Build it: read the capture (a pcap reader, layer by layer)

A packet on the wire is wrapped like a letter in a building: a corridor address outside, a street address inside, a flat number inside that, then the letter. This lesson builds the program that unwraps them.

Before you start. You need the street address (IP) of How a parcel finds any house on earth, the corridor address (MAC) of Inside your building (your router's life) and The corridor inside the building (frames, switches and VLANs), the handshake flags of TCP vs UDP, and the 3-way handshake, and the DNS question bytes of DNS on the wire. One click, every layer (what happens when you load a page) timed a page load phase by phase; this lesson opens the packets behind those phases. Python 3, standard library only.

The idea in 30 seconds

A pcap file is a 24-byte header (magic number, version, snapshot length, link type) followed by records of a 16-byte header (time, saved length, original length) and the frame; the magic number tells the reader the byte order and the time resolution.
A frame is layers wrapped inside each other: Ethernet (14 bytes), IPv4 (header length from the low nibble times four), then TCP or UDP, then the application’s bytes, and each layer says how long the next one is.
A reader should trust each header’s own length fields, not the size of the container, because a network card pads short Ethernet frames with zeros.
TCP and UDP checksums cover a pseudo-header made of the addresses from the layer below, which is why a corrupted byte anywhere is caught.
Capturing packets needs root because the kernel’s capture device, BPF (McCanne and Jacobson, 1992), is root-only; reading a capture file needs no privilege.

Read the story · Skip to the numbers