Link layer
21How a frame is carried on the wire.
Ethernet II
Destination, source and EtherType. 12 EtherTypes named.Build with: every builder, Craft lab
Linux cooked capture v1
Packet type, ARPHRD type and link address.
Linux cooked capture v2
Adds the interface index to the cooked header.
Loopback / Null
Address family field, 6 families named.
Linux Netlink (nlmon)
Netlink headers. 22 families and 16 route message types named.
Raw IP
IPv4 or IPv6 from the first byte, no link header.
802.1Q VLAN
Priority, DEI and VLAN ID.Build with: Craft lab
802.1ad QinQ
Service VLAN tag, stacked over 802.1Q.
Cisco HDLC
Address, control and protocol type.
Juniper Ethernet
Juniper capture header in front of Ethernet.
PPP
Protocol field, 12 protocols named, including LCP, PAP, CHAP and IPCP.
PPP in HDLC
HDLC-like framing around PPP.
MPLS
Label stack entries.Build with: Craft lab
SocketCAN
Linux CAN frames.
Bluetooth HCI (H4)
5 packet types and 11 HCI events named.
802.11
Management, control, data and extension frames.
802.11 with Radiotap
Radiotap header, 29 present-flag bits named.
LLC / SNAP
IEEE 802.2 header with the SNAP protocol ID.
STP, RSTP, MSTP
Spanning tree BPDUs: configuration, topology change, RST and MST.
Frame Relay
Frame Relay header, 7 NLPIDs named.
FakeNet-NG raw IP
FakeNet-NG's custom raw-IP link type.
Network layer
18Addressing, control and tunnels between hosts.
ARP
Hardware and protocol addresses, 8 opcodes named.Build with: ARP builder, ARP scenarios
RARP
Reverse ARP requests and replies.
IPv4
Header, options and checksum.Build with: every builder, Craft lab
IPv6
Header and extension headers.Build with: stream builder, Craft lab
IPv4 in IP
IPv4 encapsulation: the inner packet.
IPv6 in IP
IPv6 encapsulation: the inner packet.
ESP
SPI and sequence number. The payload stays encrypted.
AH
Authentication header fields.
Wake-on-LAN
Magic packet with its target MAC.
ICMPv4
11 message types named.Build with: ICMP builder, ping and traceroute scenarios
ICMPv6
15 message types named, including neighbor discovery and MLD.Build with: ICMP builder, NDP and ping scenarios
Geneve
Version, flags, protocol type, VNI and options.
GTP v1
Flags, message type, length and TEID.
GTPv2
Flags, message type, length and TEID.
VXLAN
Flags and VNI.Build with: Craft lab
GRE
Flags, protocol type, and optional checksum, key and sequence.Build with: Craft lab
VXLAN-GPE
Flags, next protocol and VNI.
PPPoE
Discovery codes and 10 tag types named.
Transport layer
5Delivery between ports, and group management.
IGMP
5 message types named, group address.Build with: Craft lab
TCP
Flags, options, sequence and acknowledgment numbers.Build with: stream builder, SYN scan scenario
UDP
Ports, length and checksum.Build with: stream builder
UDP-Lite
Checksum coverage field.
SCTP
15 chunk types named.
Application layer
26What the traffic is actually saying.
DNS
18 record types, 5 opcodes and 11 response codes.Build with: DNS builder, Craft lab
HTTP/1.x
Requests, responses and headers.Build with: HTTP builder
SIP
Requests, responses and headers.
TLS
SSL 3.0 through TLS 1.3, 12 handshake types, extensions and cipher suites.Build with: TLS scenario
DTLS
DTLS 1.0, 1.2 and 1.3 records.
X.509 certificates
Parsed out of handshakes, with certificate extraction.
QUIC
Versions 1 and 2, long and short headers.
HTTP/3
HTTP/3 frames over QUIC.
HTTP/2
Frames, settings, 14 error codes, and a stream view with HPACK decoded.
SSH
Version exchange and handshake. The payload is encrypted.
FTP
Control commands and replies.
FTP data
The data channel.
SMTP
Commands and replies.
DHCP / BOOTP
Messages and options.Build with: DHCP lease scenario
NTP
Mode and timestamp fields.Build with: NTP scenario
SNMP
SNMP messages.
SMB 1, 2 and 3
72 SMB1 commands, 20 SMB2 commands and the dialects.
NetBIOS session (NBSS)
6 session message types.
NetBIOS name (NBNS)
Queries, registrations, releases and refreshes.
mDNS
Multicast DNS.
SSDP
UPnP discovery messages.
WebSocket
Frames, 6 opcodes and close status codes.
RTP and RTCP
RTP headers and 8 RTCP packet types. Streams grouped by SSRC.
MQTT
14 packet types and CONNACK return codes.
DCE/RPC (MSRPC)
19 PDU types, 9 known interfaces and srvsvc operations.
WireGuard
4 message types. The payload stays encrypted.
No protocol matches. You can still describe it as a custom template, or ask us.
Named, not decoded
These show up by name in headers. Their payload stays as bytes you can still edit.
EAPOLOSPFEIGRPLCPPAPCHAPIPCPIPv6CPAppleTalkNovell IPX
Files
- Read and write: Classic pcap and PcapNG
- Read and write: Raw-frames JSON
- Import: Fiddler SAZ
- Import: Browser HAR
- Export: Annotated HTML report
19 pcap link types recognized.
Your own protocols
Describe a byte layout as a custom template, with a rule that detects it automatically. Add your own port mappings, and stack any layer onto a frame from the template palette.
