I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng files where any IP address is actually listed.
I'm nowhere near fully understanding the file format yet, but I do understand from the documentation that it has 6 blocks.
- Section Header
- Interface Description
- Enhanced Packet
- Simple Packet
- Name Resolution
- Interface Statistics
What piece of this puzzle am I not understanding?