PCAP File Format

What is a PCAP file?

A PCAP file (Packet Capture) is a standard file format used to store network packet data captured from network interfaces. PCAP files contain raw network traffic data including packet headers, payloads, and timing information, making them essential for network analysis, troubleshooting, security monitoring, and forensic investigations.

File Extensions

• .pcap (Packet Capture)
• .pcapng (Packet Capture Next Generation)
• .cap (Alternative extension)
• .dmp (Some capture tools)

MIME Type

• application/vnd.tcpdump.pcap

History and Development

The PCAP format was originally developed as part of the libpcap library by Van Jacobson, Craig Leres, and Steven McCanne at Lawrence Berkeley Laboratory in the 1990s. It became the de facto standard for packet capture data storage and exchange.

Timeline

• 1994: libpcap library and PCAP format introduced
• 1999: WinPcap brings PCAP to Windows platforms
• 2004: PCAP-NG format development begins
• 2009: PCAP-NG specification published
• 2013: npcap as modern Windows packet capture solution
• Present: Continued evolution with modern networking needs

Technical Specifications

PCAP File Structure

PCAP File Layout:
├── Global Header (24 bytes)
│   ├── Magic Number (4 bytes)
│   ├── Version Major (2 bytes)
│   ├── Version Minor (2 bytes)
│   ├── Time Zone Offset (4 bytes)
│   ├── Timestamp Accuracy (4 bytes)
│   ├── Max Packet Length (4 bytes)
│   └── Data Link Type (4 bytes)
└── Packet Records (variable)
    ├── Packet Header (16 bytes)
    │   ├── Timestamp Seconds (4 bytes)
    │   ├── Timestamp Microseconds (4 bytes)
    │   ├── Captured Length (4 bytes)
    │   └── Original Length (4 bytes)
    └── Packet Data (variable)

Global Header Format

struct pcap_file_header {
    uint32_t magic;        // 0xa1b2c3d4 or 0xd4c3b2a1
    uint16_t version_major; // Version major number
    uint16_t version_minor; // Version minor number
    int32_t  thiszone;     // GMT to local correction
    uint32_t sigfigs;      // Accuracy of timestamps
    uint32_t snaplen;      // Max length saved per packet
    uint32_t linktype;     // Data link type
};

Packet Record Format

struct pcap_packet_header {
    uint32_t ts_sec;       // Timestamp seconds
    uint32_t ts_usec;      // Timestamp microseconds
    uint32_t incl_len;     // Number of bytes saved
    uint32_t orig_len;     // Actual packet length
};

PCAP-NG Format

Enhanced Features

PCAP-NG (Next Generation) provides additional capabilities:

• Multiple Interfaces: Capture from multiple network interfaces
• Enhanced Metadata: Rich annotation and comment support
• Better Timestamps: Improved time resolution and accuracy
• Custom Blocks: Extensible block structure
• Name Resolution: Built-in DNS resolution data

Block Structure

PCAP-NG Blocks:
├── Section Header Block (SHB)
├── Interface Description Block (IDB)
├── Enhanced Packet Block (EPB)
├── Name Resolution Block (NRB)
├── Interface Statistics Block (ISB)
└── Custom Blocks

Data Link Types

Common Link Types

• Ethernet (1): IEEE 802.3 Ethernet
• 802.11 (105): IEEE 802.11 wireless
• Linux SLL (113): Linux cooked capture
• Raw IP (101): Raw IP packets
• PPP (9): Point-to-Point Protocol
• FDDI (10): Fiber Distributed Data Interface

Link Type Implications

# Python example showing link type handling
import dpkt

# Open PCAP file
with open('capture.pcap', 'rb') as f:
    pcap = dpkt.pcap.Reader(f)
    
    for timestamp, buf in pcap:
        if pcap.datalink() == dpkt.pcap.DLT_EN10MB:
            # Ethernet frame
            eth = dpkt.ethernet.Ethernet(buf)
            print(f"Ethernet: {eth.src} -> {eth.dst}")
            
        elif pcap.datalink() == dpkt.pcap.DLT_LINUX_SLL:
            # Linux cooked capture
            sll = dpkt.sll.SLL(buf)
            print(f"SLL packet type: {sll.type}")

Capture Tools and Software

Command-line Tools

• tcpdump: Unix/Linux packet capture utility
• dumpcap: Wireshark's capture engine
• tshark: Wireshark's command-line interface
• netsh: Windows built-in network capture

Graphical Applications

• Wireshark: Premier network protocol analyzer
• NetworkMiner: Network forensic analysis tool
• Colasoft Capsa: Commercial network analyzer
• SolarWinds NPM: Enterprise network monitoring

Programming Libraries

# Python packet capture with scapy
from scapy.all import *

# Capture packets
packets = sniff(interface="eth0", count=100)

# Save to PCAP file
wrpcap("capture.pcap", packets)

# Read PCAP file
packets = rdpcap("capture.pcap")
for packet in packets:
    print(packet.summary())

Network Analysis Applications

Traffic Analysis

# tcpdump examples
# Capture HTTP traffic
tcpdump -i eth0 -w http_traffic.pcap port 80

# Capture specific host communication
tcpdump -i eth0 -w host_traffic.pcap host 192.168.1.100

# Capture with packet content
tcpdump -i eth0 -w detailed.pcap -v -X

# Read and filter PCAP file
tcpdump -r capture.pcap 'tcp port 443'

Protocol Analysis

# Python protocol analysis with dpkt
import dpkt
import socket

def analyze_pcap(filename):
    with open(filename, 'rb') as f:
        pcap = dpkt.pcap.Reader(f)
        
        for timestamp, buf in pcap:
            eth = dpkt.ethernet.Ethernet(buf)
            
            if eth.type == dpkt.ethernet.ETH_TYPE_IP:
                ip = eth.data
                print(f"IP: {socket.inet_ntoa(ip.src)} -> {socket.inet_ntoa(ip.dst)}")
                
                if ip.p == dpkt.ip.IP_PROTO_TCP:
                    tcp = ip.data
                    print(f"  TCP: {tcp.sport} -> {tcp.dport}")
                    
                elif ip.p == dpkt.ip.IP_PROTO_UDP:
                    udp = ip.data
                    print(f"  UDP: {udp.sport} -> {udp.dport}")

analyze_pcap("network_traffic.pcap")

