git Service of IN-Ulm e.V. Explore Help
Sign In
cbiedl
/
file
1
0
Fork 0
Files Pull Requests 0 Wiki
Tree: de25eb5d5a
Branches Tags
file
/
magic
/
Magdir
/
sniffer

sniffer 16 KB
History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417 
  1. 

  2. #------------------------------------------------------------------------------
    3. 

  3. # $File: sniffer,v 1.32 2022/07/30 16:46:56 christos Exp $
    4. 

  4. # sniffer:  file(1) magic for packet capture files
    5. 

  5. #
    6. 

  6. # From: guy@alum.mit.edu (Guy Harris)
    7. 

  7. #
    8. 

  8. 

  9. #
    10. 

  10. # Microsoft Network Monitor 1.x capture files.
    11. 

  11. #
    12. 

  12. 0	string		RTSS		NetMon capture file
    13. 

  13. >5	byte		x		- version %d
    14. 

  14. >4	byte		x		\b.%d
    15. 

  15. >6	leshort		0		(Unknown)
    16. 

  16. >6	leshort		1		(Ethernet)
    17. 

  17. >6	leshort		2		(Token Ring)
    18. 

  18. >6	leshort		3		(FDDI)
    19. 

  19. >6	leshort		4		(ATM)
    20. 

  20. >6	leshort		>4		(type %d)
    21. 

  21. 

  22. #
    23. 

  23. # Microsoft Network Monitor 2.x capture files.
    24. 

  24. #
    25. 

  25. 0	string		GMBU		NetMon capture file
    26. 

  26. >5	byte		x		- version %d
    27. 

  27. >4	byte		x		\b.%d
    28. 

  28. >6	leshort		0		(Unknown)
    29. 

  29. >6	leshort		1		(Ethernet)
    30. 

  30. >6	leshort		2		(Token Ring)
    31. 

  31. >6	leshort		3		(FDDI)
    32. 

  32. >6	leshort		4		(ATM)
    33. 

  33. >6	leshort		5		(IP-over-IEEE 1394)
    34. 

  34. >6	leshort		6		(802.11)
    35. 

  35. >6	leshort		7		(Raw IP)
    36. 

  36. >6	leshort		8		(Raw IP)
    37. 

  37. >6	leshort		9		(Raw IP)
    38. 

  38. >6	leshort		>9		(type %d)
    39. 

  39. 

  40. #
    41. 

  41. # Network General Sniffer capture files.
    42. 

  42. # Sorry, make that "Network Associates Sniffer capture files."
    43. 

  43. # Sorry, make that "Network General old DOS Sniffer capture files."
    44. 

  44. #
    45. 

  45. 0	string		TRSNIFF\040data\040\040\040\040\032	Sniffer capture file
    46. 

  46. >33	byte		2		(compressed)
    47. 

  47. >23	leshort		x		- version %d
    48. 

  48. >25	leshort		x		\b.%d
    49. 

  49. >32	byte		0		(Token Ring)
    50. 

  50. >32	byte		1		(Ethernet)
    51. 

  51. >32	byte		2		(ARCNET)
    52. 

  52. >32	byte		3		(StarLAN)
    53. 

  53. >32	byte		4		(PC Network broadband)
    54. 

  54. >32	byte		5		(LocalTalk)
    55. 

  55. >32	byte		6		(Znet)
    56. 

  56. >32	byte		7		(Internetwork Analyzer)
    57. 

  57. >32	byte		9		(FDDI)
    58. 

  58. >32	byte		10		(ATM)
    59. 

  59. 

  60. #
    61. 

  61. # Cinco Networks NetXRay capture files.
    62. 

  62. # Sorry, make that "Network General Sniffer Basic capture files."
    63. 

  63. # Sorry, make that "Network Associates Sniffer Basic capture files."
    64. 

  64. # Sorry, make that "Network Associates Sniffer Basic, and Windows
    65. 

  65. # Sniffer Pro", capture files."
    66. 

