Corrupt PCAP Triage: Preserve Evidence Before You Rewrite
How to distinguish a damaged capture container from bad packet checksums, and where PCAP Surgery's repair scope stops.
“Corrupt PCAP” can mean several different things: a truncated file record, invalid capture container metadata, a packet whose checksum looks wrong because of NIC offload, or a structurally valid capture with timestamps that are inconvenient for a lab fixture.
Separate container damage from packet edits
First open the file in a mature parser and preserve the original. If records are truncated or the container is structurally invalid, use specialized recovery tooling. PCAP Surgery does not claim general corrupt-container recovery and may reject data it cannot index safely.
If the container is valid, inspect why a checksum appears wrong before changing it. Host captures often contain checksum-offload artifacts that never appeared on the wire.
PCAP Surgery's actual repair scope
The product can prepare a new classic PCAP from an indexed source, change timestamps, keep or drop packets, perform selected L2-L4 rewrites, and repair IPv4/TCP/UDP checksums on supported rewrite paths. Fixed-length raw byte edits do not receive automatic checksum repair.
That is controlled artifact preparation, not arbitrary recovery. Re-open the output in a trusted parser before using it as evidence or a regression fixture.