pcap_Linktype__GcomT1e1 Pcap_Linktype = 172
Pcap_Linktype__GcomSerial Pcap_Linktype = 173
Pcap_Linktype__JuniperPicPeer Pcap_Linktype = 174
Pcap_Linktype__ErfEth Pcap_Linktype = 175
Pcap_Linktype__ErfPos Pcap_Linktype = 176
Pcap_Linktype__LinuxLapd Pcap_Linktype = 177
Pcap_Linktype__JuniperEther Pcap_Linktype = 178
Pcap_Linktype__JuniperPpp Pcap_Linktype = 179
Pcap_Linktype__JuniperFrelay Pcap_Linktype = 180
Pcap_Linktype__JuniperChdlc Pcap_Linktype = 181
Pcap_Linktype__Mfr Pcap_Linktype = 182
Pcap_Linktype__JuniperVp Pcap_Linktype = 183
Pcap_Linktype__A429 Pcap_Linktype = 184
Pcap_Linktype__A653Icm Pcap_Linktype = 185
Pcap_Linktype__UsbFreebsd Pcap_Linktype = 186
Pcap_Linktype__BluetoothHciH4 Pcap_Linktype = 187
Pcap_Linktype__Ieee80216MacCps Pcap_Linktype = 188
Pcap_Linktype__UsbLinux Pcap_Linktype = 189
Pcap_Linktype__Can20b Pcap_Linktype = 190
Pcap_Linktype__Ieee802154Linux Pcap_Linktype = 191
Pcap_Linktype__Ppi Pcap_Linktype = 192
Pcap_Linktype__Ieee80216MacCpsRadio Pcap_Linktype = 193
Pcap_Linktype__JuniperIsm Pcap_Linktype = 194
Pcap_Linktype__Ieee802154Withfcs Pcap_Linktype = 195
Pcap_Linktype__Sita Pcap_Linktype = 196
Pcap_Linktype__Erf Pcap_Linktype = 197
Pcap_Linktype__Raif1 Pcap_Linktype = 198
Pcap_Linktype__IpmbKontron Pcap_Linktype = 199
Pcap_Linktype__JuniperSt Pcap_Linktype = 200
Pcap_Linktype__BluetoothHciH4WithPhdr Pcap_Linktype = 201
Pcap_Linktype__Ax25Kiss Pcap_Linktype = 202
Pcap_Linktype__Lapd Pcap_Linktype = 203
Pcap_Linktype__PppWithDir Pcap_Linktype = 204
Pcap_Linktype__CHdlcWithDir Pcap_Linktype = 205
Pcap_Linktype__FrelayWithDir Pcap_Linktype = 206
Pcap_Linktype__LapbWithDir Pcap_Linktype = 207
Pcap_Linktype__IpmbLinux Pcap_Linktype = 209
Pcap_Linktype__Flexray Pcap_Linktype = 210
Pcap_Linktype__Most Pcap_Linktype = 211
Pcap_Linktype__Lin Pcap_Linktype = 212
Pcap_Linktype__X2eSerial Pcap_Linktype = 213
Pcap_Linktype__X2eXoraya Pcap_Linktype = 214
Pcap_Linktype__Ieee802154NonaskPhy Pcap_Linktype = 215
Pcap_Linktype__LinuxEvdev Pcap_Linktype = 216
Pcap_Linktype__GsmtapUm Pcap_Linktype = 217
Pcap_Linktype__GsmtapAbis Pcap_Linktype = 218
Pcap_Linktype__Mpls Pcap_Linktype = 219
Pcap_Linktype__UsbLinuxMmapped Pcap_Linktype = 220
Pcap_Linktype__Dect Pcap_Linktype = 221
Pcap_Linktype__Aos Pcap_Linktype = 222
Pcap_Linktype__Wihart Pcap_Linktype = 223
Pcap_Linktype__Fc2 Pcap_Linktype = 224
Pcap_Linktype__Fc2WithFrameDelims Pcap_Linktype = 225
Pcap_Linktype__Ipnet Pcap_Linktype = 226
Pcap_Linktype__CanSocketcan Pcap_Linktype = 227
Pcap_Linktype__Ipv4 Pcap_Linktype = 228
Pcap_Linktype__Ipv6 Pcap_Linktype = 229
Pcap_Linktype__Ieee802154Nofcs Pcap_Linktype = 230
Pcap_Linktype__Dbus Pcap_Linktype = 231
Pcap_Linktype__JuniperVs Pcap_Linktype = 232
