libpcap file framing - the classic global + per-record headers, link-type agnostic. More...

#include "shared_primitives/endian.h"
#include <stddef.h>
#include <stdint.h>

Macros
#define	PC_PCAP_GLOBAL_HDR_LEN 24
	libpcap header sizes.

#define	PC_PCAP_REC_HDR_LEN 16

#define	PC_DLT_IEEE802_11 105
	Common libpcap DLT link-layer types.

#define	PC_DLT_CAN_SOCKETCAN 227
	Linux SocketCAN classic/FD frames.

#define	PC_DLT_ETHERNET 1
	IEEE 802.3 Ethernet.

#define	PC_DLT_IEEE802_15_4_NOFCS 230
	raw 802.15.4 MAC frame, no FCS

#define	PC_DLT_IEEE802_15_4_TAP 283
	802.15.4 with a TAP pseudo-header (RSSI / channel TLVs)

Functions
size_t	pc_pcap_global_header (uint8_t *out, size_t cap, uint32_t linktype)
	Write the 24-byte libpcap global header (little-endian, microsecond timestamps).

size_t	pc_pcap_record_header (uint8_t *out, size_t cap, uint32_t ts_sec, uint32_t ts_usec, uint32_t caplen, uint32_t origlen)
	Write a 16-byte libpcap record header for one captured frame.

Detailed Description

libpcap file framing - the classic global + per-record headers, link-type agnostic.

One owner for the PCAP framing shared by every capture feature (Wi-Fi promiscuous capture, CAN / bus listen-only capture, ...): each writes its frames with the matching DLT link type so the forwarded stream is a valid .pcap a wired Wireshark / tcpdump opens directly. Header-only and pure (little-endian byte writes, no heap, no stdlib), host-identical.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file pcap.h.

Macro Definition Documentation

◆ PC_PCAP_GLOBAL_HDR_LEN

#define PC_PCAP_GLOBAL_HDR_LEN 24

libpcap header sizes.

Definition at line 25 of file pcap.h.

◆ PC_PCAP_REC_HDR_LEN

#define PC_PCAP_REC_HDR_LEN 16

Definition at line 26 of file pcap.h.

◆ PC_DLT_IEEE802_11

#define PC_DLT_IEEE802_11 105

Common libpcap DLT link-layer types.

raw 802.11 (Wi-Fi promiscuous capture)

Definition at line 29 of file pcap.h.

◆ PC_DLT_CAN_SOCKETCAN

#define PC_DLT_CAN_SOCKETCAN 227

Linux SocketCAN classic/FD frames.

Definition at line 30 of file pcap.h.

◆ PC_DLT_ETHERNET

#define PC_DLT_ETHERNET 1

IEEE 802.3 Ethernet.

Definition at line 31 of file pcap.h.

◆ PC_DLT_IEEE802_15_4_NOFCS

#define PC_DLT_IEEE802_15_4_NOFCS 230

raw 802.15.4 MAC frame, no FCS

Definition at line 32 of file pcap.h.

◆ PC_DLT_IEEE802_15_4_TAP

#define PC_DLT_IEEE802_15_4_TAP 283

802.15.4 with a TAP pseudo-header (RSSI / channel TLVs)

Definition at line 33 of file pcap.h.

Function Documentation

◆ pc_pcap_global_header()

size_t pc_pcap_global_header	(	uint8_t *	out,
		size_t	cap,
		uint32_t	linktype
	)

inline

Write the 24-byte libpcap global header (little-endian, microsecond timestamps).

Parameters

linktype the DLT_* link type of the frames that follow (e.g. PC_DLT_IEEE802_11).

Returns: PC_PCAP_GLOBAL_HDR_LEN, or 0 if cap is too small.

Definition at line 40 of file pcap.h.

References PC_PCAP_GLOBAL_HDR_LEN, pc_wr16le(), and pc_wr32le().

◆ pc_pcap_record_header()

size_t pc_pcap_record_header	(	uint8_t *	out,
		size_t	cap,
		uint32_t	ts_sec,
		uint32_t	ts_usec,
		uint32_t	caplen,
		uint32_t	origlen
	)