## PCAP Tags

Tags extracted from CAP, PCAP and PCAPNG Packet Capture files.

> Tag ID | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0x0001 | Comment | no |
> 0x0bac | CustomOption1 | no |
> 0x0bad | CustomOption2 | no |
> 0x4bac | CustomOption3 | no |
> 0x4bad | CustomOption4 | no |
> 'ByteOrder' | ByteOrder | no | 'II' = Little-endian (Intel, II) 'MM' = Big-endian (Motorola, MM)
> 'IDB-2' | DeviceName | no |
> 'IDB-3' | Description | no |
> 'IDB-4' | IPv4Addr | no |
> 'IDB-5' | IPv6Addr | no |
> 'IDB-6' | MACAddr | no |
> 'IDB-7' | EUIAddr | no |
> 'IDB-8' | Speed | no |
> 'IDB-9' | TimeStampResolution | no |
> 'IDB-10' | TimeZone | no |
> 'IDB-11' | Filter | no |
> 'IDB-12' | OperatingSystem | no |
> 'IDB-13' | FrameCheckSequenceLength | no |
> 'IDB-14' | TimeStampOffset | no |
> 'IDB-15' | Hardware | no |
> 'IDB-16' | TXSpeed | no |
> 'IDB-17' | RXSpeed | no |
> 'IDB-18' | TimezoneName | no |

> 'LinkType'

> LinkType

> no

> 0 = BSD Loopback
> 1 = IEEE 802.3 Ethernet
> 2 = Experimental 4Mb Ethernet
> 3 = AX.25
> 4 = PRONET
> 5 = MIT CHAOSNET
> 6 = IEEE 802.5
> 7 = ARCNET BSD
> 8 = SLIP
> 9 = PPP
> 10 = fddI
> 50 = PPP HDLC
> 51 = PPP Ethernet
> 99 = Symantec Firewall
> 100 = ATM RFC 1483
> 101 = Raw
> 102 = SLIP BSD/OS
> 103 = PPP BSD/OS
> 104 = Cisco PPP with HDLC
> 105 = IEEE 802.11
> 106 = ATM Classical IP
> 107 = Frame Relay
> 108 = OpenBSD Loopback
> 109 = OpenBSD IPSEC
> 110 = ATM LANE 802.3
> 111 = NetBSD HIPPI
> 112 = NetBSD HDLC
> 113 = Linux SLL
> 114 = Apple LocalTalk
> 115 = Acorn Econet
> 116 = OpenBSD ipfilter
> 117 = OpenBSD pflog
> 118 = Cisco IOS
> 119 = IEEE 802.11 Prism
> 120 = IEEE 802.11 Aironet
> 121 = Siemens HiPath HDLC
> 122 = IP-over-Fibre
> 123 = SunATM
> 124 = RapidIO
> 125 = PCI Express
> 126 = Xilinx Aurora
> 127 = IEEE 802.11 Radiotap
> 128 = Tazmen Sniffer
> 129 = ARCNET Linux
> 130 = Juniper MLPPP
> 131 = Juniper MLFR
> 132 = Juniper ES
> 133 = Juniper GGSN
> 134 = Juniper MFR
> 135 = Juniper ATM2
> 136 = Juniper Services
> 137 = Juniper ATM1
> 138 = Apple IP-over-IEEE 1394
> 139 = MTP2 with PHDR
> 140 = MTP2
> 141 = MTP3
> 142 = SCCP
> 143 = DOCSIS
> 144 = Linux IrDA
> 145 = IBM SP
> 146 = IBM SN
> 163 = IEEE 802.11 AVS
> 164 = Juniper Monitor
> 165 = BACnet MS/TP
> 166 = PPP PPPD
> 167 = Juniper PPPOE
> 168 = Juniper PPPOE ATM
> 169 = GPRS LLC
> 170 = GPF-T
> 171 = GPF-F
> 172 = Gcom T1/E1
> 173 = Gcom Serial
> 174 = Juniper PIC Peer
> 175 = ERF ETH
> 176 = ERF POS
> 177 = Linux LAPD
> 178 = Juniper Ether
> 179 = Juniper PPP
> 180 = Juniper Frame Relay
> 181 = Juniper CHDLC
> 182 = Juniper VP
> 185 = A653 ICM
> 186 = USB FreeBSD
> 187 = Bluetooth HCI H4
> 188 = IEEE 802.16 MAC CPS
> 189 = USB Linux
> 190 = CAN 2.0B
> 191 = IEEE 802.15.4 Linux
> 192 = PPI
> 193 = IEEE 802.16 MAC CPS Radio
> 194 = Juniper ISM
> 195 = IEEE 802.15.4 with FCS
> 196 = SITA

