Display Filter Reference: PCAP File Format
Protocol field name: file-pcap
Versions: 2.0.0 to 4.0.6
Back to Display Filter Reference
| Field name | Description | Type | Versions |
|---|---|---|---|
| pcap | Header | Label | 2.0.0 to 4.0.6 |
| pcap | Link Type | Unsigned integer (32 bits) | 2.0.0 to 4.0.6 |
| pcap | Magic Bytes | Unsigned integer (32 bits) | 2.0.0 to 2.0.1 |
| pcap | Magic Number | Byte sequence | 2.0.2 to 4.0.6 |
| pcap | Sigfigs | Unsigned integer (32 bits) | 2.0.0 to 4.0.6 |
| pcap | Snapshot Length | Unsigned integer (32 bits) | 2.0.0 to 4.0.6 |
| pcap | This Zone | Signed integer (32 bits) | 2.0.0 to 4.0.6 |
| pcap | Version Major | Unsigned integer (16 bits) | 2.0.0 to 4.0.6 |
| pcap | Version Minor | Unsigned integer (16 bits) | 2.0.0 to 4.0.6 |
| pcap | included length is larger than original length | Label | 3.0.0 to 4.0.6 |
| pcap | included length is larger than snapshot length | Label | 3.0.0 to 4.0.6 |
| pcap | Packet | Label | 2.0.0 to 4.0.6 |
| pcap | Data | Label | 2.0.0 to 4.0.6 |
| pcap | Data | Label | 2.0.0 to 2.0.16 |
| pcap | Pseudoheader | Label | 2.0.0 to 2.0.16 |
| pcap | Direction | Unsigned integer (32 bits) | 2.0.0 to 2.0.16 |
| pcap | Included Length | Unsigned integer (32 bits) | 2.0.0 to 4.0.6 |
| pcap | Origin Length | Unsigned integer (32 bits) | 2.0.0 to 4.0.6 |
| pcap | Timestamp | Date and time | 2.0.0 to 4.0.6 |
| pcap | Timestamp sec | Unsigned integer (32 bits) | 2.0.0 to 4.0.6 |
| pcap | Timestamp usec | Unsigned integer (32 bits) | 2.0.0 to 4.0.6 |
| pcap | Expert Info | Label | 2.0.0 to 2.0.1 |