Question

I have a “.pcapng” binary file, created by Wireshark.

How to detect the beginning of every new package in it?

Is there any specific bytes sequence?

Alternatively, how to detect the end of a package?

Answer 1

(I’ve seen people whose native language isn’t English speak of “packages” rather than “packets” – both words come from the same word “pack”, and the same word may be used for both concepts in other languages – so I’m assuming you’re referring to network packets; “packages” is generally not used in that sense in English.)

The pcap-NG file format is described in the PCAP Next Generation Dump File Format document. A pcap-NG file is a sequence of blocks; each block has a length field at the beginning (and at the end, to simplify scanning backwards through a file). Not all blocks contain packets; the blocks that do are the Packet Block, Extended Packet Block, and Simple Packet Block.

Note that libpcap 1.1 and later can read pcap-NG files, so any program that uses libpcap to read capture files can, if dynamically liked with libpcap and running on a system where the libpcap shared library is 1.1 or later, or statically linked with libpcap 1.1 or later, can read some pcap-NG files using the same APIs that are used to read pcap files, without any change to the program. (pcap-NG files containing multiple interfaces where not all of them have the same link-layer header type or snapshot length cannot be read, as the current libpcap APIs don’t support that.) There is no version of WinPcap based on libpcap 1.1 or later, so WinPcap cannot currently be used to read pcap-NG files.

Another library that can read pcap-NG files is the NTAR library. It, however, can only read pcap-NG files, not pcap files.