RFC 1761
Snoop Version 2 Packet Capture File Format
RFC 1761: Snoop Version 2 Packet Capture File Format 🎀
Network Working Group 🌸 It's an Informational RFC, so it's sharing info, not setting a standard. 💅
Authors: Brent Callaghan and Robert E. Gilligan, both from Sun Microsystems, Inc. 🧚
Date: February 1995 📅
Obsoletes / Updates: The title block doesn't list anything this RFC obsoletes or updates. 🦋
Status of this Memo
This memo gives information to the Internet community. 🌈 It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. ✨
Abstract
Okay so this paper explains the file format that "snoop" uses. Snoop is a packet monitoring and capture program that Sun made. 💜 The whole point is that other people can write their own programs that can make snoop capture files, or read them. 🫶
1. Introduction ✨
Okay bestie, being able to capture packets on a network and analyse them is literally a lifesaver when you're debugging networking problems. 😭 Capturing and storing packets means you can split up the job: collect the data about a network problem now, and figure it out later. 🧠
Sun's snoop program can capture packets, save them to a file, and read back the packets stored in those files. 🔥 This RFC is the file format snoop uses, so anyone can write a program that reads snoop files or makes files snoop can read. It's giving interoperability, periodt. 💅
2. File Format 🎀
A snoop packet capture file is an array of octets laid out like this:
+------------------------+
| |
| File Header |
| |
+------------------------+
| |
| Packet Record |
~ Number 1 ~
| |
+------------------------+
. .
. .
. .
+------------------------+
| |
| Packet Record |
~ Number N ~
| |
+------------------------+So you've got one File Header up front, which is a fixed-length field with general info about the file and the format of the packet records inside it. ✨ After that come one or more variable-length Packet Record fields, and each one holds the data for one captured packet. 💖
3. File Header 🌸
The File Header is laid out like this:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
+ Identification Pattern +
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version Number = 2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Datalink Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Identification Pattern 🔥
This is a 64-bit (8 octet) pattern that identifies the file as a snoop packet capture file. ✨ It's the 8 hexadecimal octets 73 6E 6F 6F 70 00 00 00. 🧚 In ASCII that spells "snoop" followed by three null octets. 🌈
Version Number 💜
This is a 32-bit (4 octet) unsigned integer that tells you which version of the packet capture file you're dealing with. 🦋 This document covers version number 2. Version number 1 was used in early implementations and is now obsolete, so no cap, skip it. 💀
Datalink Type 🍓
This is a 32-bit (4 octet) field that says what kind of datalink header is used in the packet records that follow. 👑 The codes are in this table:
Datalink Type Code
------------- ----
IEEE 802.3 0
IEEE 802.4 Token Bus 1
IEEE 802.5 Token Ring 2
IEEE 802.6 Metro Net 3
Ethernet 4
HDLC 5
Character Synchronous 6
IBM Channel-to-Channel 7
FDDI 8
Other 9
Unassigned 10 - 42949672954. Packet Record Format 💅
Each packet record holds a partial or complete copy of one packet, plus some descriptive info about it. 🫶 The packet can be truncated to limit how much data gets stored in the file. 🎀 The record can also be padded so it lines up on a convenient machine-dependent boundary. ✨
Each packet record has 24 octets of descriptive info, then the packet data (which is variable-length), then an optional pad field. 🌸 That descriptive info is six 32-bit (4-octet) integer values. 🔥
The packet record is laid out like this:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Original Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Included Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Packet Record Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Cumulative Drops |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Timestamp Seconds |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Timestamp Microseconds |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| |
. .
. Packet Data .
. .
+ +- - - - - - - -+
| | Pad |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Original Length 🦋
This is a 32-bit unsigned integer for the length, in octets, of the captured packet as it was received over the network. 🌈
Included Length 💖
This is a 32-bit unsigned integer for the length of the Packet Data field. 🧚 It's the number of octets from the captured packet that are actually in this record. If the received packet got truncated, Included Length will be less than Original Length. ✂️
Packet Record Length 🍓
This is a 32-bit unsigned integer for the total length of this packet record, in octets. 💜 It counts the 24 octets of descriptive info, plus the length of the Packet Data field, plus the length of the Pad field. 🔥
Cumulative Drops 👑
This is a 32-bit unsigned integer for the number of packets that the system which made the packet file lost between the first packet record in the file and this one. 💀 Packets can get lost because the capturing system ran out of resources, or for other reasons. 🙈
Note: some implementations can't count dropped packets. Those implementations may set the cumulative drops value to zero. 🫶
Timestamp Seconds ⭐
This is a 32-bit unsigned integer for the time, in seconds since January 1, 1970, when the packet arrived. 🕰️
Timestamp Microseconds ✨
This is a 32-bit unsigned integer that gives the arrival time at microsecond resolution. 🌸
Packet Data 🎀
This is a variable-length field holding the packet that got captured, starting with its datalink header. 💅 The Datalink Type field in the file header tells you how to decode that datalink header. 🧠 The length of the Packet Data field is given in Included Length. 🦋
Pad 🌈
This is a variable-length field holding zero or more octets. It pads the packet record out to a convenient boundary. 🧸
5. Data Format 💖
All integer values are stored in "big-endian" order, with the high-order bits first. 🔥 So the big end comes first, bestie. 💜
6. Security Considerations 💀
Security issues are not discussed in this memo. 🙈 Yes, that means this RFC says nothing about security, so keep that in mind before you build anything on it. 🔒
Authors' Addresses 🧚
Brent Callaghan Sun Microsystems, Inc. 2550 Garcia Avenue Mailstop UMTV05-44 Mountain View, CA 94043-1100
Phone: 1-415-336-1051 EMail: brent.callaghan@eng.sun.com
Robert E. Gilligan Sun Microsystems, Inc. 2550 Garcia Avenue Mailstop UMTV05-44 Mountain View, CA 94043-1100
Phone: 1-415-336-1012 EMail: bob.gilligan@eng.sun.com 🫶
📦 where this page comes from
- ietf: rfc1761 1995-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms