编辑“︁PCAP文件修复”︁（章节）

== PCAP文件结构 ==

一般来说,对于 <code>PCAP</code> 文件格式考察较少，且通常都能借助于现成的工具如 <code>pcapfix</code> 直接修复，这里大致介绍下几个常见的块，详细可以翻看[http://www.tcpdump.org/pcap/pcap.html Here]。

* Tools
** [https://f00l.de/hacking/pcapfix.php PcapFix Online]
** [https://github.com/Rup0rt/pcapfix/tree/devel PcapFix]

一般文件结构

<syntaxhighlight lang="shell">    0                   1                   2                   3   
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                          Block Type                           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      Block Total Length                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   /                          Block Body                           /
   /          /* variable length, aligned to 32 bits */            /
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      Block Total Length                       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+</syntaxhighlight>
目前所定义的常见块类型有

# Section Header Block: it defines the most important characteristics of the capture file.
# Interface Description Block: it defines the most important characteristics of the interface(s) used for capturing traffic.
# Packet Block: it contains a single captured packet, or a portion of it.
# Simple Packet Block: it contains a single captured packet, or a portion of it, with only a minimal set of information about it.
# Name Resolution Block: it defines the mapping from numeric addresses present in the packet dump and the canonical name counterpart.
# Capture Statistics Block: it defines how to store some statistical data (e.g. packet dropped, etc) which can be useful to undestand the conditions in which the capture has been made.