pcapfix For Linux

As its name might suggest, pcapfix is a software project that tries to fix/repair damaged or corrupted pcap and pcapng files on a Linux kernel-based operating system, as well as on Windows and Mac computers. It is an open source application written in the C++ programming language and designed to run on a console/terminal environment.

The application is capable of checking for an intact packet block or pcap global header and, if it finds any corrupted bytes, it will attempt to repair the file. However, if a header is not available, one is generated and added to the beginning of the file. Then, pcapfix tries to find packet blocks or pcap packet headers, and analyze and repairs them.

While pcapfix will default to using the LINKTYPE_ETHERNET data link type when trying to fix a corrupted data link type field, it has been designed from the offset to support a wide range of data link types, including LINKTYPE_NULL, LINKTYPE_RAW, LINKTYPE_USB_LINUX, LINKTYPE_DVB_CI, LINKTYPE_NFC_LLCP and LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR.

The software works by first checking for an intact pcap global header and then it attempts to repair the file if corrupted bytes are detected. pcapfix will add a self-created global header for pcap or pcapng files that don’t have one, at the beginning of the file. The tool tries to discover pcap packet headers inside a given file, below the global header, and checks if the values are correct, automatically repairing them if they are corrupted.

As mentioned, pcapfix is a cross-platform application that runs on mainstream operating systems, including GNU/Linux, Microsoft Windows and Mac OS X. It’s available for download as a source archive, which must be manually configured and compiled prior to installation, as well as pre-compiled binary packages for 32-bit Windows OSes.