Weird pcap header of byte sequence 0a 0d 0d 0a created on Mac?

Question

I have a PCAP file that was created on a Mac with mergecap that can be parsed on a Mac with Apple's libpcap but cannot be parsed on a Linux system. combined file has an extra 16-byte header that contains 0a 0d 0d 0a 78 00 00 00 before the 4d 3c 2b 1a intro that's common in pcap files. Here is a hex dump:

0000000: 0a0d 0d0a 7800 0000 4d3c 2b1a 0100 0000  ....x...M<+.....
0000010: ffff ffff ffff ffff 0100 4700 4669 6c65  ..........G.File
0000020: 2063 7265 6174 6564 2062 7920 6d65 7267   created by merg
0000030: 696e 673a 200a 4669 6c65 313a 2037 2e70  ing: .File1: 7.p
0000040: 6361 7020 0a46 696c 6532 3a20 362e 7063  cap .File2: 6.pc
0000050: 6170 200a 4669 6c65 333a 2034 2e70 6361  ap .File3: 4.pca
0000060: 7020 0a00 0400 0800 6d65 7267 6563 6170  p ......mergecap

Does anybody know what this is? or how I can read it on a Linux system with libpcap?

Answer 1

I have a PCAP file

No, you don't. You have a pcap-ng file.

that can be parsed on a Mac with Apple's libpcap

libpcap 1.1.0 and later can also read some pcap-ng files (the pcap API only allows a file to have one link-layer header type, one snapshot length, and one byte order, so only pcap-ng files where all sections have the same byte order and all interfaces have the same link-layer header type and snapshot length are supported), and OS X Snow Leopard and later have a libpcap based on 1.1.x, so they can read those files.

(OS X Mountain Lion and later have tweaked libpcap to allow it to write pcap-ng files as well; the -P flag makes tcpdump write out pcap-ng files, with text comments attached to some outgoing packets indicating the process ID and process name of the process that sent them - pcap-ng allows text comments to be attached to packets.)

but cannot be parsed on a Linux system

Your Linux system probably has an older libpcap version. (Note: do not be confused by Debian and Debian derivatives calling the libpcap package "libpcap0.8" - they're not still using libpcap 0.8.)

combined file has an extra 16-byte header that contains 0a 0d 0d 0a 78 00 00 00

A pcap-ng file is a sequence of "blocks" that start with a 4-byte block type and a 4-byte length, both in the byte order of the host that wrote them.

They're divided into "sections", each one beginning with a "Section Header Block" (SHB); the block type for the SHB is 0x0a0d0d0a, which is byte-order-independent (so that you don't have to know the byte order to read the SHB) and contains carriage returns and line feeds (so that if the file is, for example, transferred between a UN*X system and a Windows system by a tool that thinks it's transferring a text file and that "helpfully" tries to fix line endings, the SHB magic number will be damaged and it will be obvious that the file was corrupted by being transferred in that fashion; think of it as the equivalent of a shock indicator).

The 0x78000000 is the length; what follows it is the "byte-order magic" field, which is 0x1A2B3C4D (which is not the same as the 0xA1B2C3D4 magic number for pcap files), and which serves the same purposes as the pcap magic number, namely:

1. it lets code identify that the file is a pcap-ng file
2. it lets code determine the byte order of the section.

(No, you don't need to know the length before looking for the pcap magic number; once you've found the magic number, you then check the length to make sure it's at least 28 and, if it's less than or equal to 28, you reject the block as not being valid.)

Does anybody know what this is?

A (little-endian) pcap-ng file.

or how I can read it on a Linux system with libpcap?

Either read it on a Linux system with a newer version of libpcap (which may mean a newer version of whatever distribution you're using, or may just mean doing an update if that will get you a 1.1.0 or later version of libpcap), read it with Wireshark or TShark (which have their own library for reading capture files, which supports the native pcap and pcap-ng formats, as well as a lot of other formats), or download a newer version of libpcap from tcpdump.org, build it, install it, and then build whatever other tools need to read pcap-ng files with that version of libpcap rather than the one that comes with the system.

Newer versions of Wireshark write pcap-ng files by default, including in tools such as mergecap; you can get them to write pcap files with a flag argument of -F pcap.