Pcap_Linktype__JuniperSrxE2e Pcap_Linktype = 233
Pcap_Linktype__JuniperFibrechannel Pcap_Linktype = 234
Pcap_Linktype__DvbCi Pcap_Linktype = 235
Pcap_Linktype__Mux27010 Pcap_Linktype = 236
Pcap_Linktype__Stanag5066DPdu Pcap_Linktype = 237
Pcap_Linktype__JuniperAtmCemic Pcap_Linktype = 238
Pcap_Linktype__Nflog Pcap_Linktype = 239
Pcap_Linktype__Netanalyzer Pcap_Linktype = 240
Pcap_Linktype__NetanalyzerTransparent Pcap_Linktype = 241
Pcap_Linktype__Ipoib Pcap_Linktype = 242
Pcap_Linktype__Mpeg2Ts Pcap_Linktype = 243
Pcap_Linktype__Ng40 Pcap_Linktype = 244
Pcap_Linktype__NfcLlcp Pcap_Linktype = 245
Pcap_Linktype__Pfsync Pcap_Linktype = 246
Pcap_Linktype__Infiniband Pcap_Linktype = 247
Pcap_Linktype__Sctp Pcap_Linktype = 248
Pcap_Linktype__Usbpcap Pcap_Linktype = 249
Pcap_Linktype__RtacSerial Pcap_Linktype = 250
Pcap_Linktype__BluetoothLeLl Pcap_Linktype = 251
Pcap_Linktype__WiresharkUpperPdu Pcap_Linktype = 252
Pcap_Linktype__Netlink Pcap_Linktype = 253
Pcap_Linktype__BluetoothLinuxMonitor Pcap_Linktype = 254
Pcap_Linktype__BluetoothBredrBb Pcap_Linktype = 255
Pcap_Linktype__BluetoothLeLlWithPhdr Pcap_Linktype = 256
Pcap_Linktype__ProfibusDl Pcap_Linktype = 257
Pcap_Linktype__Pktap Pcap_Linktype = 258
Pcap_Linktype__Epon Pcap_Linktype = 259
Pcap_Linktype__IpmiHpm2 Pcap_Linktype = 260
Pcap_Linktype__ZwaveR1R2 Pcap_Linktype = 261
Pcap_Linktype__ZwaveR3 Pcap_Linktype = 262
Pcap_Linktype__WattstopperDlm Pcap_Linktype = 263
Pcap_Linktype__Iso14443 Pcap_Linktype = 264
Pcap_Linktype__Rds Pcap_Linktype = 265
Pcap_Linktype__UsbDarwin Pcap_Linktype = 266
Pcap_Linktype__Openflow Pcap_Linktype = 267
Pcap_Linktype__Sdlc Pcap_Linktype = 268
Pcap_Linktype__TiLlnSniffer Pcap_Linktype = 269
Pcap_Linktype__Loratap Pcap_Linktype = 270
Pcap_Linktype__Vsock Pcap_Linktype = 271
Pcap_Linktype__NordicBle Pcap_Linktype = 272
Pcap_Linktype__Docsis31Xra31 Pcap_Linktype = 273
Pcap_Linktype__EthernetMpacket Pcap_Linktype = 274
Pcap_Linktype__DisplayportAux Pcap_Linktype = 275
Pcap_Linktype__LinuxSll2 Pcap_Linktype = 276
Pcap_Linktype__SercosMonitor Pcap_Linktype = 277
Pcap_Linktype__Openvizsla Pcap_Linktype = 278
Pcap_Linktype__Ebhscr Pcap_Linktype = 279
Pcap_Linktype__VppDispatch Pcap_Linktype = 280
Pcap_Linktype__DsaTagBrcm Pcap_Linktype = 281
Pcap_Linktype__DsaTagBrcmPrepend Pcap_Linktype = 282
Pcap_Linktype__Ieee802154Tap Pcap_Linktype = 283
Pcap_Linktype__DsaTagDsa Pcap_Linktype = 284
Pcap_Linktype__DsaTagEdsa Pcap_Linktype = 285
Pcap_Linktype__Elee Pcap_Linktype = 286
Pcap_Linktype__ZwaveSerial Pcap_Linktype = 287
Pcap_Linktype__Usb20 Pcap_Linktype = 288
Pcap_Linktype__AtscAlp Pcap_Linktype = 289
Pcap_Linktype__Etw Pcap_Linktype = 290
