PCAP capture scope

PCAP Surgery Capture Scope, Formats, and Export Limits

PCAP Surgery works on local packet-capture files, not live network traffic. It can inspect classic PCAP and a deliberately limited PCAPNG path, narrow a capture to relevant packets, preview supported edits, run export and privacy preflight checks, and write a new classic PCAP when the paid export feature is available.

The source file is not overwritten. The output is a derivative capture and must be validated independently before it is used as a regression fixture, attached to a support case, or shared outside the organization.

Supported input and output formats

Format or capture property	Current support	Boundary
Classic PCAP (`.pcap`)	Read, inspect, filter, edit, preflight, and export	Export requires the `pcap-export` feature
Basic PCAPNG (`.pcapng`)	Read and inspect supported single-interface Ethernet captures	Rich or unknown block semantics are not guaranteed
Export format	Classic PCAP	PCAPNG metadata is not round-tripped
Ethernet link type	Supported path	Other link-layer types are outside the guarantee
Single interface	Supported PCAPNG path	Multi-interface interpretation is outside the guarantee
Live capture	Not supported	Capture with a dedicated sniffer first

PCAPNG is a container with interface descriptions, packet blocks, comments, name-resolution data, capture statistics, and vendor extensions. Accepting one common path does not mean every PCAPNG file is losslessly understood. If interface identity, comments, direction flags, timestamps from multiple interfaces, or custom blocks matter, keep the original file and use a workflow that preserves those semantics.

Opening a file successfully proves only that the supported parser accepted it. It does not prove that every protocol is decoded, every field is editable, or every metadata block will survive export.

What packet selection can do

The investigation workspace can narrow packet evidence by supported filter fields such as protocol, address, port, packet number or range, time range, and text. A subset export retains packets that match the selected scope; it does not invent missing packets or reassemble a new application conversation.

Use selection to keep the context that explains a failure:

DNS resolution before a connection;
the TCP handshake and option negotiation;
TLS or application setup;
the first failed request and corresponding response;
retransmission, ACK, FIN, or RST evidence;
a short recovery or retry sequence.

A filter that keeps only the visibly failing packet is often too narrow. For example, a TCP retransmission has little diagnostic value without the sequence and acknowledgment context around it. Start with a wider failure window, export a candidate subset, and then prove that the reduced file still supports the same conclusion.

The failure-window subset workflow shows how an evidence-focused derivative should be framed. For protocol-specific scope decisions, see the packet-capture analysis guide.

Supported transformation classes

PCAP Surgery exposes controlled operations rather than arbitrary packet reconstruction. Current supported paths include:

keep or drop decisions for selected packets;
packet reordering;
timestamp adjustments;
fixed-length raw-byte edits;
supported MAC and IPv4 address rewrites;
supported port, VLAN, TCP, and IP field rewrites;
checksum repair on supported IPv4, TCP, and UDP header-rewrite paths.

Every edit must be reviewed in context. A fixed-length byte change can alter protocol meaning even when the file remains parseable. Reordering changes the evidence timeline. Timestamp changes can invalidate latency analysis. Rewriting an endpoint can break application-layer values that refer to the old address.

Raw-byte editing is especially narrow: changing bytes does not automatically update dependent lengths, offsets, cryptographic integrity checks, or transport checksums. Checksum repair applies only on the explicit supported rewrite paths; it is not a general promise that an arbitrary modified packet becomes valid.

What PCAP Surgery does not promise

The current release does not guarantee:

live capture or packet sniffing;
arbitrary non-Ethernet link types;
general multi-interface PCAPNG interpretation;
preservation of every PCAPNG block, option, comment, or vendor extension;
arbitrary payload stripping or variable-length payload replacement;
packet truncation as a general sanitization operation;
automatic capture splitting into a family of files;
protocol-complete decoding;
TCP or application-stream reassembly for privacy detection;
decryption of TLS or other protected payloads;
complete anonymization;
a declaration that an export is safe to share;
automatic post-export reparsing;
a complete transformation manifest.

These are product boundaries, not small-print exceptions. If a case requires one of them, use a workflow designed for that requirement and retain PCAP Surgery only for the supported inspection or edit stage.

Privacy inventory scope

The export workspace can inventory visible exposure in the selected full capture or subset. Current categories include visible IPv4 and IPv6 addresses, MAC addresses, DNS names, HTTP Host values, TLS SNI values, printable payload, and content that remains unknown to the bounded scan.

Inventory result	What it means	What it does not mean
IPv4 address found	A visible IPv4 value was detected	Every occurrence can be safely rewritten
DNS or Host value found	A supported plaintext name was visible	Encrypted or reassembled names were checked
TLS SNI found	A visible ClientHello name was recognized	The TLS payload was decrypted
Printable payload found	Human-readable bytes may contain data	The bytes were semantically classified
Unknown exposure	Coverage cannot classify all content	The unknown content is harmless
No item in a category	The bounded scan found none	The artifact is safe to share

The inventory performs no decryption and no complete stream reassembly. Data split across packets can evade a packet-bounded check. Compressed, encoded, encrypted, proprietary, or malformed application content may remain opaque.