  66. # Sorry, make that "Network General Sniffer capture files."
    67. 

  67. # Sorry, make that "NetScout Sniffer capture files."
    68. 

  68. #
    69. 

  69. 0	string		XCP\0		NetXRay capture file
    70. 

  70. >4	string		>\0		- version %s
    71. 

  71. >44	leshort		0		(Ethernet)
    72. 

  72. >44	leshort		1		(Token Ring)
    73. 

  73. >44	leshort		2		(FDDI)
    74. 

  74. >44	leshort		3		(WAN)
    75. 

  75. >44	leshort		8		(ATM)
    76. 

  76. >44	leshort		9		(802.11)
    77. 

  77. 

  78. #
    79. 

  79. # "libpcap" capture files.
    80. 

  80. # https://www.tcpdump.org/manpages/pcap-savefile.5.html
    81. 

  81. # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
    82. 

  82. # the main program that uses that format, but there are other programs
    83. 

  83. # that use "libpcap", or that use the same capture file format.)
    84. 

  84. #
    85. 

  85. 0	name		pcap-be
    86. 

  86. >4	beshort		x		- version %d
    87. 

  87. >6	beshort		x		\b.%d
    88. 

  88. # clear that continuation level match
    89. 

  89. >20	clear		x
    90. 

  90. >20	belong&0x03FFFFFF		0		(No link-layer encapsulation
    91. 

  91. >20	belong&0x03FFFFFF		1		(Ethernet
    92. 

  92. >20	belong&0x03FFFFFF		2		(3Mb Ethernet
    93. 

  93. >20	belong&0x03FFFFFF		3		(AX.25
    94. 

  94. >20	belong&0x03FFFFFF		4		(ProNET
    95. 

  95. >20	belong&0x03FFFFFF		5		(CHAOS
    96. 

  96. >20	belong&0x03FFFFFF		6		(Token Ring
    97. 

  97. >20	belong&0x03FFFFFF		7		(BSD ARCNET
    98. 

  98. >20	belong&0x03FFFFFF		8		(SLIP
    99. 

  99. >20	belong&0x03FFFFFF		9		(PPP
    100. 

  100. >20	belong&0x03FFFFFF		10		(FDDI
    101. 

  101. >20	belong&0x03FFFFFF		11		(RFC 1483 ATM
    102. 

  102. >20	belong&0x03FFFFFF		12		(Raw IP
    103. 

  103. >20	belong&0x03FFFFFF		13		(BSD/OS SLIP
    104. 

  104. >20	belong&0x03FFFFFF		14		(BSD/OS PPP
    105. 

  105. >20	belong&0x03FFFFFF		19		(Linux ATM Classical IP
    106. 

  106. >20	belong&0x03FFFFFF		50		(PPP or Cisco HDLC
    107. 

  107. >20	belong&0x03FFFFFF		51		(PPP-over-Ethernet
    108. 

  108. >20	belong&0x03FFFFFF		99		(Symantec Enterprise Firewall
    109. 

  109. >20	belong&0x03FFFFFF		100		(RFC 1483 ATM
    110. 

  110. >20	belong&0x03FFFFFF		101		(Raw IP
    111. 

  111. >20	belong&0x03FFFFFF		102		(BSD/OS SLIP
    112. 

  112. >20	belong&0x03FFFFFF		103		(BSD/OS PPP
    113. 

  113. >20	belong&0x03FFFFFF		104		(BSD/OS Cisco HDLC
    114. 

  114. >20	belong&0x03FFFFFF		105		(802.11
    115. 

  115. >20	belong&0x03FFFFFF		106		(Linux Classical IP over ATM
    116. 

  116. >20	belong&0x03FFFFFF		107		(Frame Relay
    117. 

  117. >20	belong&0x03FFFFFF		108		(OpenBSD loopback
    118. 

  118. >20	belong&0x03FFFFFF		109		(OpenBSD IPsec encrypted
    119. 

  119. >20	belong&0x03FFFFFF		112		(Cisco HDLC
    120. 

  120. >20	belong&0x03FFFFFF		113		(Linux cooked v1
    121. 

  121. >20	belong&0x03FFFFFF		114		(LocalTalk
    122. 

  122. >20	belong&0x03FFFFFF		117		(OpenBSD PFLOG
    123. 

  123. >20	belong&0x03FFFFFF		119		(802.11 with Prism header
    124. 

  124. >20	belong&0x03FFFFFF		122		(RFC 2625 IP over Fibre Channel
    125. 

  125. >20	belong&0x03FFFFFF		123		(SunATM
    126. 

  126. >20	belong&0x03FFFFFF		127		(802.11 with radiotap header
    127. 

  127. >20	belong&0x03FFFFFF		129		(Linux ARCNET
    128. 

  128. >20	belong&0x03FFFFFF		130		(Juniper Multi-Link PPP
    129. 

  129. >20	belong&0x03FFFFFF		131		(Juniper Multi-Link Frame Relay
    130. 

  130. >20	belong&0x03FFFFFF		132		(Juniper Encryption Services PIC
    131. 

  131. >20	belong&0x03FFFFFF		133		(Juniper GGSN PIC
    132. 

  132. >20	belong&0x03FFFFFF		134		(Juniper FRF.16 Frame Relay
    133. 

  133. >20	belong&0x03FFFFFF		135		(Juniper ATM2 PIC
    134. 

  134. >20	belong&0x03FFFFFF		136		(Juniper Advanced Services PIC
    135. 

  135. >20	belong&0x03FFFFFF		137		(Juniper ATM1 PIC
    136. 

  136. >20	belong&0x03FFFFFF		138		(Apple IP over IEEE 1394
    137. 

  137. >20	belong&0x03FFFFFF		139		(SS7 MTP2 with pseudo-header
    138. 

  138. >20	belong&0x03FFFFFF		140		(SS7 MTP2
    139. 

  139. >20	belong&0x03FFFFFF		141		(SS7 MTP3
    140. 

  140. >20	belong&0x03FFFFFF		142		(SS7 SCCP
    141. 

  141. >20	belong&0x03FFFFFF		143		(DOCSIS
    142. 

  142. >20	belong&0x03FFFFFF		144		(Linux IrDA
    143. 

  143. >20	belong&0x03FFFFFF		147		(Private use 0
    144. 

  144. >20	belong&0x03FFFFFF		148		(Private use 1
    145. 

  145. >20	belong&0x03FFFFFF		149		(Private use 2
    146. 

  146. >20	belong&0x03FFFFFF		150		(Private use 3
    147. 

  147. >20	belong&0x03FFFFFF		151		(Private use 4
    148. 

  148. >20	belong&0x03FFFFFF		152		(Private use 5
    149. 

  149. >20	belong&0x03FFFFFF		153		(Private use 6
    150. 

  150. >20	belong&0x03FFFFFF		154		(Private use 7
    151. 

  151. >20	belong&0x03FFFFFF		155		(Private use 8
    152. 

  152. >20	belong&0x03FFFFFF		156		(Private use 9
    153. 

  153. >20	belong&0x03FFFFFF		157		(Private use 10
    154. 

  154. >20	belong&0x03FFFFFF		158		(Private use 11
    155. 

  155. >20	belong&0x03FFFFFF		159		(Private use 12
    156. 

  156. >20	belong&0x03FFFFFF		160		(Private use 13
    157. 

  157. >20	belong&0x03FFFFFF		161		(Private use 14
    158. 

  158. >20	belong&0x03FFFFFF		162		(Private use 15
    159. 

  159. >20	belong&0x03FFFFFF		163		(802.11 with AVS header
    160. 

  160. >20	belong&0x03FFFFFF		164		(Juniper Passive Monitor PIC
    161. 

  161. >20	belong&0x03FFFFFF		165		(BACnet MS/TP
    162. 

  162. >20	belong&0x03FFFFFF		166		(PPPD
    163. 

  163. >20	belong&0x03FFFFFF		167		(Juniper PPPoE
    164. 

