The value is for the current version of the format is 4. ¶Īn unsigned value, giving the number of the current minor version of the format. This value should change if the format changes in such a way that code that reads the new format could not read the old format (i.e., code to read both formats would have to check the version number and use different code paths for the two formats) and code that reads the old format could not read the new format. The value for the current version of the format is 2.

¶Īn unsigned value, giving the number of the current major version of the format. These numbers can be used to distinguish sections that have been saved on little-endian machines from the ones saved on big-endian machines, and to heuristically identify pcap files.

If the value is 0xA1B2C3D4, time stamps in Packet Records (see Figure 2) are in seconds and microseconds if it is 0xA1B23C4D, time stamps in Packet Records are in seconds and nanoseconds.

The meaning of the fields in the File Header is: ¶Īn unsigned magic number, whose value is either the hexadecimal number 0xA1B2C3D4 or the hexadecimal number 0xA1B23C4D.

Example pcap files