Official certification from the Wireshark Foundation is available! Learn about becoming a Wireshark Certified Analyst.

Display Filter Reference: PCAPNG File Format

Protocol field name: file-pcapng

Versions: 2.0.0 to 4.6.0

Back to Display Filter Reference

Field name Description Type Versions
pcapng.blockBlockLabel2.0.0 to 4.6.0
pcapng.block.dataBlock DataLabel2.0.0 to 4.6.0
pcapng.block.extraneous.dataExtraneous DataByte sequence4.6.0
pcapng.block.extraneous.data.lengthExtraneous Data LengthUnsigned integer (32 bits)4.6.0
pcapng.block.extraneous_dataExtraneous data in block after END-OF-OPTION optionLabel4.6.0
pcapng.block.lengthBlock LengthUnsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.block.length_trailerBlock Length (trailer)Unsigned integer (32 bits)3.6.0 to 4.6.0
pcapng.block.typeBlock TypeUnsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.block.type.valueBlock Type ValueUnsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.block.type.vendorBlock Type VendorBoolean2.0.0 to 4.6.0
pcapng.block_length_below_block_content_lengthBlock length is < the length of the contents of the blockLabel3.6.0 to 4.6.0
pcapng.block_length_below_block_minimumBlock length is < 12 bytesLabel3.6.0 to 4.6.0
pcapng.block_length_not_multiple_of4Block length is not a multiple of 4Label3.2.15 to 3.2.18, 3.4.7 to 4.6.0
pcapng.block_length_too_shortBlock length is < 12 bytesLabel2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 3.4.16
pcapng.block_lengths_dont_matchBlock length in trailer differs from block length in headerLabel3.6.0 to 4.6.0
pcapng.cb.custom_dataCustom DataByte sequence4.2.0 to 4.6.0
pcapng.cb.custom_option.dataCustom Option BinaryByte sequence4.2.0 to 4.6.0
pcapng.cb.custom_option.stringCustom Option StringCharacter string4.2.0 to 4.6.0
pcapng.cb.penPrivate Enterprise Number (PEN)Unsigned integer (32 bits)4.2.0 to 4.6.0
pcapng.darwin.process_idDarwin Process IDUnsigned integer (32 bits)2.4.0 to 4.0.17
pcapng.darwin.process_nameDarwin Process NameCharacter string2.4.0 to 4.0.17
pcapng.darwin.process_uuidDarwin Process UUIDGlobally Unique Identifier2.4.0 to 4.0.17
pcapng.dsb.secrets_dataSecrets DataByte sequence3.0.0 to 4.6.0
pcapng.dsb.secrets_lengthSecrets LengthUnsigned integer (32 bits)3.0.0 to 4.6.0
pcapng.dsb.secrets_typeSecrets TypeUnsigned integer (32 bits)3.0.0 to 4.6.0
pcapng.interface_description.reservedReservedUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.interface_description.snap_lengthSnap LengthUnsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.interface_idInterfaceUnsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.invalid_byte_order_magicThe byte-order magic number is not validLabel2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.6.0
pcapng.invalid_option_lengthInvalid Option LengthLabel2.0.0 to 4.6.0
pcapng.invalid_record_lengthInvalid Record LengthLabel2.0.0 to 4.6.0
pcapng.no_interfacesNo Interface Description before block that requires itLabel2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.6.0
pcapng.optionsOptionsLabel2.0.0 to 4.6.0
pcapng.options.optionOptionLabel2.0.0 to 4.6.0
pcapng.options.option.codeCodeUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.options.option.dataOption DataLabel2.0.0 to 4.6.0
pcapng.options.option.data.commentCommentCharacter string2.0.0 to 4.6.0
pcapng.options.option.data.dns_nameDNS NameCharacter string2.0.0 to 4.6.0
pcapng.options.option.data.end_timeEnd TimeLabel2.0.0 to 4.6.0
pcapng.options.option.data.euiEUI AddressEUI64 address2.0.0 to 4.6.0
pcapng.options.option.data.hardwareHardwareCharacter string2.0.0 to 4.6.0