> 197 = ERF
> 198 = RAIF1
> 199 = IPMB Kontron
> 200 = Juniper ST
> 201 = Bluetooth HCI H4 with PHDR
> 202 = AX.25 KISS
> 203 = LAPD
> 204 = PPP with DIR
> 205 = Cisco HDLC with DIR
> 206 = Frame Relay with DIR
> 207 = LAPB with DIR
> 209 = IPMB Linux
> 210 = FlexRay
> 211 = MOST
> 212 = LIN
> 213 = X2E Serial
> 214 = X2E Xoraya
> 215 = IEEE 802.15.4 Nonask PHY
> 216 = Linux evdev
> 217 = GSMtap Um
> 218 = GSMtap Abis
> 219 = MPLS
> 220 = USB Linux MMapped
> 221 = DECT
> 222 = AOS
> 223 = Wireless HART
> 224 = FC-2
> 225 = FC-2 with Frame Delims
> 226 = IPNET
> 227 = CAN Socketcan
> 228 = IPv4
> 229 = IPv6
> 230 = IEEE 802.15.4 No FCS
> 231 = D-Bus
> 232 = Juniper VS
> 233 = Juniper SRX E2E
> 234 = Juniper Fibre Channel
> 235 = DVB-CI
> 236 = Mux 27.010
> 237 = STANAG 5066 D_PDU
> 238 = Juniper ATM Cemic
> 239 = NFLOG
> 240 = Netanalyzer
> 241 = Netanalyzer Transparent
> 242 = IP-over-InfiniBand
> 243 = MPEG-2 TS
> 244 = NG40
> 245 = NFC LLCP
> 246 = Pfsync
> 247 = InfiniBand
> 248 = SCTP
> 249 = USBPcap
> 250 = RTAC Serial
> 251 = Bluetooth LE LL
> 252 = Wireshark Upper PDU
> 253 = Netlink
> 254 = Bluetooth Linux Monitor
> 255 = Bluetooth BREDR BB
> 256 = Bluetooth LE LL with PHDR
> 257 = PROFIBUS Data Link
> 258 = Apple PKTAP
> 259 = EPON
> 260 = IPMI HPM.2
> 261 = Z-Wave R1/R2
> 262 = Z-Wave R3
> 263 = WattStopper DLM
> 264 = ISO 14443
> 265 = RDS
> 266 = USB Darwin
> 267 = Openflow
> 268 = SDLC
> 269 = TI LLN Sniffer
> 270 = LoRaTap
> 271 = Vsock
> 272 = Nordic BLE
> 273 = DOCSIS 31 XRA31
> 274 = Ethernet MPacket
> 275 = DisplayPort AUX
> 276 = Linux SLL2
> 277 = Sercos Monitor
> 278 = Openvizsla
> 279 = Elektrobit EBHSR
> 280 = VPP Dispatch
> 281 = DSA Tag BRCM
> 282 = DSA Tag BRCM Prepend
> 283 = IEEE 802.15.4 Tap
> 284 = DSA Tag DSA
> 285 = DSA Tag EDSA
> 286 = ELEE
> 287 = Z-Wave Serial
> 288 = USB 2.0
> 289 = ATSC ALP

> 'PCAPVersion' | PCAPVersion | no |
> 'SHB-2' | Hardware | no |
> 'SHB-3' | OperatingSystem | no |
> 'SHB-4' | UserApplication | no |
> 'TimeStamp' | TimeStamp | no |

(This document generated automatically by Image::ExifTool::BuildTagLookup)
Last revised Mar 11, 2025

<-- ExifTool Tag Names