libpcap file framing - the classic global + per-record headers, link-type agnostic. More...

#include <stddef.h>
#include <stdint.h>

Namespaces
namespace	detpcap_detail

Macros
#define	DET_PCAP_GLOBAL_HDR_LEN 24
	libpcap header sizes.

#define	DET_PCAP_REC_HDR_LEN 16

#define	DET_DLT_IEEE802_11 105
	Common libpcap DLT link-layer types.

#define	DET_DLT_CAN_SOCKETCAN 227
	Linux SocketCAN classic/FD frames.

#define	DET_DLT_ETHERNET 1
	IEEE 802.3 Ethernet.

#define	DET_DLT_IEEE802_15_4_NOFCS 230
	raw 802.15.4 MAC frame, no FCS

#define	DET_DLT_IEEE802_15_4_TAP 283
	802.15.4 with a TAP pseudo-header (RSSI / channel TLVs)

Functions
void	detpcap_detail::wr32le (uint8_t *p, uint32_t v)

void	detpcap_detail::wr16le (uint8_t *p, uint16_t v)

size_t	det_pcap_global_header (uint8_t *out, size_t cap, uint32_t linktype)
	Write the 24-byte libpcap global header (little-endian, microsecond timestamps).

size_t	det_pcap_record_header (uint8_t *out, size_t cap, uint32_t ts_sec, uint32_t ts_usec, uint32_t caplen, uint32_t origlen)
	Write a 16-byte libpcap record header for one captured frame.

Detailed Description

libpcap file framing - the classic global + per-record headers, link-type agnostic.

One owner for the PCAP framing shared by every capture feature (Wi-Fi promiscuous capture, CAN / bus listen-only capture, ...): each writes its frames with the matching DLT link type so the forwarded stream is a valid .pcap a wired Wireshark / tcpdump opens directly. Header-only and pure (little-endian byte writes, no heap, no stdlib), host-identical.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file pcap.h.

Macro Definition Documentation

◆ DET_PCAP_GLOBAL_HDR_LEN

#define DET_PCAP_GLOBAL_HDR_LEN 24

libpcap header sizes.

Definition at line 24 of file pcap.h.

◆ DET_PCAP_REC_HDR_LEN

#define DET_PCAP_REC_HDR_LEN 16

Definition at line 25 of file pcap.h.

◆ DET_DLT_IEEE802_11

#define DET_DLT_IEEE802_11 105

Common libpcap DLT link-layer types.

raw 802.11 (Wi-Fi promiscuous capture)

Definition at line 28 of file pcap.h.

◆ DET_DLT_CAN_SOCKETCAN

#define DET_DLT_CAN_SOCKETCAN 227

Linux SocketCAN classic/FD frames.

Definition at line 29 of file pcap.h.

◆ DET_DLT_ETHERNET

#define DET_DLT_ETHERNET 1

IEEE 802.3 Ethernet.

Definition at line 30 of file pcap.h.

◆ DET_DLT_IEEE802_15_4_NOFCS

#define DET_DLT_IEEE802_15_4_NOFCS 230

raw 802.15.4 MAC frame, no FCS

Definition at line 31 of file pcap.h.

◆ DET_DLT_IEEE802_15_4_TAP

#define DET_DLT_IEEE802_15_4_TAP 283

802.15.4 with a TAP pseudo-header (RSSI / channel TLVs)

Definition at line 32 of file pcap.h.

Function Documentation

◆ det_pcap_global_header()

size_t det_pcap_global_header	(	uint8_t *	out,
		size_t	cap,
		uint32_t	linktype
	)

inline

Write the 24-byte libpcap global header (little-endian, microsecond timestamps).

Parameters

linktype the DLT_* link type of the frames that follow (e.g. DET_DLT_IEEE802_11).

Returns: DET_PCAP_GLOBAL_HDR_LEN, or 0 if cap is too small.

Definition at line 55 of file pcap.h.

References DET_PCAP_GLOBAL_HDR_LEN, detpcap_detail::wr16le(), and detpcap_detail::wr32le().

◆ det_pcap_record_header()

size_t det_pcap_record_header	(	uint8_t *	out,
		size_t	cap,
		uint32_t	ts_sec,
		uint32_t	ts_usec,
		uint32_t	caplen,
		uint32_t	origlen
	)

inline

Write a 16-byte libpcap record header for one captured frame.

Returns: DET_PCAP_REC_HDR_LEN, or 0 if cap is too small.

Definition at line 73 of file pcap.h.

References DET_PCAP_REC_HDR_LEN, and detpcap_detail::wr32le().

Namespaces

Macros

Functions