pcapng.options.option.data.interface.accepted_by_filterNumber of Accepted by Filter PacketsUnsigned integer (64 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.delivered_to_userNumber of Delivered to the User PacketsUnsigned integer (64 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.descriptionDescriptionCharacter string2.0.0 to 4.6.0
pcapng.options.option.data.interface.droppedNumber of Dropped PacketsUnsigned integer (64 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.dropped_by_osNumber of Dropped Packets by OSUnsigned integer (64 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.fcs_lengthFCS LengthUnsigned integer (8 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.filterFilterCharacter string2.0.0 to 3.4.16
pcapng.options.option.data.interface.filter.bpf_programFilter BPF programLabel3.6.0 to 4.6.0
pcapng.options.option.data.interface.filter.stringFilter stringCharacter string3.6.0 to 4.6.0
pcapng.options.option.data.interface.filter.typeFilter typeUnsigned integer (8 bits)3.6.0 to 4.6.0
pcapng.options.option.data.interface.filter.unknownFilter dataLabel3.6.0 to 4.6.0
pcapng.options.option.data.interface.hardwareHardwareCharacter string2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.6.0
pcapng.options.option.data.interface.iana_tznameIANA timezone nameCharacter string4.6.0
pcapng.options.option.data.interface.nameNameCharacter string2.0.0 to 4.6.0
pcapng.options.option.data.interface.osOSCharacter string2.0.0 to 4.6.0
pcapng.options.option.data.interface.receivedNumber of Received PacketsUnsigned integer (64 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.rxspeedRx speedUnsigned integer (64 bits)4.6.0
pcapng.options.option.data.interface.speedSpeedUnsigned integer (64 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.timestamp_offsetTimestamp OffsetUnsigned integer (64 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.timestamp_resolutionTimestamp ResolutionUnsigned integer (8 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.timestamp_resolution.baseBaseUnsigned integer (8 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.timestamp_resolution.valueValueUnsigned integer (8 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.timezoneTimezoneUnsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.options.option.data.interface.txspeedTx speedUnsigned integer (64 bits)4.6.0
pcapng.options.option.data.ipv4IPv4IPv4 address2.0.0 to 4.6.0
pcapng.options.option.data.ipv4_maskIPv4 MaskIPv4 address2.0.0 to 4.6.0
pcapng.options.option.data.ipv6IPv6IPv6 address2.2.0 to 4.6.0
pcapng.options.option.data.ipv6_maskIPv6 MaskUnsigned integer (8 bits)2.0.0 to 4.6.0
pcapng.options.option.data.macMAC AddressEthernet or other MAC address2.0.0 to 4.6.0
pcapng.options.option.data.osOSCharacter string2.0.0 to 4.6.0
pcapng.options.option.data.packet.darwin.dpeb_idDPEB IDUnsigned integer (32 bits)2.4.0 to 4.4.10
pcapng.options.option.data.packet.darwin.dpib_idDPIB IDUnsigned integer (32 bits)4.6.0
pcapng.options.option.data.packet.darwin.edpeb_idEffective DPED IDUnsigned integer (32 bits)2.4.0 to 4.4.10
pcapng.options.option.data.packet.darwin.edpib_idEffective DPIB IDUnsigned integer (32 bits)4.6.0
pcapng.options.option.data.packet.darwin.flagsDarwin FlagsUnsigned integer (32 bits)3.4.0 to 4.6.0
pcapng.options.option.data.packet.darwin.flags.chNexus Channel(ch)Boolean3.4.0 to 4.6.0
pcapng.options.option.data.packet.darwin.flags.kaKeep Alive(ka)Boolean3.4.0 to 4.6.0
pcapng.options.option.data.packet.darwin.flags.nfNew Flow(nf)Boolean3.4.0 to 4.6.0
pcapng.options.option.data.packet.darwin.flags.reReXmit(re)Boolean3.4.0 to 4.6.0
pcapng.options.option.data.packet.darwin.flags.reservedReservedBoolean3.4.0 to 4.6.0