Pcap_Linktype__NetanalyzerNg Pcap_Linktype = 291
Pcap_Linktype__ZbossNcp Pcap_Linktype = 292
Pcap_Linktype__Usb20LowSpeed Pcap_Linktype = 293
Pcap_Linktype__Usb20FullSpeed Pcap_Linktype = 294
Pcap_Linktype__Usb20HighSpeed Pcap_Linktype = 295
Pcap_Linktype__AuerswaldLog Pcap_Linktype = 296
Pcap_Linktype__ZwaveTap Pcap_Linktype = 297
Pcap_Linktype__SilabsDebugChannel Pcap_Linktype = 298
Pcap_Linktype__FiraUci Pcap_Linktype = 299
)
type Pcap struct {
Hdr *Pcap_Header
Packets []*Pcap_Packet
_io *kaitai.Stream
_root *Pcap
_parent interface{}
}
func NewPcap() *Pcap {
return &Pcap{
}
}
func (this *Pcap) Read(io *kaitai.Stream, parent interface{}, root *Pcap) (err error) {
this._io = io
this._parent = parent
this._root = root
tmp1 := NewPcap_Header()
err = tmp1.Read(this._io, this, this._root)
if err != nil {
return err
}
this.Hdr = tmp1
for i := 1;; i++ {
tmp2, err := this._io.EOF()
if err != nil {
return err
}
if tmp2 {
break
}
tmp3 := NewPcap_Packet()
err = tmp3.Read(this._io, this, this._root)
if err != nil {
return err
}
this.Packets = append(this.Packets, tmp3)
}
return err
}
/**
* @see <a href="https://wiki.wireshark.org/Development/LibpcapFileFormat#Global_Header">Source</a>
*/
type Pcap_Header struct {
MagicNumber []byte
VersionMajor uint16
VersionMinor uint16
Thiszone int32
Sigfigs uint32
Snaplen uint32
Network Pcap_Linktype
_io *kaitai.Stream
_root *Pcap
_parent *Pcap
}
func NewPcap_Header() *Pcap_Header {
return &Pcap_Header{
}
}
func (this *Pcap_Header) Read(io *kaitai.Stream, parent *Pcap, root *Pcap) (err error) {
this._io = io
this._parent = parent
this._root = root
tmp4, err := this._io.ReadBytes(int(4))
if err != nil {
return err
}
tmp4 = tmp4
this.MagicNumber = tmp4
if !(bytes.Equal(this.MagicNumber, []uint8{212, 195, 178, 161})) {
return kaitai.NewValidationNotEqualError([]uint8{212, 195, 178, 161}, this.MagicNumber, this._io, "/types/header/seq/0")
}
tmp5, err := this._io.ReadU2le()
if err != nil {
return err
}
this.VersionMajor = uint16(tmp5)
if !(this.VersionMajor == 2) {
return kaitai.NewValidationNotEqualError(2, this.VersionMajor, this._io, "/types/header/seq/1")
}
tmp6, err := this._io.ReadU2le()
if err != nil {
return err
}
this.VersionMinor = uint16(tmp6)
tmp7, err := this._io.ReadS4le()
if err != nil {
return err
}
this.Thiszone = int32(tmp7)
tmp8, err := this._io.ReadU4le()
if err != nil {
return err
}
this.Sigfigs = uint32(tmp8)
tmp9, err := this._io.ReadU4le()
if err != nil {
return err
}
this.Snaplen = uint32(tmp9)
tmp10, err := this._io.ReadU4le()
if err != nil {
return err
}
this.Network = Pcap_Linktype(tmp10)
return err
}
/**
* Correction time in seconds between UTC and the local
* timezone of the following packet header timestamps.
