Main Page Modules Data Structures File List Data Fields Globals Related Pages

# pcap_file_header Struct Reference
[Definitions]

Header of a libpcap dump file. More...

`#include <pcap.h>`

## Data Fields
bpf_u_int32 | magic
u_short | version_major
| Libpcap major version.
u_short | version_minor
| Libpcap minor version.
bpf_int32 | thiszone
| gmt to local correction
bpf_u_int32 | sigfigs
| accuracy of timestamps
bpf_u_int32 | snaplen
| max length saved portion of each pkt
bpf_u_int32 | linktype
| data link type (LINKTYPE_*)

## Detailed Description

Header of a libpcap dump file.

The first record in the file contains saved values for some of the flags used in the printout phases of tcpdump. Many fields here are 32 bit ints so compilers won't insert unwanted padding; these files need to be interchangeable across architectures.

Do not change the layout of this structure, in any way (this includes changes that only affect the length of fields in this structure).

Also, do not change the interpretation of any of the members of this structure, in any way (this includes using values other than LINKTYPE_ values, as defined in "savefile.c", in the "linktype" field).

Instead:

introduce a new structure for the new format, if the layout of the structure changed;

send mail to "tcpdump-workers.org", requesting a new magic number for your new capture file format, and, when you get the new magic number, put it in "savefile.c";

use that magic number for save files with the changed file header;

make the code in "savefile.c" capable of reading files with the old file header as well as files with the new file header (using the magic number to determine the header format).

Then supply the changes to "patches.org", so that future versions of libpcap and programs that use it (such as tcpdump) will be able to read your new capture file format.

Definition at line 110 of file incs/pcap.h.

## Field Documentation

bpf_u_int32 linktype

| data link type (LINKTYPE_*) Definition at line 117 of file incs/pcap.h. Referenced by sf_write_header(), and swap_hdr().

bpf_u_int32 magic

| Definition at line 111 of file incs/pcap.h. Referenced by sf_write_header().

bpf_u_int32 sigfigs

| accuracy of timestamps Definition at line 115 of file incs/pcap.h. Referenced by sf_write_header(), and swap_hdr().

bpf_u_int32 snaplen

| max length saved portion of each pkt Definition at line 116 of file incs/pcap.h. Referenced by sf_write_header(), and swap_hdr().

bpf_int32 thiszone

| gmt to local correction Definition at line 114 of file incs/pcap.h. Referenced by sf_write_header(), and swap_hdr().

u_short version_major

| Libpcap major version. Definition at line 112 of file incs/pcap.h. Referenced by sf_write_header(), and swap_hdr().

u_short version_minor

| Libpcap minor version. Definition at line 113 of file incs/pcap.h. Referenced by sf_write_header(), and swap_hdr().

The documentation for this struct was generated from the following file:

- incs/pcap.h

documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.