pcapng.options.option.data.packet.darwin.flags.soSocket(so)Boolean3.4.0 to 4.6.0
pcapng.options.option.data.packet.darwin.flags.wkWake Packet(wk)Boolean4.2.0 to 4.6.0
pcapng.options.option.data.packet.darwin.flow_idFlow IDUnsigned integer (32 bits)4.2.0 to 4.6.0
pcapng.options.option.data.packet.darwin.svc_classDarwin svcUnsigned integer (32 bits)2.4.0 to 4.6.0
pcapng.options.option.data.packet.drop_countDrop CountUnsigned integer (64 bits)2.0.0 to 4.6.0
pcapng.options.option.data.packet.flagsFlagsUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.options.option.data.packet.flags.directionDirectionUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.options.option.data.packet.flags.fcs_lengthFCS LengthUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.options.option.data.packet.flags.reception_typeReception TypeUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.options.option.data.packet.flags.reservedReservedUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.options.option.data.packet.hash.algorithmHash AlgorithmUnsigned integer (8 bits)2.0.0 to 4.6.0
pcapng.options.option.data.packet.hash.dataHash DataByte sequence2.0.0 to 4.6.0
pcapng.options.option.data.packet.idPacket IDUnsigned integer (64 bits)3.4.3 to 4.6.0
pcapng.options.option.data.packet.queueQueueUnsigned integer (32 bits)3.4.3 to 4.6.0
pcapng.options.option.data.packet.verdict.dataVerdict dataByte sequence3.4.3 to 4.6.0
pcapng.options.option.data.packet.verdict.typeVerdict typeUnsigned integer (8 bits)3.4.3 to 4.6.0
pcapng.options.option.data.process_idProcess IDUnsigned integer (32 bits)4.6.0
pcapng.options.option.data.start_timeStart TimeLabel2.0.0 to 4.6.0
pcapng.options.option.data.thread_idThread IDUnsigned integer (32 bits)4.6.0
pcapng.options.option.data.user_applicationUser ApplicationCharacter string2.0.0 to 4.6.0
pcapng.options.option.lengthLengthUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.options.option.paddingOption PaddingLabel2.0.0 to 4.6.0
pcapng.packet.captured_lengthCaptured Packet LengthUnsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.packet.drops_countDrops CountUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.packet.interface_idInterfaceUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.packet.original_lengthOriginal Packet LengthUnsigned integer (32 bits)4.2.0 to 4.6.0
pcapng.packet.packet_dataPacket DataLabel2.0.0 to 4.6.0
pcapng.packet.packet_lengthPacket LengthUnsigned integer (16 bits)2.0.0 to 4.0.17
pcapng.packet.paddingPacket PaddingLabel2.0.0 to 4.6.0
pcapng.recordsRecordsLabel2.0.0 to 4.6.0
pcapng.records.recordRecordLabel2.0.0 to 4.6.0
pcapng.records.record.codeCodeUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.records.record.dataRecord DataLabel2.0.0 to 4.6.0
pcapng.records.record.data.ipv4IPv4IPv4 address2.0.0 to 4.6.0
pcapng.records.record.data.ipv6IPv6IPv6 address2.0.0 to 4.6.0
pcapng.records.record.data.nameNameCharacter string2.0.0 to 4.6.0
pcapng.records.record.lengthLengthUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.records.record.paddingRecord PaddingLabel2.0.0 to 4.6.0
pcapng.section_header.byte_order_magicByte Order MagicByte sequence2.0.0 to 4.6.0
pcapng.section_header.section_lengthSection LengthSigned integer (64 bits)2.0.0 to 4.6.0
pcapng.section_header.version.majorMajor VersionUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.section_header.version.minorMinor VersionUnsigned integer (16 bits)2.0.0 to 4.6.0
pcapng.timestampTimestampDate and time2.0.0 to 4.6.0
pcapng.timestamp_highTimestamp (High)Unsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.timestamp_lowTimestamp (Low)Unsigned integer (32 bits)2.0.0 to 4.6.0
pcapng.unknown_encodingExpert InfoLabel2.0.0 to 2.0.1