*/
/**
* In theory, the accuracy of time stamps in the capture; in
* practice, all tools set it to 0.
*/
/**
* The "snapshot length" for the capture (typically 65535 or
* even more, but might be limited by the user), see: incl_len
* vs. orig_len.
*/
/**
* Link-layer header type, specifying the type of headers at
* the beginning of the packet.
*/
/**
* @see <a href="https://wiki.wireshark.org/Development/LibpcapFileFormat#Record_.28Packet.29_Header">Source</a>
*/
type Pcap_Packet struct {
TsSec uint32
TsUsec uint32
InclLen uint32
OrigLen uint32
Body interface{}
_io *kaitai.Stream
_root *Pcap
_parent *Pcap
_raw_Body []byte
}
func NewPcap_Packet() *Pcap_Packet {
return &Pcap_Packet{
}
}
func (this *Pcap_Packet) Read(io *kaitai.Stream, parent *Pcap, root *Pcap) (err error) {
this._io = io
this._parent = parent
this._root = root
tmp11, err := this._io.ReadU4le()
if err != nil {
return err
}
this.TsSec = uint32(tmp11)
tmp12, err := this._io.ReadU4le()
if err != nil {
return err
}
this.TsUsec = uint32(tmp12)
tmp13, err := this._io.ReadU4le()
if err != nil {
return err
}
this.InclLen = uint32(tmp13)
tmp14, err := this._io.ReadU4le()
if err != nil {
return err
}
this.OrigLen = uint32(tmp14)
switch (this._root.Hdr.Network) {
case Pcap_Linktype__Ppi:
var tmp15 uint32;
if (this.InclLen < this._root.Hdr.Snaplen) {
tmp15 = this.InclLen
} else {
tmp15 = this._root.Hdr.Snaplen
}
tmp16, err := this._io.ReadBytes(int(tmp15))
if err != nil {
return err
}
tmp16 = tmp16
this._raw_Body = tmp16
_io__raw_Body := kaitai.NewStream(bytes.NewReader(this._raw_Body))
tmp17 := NewPacketPpi()
err = tmp17.Read(_io__raw_Body, this, nil)
if err != nil {
return err
}
this.Body = tmp17
case Pcap_Linktype__Ethernet:
var tmp18 uint32;
if (this.InclLen < this._root.Hdr.Snaplen) {
tmp18 = this.InclLen
} else {
tmp18 = this._root.Hdr.Snaplen
}
tmp19, err := this._io.ReadBytes(int(tmp18))
if err != nil {
return err
}
tmp19 = tmp19
this._raw_Body = tmp19
_io__raw_Body := kaitai.NewStream(bytes.NewReader(this._raw_Body))
tmp20 := NewEthernetFrame()
err = tmp20.Read(_io__raw_Body, this, nil)
if err != nil {
return err
}
this.Body = tmp20
default:
var tmp21 uint32;
if (this.InclLen < this._root.Hdr.Snaplen) {
tmp21 = this.InclLen
} else {
tmp21 = this._root.Hdr.Snaplen
}
tmp22, err := this._io.ReadBytes(int(tmp21))
if err != nil {
return err
}
tmp22 = tmp22
this._raw_Body = tmp22
}
return err
}
/**
* Number of bytes of packet data actually captured and saved in the file.
*/
/**
* Length of the packet as it appeared on the network when it was captured.
*/
/**
* @see <a href="https://wiki.wireshark.org/Development/LibpcapFileFormat#Packet_Data">Source</a>
*/