pcap_file_header Struct Reference

Header of a libpcap dump file. More...

#include <pcap.h>

Data Fields

bpf_u_int32 magic
u_short version_major
 Libpcap major version.
u_short version_minor
 Libpcap minor version.
bpf_int32 thiszone
 gmt to local correction
bpf_u_int32 sigfigs
 accuracy of timestamps
bpf_u_int32 snaplen
 max length saved portion of each pkt
bpf_u_int32 linktype
 data link type (LINKTYPE_*)

Detailed Description

Header of a libpcap dump file.

The first record in the file contains saved values for some of the flags used in the printout phases of tcpdump. Many fields here are 32 bit ints so compilers won't insert unwanted padding; these files need to be interchangeable across architectures.

Do not change the layout of this structure, in any way (this includes changes that only affect the length of fields in this structure).

Also, do not change the interpretation of any of the members of this structure, in any way (this includes using values other than LINKTYPE_ values, as defined in "savefile.c", in the "linktype" field).


introduce a new structure for the new format, if the layout of the structure changed;

send mail to "[email protected]", requesting a new magic number for your new capture file format, and, when you get the new magic number, put it in "savefile.c";

use that magic number for save files with the changed file header;

make the code in "savefile.c" capable of reading files with the old file header as well as files with the new file header (using the magic number to determine the header format).

Then supply the changes to "[email protected]", so that future versions of libpcap and programs that use it (such as tcpdump) will be able to read your new capture file format.

Definition at line 110 of file incs/pcap.h.

Field Documentation

bpf_u_int32 magic

Definition at line 111 of file incs/pcap.h.

u_short version_major

Libpcap major version.

Definition at line 112 of file incs/pcap.h.

u_short version_minor

Libpcap minor version.

Definition at line 113 of file incs/pcap.h.

bpf_int32 thiszone

gmt to local correction

Definition at line 114 of file incs/pcap.h.

bpf_u_int32 sigfigs

accuracy of timestamps

Definition at line 115 of file incs/pcap.h.

bpf_u_int32 snaplen

max length saved portion of each pkt

Definition at line 116 of file incs/pcap.h.

bpf_u_int32 linktype

data link type (LINKTYPE_*)

Definition at line 117 of file incs/pcap.h.

The documentation for this struct was generated from the following file:

documentation. Copyright (c) 2002-2005 Politecnico di Torino. Copyright (c) 2005-2007 CACE Technologies. All rights reserved.