pcap文件格式

timestamp microseconds(4Byte)

data link type(4Byte)

struct pcap_hdr

actual length of packet(4Byte)

struct pcaprec_hdr

timestamp seconds(4 Byte)

packet data

accuracy of timestamps(4Byte)

GMT to local correction(4Byte)

magic number(4 Byte)

number of octets of packet saved in file(4Byte)

major version number(2Byte)

minor version number(2Byte)