  164. >20	belong&0x03FFFFFF		168		(Juniper PPPoE/ATM
    165. 

  165. >20	belong&0x03FFFFFF		169		(GPRS LLC
    166. 

  166. >20	belong&0x03FFFFFF		170		(GPF-T
    167. 

  167. >20	belong&0x03FFFFFF		171		(GPF-F
    168. 

  168. >20	belong&0x03FFFFFF		174		(Juniper PIC Peer
    169. 

  169. >20	belong&0x03FFFFFF		175		(Ethernet with Endace ERF header
    170. 

  170. >20	belong&0x03FFFFFF		176		(Packet-over-SONET with Endace ERF header
    171. 

  171. >20	belong&0x03FFFFFF		177		(Linux LAPD
    172. 

  172. >20	belong&0x03FFFFFF		178		(Juniper Ethernet
    173. 

  173. >20	belong&0x03FFFFFF		179		(Juniper PPP
    174. 

  174. >20	belong&0x03FFFFFF		180		(Juniper Frame Relay
    175. 

  175. >20	belong&0x03FFFFFF		181		(Juniper C-HDLC
    176. 

  176. >20	belong&0x03FFFFFF		182		(FRF.16 Frame Relay
    177. 

  177. >20	belong&0x03FFFFFF		183		(Juniper Voice PIC
    178. 

  178. >20	belong&0x03FFFFFF		184		(Arinc 429
    179. 

  179. >20	belong&0x03FFFFFF		185		(Arinc 653 Interpartition Communication
    180. 

  180. >20	belong&0x03FFFFFF		186		(USB with FreeBSD header
    181. 

  181. >20	belong&0x03FFFFFF		187		(Bluetooth HCI H4
    182. 

  182. >20	belong&0x03FFFFFF		188		(802.16 MAC Common Part Sublayer
    183. 

  183. >20	belong&0x03FFFFFF		189		(Linux USB
    184. 

  184. >20	belong&0x03FFFFFF		190		(Controller Area Network (CAN) v. 2.0B
    185. 

  185. >20	belong&0x03FFFFFF		191		(802.15.4 with Linux padding
    186. 

  186. >20	belong&0x03FFFFFF		192		(PPI
    187. 

  187. >20	belong&0x03FFFFFF		193		(802.16 MAC Common Part Sublayer plus radiotap header
    188. 

  188. >20	belong&0x03FFFFFF		194		(Juniper Integrated Service Module
    189. 

  189. >20	belong&0x03FFFFFF		195		(802.15.4 with FCS
    190. 

  190. >20	belong&0x03FFFFFF		196		(SITA
    191. 

  191. >20	belong&0x03FFFFFF		197		(Endace ERF
    192. 

  192. >20	belong&0x03FFFFFF		198		(Ethernet with u10 Networks pseudo-header
    193. 

  193. >20	belong&0x03FFFFFF		199		(IPMB
    194. 

  194. >20	belong&0x03FFFFFF		200		(Juniper Secure Tunnel
    195. 

  195. >20	belong&0x03FFFFFF		201		(Bluetooth HCI H4 with pseudo-header
    196. 

  196. >20	belong&0x03FFFFFF		202		(AX.25 with KISS header
    197. 

  197. >20	belong&0x03FFFFFF		203		(LAPD
    198. 

  198. >20	belong&0x03FFFFFF		204		(PPP with direction pseudo-header
    199. 

  199. >20	belong&0x03FFFFFF		205		(Cisco HDLC with direction pseudo-header
    200. 

  200. >20	belong&0x03FFFFFF		206		(Frame Relay with direction pseudo-header
    201. 

  201. >20	belong&0x03FFFFFF		209		(Linux IPMB
    202. 

  202. >20	belong&0x03FFFFFF		215		(802.15.4 with non-ASK PHY header
    203. 

  203. >20	belong&0x03FFFFFF		216		(Linux evdev events
    204. 

