Format
pcap Packet Capture
Summary
- Name
- pcap Packet Capture
- Identifiers
-
- MIME: application/vnd.tcpdump.pcap
- PUID: fmt/779
- Description
- The pcap file format was invented for use by tcpdump, a packet analyser used to examine and interpret network traffic.
- File extensions
-
pcap,cap,dmp - Submitted by
- Digital Preservation Department / The National Archives
Internal signatures
pcap Big Endian
- Description
- 0xa1b2c3d4 indicates that the capture reader has the same byte order as the capture writer. 0xd4c3b2a1 indicates that the reader has a different byte order from the writer.
- Provenance
- http://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap
Byte sequences
- Min Frag Length
- Absolute from BOF
- Offset
- 0
- Max offset
- 0
- Byte Sequence
A1B2C3D4- Endianness
- None
pcap Little Endian
- Description
- 0xa1b2c3d4 indicates that the capture reader has the same byte order as the capture writer. 0xd4c3b2a1 indicates that the reader has a different byte order from the writer.
- Provenance
- http://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap
Byte sequences
- Min Frag Length
- Absolute from BOF
- Offset
- 0
- Max offset
- 0
- Byte Sequence
D4C3B2A1- Endianness
- None