Security and Forensics

Malware Analysis

# Extract suspicious files from PCAP
tcpflow -r malware_traffic.pcap

# Search for specific patterns
strings suspicious.pcap | grep -i "password\|login\|admin"

# Extract HTTP objects
tshark -r traffic.pcap --export-objects http,extracted_files/

Intrusion Detection

# Python IDS signature matching
import dpkt
import re

def detect_suspicious_traffic(pcap_file):
    signatures = [
        rb'GET.*\.php\?.*union.*select',  # SQL injection
        rb'<script.*>.*</script>',        # XSS attempt
        rb'cmd\.exe',                     # Command execution
        rb'/etc/passwd',                  # File inclusion
    ]
    
    with open(pcap_file, 'rb') as f:
        pcap = dpkt.pcap.Reader(f)
        
        for timestamp, buf in pcap:
            for signature in signatures:
                if re.search(signature, buf, re.IGNORECASE):
                    print(f"Suspicious pattern detected at {timestamp}")
                    return True
    return False

Network Forensics

# Wireshark command-line analysis
# Extract email communications
tshark -r evidence.pcap -Y "smtp or pop or imap" -w email_traffic.pcap

# Extract file transfers
tshark -r evidence.pcap -Y "ftp-data" -w file_transfers.pcap

# Timeline analysis
tshark -r evidence.pcap -T fields -e frame.time -e ip.src -e ip.dst -e tcp.dstport

Performance Considerations

Capture Performance

# High-performance capture settings
# Use ring buffer to prevent packet loss
tcpdump -i eth0 -w capture.pcap -W 10 -C 100

# Capture with specific buffer size
tcpdump -i eth0 -w capture.pcap -B 4096

# Multi-threaded capture with dumpcap
dumpcap -i eth0 -w capture.pcap -b filesize:100000 -b files:10

File Size Management

# Python PCAP file splitting
import dpkt
import time

def split_pcap_by_time(input_file, interval_seconds):
    with open(input_file, 'rb') as f:
        pcap = dpkt.pcap.Reader(f)
        
        current_time = None
        file_counter = 1
        current_writer = None
        
        for timestamp, buf in pcap:
            if current_time is None:
                current_time = timestamp
                current_writer = dpkt.pcap.Writer(
                    open(f'split_{file_counter:03d}.pcap', 'wb')
                )
            
            if timestamp - current_time > interval_seconds:
                current_writer.close()
                file_counter += 1
                current_time = timestamp
                current_writer = dpkt.pcap.Writer(
                    open(f'split_{file_counter:03d}.pcap', 'wb')
                )
            
            current_writer.writepkt(buf, timestamp)
        
        if current_writer:
            current_writer.close()

# Split PCAP into 1-hour segments
split_pcap_by_time('large_capture.pcap', 3600)

Filtering and Processing

Display Filters (Wireshark)

# Protocol filters
http
tcp
udp
dns
dhcp

# IP address filters
ip.addr == 192.168.1.1
ip.src == 10.0.0.0/8
ip.dst == 172.16.0.0/12

# Port filters
tcp.port == 80
udp.port == 53
tcp.dstport == 443

# Combined filters
http and ip.addr == 192.168.1.100
tcp.port == 80 or tcp.port == 443
not broadcast and not multicast

Capture Filters (BPF)

# Berkeley Packet Filter syntax
# Capture specific host
tcpdump -i eth0 host 192.168.1.100

# Capture specific protocol
tcpdump -i eth0 tcp

# Capture specific port
tcpdump -i eth0 port 80

# Complex filters
tcpdump -i eth0 'host 192.168.1.100 and (port 80 or port 443)'
tcpdump -i eth0 'net 192.168.0.0/24 and not port 22'

Best Practices

Capture Guidelines

1. Ring Buffers: Use ring buffers for continuous capture
2. Filtering: Apply capture filters to reduce file size
3. Storage: Monitor disk space during long captures
4. Permissions: Ensure proper capture permissions

Analysis Workflow

• Initial Overview: Get general traffic statistics
• Protocol Distribution: Analyze protocol usage
• Timeline Analysis: Identify temporal patterns
• Detailed Investigation: Focus on specific flows or events

Security Considerations

• Data Sensitivity: PCAP files may contain sensitive information
• Access Control: Restrict access to capture files
• Encryption: Encrypt stored PCAP files if necessary
• Retention: Implement data retention policies

Legal and Compliance

• Authorization: Ensure proper authorization for packet capture
• Privacy Laws: Comply with applicable privacy regulations
• Chain of Custody: Maintain evidence integrity for forensics
• Documentation: Document capture procedures and analysis

PCAP files serve as the foundation for network analysis, security monitoring, and forensic investigations, providing detailed insights into network communication patterns and enabling comprehensive analysis of network behavior and security incidents.