  204. >20	belong&0x03FFFFFF		219		(MPLS with label as link-layer header
    205. 

  205. >20	belong&0x03FFFFFF		220		(Memory-mapped Linux USB
    206. 

  206. >20	belong&0x03FFFFFF		221		(DECT
    207. 

  207. >20	belong&0x03FFFFFF		222		(AOS Space Data Link protocol
    208. 

  208. >20	belong&0x03FFFFFF		223		(Wireless HART
    209. 

  209. >20	belong&0x03FFFFFF		224		(Fibre Channel FC-2
    210. 

  210. >20	belong&0x03FFFFFF		225		(Fibre Channel FC-2 with frame delimiters
    211. 

  211. >20	belong&0x03FFFFFF		226		(Solaris IPNET
    212. 

  212. >20	belong&0x03FFFFFF		227		(SocketCAN
    213. 

  213. >20	belong&0x03FFFFFF		228		(Raw IPv4
    214. 

  214. >20	belong&0x03FFFFFF		229		(Raw IPv6
    215. 

  215. >20	belong&0x03FFFFFF		230		(802.15.4 without FCS
    216. 

  216. >20	belong&0x03FFFFFF		231		(D-Bus messages
    217. 

  217. >20	belong&0x03FFFFFF		232		(Juniper Virtual Server
    218. 

  218. >20	belong&0x03FFFFFF		233		(Juniper SRX E2E
    219. 

  219. >20	belong&0x03FFFFFF		234		(Juniper Fibre Channel
    220. 

  220. >20	belong&0x03FFFFFF		235		(DVB-CI
    221. 

  221. >20	belong&0x03FFFFFF		236		(MUX27010
    222. 

  222. >20	belong&0x03FFFFFF		237		(STANAG 5066 D_PDUs
    223. 

  223. >20	belong&0x03FFFFFF		238		(Juniper ATM CEMIC
    224. 

  224. >20	belong&0x03FFFFFF		239		(Linux netfilter log messages
    225. 

  225. >20	belong&0x03FFFFFF		240		(Hilscher netAnalyzer
    226. 

  226. >20	belong&0x03FFFFFF		241		(Hilscher netAnalyzer with delimiters
    227. 

  227. >20	belong&0x03FFFFFF		242		(IP-over-Infiniband
    228. 

  228. >20	belong&0x03FFFFFF		243		(MPEG-2 Transport Stream packets
    229. 

  229. >20	belong&0x03FFFFFF		244		(ng4t ng40
    230. 

  230. >20	belong&0x03FFFFFF		245		(NFC LLCP
    231. 

  231. >20	belong&0x03FFFFFF		246		(Packet filter state syncing
    232. 

  232. >20	belong&0x03FFFFFF		247		(InfiniBand
    233. 

  233. >20	belong&0x03FFFFFF		248		(SCTP
    234. 

  234. >20	belong&0x03FFFFFF		249		(USB with USBPcap header
    235. 

  235. >20	belong&0x03FFFFFF		250		(Schweitzer Engineering Laboratories RTAC packets
    236. 

  236. >20	belong&0x03FFFFFF		251		(Bluetooth Low Energy air interface
    237. 

  237. >20	belong&0x03FFFFFF		252		(Wireshark Upper PDU export
    238. 

  238. >20	belong&0x03FFFFFF		253		(Linux netlink
    239. 

  239. >20	belong&0x03FFFFFF		254		(Bluetooth Linux Monitor
    240. 

  240. >20	belong&0x03FFFFFF		255		(Bluetooth Basic Rate/Enhanced Data Rate baseband packets
    241. 

  241. >20	belong&0x03FFFFFF		256		(Bluetooth Low Energy air interface with pseudo-header
    242. 

  242. >20	belong&0x03FFFFFF		257		(PROFIBUS data link layer
    243. 

  243. >20	belong&0x03FFFFFF		258		(Apple DLT_PKTAP
    244. 

  244. >20	belong&0x03FFFFFF		259		(Ethernet with 802.3 Clause 65 EPON preamble
    245. 

