User comments on individual frames (a.k.a.Cached name resolution entries (mappings from IPv4 or IPv6 addresses to host names).Capture filter used when sniffing packets.Description of interface from where packets are captured.Name of interface from where packets are captured.Software used to create the capture file (application name and version).Operating system of the sniffer machine.Well, the spec allows features such as MAC address of capturing interface as well as interface speed (in bps) to be stored.īut the most commonly used metadata types are:
So what types of metadata can a PcapNG file contain? The remaining 80% is focused on various types of metadata. In fact only about 20% of the PcapNG file specification concerns storage of captured frames, The new PCAP-NG format, however, additionally includes the ability to store meta-data in the capture files.
PCAP) is designed to only store captured network frames. In this blog post we explain what type of meta-data that can be found in PcapNG files, and how to extract it. We revealed the identity of the anonymous capture file uploader by analyzing metadata available in the PCAP-NG file format.
0 kommentar(er)
