0

I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng files where any IP address is actually listed.

I'm nowhere near fully understanding the file format yet, but I do understand from the documentation that it has 6 blocks.

  • Section Header
  • Interface Description
  • Enhanced Packet
  • Simple Packet
  • Name Resolution
  • Interface Statistics

What piece of this puzzle am I not understanding?

2

The pcap-ng format just describes the container format which encapsulates the captured packets. It does not describe the content of the captured packet. Thus if you have captured an IP packet you need to refer to the specification of IP to get the source and destination IP address. And if the captured data also include the ethernet frame you have to remove this first before you get to the IP part. If you want to get to the TCP ports you have to understand the TCP header format in order to find where the port numbers are in the TCP header inside the IP packet etc. None of this is part of pcap or pcap-ng.

2
  • Thanks, that makes sense. To make sure I understand, the IP packets are inside of the pcap file? So I'll have to use the the IP specifications to pull the data i'm looking for out, once I've been able to parse out the IP packets from the pcap file? Apr 22 '17 at 13:21
  • 2
    @trueCamelType: yes, first have you have to get to the packet data. Then you need to interpret these data depending on the link layer information, i.e. strip all layers until you get to the IP layer. And then you can extract the IP address from this layer by parsing the IP header according to the specification of IPv4 or IPv6. Apr 22 '17 at 15:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.