  245. >20	belong&0x03FFFFFF		260		(IPMI trace packets
    246. 

  246. >20	belong&0x03FFFFFF		261		(Z-Wave RF profile R1 and R2 packets
    247. 

  247. >20	belong&0x03FFFFFF		262		(Z-Wave RF profile R3 packets
    248. 

  248. >20	belong&0x03FFFFFF		263		(WattStopper Digital Lighting Mngmt/Legrand Nitoo Open Proto
    249. 

  249. >20	belong&0x03FFFFFF		264		(ISO 14443 messages
    250. 

  250. >20	belong&0x03FFFFFF		265		(IEC 62106 Radio Data System groups
    251. 

  251. >20	belong&0x03FFFFFF		266		(USB with Darwin header
    252. 

  252. >20	belong&0x03FFFFFF		267		(OpenBSD DLT_OPENFLOW
    253. 

  253. >20	belong&0x03FFFFFF		268		(IBM SDLC frames
    254. 

  254. >20	belong&0x03FFFFFF		269		(TI LLN sniffer frames
    255. 

  255. >20	belong&0x03FFFFFF		271		(Linux vsock
    256. 

  256. >20	belong&0x03FFFFFF		272		(Nordic Semiconductor Bluetooth LE sniffer frames
    257. 

  257. >20	belong&0x03FFFFFF		273		(Excentis XRA-31 DOCSIS 3.1 RF sniffer frames
    258. 

  258. >20	belong&0x03FFFFFF		274		(802.3br mPackets
    259. 

  259. >20	belong&0x03FFFFFF		275		(DisplayPort AUX channel monitoring data
    260. 

  260. >20	belong&0x03FFFFFF		276		(Linux cooked v2
    261. 

  261. >20	belong&0x03FFFFFF		278		(OpenVizsla USB
    262. 

  262. >20	belong&0x03FFFFFF		279		(Elektrobit High Speed Capture and Replay (EBHSCR)
    263. 

  263. >20	belong&0x03FFFFFF		281		(Broadcom tag
    264. 

  264. >20	belong&0x03FFFFFF		282		(Broadcom tag (prepended)
    265. 

  265. >20	belong&0x03FFFFFF		283		(802.15.4 with TAP
    266. 

  266. >20	belong&0x03FFFFFF		284		(Marvell DSA
    267. 

  267. >20	belong&0x03FFFFFF		285		(Marvell EDSA
    268. 

  268. >20	belong&0x03FFFFFF		286		(ELEE lawful intercept
    269. 

  269. >20	belong&0x03FFFFFF		287		(Z-Wave serial
    270. 

  270. >20	belong&0x03FFFFFF		288		(USB 2.0
    271. 

  271. >20	belong&0x03FFFFFF		289		(ATSC ALP
    272. 

  272. >20	belong&0x03FFFFFF		290		(Event Tracing for Windows
    273. 

  273. >20	belong&0x03FFFFFF		291		(Hilscher netANALYZER NG pseudo-footer
    274. 

  274. >20	belong&0x03FFFFFF		292		(ZBOSS NCP protocol with pseudo-header
    275. 

  275. >20	belong&0x03FFFFFF		293		(Low-Speed USB 2.0/1.1/1.0
    276. 

  276. >20	belong&0x03FFFFFF		294		(Full-Speed USB 2.0/1.1/1.0
    277. 

  277. >20	belong&0x03FFFFFF		295		(High-Speed USB 2.0
    278. 

  278. # print default match
    279. 

  279. >20	default		x
    280. 

  280. >>20	belong		x		(linktype#%u
    281. 

  281. >16	belong		x		\b, capture length %u)
    282. 

  282. 

  283. # packets time stamps in seconds and microseconds.
    284. 

  284. 0	ubelong		0xa1b2c3d4	pcap capture file, microseconds ts (big-endian)
    285. 

  285. !:mime	application/vnd.tcpdump.pcap
    286. 

  286. >0	use	pcap-be
    287. 