IPv4 header masking is not payload redaction. The old value may remain in DNS messages, HTTP fields, TLS SNI, credentials, URLs, logs carried in payload, IPv6 traffic, checksums, or an unknown protocol. Treat every output as potentially sensitive until a separate privacy review proves otherwise.

Use the PCAP sanitization workflow to plan that review, but do not interpret it as an automatic safety guarantee.

Checksum boundary

Checksums deserve explicit review because capture offload can make a valid on-wire packet look incorrect at the capture point. Before changing anything, distinguish a genuine malformed packet from a checksum-offload artifact. The checksum evidence guide explains that distinction.

When a supported header rewrite changes IPv4, TCP, or UDP fields, the corresponding supported repair path can update checksums. A fixed-length raw edit does not automatically invoke that logic. Non-IP protocols, encapsulated packets, IPv6 extension cases, fragmented traffic, and application integrity mechanisms may require separate handling.

After export, reopen the derivative in a trusted parser and inspect a packet before, inside, and after the changed region. Confirm lengths, timestamps, link type, protocol decode, and checksum interpretation.

Export preflight

Preflight is available before the final write and should be treated as a decision gate. Review:

whether the full capture or a subset is selected;
how many packets will be included;
whether any packets are marked to keep or drop;
which transformations are pending;
whether checksum handling matches those transformations;
what the bounded privacy inventory found;
which warnings remain unresolved;
where the derivative file will be written.

The Community workflow can inspect and prepare a capture. Writing the final PCAP requires the paid pcap-export capability. Licensing does not change the parser's safety boundary; it only controls the export action.

Validation checklist

Before sharing or automating around an output:

Keep the original capture read-only and separately named.
Write the output to a new path.
Record why each retained packet is necessary.
Verify the first and last packet in the subset.
Confirm packet count and timestamp order.
Inspect representative rewritten fields and raw bytes.
Recheck IPv4, TCP, and UDP checksum behavior where applicable.
Search separately for customer identifiers and credentials.
Reopen the file in a second trusted parser.
Confirm that the support or QA conclusion remains defensible.

If the output will become a regression fixture, run the consuming test against that exact exported artifact and store its provenance with the fixture.

Frequently asked questions

Can PCAP Surgery capture packets from an interface?

No. It opens existing local files. Create the capture with a suitable capture tool, then bring the saved file into the workbench.

Does it convert PCAPNG to lossless PCAP?

No. The supported PCAPNG path is limited, and classic PCAP cannot preserve arbitrary PCAPNG block metadata. Keep the original PCAPNG file.

Can it export only one conversation?

It can export a supported filtered subset. You must choose a scope that preserves all packets needed to interpret that conversation.

Does an empty privacy warning list mean the file is safe?

No. The inventory is bounded and partial. It cannot inspect all encoded, encrypted, reassembled, or unknown content.

Are checksums always repaired after an edit?

No. Supported header-rewrite paths can repair corresponding IPv4, TCP, or UDP checksums. Arbitrary raw-byte edits do not automatically receive that repair.

Does export overwrite the input?

No. The workflow writes a new classic PCAP. Keep the source as immutable evidence.

For the broader end-to-end process, read the PCAP Surgery overview. Current editions and downloads are listed on the PCAP Surgery product page.

Direct answer and acceptance boundary

For “PCAP Surgery Capture Scope, Formats, and Export Limits”, the short answer is: Understand which PCAP and PCAPNG files PCAP Surgery can inspect, transform, preflight, and export, including checksum and privacy boundaries. Treat that statement as a result to verify, not as a promise that every input, device, project, or environment behaves identically. A complete result records the starting state, the exact action, the visible output, and the condition that proves the task is finished in PCAP Surgery.

Evidence-first operating procedure

Work from a small, repeatable case before changing a full project. Record the application version, operating system, input or device identity, relevant settings, and the expected result. Perform one deliberate action, preserve the first unexpected transition, and compare it with a known-good run whenever one is available. Changing several controls at once may hide which condition fixed or created the problem.

Checkpoint 1: PCAP Surgery Capture Scope, Formats, and Export Limits

Treat “PCAP Surgery Capture Scope, Formats, and Export Limits” as a separate acceptance gate for “PCAP Surgery Capture Scope, Formats, and Export Limits”. Record its initial state before acting, then capture the first visible change and the final state. If the result differs from the page’s stated outcome, return to the last confirmed checkpoint instead of continuing with assumptions.

Checkpoint 2: Understand which PCAP and PCAPNG files PCAP Surgery can inspect, transform, preflight, and

Verify “Understand which PCAP and PCAPNG files PCAP Surgery can inspect, transform, preflight, and export, including checksum and privacy boundaries.” with the smallest representative input. Keep unrelated settings unchanged, repeat the same action once, and note whether the result is stable after reopening or reconnecting. A screenshot alone is weaker than a record that includes the input, setting, action, output, and time.

