| blob | 47f5798bd6e54a4a6f775467168c8ed277e2c4d2 |
2 #------------------------------------------------------------------------------
3 # $File: sniffer,v 1.18 2011/08/08 08:49:27 christos Exp $
4 # sniffer: file(1) magic for packet capture files
5 #
6 # From: guy@alum.mit.edu (Guy Harris)
7 #
9 #
10 # Microsoft Network Monitor 1.x capture files.
11 #
12 0 string RTSS NetMon capture file
13 >5 byte x - version %d
14 >4 byte x \b.%d
15 >6 leshort 0 (Unknown)
16 >6 leshort 1 (Ethernet)
17 >6 leshort 2 (Token Ring)
18 >6 leshort 3 (FDDI)
19 >6 leshort 4 (ATM)
21 #
22 # Microsoft Network Monitor 2.x capture files.
23 #
24 0 string GMBU NetMon capture file
25 >5 byte x - version %d
26 >4 byte x \b.%d
27 >6 leshort 0 (Unknown)
28 >6 leshort 1 (Ethernet)
29 >6 leshort 2 (Token Ring)
30 >6 leshort 3 (FDDI)
31 >6 leshort 4 (ATM)
33 #
34 # Network General Sniffer capture files.
35 # Sorry, make that "Network Associates Sniffer capture files."
36 # Sorry, make that "Network General old DOS Sniffer capture files."
37 #
38 0 string TRSNIFF\ data\ \ \ \ \032 Sniffer capture file
39 >33 byte 2 (compressed)
40 >23 leshort x - version %d
41 >25 leshort x \b.%d
42 >32 byte 0 (Token Ring)
43 >32 byte 1 (Ethernet)
44 >32 byte 2 (ARCNET)
45 >32 byte 3 (StarLAN)
46 >32 byte 4 (PC Network broadband)
47 >32 byte 5 (LocalTalk)
48 >32 byte 6 (Znet)
49 >32 byte 7 (Internetwork Analyzer)
50 >32 byte 9 (FDDI)
51 >32 byte 10 (ATM)
53 #
54 # Cinco Networks NetXRay capture files.
55 # Sorry, make that "Network General Sniffer Basic capture files."
56 # Sorry, make that "Network Associates Sniffer Basic capture files."
57 # Sorry, make that "Network Associates Sniffer Basic, and Windows
58 # Sniffer Pro", capture files."
59 # Sorry, make that "Network General Sniffer capture files."
60 #
61 0 string XCP\0 NetXRay capture file
62 >4 string >\0 - version %s
63 >44 leshort 0 (Ethernet)
64 >44 leshort 1 (Token Ring)
65 >44 leshort 2 (FDDI)
66 >44 leshort 3 (WAN)
67 >44 leshort 8 (ATM)
68 >44 leshort 9 (802.11)
70 #
71 # "libpcap" capture files.
72 # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
73 # the main program that uses that format, but there are other programs
74 # that use "libpcap", or that use the same capture file format.)
75 #
76 0 ubelong 0xa1b2c3d4 tcpdump capture file (big-endian)
77 !:mime application/vnd.tcpdump.pcap
78 >4 beshort x - version %d
79 >6 beshort x \b.%d
80 >20 belong 0 (No link-layer encapsulation
81 >20 belong 1 (Ethernet
82 >20 belong 2 (3Mb Ethernet
83 >20 belong 3 (AX.25
84 >20 belong 4 (ProNET
85 >20 belong 5 (CHAOS
86 >20 belong 6 (Token Ring
87 >20 belong 7 (BSD ARCNET
88 >20 belong 8 (SLIP
89 >20 belong 9 (PPP
90 >20 belong 10 (FDDI
91 >20 belong 11 (RFC 1483 ATM
92 >20 belong 12 (raw IP
93 >20 belong 13 (BSD/OS SLIP
94 >20 belong 14 (BSD/OS PPP
95 >20 belong 19 (Linux ATM Classical IP
96 >20 belong 50 (PPP or Cisco HDLC
97 >20 belong 51 (PPP-over-Ethernet
98 >20 belong 99 (Symantec Enterprise Firewall
99 >20 belong 100 (RFC 1483 ATM
100 >20 belong 101 (raw IP
101 >20 belong 102 (BSD/OS SLIP
102 >20 belong 103 (BSD/OS PPP
103 >20 belong 104 (BSD/OS Cisco HDLC
104 >20 belong 105 (802.11
105 >20 belong 106 (Linux Classical IP over ATM
106 >20 belong 107 (Frame Relay
107 >20 belong 108 (OpenBSD loopback
108 >20 belong 109 (OpenBSD IPsec encrypted
109 >20 belong 112 (Cisco HDLC
