This is a static archive of our old Q&A Site. Please post any new questions and answers at

libpcap format - packet header - incl_len / orig_len


The libpcap packet header structure has 2 length fields:

typedef struct pcaprec_hdr_s {
        guint32 ts_sec;         /* timestamp seconds */
        guint32 ts_usec;        /* timestamp microseconds */
        guint32 incl_len;       /* number of octets of packet saved in file */
        guint32 orig_len;       /* actual length of packet */
} pcaprec_hdr_t;

incl_len: the number of bytes of packet data actually captured and saved in the file. This value should never become larger than orig_len or the snaplen value of the global header.

orig_len: the length of the packet as it appeared on the network when it was captured. If incl_len and orig_len differ, the actually saved packet size was limited by snaplen.

Can any one tell me what is the difference between the 2 length fields? We are saving the packet in entirely then how can the 2 differ?

asked 07 Mar '12, 21:17

v%20j's gravatar image

v j
accept rate: 0%

One Answer:


If you are capturing the entire packet they do not differ, but if yo have specified that only 96 bytes of each packet should be saved(snap lenght) then incl_lenght will be 96 and orig_len the actual lenght of the packets which makes it possible for a program reading the file to "know" that bytes are "missing".

answered 07 Mar '12, 21:58

Anders's gravatar image

Anders ♦
accept rate: 17%

I am trying to capture TinyOS (telosb mote) packets in wireshark. Wireshark doesnt support direct capture from telosb motes so i am writing a application that fetches the packets and writes to a capture file in pcap format. The problem is the received packets are in TINYOS format so I need to create a 802.15.4 packet from it. I have used the structure Ieee802154_packet (from wirshark) to create the packet and write to the file. Here incl/cap len should be the size of Ieee802154_packet struct? Please correct me if I am wrong.

(07 Mar '12, 22:21) v j