Checkpoint 3: Supported input and output formats

For “Supported input and output formats”, distinguish a product decision from an operating-system, hardware, source-file, permission, or workflow boundary. Confirm which layer supplied the evidence before assigning a cause. This prevents a nearby symptom from being reported as a proven root cause.

Checkpoint 4: What packet selection can do

Use “What packet selection can do” to define a pass/fail statement that another operator can repeat. Include what should be present, what must be absent, and what recovery action is safe if the check fails. Keep the original project or capture unchanged until the repaired copy has passed the same check.

Checkpoint 5: Supported transformation classes

When “Supported transformation classes” is ambiguous, compare one known-good case with one failing case under matching conditions. Mark the first meaningful difference rather than listing every later symptom. That first boundary usually produces a clearer support request and a safer next experiment.

Checkpoint 6: What PCAP Surgery does not promise

Close “What PCAP Surgery does not promise” only after the saved, exported, or reopened result still matches the observed state. Temporary UI feedback is useful, but durable evidence is stronger. Record any limitation that remains so the next reader does not interpret an incomplete path as a successful one.

Checkpoint 7: Privacy inventory scope

Treat “Privacy inventory scope” as a separate acceptance gate for “PCAP Surgery Capture Scope, Formats, and Export Limits”. Record its initial state before acting, then capture the first visible change and the final state. If the result differs from the page’s stated outcome, return to the last confirmed checkpoint instead of continuing with assumptions.

Checkpoint 8: Checksum boundary

Verify “Checksum boundary” with the smallest representative input. Keep unrelated settings unchanged, repeat the same action once, and note whether the result is stable after reopening or reconnecting. A screenshot alone is weaker than a record that includes the input, setting, action, output, and time.

Checkpoint 9: Export preflight

For “Export preflight”, distinguish a product decision from an operating-system, hardware, source-file, permission, or workflow boundary. Confirm which layer supplied the evidence before assigning a cause. This prevents a nearby symptom from being reported as a proven root cause.

Checkpoint 10: Validation checklist

Use “Validation checklist” to define a pass/fail statement that another operator can repeat. Include what should be present, what must be absent, and what recovery action is safe if the check fails. Keep the original project or capture unchanged until the repaired copy has passed the same check.

Acceptance matrix

Checkpoint	Evidence to retain	Pass condition
PCAP Surgery Capture Scope, Formats, and Export Limits	Initial state, one action, and resulting state	A second operator can reproduce the stated outcome
Understand which PCAP and PCAPNG files PCAP Surgery can inspect, transform, preflight, and export, including checksum an	Initial state, one action, and resulting state	A second operator can reproduce the stated outcome
Supported input and output formats	Initial state, one action, and resulting state	A second operator can reproduce the stated outcome
What packet selection can do	Initial state, one action, and resulting state	A second operator can reproduce the stated outcome
Supported transformation classes	Initial state, one action, and resulting state	A second operator can reproduce the stated outcome
What PCAP Surgery does not promise	Initial state, one action, and resulting state	A second operator can reproduce the stated outcome

Failure isolation, recovery, and handoff

If a check fails, stop at the first failed boundary. Preserve the source, project, session, or capture; duplicate it before destructive editing; and change one variable per experiment. Repeating a broad workflow after several simultaneous changes may produce a different result without explaining why.

Separate absence of evidence from evidence of absence. A blank view may mean the wrong input, scope, filter, permission, device, time range, or project state rather than “nothing happened.” Verify the acquisition or import path before interpreting a decoder, editor, report, or export.

Before handoff, reopen the durable artifact and inspect its beginning, the decision point, and its end. Record version, platform, relevant configuration, expected behavior, observed behavior, and the smallest reproduction. Remove or redact sensitive material and confirm the recipient is authorized to receive it.

Questions and answers

What is the fastest reliable way to start?

Use the smallest representative case, write down the expected result, and change one variable. Confirm the basic path before adding filters, effects, edits, automation, or a larger source. This creates a baseline that can be compared after every later decision.

What evidence should be saved?

Keep the input identity, application version, platform, relevant settings, exact action, first unexpected transition, and final output. If the workflow creates a project, session, report, or export, close and reopen it before treating it as durable evidence.

When should the procedure be repeated?

Repeat it after an application, operating-system, driver, firmware, model, source, or workflow change that can alter the result. Preserve the earlier accepted case so the comparison uses the same acceptance boundary rather than memory.

When is the task ready for handoff?

It is ready when another authorized person can identify the input, repeat the action, see the same result, understand any remaining limitation, and open the saved artifact without relying on undocumented local state.

Related guides

Continue with the same-language pages below. They cover adjacent stages without changing the canonical owner of this topic: