| // Grammar file for the Libpcap File Format. | |
| // https://wiki.wireshark.org/Development/LibpcapFileFormat | |
| little_endian_packets | |
| struct PcapHeader { | |
| _fixed_ = 0xa1b2c3d4: 32, /* magic number */ | |
| version_major: 16, | |
| version_minor: 16, | |
| thiszone: 32, /* GMT to local correction */ | |
| sigfigs: 32, /* accuracy of timestamps */ | |
| snaplen: 32, /* max length of captured packets, in octets */ | |
| network: 32, /* data link type */ | |
| } | |
| struct PcapRecord { | |
| ts_sec: 32, /* timestamp seconds */ | |
| ts_usec: 32, /* timestamp microseconds */ | |
| _size_(_payload_): 32, /* number of octets of packet saved in file */ | |
| orig_len: 32, /* actual length of packet */ | |
| _payload_, /* packet octets */ | |
| } | |
| packet PcapFile { | |
| header: PcapHeader, | |
| records: PcapRecord[], | |
| } |