Wireshark · Display Filter Reference: PCAPNG File Format

Field name	Description	Type	Versions
pcapng.block	Block	Label	2.0.0 to 4.4.2
pcapng.block.data	Block Data	Label	2.0.0 to 4.4.2
pcapng.block.length	Block Length	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.block.length_trailer	Block Length (trailer)	Unsigned integer (32 bits)	3.6.0 to 4.4.2
pcapng.block.type	Block Type	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.block.type.value	Block Type Value	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.block.type.vendor	Block Type Vendor	Boolean	2.0.0 to 4.4.2
pcapng.block_length_below_block_content_length	Block length is < the length of the contents of the block	Label	3.6.0 to 4.4.2
pcapng.block_length_below_block_minimum	Block length is < 12 bytes	Label	3.6.0 to 4.4.2
pcapng.block_length_not_multiple_of4	Block length is not a multiple of 4	Label	3.2.15 to 3.2.18, 3.4.7 to 4.4.2
pcapng.block_length_too_short	Block length is < 12 bytes	Label	2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 3.4.16
pcapng.block_lengths_dont_match	Block length in trailer differs from block length in header	Label	3.6.0 to 4.4.2
pcapng.cb.custom_data	Custom Data	Byte sequence	4.2.0 to 4.4.2
pcapng.cb.custom_option.data	Custom Option Binary	Byte sequence	4.2.0 to 4.4.2
pcapng.cb.custom_option.string	Custom Option String	Character string	4.2.0 to 4.4.2
pcapng.cb.pen	Private Enterprise Number (PEN)	Unsigned integer (32 bits)	4.2.0 to 4.4.2
pcapng.darwin.process_id	Darwin Process ID	Unsigned integer (32 bits)	2.4.0 to 4.0.17
pcapng.darwin.process_name	Darwin Process Name	Character string	2.4.0 to 4.0.17
pcapng.darwin.process_uuid	Darwin Process UUID	Globally Unique Identifier	2.4.0 to 4.0.17
pcapng.dsb.secrets_data	Secrets Data	Byte sequence	3.0.0 to 4.4.2
pcapng.dsb.secrets_length	Secrets Length	Unsigned integer (32 bits)	3.0.0 to 4.4.2
pcapng.dsb.secrets_type	Secrets Type	Unsigned integer (32 bits)	3.0.0 to 4.4.2
pcapng.interface_description.link_type	Link Type	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.interface_description.reserved	Reserved	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.interface_description.snap_length	Snap Length	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.interface_id	Interface	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.invalid_byte_order_magic	The byte-order magic number is not valid	Label	2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.4.2
pcapng.invalid_option_length	Invalid Option Length	Label	2.0.0 to 4.4.2
pcapng.invalid_record_length	Invalid Record Length	Label	2.0.0 to 4.4.2
pcapng.no_interfaces	No Interface Description before block that requires it	Label	2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.4.2
pcapng.options	Options	Label	2.0.0 to 4.4.2
pcapng.options.option	Option	Label	2.0.0 to 4.4.2
pcapng.options.option.code	Code	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.data	Option Data	Label	2.0.0 to 4.4.2
pcapng.options.option.data.comment	Comment	Character string	2.0.0 to 4.4.2
pcapng.options.option.data.dns_name	DNS Name	Character string	2.0.0 to 4.4.2
pcapng.options.option.data.end_time	End Time	Label	2.0.0 to 4.4.2
pcapng.options.option.data.eui	EUI Address	EUI64 address	2.0.0 to 4.4.2
pcapng.options.option.data.hardware	Hardware	Character string	2.0.0 to 4.4.2
pcapng.options.option.data.interface.accepted_by_filter	Number of Accepted by Filter Packets	Unsigned integer (64 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.delivered_to_user	Number of Delivered to the User Packets	Unsigned integer (64 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.description	Description	Character string	2.0.0 to 4.4.2
pcapng.options.option.data.interface.dropped	Number of Dropped Packets	Unsigned integer (64 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.dropped_by_os	Number of Dropped Packets by OS	Unsigned integer (64 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.fcs_length	FCS Length	Unsigned integer (8 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.filter	Filter	Character string	2.0.0 to 3.4.16
pcapng.options.option.data.interface.filter.bpf_program	Filter BPF program	Label	3.6.0 to 4.4.2
pcapng.options.option.data.interface.filter.string	Filter string	Character string	3.6.0 to 4.4.2
pcapng.options.option.data.interface.filter.type	Filter type	Unsigned integer (8 bits)	3.6.0 to 4.4.2
pcapng.options.option.data.interface.filter.unknown	Filter data	Label	3.6.0 to 4.4.2
pcapng.options.option.data.interface.hardware	Hardware	Character string	2.6.17 to 2.6.20, 3.0.11 to 3.0.14, 3.2.4 to 4.4.2
pcapng.options.option.data.interface.name	Name	Character string	2.0.0 to 4.4.2
pcapng.options.option.data.interface.os	OS	Character string	2.0.0 to 4.4.2
pcapng.options.option.data.interface.received	Number of Received Packets	Unsigned integer (64 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.speed	Speed	Unsigned integer (64 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.timestamp_offset	Timestamp Offset	Unsigned integer (64 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.timestamp_resolution	Timestamp Resolution	Unsigned integer (8 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.timestamp_resolution.base	Base	Unsigned integer (8 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.timestamp_resolution.value	Value	Unsigned integer (8 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.interface.timezone	Timezone	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.ipv4	IPv4	IPv4 address	2.0.0 to 4.4.2
