PcapNg

The PCAP Next Generation Dump File Format (or pcapng for short) is an attempt to overcome the limitations of the currently widely used (but limited) libpcap format.

The pcapng file format specification is still work in progress, see:

Example pcapng Capture File

Included below are some example pcapng files. While the block headers for these files appears to be formatted correctly, the payloads contained within these may NOT necessarily be well-formed (this is especially true of the "http.bigendian.ntar" file). Examples of pcapng files are currently very scarce. A few of these files were found elsewhere on the net (most likely the at the winpcap.org site referenced above). The "http.littlendian.ntar" file was found as an attachment(under a different name) in an email regarding pcapng. The http.bigendian.ntar is a version of this same file that was edited by hand to illustrate how a big-endian and little-endian machine might write the same data.

/!\ Please note: The recommended file name extension for pcapng files is .pcapng

ntartest - a simplistic standalone pcapng (ntar) file reader

Included below is the C source code to a very simplistic program to read and dump header information about a pcapng (a.k.a. ntar) file. This program has been successfully compiled using gcc and used on several different types of systems including Linux, cygwin and Solaris 9.

To compile this program use the command:

To use the program provide a pcapng file as the first argument to the program:

Current Wireshark Prototype

Wireshark development builds contains a running *prototype*, which can read and write simple pcapng files.

It has currently limited functionality (e.g. only one capture interface, no comments, ...), basically what libpcap also can do and the implementation might be as buggy as hell :)

Known Limitations

Options working

These options are working:

These options will only be displayed on the console (missing API from wiretap to Wireshark):

Future

So after implementing the "skeleton" to read the pcapng file, there's a lot more to do:

Development/PcapNg (last edited 2009-05-22 01:31:28 by TysonKey)