  287. 0	ulelong		0xa1b2c3d4	pcap capture file, microsecond ts (little-endian)
    288. 

  288. !:mime	application/vnd.tcpdump.pcap
    289. 

  289. >0	use	\^pcap-be
    290. 

  290. 

  291. # packets time stamps in seconds and nanoseconds.
    292. 

  292. 0	ubelong		0xa1b23c4d	pcap capture file, nanosecond ts (big-endian)
    293. 

  293. !:mime	application/vnd.tcpdump.pcap
    294. 

  294. >0	use	pcap-be
    295. 

  295. 0	ulelong		0xa1b23c4d	pcap capture file, nanosecond ts (little-endian)
    296. 

  296. !:mime	application/vnd.tcpdump.pcap
    297. 

  297. >0	use	\^pcap-be
    298. 

  298. 

  299. #
    300. 

  300. # "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
    301. 

  301. #
    302. 

  302. 0	ubelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (big-endian)
    303. 

  303. >0	use	pcap-be
    304. 

  304. 0	ulelong		0xa1b2cd34	pcap capture file, microsecond ts, extensions (little-endian)
    305. 

  305. >0	use	\^pcap-be
    306. 

  306. 

  307. #
    308. 

  308. # "pcapng" capture files.
    309. 

  309. # https://github.com/pcapng/pcapng
    310. 

  310. # Pcapng files can contain multiple sections. Printing the endianness,
    311. 

  311. # snaplen, or other information from the first SHB may be misleading.
    312. 

  312. #
    313. 

  313. 0	ubelong		0x0a0d0d0a
    314. 

  314. >8	ubelong		0x1a2b3c4d	pcapng capture file
    315. 

  315. >>12	beshort		x		- version %d
    316. 

  316. >>14	beshort		x		\b.%d
    317. 

  317. 0	ulelong		0x0a0d0d0a
    318. 

  318. >8	ulelong		0x1a2b3c4d	pcapng capture file
    319. 

  319. >>12	leshort		x		- version %d
    320. 

  320. >>14	leshort		x		\b.%d
    321. 

  321. 

  322. #
    323. 

  323. # AIX "iptrace" capture files.
    324. 

  324. #
    325. 

  325. 0	string		iptrace\0401.0	AIX iptrace capture file
    326. 

  326. 0	string		iptrace\0402.0	AIX iptrace capture file
    327. 

  327. 

  328. #
    329. 

  329. # Novell LANalyzer capture files.
    330. 

  330. #
    331. 

  331. 0	leshort		0x1001		Novell LANalyzer capture file
    332. 

  332. 0	leshort		0x1007		Novell LANalyzer capture file
    333. 

  333. 

  334. #
    335. 

  335. # HP-UX "nettl" capture files.
    336. 

  336. #
    337. 

  337. 0	string		\x54\x52\x00\x64\x00	HP/UX nettl capture file
    338. 

  338. 

  339. #
    340. 

  340. # RADCOM WAN/LAN Analyzer capture files.
    341. 

  341. #
    342. 

  342. 0	string		\x42\xd2\x00\x34\x12\x66\x22\x88	RADCOM WAN/LAN Analyzer capture file
    343. 

  343. 

  344. #
    345. 

  345. # NetStumbler log files.  Not really packets, per se, but about as
    346. 

  346. # close as you can get.  These are log files from NetStumbler, a
    347. 

  347. # Windows program, that scans for 802.11b networks.
    348. 

  348. #
    349. 

  349. 0	string		NetS		NetStumbler log file
    350. 

  350. >8	lelong		x		\b, %d stations found
    351. 

  351. 

  352. #
    353. 

  353. # *Peek tagged capture files.
    354. 

  354. #
    355. 

  355. 0	string		\177ver		EtherPeek/AiroPeek/OmniPeek capture file
    356. 

  356. 

  357. #
    358. 

  358. # Visual Networks traffic capture files.
    359. 

  359. #
    360. 

  360. 0	string		\x05VNF		Visual Networks traffic capture file
    361. 

