Understanding pcap file format – part I – Global Header

$ sed to distinguish sections that have been saved on little-endian machines from the ones saved on big-endian machines. Major Version: number of the current mayor version of the format. Current value is 1. This value should change if the format changes in such a way that tools that can read the new format could not read the old format (i.e., the code would have to check the version number to be able to read both formats). Minor Version: number of the current minor version of the format. Current value is 0. This value should change if the format changes in such a way that tools that can read the new format can still automatically read the new format but code that can only read the old format cannot read the new format. Section Length: 64-bit value specifying the lenght in bytes of the following section, excluding the Section Header Block itself. This field can be used to skip the section, for faster navigation inside large files. Section Length equal -1 (0xffffffffffffffff) means that the size of the section is not specified, and the only way to skip the section is to parse the blocks that it contains. Options: optionally, a list of options (formatted according to the rules defined in Section 4) can be present. Interface Description Block (mandatory) The Interface Description Block is mandatory. This block is needed to specify the characteristics of the network interface on which the capture has been made. In order to properly associate the captured data to the corresponding interface, the Interface Description Block must be defined before any other block that uses it; therefore, this block is usually placed immediately after the Section Header Block. An Interface Description Block is valid only inside the section which it belongs to. The structure of a Interface Description Block is shown in Figure 4.     0                   1                   2                   3        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    |           LinkType            |           Reserved            |    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    |                            SnapLen                            |    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+    /                                                               /     /                      Options (variable)                       /     /                                                               /     +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+  Interface Description Block format.  The meaning of the fields is: LinkType: a value that defines the link layer type of this interface. (TODO) SnapLen: maximum number of bytes dumped from each packet. The portion of each packet that exceeds this value will not be stored in the file. Options: optionally, a list of options (formatted according to the rules defined in Section 4) can be present. Now, let us try to understand how it looks in actually captured file with an example, Global Header –  The global header has a fixed size of 24 bytes. We captured some packets in wifi monitor mode and saved those to file named understand_pcap_file.pcap, now lets print hex values of global header in bytes, $ hexdump -n 24 -C understand_pcap_file.pcap | cut -c 11-59 d4 c3 b2 a1 02 00 04  00 00 00 00 00 00 00 00 00 ee 05 00 00 7f 00 00 00 The first 4 bytes  d4 c3 b2 a1  constitute the magic number which is used to identify pcap files. The next 4 bytes  02 00 04 00  are the Major version (2 bytes) and Minor Version (2 bytes), in our case 2.4. Why is 2 written on 2 bytes as 0x0200 and not 0x0002 ? This is called little endianess in which, the least significant byte is stored in the least significant position: This means that 2 would be written on 2 bytes as 02 00. How do we know that we are not using Big Endianness instead ? The magic number is also used to distinguish between Little and Big Endianness. The “real” value is 0xa1b2c3d4, if we read it as as a1 b2 c3 d4, it means Big E. Otherwise (0xd4c3b2a1), it means Little E. Now, we will try to understand next 8 bytes, $ hexdump -n 24 -C understand_pcap_file.pcap | cut -c 11-59 d4 c3 b2 a1 02 00 04