pcapng.options.option.data.ipv4_mask	IPv4 Mask	IPv4 address	2.0.0 to 4.4.2
pcapng.options.option.data.ipv6	IPv6	IPv6 address	2.2.0 to 4.4.2
pcapng.options.option.data.ipv6_mask	IPv6 Mask	Unsigned integer (8 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.mac	MAC Address	Ethernet or other MAC address	2.0.0 to 4.4.2
pcapng.options.option.data.os	OS	Character string	2.0.0 to 4.4.2
pcapng.options.option.data.packet.darwin.dpeb_id	DPEB ID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.edpeb_id	Effective DPED ID	Unsigned integer (32 bits)	2.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flags	Darwin Flags	Unsigned integer (32 bits)	3.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flags.ch	Nexus Channel(ch)	Boolean	3.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flags.ka	Keep Alive(ka)	Boolean	3.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flags.nf	New Flow(nf)	Boolean	3.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flags.re	ReXmit(re)	Boolean	3.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flags.reserved	Reserved	Boolean	3.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flags.so	Socket(so)	Boolean	3.4.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flags.wk	Wake Packet(wk)	Boolean	4.2.0 to 4.4.2
pcapng.options.option.data.packet.darwin.flow_id	Flow ID	Unsigned integer (32 bits)	4.2.0 to 4.4.2
pcapng.options.option.data.packet.darwin.svc_class	Darwin svc	Unsigned integer (32 bits)	2.4.0 to 4.4.2
pcapng.options.option.data.packet.drop_count	Drop Count	Unsigned integer (64 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags	Flags	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.direction	Direction	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.fcs_length	FCS Length	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors	Link Layer Errors	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.crc	CRC Error	Boolean	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.packet_too_long	Packet Too Long	Boolean	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.packet_too_short	Packet Too Short	Boolean	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.preamble	Preamble Error	Boolean	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.reserved	Reserved	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.start_frame_delimiter	Start Frame Delimiter Error	Boolean	2.0.15 to 2.0.16, 2.2.9 to 2.2.17, 2.4.1 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.symbol	Symbol Error	Boolean	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.unaligned_frame	Unaligned Frame Error	Boolean	2.0.15 to 2.0.16, 2.2.9 to 2.2.17, 2.4.1 to 4.4.2
pcapng.options.option.data.packet.flags.link_layer_errors.wrong_inter_frame_gap	Wrong Inter Frame Gap	Boolean	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.reception_type	Reception Type	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.flags.reserved	Reserved	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.hash.algorithm	Hash Algorithm	Unsigned integer (8 bits)	2.0.0 to 4.4.2
pcapng.options.option.data.packet.hash.data	Hash Data	Byte sequence	2.0.0 to 4.4.2
pcapng.options.option.data.packet.id	Packet ID	Unsigned integer (64 bits)	3.4.3 to 4.4.2
pcapng.options.option.data.packet.queue	Queue	Unsigned integer (32 bits)	3.4.3 to 4.4.2
pcapng.options.option.data.packet.verdict.data	Verdict data	Byte sequence	3.4.3 to 4.4.2
pcapng.options.option.data.packet.verdict.type	Verdict type	Unsigned integer (8 bits)	3.4.3 to 4.4.2
pcapng.options.option.data.start_time	Start Time	Label	2.0.0 to 4.4.2
pcapng.options.option.data.user_application	User Application	Character string	2.0.0 to 4.4.2
pcapng.options.option.length	Length	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.options.option.padding	Option Padding	Label	2.0.0 to 4.4.2
pcapng.packet.captured_length	Captured Packet Length	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.packet.drops_count	Drops Count	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.packet.interface_id	Interface	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.packet.original_length	Original Packet Length	Unsigned integer (32 bits)	4.2.0 to 4.4.2
pcapng.packet.packet_data	Packet Data	Label	2.0.0 to 4.4.2
pcapng.packet.packet_length	Packet Length	Unsigned integer (16 bits)	2.0.0 to 4.0.17
pcapng.packet.padding	Packet Padding	Label	2.0.0 to 4.4.2
pcapng.records	Records	Label	2.0.0 to 4.4.2
pcapng.records.record	Record	Label	2.0.0 to 4.4.2
pcapng.records.record.code	Code	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.records.record.data	Record Data	Label	2.0.0 to 4.4.2
pcapng.records.record.data.ipv4	IPv4	IPv4 address	2.0.0 to 4.4.2
pcapng.records.record.data.ipv6	IPv6	IPv6 address	2.0.0 to 4.4.2
pcapng.records.record.data.name	Name	Character string	2.0.0 to 4.4.2
pcapng.records.record.length	Length	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.records.record.padding	Record Padding	Label	2.0.0 to 4.4.2
pcapng.section_header.byte_order_magic	Byte Order Magic	Byte sequence	2.0.0 to 4.4.2
pcapng.section_header.section_length	Section Length	Signed integer (64 bits)	2.0.0 to 4.4.2
pcapng.section_header.version.major	Major Version	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.section_header.version.minor	Minor Version	Unsigned integer (16 bits)	2.0.0 to 4.4.2
pcapng.timestamp	Timestamp	Date and time	2.0.0 to 4.4.2
pcapng.timestamp_high	Timestamp (High)	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.timestamp_low	Timestamp (Low)	Unsigned integer (32 bits)	2.0.0 to 4.4.2
pcapng.unknown_encoding	Expert Info	Label	2.0.0 to 2.0.1