110 >20 belong 113 (Linux "cooked"
111 >20 belong 114 (LocalTalk
112 >20 belong 117 (OpenBSD PFLOG
113 >20 belong 119 (802.11 with Prism header
114 >20 belong 122 (RFC 2625 IP over Fibre Channel
115 >20 belong 123 (SunATM
116 >20 belong 127 (802.11 with radiotap header
117 >20 belong 129 (Linux ARCNET
118 >20 belong 138 (Apple IP over IEEE 1394
119 >20 belong 140 (MTP2
120 >20 belong 141 (MTP3
121 >20 belong 143 (DOCSIS
122 >20 belong 144 (IrDA
123 >20 belong 147 (Private use 0
124 >20 belong 148 (Private use 1
125 >20 belong 149 (Private use 2
126 >20 belong 150 (Private use 3
127 >20 belong 151 (Private use 4
128 >20 belong 152 (Private use 5
129 >20 belong 153 (Private use 6
130 >20 belong 154 (Private use 7
131 >20 belong 155 (Private use 8
132 >20 belong 156 (Private use 9
133 >20 belong 157 (Private use 10
134 >20 belong 158 (Private use 11
135 >20 belong 159 (Private use 12
136 >20 belong 160 (Private use 13
137 >20 belong 161 (Private use 14
138 >20 belong 162 (Private use 15
139 >20 belong 163 (802.11 with AVS header
140 >16 belong x \b, capture length %d)
141 0 ulelong 0xa1b2c3d4 tcpdump capture file (little-endian)
142 !:mime application/vnd.tcpdump.pcap
143 >4 leshort x - version %d
144 >6 leshort x \b.%d
145 >20 lelong 0 (No link-layer encapsulation
146 >20 lelong 1 (Ethernet
147 >20 lelong 2 (3Mb Ethernet
148 >20 lelong 3 (AX.25
149 >20 lelong 4 (ProNET
150 >20 lelong 5 (CHAOS
151 >20 lelong 6 (Token Ring
152 >20 lelong 7 (ARCNET
153 >20 lelong 8 (SLIP
154 >20 lelong 9 (PPP
155 >20 lelong 10 (FDDI
156 >20 lelong 11 (RFC 1483 ATM
157 >20 lelong 12 (raw IP
158 >20 lelong 13 (BSD/OS SLIP
159 >20 lelong 14 (BSD/OS PPP
160 >20 lelong 19 (Linux ATM Classical IP
161 >20 lelong 50 (PPP or Cisco HDLC
162 >20 lelong 51 (PPP-over-Ethernet
163 >20 lelong 99 (Symantec Enterprise Firewall
164 >20 lelong 100 (RFC 1483 ATM
165 >20 lelong 101 (raw IP
166 >20 lelong 102 (BSD/OS SLIP
167 >20 lelong 103 (BSD/OS PPP
168 >20 lelong 104 (BSD/OS Cisco HDLC
169 >20 lelong 105 (802.11
170 >20 lelong 106 (Linux Classical IP over ATM
171 >20 lelong 107 (Frame Relay
172 >20 lelong 108 (OpenBSD loopback
173 >20 lelong 109 (OpenBSD IPsec encrypted
174 >20 lelong 112 (Cisco HDLC
175 >20 lelong 113 (Linux "cooked"
176 >20 lelong 114 (LocalTalk
177 >20 lelong 117 (OpenBSD PFLOG
178 >20 lelong 119 (802.11 with Prism header
179 >20 lelong 122 (RFC 2625 IP over Fibre Channel
180 >20 lelong 123 (SunATM
181 >20 lelong 127 (802.11 with radiotap header
182 >20 lelong 129 (Linux ARCNET
183 >20 lelong 138 (Apple IP over IEEE 1394
184 >20 lelong 140 (MTP2
185 >20 lelong 141 (MTP3
186 >20 lelong 143 (DOCSIS
187 >20 lelong 144 (IrDA
188 >20 lelong 147 (Private use 0
189 >20 lelong 148 (Private use 1
190 >20 lelong 149 (Private use 2
191 >20 lelong 150 (Private use 3
192 >20 lelong 151 (Private use 4
193 >20 lelong 152 (Private use 5
194 >20 lelong 153 (Private use 6
195 >20 lelong 154 (Private use 7
196 >20 lelong 155 (Private use 8
197 >20 lelong 156 (Private use 9
198 >20 lelong 157 (Private use 10
199 >20 lelong 158 (Private use 11
200 >20 lelong 159 (Private use 12
201 >20 lelong 160 (Private use 13
202 >20 lelong 161 (Private use 14
203 >20 lelong 162 (Private use 15
204 >20 lelong 163 (802.11 with AVS header
205 >16 lelong x \b, capture length %d)
207 #
208 # "libpcap"-with-Alexey-Kuznetsov's-patches capture files.
