Classic PCAP Capture Inspector

How to use Classic PCAP Capture Inspector

Inspect classic PCAP packet lengths and exact timestamp fields, or extract one captured payload as a separate binary file. Read microsecond or nanosecond captures in either byte order without replaying traffic. Find truncated packets, decreasing timestamps and container-boundary errors while keeping protocol interpretation separate.

1. Provide classic pcap file, zero-based packet index.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• Classic PCAP version 2.4 only: 8 MiB and 1,000 packet records. PCAPNG, compressed input and modified/legacy header formats are refused. No libpcap or packet dissector is embedded.
• Supports the four standard byte-order and microsecond/nanosecond magic values. Timestamp fractions remain exact decimal fields; the reported span is max minus min, not an assumption of chronological record order.
• This strict profile requires positive snaplen, zero reserved link-type flag bits, complete packet headers/data and captured length no greater than snaplen or original length. Historical reserved timestamp fields are ignored.
• The numeric link type and declared FCS length are reported without decoding, verifying or stripping payload data. An unknown link type does not prevent container inspection.
• Extraction returns only the selected captured bytes, including any stored link header/FCS. It does not restore omitted bytes, create a PCAP subset, execute content or send traffic. An explicitly empty packet may be downloaded.
• Inputs are processed on this device and are not automatically saved or uploaded.