<?xml version="1.0" encoding="utf-8"?>
<PRONOM-Report xmlns="http://pronom.nationalarchives.gov.uk">
  <report_format_detail>
    <FileFormat>
      <FormatID>1578</FormatID>
      <FormatName>pcap Packet Capture</FormatName>
      <FormatVersion>
      </FormatVersion>
      <FormatAliases>
      </FormatAliases>
      <FormatFamilies>
      </FormatFamilies>
      <FormatTypes>
      </FormatTypes>
      <FormatDisclosure>
      </FormatDisclosure>
      <FormatDescription>The pcap file format was invented for use by tcpdump, a packet analyser used to examine and interpret network traffic.</FormatDescription>
      <BinaryFileFormat>
      </BinaryFileFormat>
      <ByteOrders>
      </ByteOrders>
      <ReleaseDate>
      </ReleaseDate>
      <WithdrawnDate>
      </WithdrawnDate>
      <ProvenanceSourceID>1</ProvenanceSourceID>
      <ProvenanceName>Digital Preservation Department / The National Archives</ProvenanceName>
      <ProvenanceSourceDate>21 Nov 2015</ProvenanceSourceDate>
      <ProvenanceDescription>
      </ProvenanceDescription>
      <LastUpdatedDate>21 Nov 2015</LastUpdatedDate>
      <FormatNote>
      </FormatNote>
      <FormatRisk>
      </FormatRisk>
      <TechnicalEnvironment>
      </TechnicalEnvironment>
      <FileFormatIdentifier>
        <Identifier>application/vnd.tcpdump.pcap</Identifier>
        <IdentifierType>MIME</IdentifierType>
      </FileFormatIdentifier>
      <FileFormatIdentifier>
        <Identifier>fmt/779</Identifier>
        <IdentifierType>PUID</IdentifierType>
      </FileFormatIdentifier>
      <ExternalSignature>
        <ExternalSignatureID>1670</ExternalSignatureID>
        <Signature>pcap</Signature>
        <SignatureType>File extension</SignatureType>
      </ExternalSignature>
      <ExternalSignature>
        <ExternalSignatureID>1731</ExternalSignatureID>
        <Signature>cap</Signature>
        <SignatureType>File extension</SignatureType>
      </ExternalSignature>
      <ExternalSignature>
        <ExternalSignatureID>1732</ExternalSignatureID>
        <Signature>dmp</Signature>
        <SignatureType>File extension</SignatureType>
      </ExternalSignature>
      <InternalSignature>
        <SignatureID>1145</SignatureID>
        <SignatureName>pcap Big Endian</SignatureName>
        <SignatureNote>0xa1b2c3d4 indicates that the capture reader has the same byte order as the capture writer. 
0xd4c3b2a1 indicates that the reader has a different byte order from the writer.</SignatureNote>
        <ByteSequence>
          <ByteSequenceID>1396</ByteSequenceID>
          <PositionType>Absolute from BOF</PositionType>
          <Offset>0</Offset>
          <MaxOffset>0</MaxOffset>
          <IndirectOffsetLocation>
          </IndirectOffsetLocation>
          <IndirectOffsetLength>
          </IndirectOffsetLength>
          <Endianness>
          </Endianness>
          <ByteSequenceValue>A1B2C3D4</ByteSequenceValue>
        </ByteSequence>
      </InternalSignature>
      <InternalSignature>
        <SignatureID>1146</SignatureID>
        <SignatureName>pcap Little Endian</SignatureName>
        <SignatureNote>0xa1b2c3d4 indicates that the capture reader has the same byte order as the capture writer. 
0xd4c3b2a1 indicates that the reader has a different byte order from the writer.</SignatureNote>
        <ByteSequence>
          <ByteSequenceID>1397</ByteSequenceID>
          <PositionType>Absolute from BOF</PositionType>
          <Offset>0</Offset>
          <MaxOffset>0</MaxOffset>
          <IndirectOffsetLocation>
          </IndirectOffsetLocation>
          <IndirectOffsetLength>
          </IndirectOffsetLength>
          <Endianness>
          </Endianness>
          <ByteSequenceValue>D4C3B2A1</ByteSequenceValue>
        </ByteSequence>
      </InternalSignature>
    </FileFormat>
    <SearchCriteria>Criteria</SearchCriteria>
  </report_format_detail>
</PRONOM-Report>
