Top-level file header for a Network Instruments Observer capture file. More...

#include <observer.h>

Public Attributes
char	observer_version [31]
uint8_t	offset_to_first_packet_high_byte
uint16_t	offset_to_first_packet
char	probe_instance
uint8_t	number_of_information_elements

Detailed Description

Top-level file header for a Network Instruments Observer capture file.

As of v15, observer_version was shortened by one byte to introduce offset_to_first_packet_high_byte, extending the addressable range for the first-packet offset to 16 MB. Files predating v15 will always have offset_to_first_packet_high_byte set to 0.

Member Data Documentation

◆ number_of_information_elements

uint8_t capture_file_header::number_of_information_elements

Number of TLV information elements appended to this header.

◆ observer_version

char capture_file_header::observer_version[31]

Null-terminated version string of the Observer software that created this file; maximum 30 characters.

◆ offset_to_first_packet

uint16_t capture_file_header::offset_to_first_packet

Low 16 bits of the byte offset from the start of the file to the first packet record.

◆ offset_to_first_packet_high_byte

uint8_t capture_file_header::offset_to_first_packet_high_byte

High byte of the offset to the first packet, extending the range to 256 × 0x10000 = 16 MB; always 0 in files predating v15.

◆ probe_instance

char capture_file_header::probe_instance

Identifier of the probe instance that captured this file.

The documentation for this struct was generated from the following file:

/builds/wireshark/wireshark/wiretap/observer.h