Features at a glance
The application is capable of checking for an intact packet block or pcap global header and, if it finds any corrupted bytes, it will attempt to repair the file. However, if a header is not available, one is generated and added to the beginning of the file. Then, pcapfix tries to find packet blocks or pcap packet headers, and analyze and repairs them.
Supports numerous data link types
While pcapfix will default to using the LINKTYPE_ETHERNET data link type when trying to fix a corrupted data link type field, it has been designed from the offset to support a wide range of data link types, including LINKTYPE_NULL, LINKTYPE_RAW, LINKTYPE_USB_LINUX, LINKTYPE_DVB_CI, LINKTYPE_NFC_LLCP and LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR.
How does it work?
The software works by first checking for an intact pcap global header and then it attempts to repair the file if corrupted bytes are detected. pcapfix will add a self-created global header for pcap or pcapng files that don’t have one, at the beginning of the file. Furthermore, the tool tries to discover pcap packet headers inside a given file, below the global header, and checks if the values are correct, automatically repairing them if they are corrupted.
Runs on mainstream operating systems
As mentioned, pcapfix is a cross-platform application that runs on mainstream operating systems, including GNU/Linux, Microsoft Windows and Mac OS X. It’s available for download as a source archive, which must be manually configured and compiled prior to installation, as well as pre-compiled binary packages for 32-bit Windows OSes.
Reviewed by Marius Nestor, last updated on September 8th, 2014
In a hurry? Add it to your Download Basket!
- added checks for valid pcapng format (epb)
- added --outfile parameter to chose fixed file name
- improved pcapng packet alignment (pb, spb, nrb)
- improved pcapng option fields handling
Application descriptionpcapfix is an open source command-line software that can be used as a repair utility for defected pcap files. It is k...