Grammar for the BSD libpcap file format, ver 1.0 by Bret Jordan, blog.mywarwithentropy.com. GPLv3 GMT to local correction Accuracy of timestamps Max length of captured packets, in octets Data link type Timestamp in seconds from epoch Timestamp in microseconds from epoch Frame length on the wire (bytes) Frame length stored into the capture file (bytes) Number of 32 bit works. Minimum value is 5, thus 5 x 32 bit = 160 bits = 20 bytes. Being a 4-bit value, the maximum length is 15 words (15 x 32 bits) = 480 bits = 60 bytes Number of 32 bit words in header thus ip.len x 32 = number of bits