libpcap Network Packet Capture
Classic 24-byte header packet capture format produced by `tcpdump` and Wireshark, encoding host endianness and timestamp precision directly in its 4-byte magic number.
If bytes `0..3` read `D4 C3 B2 A1`, fields are little-endian with microsecond timestamps; `A1 B2 C3 D4` indicates big-endian; `4D 3C B2 A1` indicates nanosecond resolution.
Drop any .pcap file (even 100 GB+) to inspect locally
Reads tiny File.slice() header/footer pages in a sandboxed Web Worker · 0 Bytes Uploaded
.pcap Magic Bytes & Header Offset Map
Little-endian microsecond libpcap magic (0xA1B2C3D4)
Big-endian microsecond libpcap variant (legacy tcpdump on BE hosts)
Little-endian nanosecond-resolution variant (0xA1B23C4D)
Big-endian nanosecond-resolution variant
| Byte Offset | Length | Data Type | Field Name | Engineering Description |
|---|---|---|---|---|
| 0x00 - 0x03 | 4 B | uint32 | magic_number | 0xA1B2C3D4 (µs) or 0xA1B23C4D (ns) determines endianness |
| 0x04 - 0x07 | 4 B | uint16[2] | version | Major.Minor version (2.4) |
| 0x10 - 0x13 | 4 B | uint32 | snaplen | Max captured bytes per packet (e.g. 65535) |
| 0x14 - 0x17 | 4 B | uint32 | network | Link-layer header type (1 = Ethernet) |
.pcap Security & Polyglot Risk Matrix
PCAP captures may contain cleartext HTTP/DNS/DB credentials or internal IP topologies; enforce `incl_len <= snaplen` when parsing untrusted packet records.
Read .pcap Header & Metadata Without Heavy Dependencies
import struct, sys
with open(sys.argv[1], "rb") as f:
hdr = f.read(24)
magic = struct.unpack("<I", hdr[:4])[0]
endian = "<" if magic in (0xA1B2C3D4, 0xA1B23C4D) else ">"
_, maj, min_v, _, _, snaplen, net = struct.unpack(endian + "IHHiIII", hdr)
print(f"PCAP v{maj}.{min_v} snaplen={snaplen} linktype={net}")Deterministic .pcap Sample Files & Edge Cases
minimal-ethernet.pcap
24-byte little-endian microsecond PCAP v2.4 header (`D4 C3 B2 A1`) plus one 42-byte Ethernet frame.
curl -fsSL https://fileformat.co/fixtures/v1/pcap/minimal-ethernet.pcap -o minimal-ethernet.pcap \
&& echo "8e6bf3f1ae8790e789ba3972cec94620b890fed7d3f6b9212467fcd5cedf3e48 minimal-ethernet.pcap" | shasum -a 256 -cthree-frames-capture.pcap
Three sequential packet records with incrementing microsecond timestamps.
curl -fsSL https://fileformat.co/fixtures/v1/pcap/three-frames-capture.pcap -o three-frames-capture.pcap \
&& echo "289189333aa50832b63f984ebcbd5f8d9a71316a5e9864e07781e193478711c8 three-frames-capture.pcap" | shasum -a 256 -csnaplen-truncated-packet.pcap
Packet record `incl_len` exceeds remaining bytes at EOF—tests packet parser bounds checks.
curl -fsSL https://fileformat.co/fixtures/v1/pcap/snaplen-truncated-packet.pcap -o snaplen-truncated-packet.pcap \
&& echo "a5ce5c7570b15f92fc0a3896b4254af5f94891bd5a7528c7847319864b0175d0 snaplen-truncated-packet.pcap" | shasum -a 256 -cRelated Specifications & Alternatives
UTF-8 JSON network session capture exported by Chrome/Firefox/Playwright containing full HTTP headers, cookies, request payloads, and timing waterfalls.
Portable, sandboxed stack-machine binary bytecode format (`\0asm` v1) structured as a sequence of LEB128-framed Type, Import, Function, Memory, Export, and Code sections.
Ubiquitous single-file ACID relational B-tree database with a big-endian 100-byte header at offset 0x00 and full SQL DDL catalog stored in Root Page 1 (`sqlite_schema`).