209 # (We call them "tcpdump capture file(s)" for now, as "tcpdump" is
210 # the main program that uses that format, but there are other programs
211 # that use "libpcap", or that use the same capture file format.)
212 #
213 0 ubelong 0xa1b2cd34 extended tcpdump capture file (big-endian)
214 >4 beshort x - version %d
215 >6 beshort x \b.%d
216 >20 belong 0 (No link-layer encapsulation
217 >20 belong 1 (Ethernet
218 >20 belong 2 (3Mb Ethernet
219 >20 belong 3 (AX.25
220 >20 belong 4 (ProNET
221 >20 belong 5 (CHAOS
222 >20 belong 6 (Token Ring
223 >20 belong 7 (ARCNET
224 >20 belong 8 (SLIP
225 >20 belong 9 (PPP
226 >20 belong 10 (FDDI
227 >20 belong 11 (RFC 1483 ATM
228 >20 belong 12 (raw IP
229 >20 belong 13 (BSD/OS SLIP
230 >20 belong 14 (BSD/OS PPP
231 >16 belong x \b, capture length %d)
232 0 ulelong 0xa1b2cd34 extended tcpdump capture file (little-endian)
233 >4 leshort x - version %d
234 >6 leshort x \b.%d
235 >20 lelong 0 (No link-layer encapsulation
236 >20 lelong 1 (Ethernet
237 >20 lelong 2 (3Mb Ethernet
238 >20 lelong 3 (AX.25
239 >20 lelong 4 (ProNET
240 >20 lelong 5 (CHAOS
241 >20 lelong 6 (Token Ring
242 >20 lelong 7 (ARCNET
243 >20 lelong 8 (SLIP
244 >20 lelong 9 (PPP
245 >20 lelong 10 (FDDI
246 >20 lelong 11 (RFC 1483 ATM
247 >20 lelong 12 (raw IP
248 >20 lelong 13 (BSD/OS SLIP
249 >20 lelong 14 (BSD/OS PPP
250 >16 lelong x \b, capture length %d)
252 #
253 # "pcap-ng" capture files.
254 # http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
255 # Pcap-ng files can contain multiple sections. Printing the endianness,
256 # snaplen, or other information from the first SHB may be misleading.
257 #
258 0 ubelong 0x0a0d0d0a
259 >8 ubelong 0x1a2b3c4d pcap-ng capture file
260 >>12 beshort x - version %d
261 >>14 beshort x \b.%d
262 0 ulelong 0x0a0d0d0a
263 >8 ulelong 0x1a2b3c4d pcap-ng capture file
264 >>12 leshort x - version %d
265 >>14 leshort x \b.%d
267 #
268 # AIX "iptrace" capture files.
269 #
270 0 string iptrace\ 1.0 "iptrace" capture file
271 0 string iptrace\ 2.0 "iptrace" capture file
273 #
274 # Novell LANalyzer capture files.
275 #
276 0 leshort 0x1001 LANalyzer capture file
277 0 leshort 0x1007 LANalyzer capture file
279 #
280 # HP-UX "nettl" capture files.
281 #
282 0 string \x54\x52\x00\x64\x00 "nettl" capture file
284 #
285 # RADCOM WAN/LAN Analyzer capture files.
286 #
287 0 string \x42\xd2\x00\x34\x12\x66\x22\x88 RADCOM WAN/LAN Analyzer capture file
289 #
290 # NetStumbler log files. Not really packets, per se, but about as
291 # close as you can get. These are log files from NetStumbler, a
292 # Windows program, that scans for 802.11b networks.
293 #
294 0 string NetS NetStumbler log file
295 >8 lelong x \b, %d stations found
297 #
298 # EtherPeek/AiroPeek "version 9" capture files.
299 #
300 0 string \177ver EtherPeek/AiroPeek capture file
302 #
303 # Visual Networks traffic capture files.
304 #
305 0 string \x05VNF Visual Networks traffic capture file
307 #
308 # Network Instruments Observer capture files.
309 #
310 0 string ObserverPktBuffe Network Instruments Observer capture file
312 #
313 # Files from Accellent Group's 5View products.
314 #
315 0 string \xaa\xaa\xaa\xaa 5View capture file