PCAP / PCAPNG¶

Packet capture formats used for Ethernet/IP, DoIP, SOME/IP, AFDX-like traffic, and USB captures.

Identity¶

Packet capture formats used for Ethernet/IP, DoIP, SOME/IP, AFDX-like traffic, and USB captures.

What This Protocol Teaches¶

• PCAP is the lingua franca once machine traffic becomes packets.
• It teaches how to inspect global/header blocks, interface descriptions, enhanced packet blocks without mistaking field extraction for meaning.
• It keeps observer inference separate from system truth.

Operational Context¶

PCAP / PCAPNG appears in networking, capture-format contexts and is modeled in the atlas at the capture-format layer(s). The binder treats it as an inspection surface: what evidence appears, what timing matters, and what outside authority is required before assigning meaning.

draft-structure-only: this is not yet a final-copy binder page. It has an atlas-grounded teaching hook and source notes, but still needs a stronger worked trace, page-specific ambiguity case, and reviewer-validated visual before promotion.

A Concrete Artifact¶

# synthetic capture summary
packet 42 ts=0.125000 linktype=CAN payload=123#1027202718272227

Synthetic offline sample for explanation; not a real operational trace or live-system instruction.

Worked Decode¶

1. Treat packet 42 as capture-record evidence at one timestamp, not a live network instruction.
2. ts=0.125000 and linktype=CAN are metadata that govern how payload bytes should be interpreted.
3. payload=123#1027202718272227 is CAN-shaped evidence embedded in a packet-capture container.
4. A correct link type and timestamp do not prove capture completeness, clock quality, or signal authority.

Field Layout / Anatomy¶

Visual Model¶

Timing And Authority¶

Timing and authority depend on the packet-capture-format role: scheduled, polled, arbitrated, transmitted, or logged evidence should not be read as the same kind of truth. Semantic authority is external to the raw artifact unless the artifact is itself a description or capture format; even then, provenance determines whether the description should be trusted.

Bytes rarely explain themselves. Name the source that defines meaning before naming engineering values: standard metadata, label table, DBC, PGN/SPN definition, object dictionary, register map, DID catalog, LDF, ARXML, channel metadata, or vendor profile.

Failure And Ambiguity¶

• Link type and payload shape do not prove dissector correctness.
• Capture clocks, truncation, and dropped packets affect observer claims.
• PCAP containers do not provide signal semantics by themselves.

Observer Lesson¶

A passive observer can usually infer artifact boundaries, repeated structure, cadence, missingness, and candidate state transitions. The observer usually cannot prove physical truth, application intent, complete system state, or engineering-unit meaning without semantic authority and timing provenance.

Python Model¶

schoolbus does not parse this format in this wave. This page records source posture, passive inspection questions, and metadata boundaries only. Runtime support would require a separate approved plan with concrete synthetic artifacts, tests, and source-checked parser boundaries.

Local Teaching Notes¶

The artifact and diagrams are synthetic teaching material. The page intentionally omits conformance timing tables, electrical design detail, proprietary configuration, and exhaustive standard behavior.

Source Confidence¶

Source confidence is high for scope and terminology, with semantic claims limited to public metadata, public source notes, and synthetic teaching artifacts.

Source Notes¶

References¶

Public Sources¶

• tcpdump / libpcap
• PCAP file format — canonical-standard.
• IETF
• PCAP Next Generation capture file format — Internet-Draft.
• Wireshark
• Wireshark capture files — tool-doc.
• Tooling references
• Wireshark — Protocol dissectors and PCAP analysis.
• Scapy automotive layers — automotive layer structure and packet inspection docs.