  361. 

  362. #
    363. 

  363. # Network Instruments Observer capture files.
    364. 

  364. #
    365. 

  365. 0	string		ObserverPktBuffe	Network Instruments Observer capture file
    366. 

  366. 

  367. #
    368. 

  368. # Files from Accellent Group's 5View products.
    369. 

  369. #
    370. 

  370. # URL:		http://www.infovista.com
    371. 

  371. # Reference:	http://mark0.net/download/triddefs_xml.7z
    372. 

  372. #		defs/0/5vw.trid.xml
    373. 

  373. #		https://2.na.dl.wireshark.org/src/wireshark-3.6.2.tar.xz
    374. 

  374. #		wireshark-3.6.2/wiretap/5views.c 
    375. 

  375. # Update:	Joerg Jenderek
    376. 

  376. # Note:		called "5View capture" by TrID and
    377. 

  377. #		"Wireshark capture file" on Windows or
    378. 

  378. #		"Packet Capture (Accellent/InfoVista 5view)" by shared MIME-info database
    379. 

  379. #		verified/falsified by `wireshark *.5vw`
    380. 

  380. 0	string		\xaa\xaa\xaa\xaa
    381. 

  381. # skip misidentified boot/x86_64/loader/kroete.dat on Suse LEAP DVD
    382. 

  382. # by check for valid record version
    383. 

  383. >8	ulelong		=0x00010000
    384. 

  384. >>0	use	5view-le
    385. 

  385. 0	name	5view-le
    386. 

  386. # t_5VW_Info_Header.Signature = CST_5VW_INFO_HEADER_KEY = 0xAAAAAAAAU
    387. 

  387. >0	ulelong		x			5View capture file
    388. 

  388. # https://reposcope.com/mimetype/application/x-5view
    389. 

  389. !:mime	application/x-5view
    390. 

  390. !:ext	5vw
    391. 

  391. # size of header in bytes (included signature and reserved fields); probably always 20h
    392. 

  392. >4	ulelong		!0x00000020		\b, header size %#x
    393. 

  393. # version of header record; apparently always CST_5VW_INFO_RECORD_VERSION=0x00010000U
    394. 

  394. >8	ulelong		!0x00010000		\b, record version %#x
    395. 

  395. # DataSize; total size of data without header like: 18h
    396. 

  396. >12	ulelong		x			\b, record size %#x
    397. 

  397. # filetype; type of the capture file like: 18001000h
    398. 

  398. >16	ulelong		x			\b, file type %#8.8x
    399. 

  399. # Reserved[3]; reserved for future use; apparently zero
    400. 

  400. >20	quad		!0			\b, Reserved %#llx
    401. 

  401. # look for record header key CST_5VW_RECORDS_HEADER_KEY of structure t_5VW_TimeStamped_Header
    402. 

  402. >0x20	search/0xB8/b	\xEE\xEE\x33\x33	\b; record
    403. 

  403. # HeaderSize; actual size of this header in bytes like: 32 24h
    404. 

  404. >>&0	uleshort	x			size %#x
    405. 

  405. # HeaderType; exact type of this header; probably always 0x4000
    406. 

  406. >>&2	uleshort	!0x4000			\b, header type %#x
    407. 

  407. # RecType; type of record like: 80000000h
    408. 

  408. >>&4	ulelong		x			\b, record type %#x
    409. 

  409. # RecSubType; subtype of record like: 0
    410. 

  410. >>&8	ulelong		!0			\b, subtype %#x
    411. 

  411. # RecSize; Size of one record like: 5Ch
    412. 

  412. >>&12	ulelong		x			\b, RecSize %#x
    413. 

  413. # RecNb; Number of records like: 1
    414. 

  414. >>&16	ulelong		>1			\b, %#x records
    415. 

  415. # Timestamp Utc
    416. 

  416. #>>&20	ulelong		x			\b, RAW TIME %#8.8x
    417. 

  417. >>&20	date		x			\b, Time-stamp %s
    418.