| Wireshark 4.7.3 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
Public Attributes | List of all members
capture_file_header Struct Reference

Top-level file header for a Network Instruments Observer capture file. More...

`#include <observer.h>`

## Public Attributes
char | observer_version [31]
uint8_t | offset_to_first_packet_high_byte
uint16_t | offset_to_first_packet
char | probe_instance
uint8_t | number_of_information_elements

## Detailed Description

Top-level file header for a Network Instruments Observer capture file.

As of v15, `observer_version` was shortened by one byte to introduce `offset_to_first_packet_high_byte`, extending the addressable range for the first-packet offset to 16 MB. Files predating v15 will always have `offset_to_first_packet_high_byte` set to 0.

## Member Data Documentation

## ◆ number_of_information_elements

uint8_t capture_file_header::number_of_information_elements

Number of TLV information elements appended to this header.

## ◆ observer_version

char capture_file_header::observer_version[31]

Null-terminated version string of the Observer software that created this file; maximum 30 characters.

## ◆ offset_to_first_packet

uint16_t capture_file_header::offset_to_first_packet

Low 16 bits of the byte offset from the start of the file to the first packet record.

## ◆ offset_to_first_packet_high_byte

uint8_t capture_file_header::offset_to_first_packet_high_byte

High byte of the offset to the first packet, extending the range to 256 × 0x10000 = 16 MB; always 0 in files predating v15.

## ◆ probe_instance

char capture_file_header::probe_instance

Identifier of the probe instance that captured this file.

The documentation for this struct was generated from the following file:

- /builds/wireshark/wireshark/wiretap/observer.h