## PCAP Tags

Tags extracted from CAP, PCAP and PCAPNG Packet Capture files.

> Tag ID | Tag Name | Writable | Values / Notes
> --- | --- | --- | ---
> 0x0001 | Comment | no |
> 0x0bac | CustomOption1 | no |
> 0x0bad | CustomOption2 | no |
> 0x4bac | CustomOption3 | no |
> 0x4bad | CustomOption4 | no |
> 'ByteOrder' | ByteOrder | no | 'II' = Little-endian (Intel, II) 'MM' = Big-endian (Motorola, MM)
> 'IDB-2' | DeviceName | no |
> 'IDB-3' | Description | no |
> 'IDB-4' | IPv4Addr | no |
> 'IDB-5' | IPv6Addr | no |
> 'IDB-6' | MACAddr | no |
> 'IDB-7' | EUIAddr | no |
> 'IDB-8' | Speed | no |
> 'IDB-9' | TimeStampResolution | no |
> 'IDB-10' | TimeZone | no |
> 'IDB-11' | Filter | no |
> 'IDB-12' | OperatingSystem | no |
> 'IDB-13' | FrameCheckSequenceLength | no |
> 'IDB-14' | TimeStampOffset | no |
> 'IDB-15' | Hardware | no |
> 'IDB-16' | TXSpeed | no |
> 'IDB-17' | RXSpeed | no |
> 'IDB-18' | TimezoneName | no |
> 'LinkType' | LinkType | no |
> 0 = BSD Loopback 1 = IEEE 802.3 Ethernet 2 = Experimental 4Mb Ethernet 3 = AX.25 4 = PRONET 5 = MIT CHAOSNET 6 = IEEE 802.5 7 = ARCNET BSD 8 = SLIP 9 = PPP 10 = fddI 50 = PPP HDLC 51 = PPP Ethernet 99 = Symantec Firewall 100 = ATM RFC 1483 101 = Raw 102 = SLIP BSD/OS 103 = PPP BSD/OS 104 = Cisco PPP with HDLC 105 = IEEE 802.11 106 = ATM Classical IP 107 = Frame Relay 108 = OpenBSD Loopback 109 = OpenBSD IPSEC 110 = ATM LANE 802.3 111 = NetBSD HIPPI 112 = NetBSD HDLC 113 = Linux SLL 114 = Apple LocalTalk 115 = Acorn Econet 116 = OpenBSD ipfilter 117 = OpenBSD pflog 118 = Cisco IOS 119 = IEEE 802.11 Prism 120 = IEEE 802.11 Aironet 121 = Siemens HiPath HDLC 122 = IP-over-Fibre 123 = SunATM 124 = RapidIO 125 = PCI Express 126 = Xilinx Aurora 127 = IEEE 802.11 Radiotap 128 = Tazmen Sniffer 129 = ARCNET Linux 130 = Juniper MLPPP 131 = Juniper MLFR 132 = Juniper ES 133 = Juniper GGSN 134 = Juniper MFR 135 = Juniper ATM2 136 = Juniper Services 137 = Juniper ATM1 138 = Apple IP-over-IEEE 1394 139 = MTP2 with PHDR 140 = MTP2 141 = MTP3 142 = SCCP 143 = DOCSIS 144 = Linux IrDA 145 = IBM SP 146 = IBM SN 163 = IEEE 802.11 AVS 164 = Juniper Monitor 165 = BACnet MS/TP 166 = PPP PPPD 167 = Juniper PPPOE 168 = Juniper PPPOE ATM 169 = GPRS LLC 170 = GPF-T 171 = GPF-F 172 = Gcom T1/E1 173 = Gcom Serial 174 = Juniper PIC Peer 175 = ERF ETH 176 = ERF POS 177 = Linux LAPD 178 = Juniper Ether 179 = Juniper PPP 180 = Juniper Frame Relay 181 = Juniper CHDLC 182 = Juniper VP 185 = A653 ICM 186 = USB FreeBSD 187 = Bluetooth HCI H4 188 = IEEE 802.16 MAC CPS 189 = USB Linux 190 = CAN 2.0B 191 = IEEE 802.15.4 Linux 192 = PPI 193 = IEEE 802.16 MAC CPS Radio 194 = Juniper ISM 195 = IEEE 802.15.4 with FCS 196 = SITA |  | 197 = ERF 198 = RAIF1 199 = IPMB Kontron 200 = Juniper ST 201 = Bluetooth HCI H4 with PHDR 202 = AX.25 KISS 203 = LAPD 204 = PPP with DIR 205 = Cisco HDLC with DIR 206 = Frame Relay with DIR 207 = LAPB with DIR 209 = IPMB Linux 210 = FlexRay 211 = MOST 212 = LIN 213 = X2E Serial 214 = X2E Xoraya 215 = IEEE 802.15.4 Nonask PHY 216 = Linux evdev 217 = GSMtap Um 218 = GSMtap Abis 219 = MPLS 220 = USB Linux MMapped 221 = DECT 222 = AOS 223 = Wireless HART 224 = FC-2 225 = FC-2 with Frame Delims 226 = IPNET 227 = CAN Socketcan 228 = IPv4 229 = IPv6 230 = IEEE 802.15.4 No FCS 231 = D-Bus 232 = Juniper VS 233 = Juniper SRX E2E 234 = Juniper Fibre Channel 235 = DVB-CI 236 = Mux 27.010 237 = STANAG 5066 D_PDU 238 = Juniper ATM Cemic 239 = NFLOG 240 = Netanalyzer 241 = Netanalyzer Transparent 242 = IP-over-InfiniBand 243 = MPEG-2 TS 244 = NG40 245 = NFC LLCP 246 = Pfsync 247 = InfiniBand 248 = SCTP 249 = USBPcap 250 = RTAC Serial 251 = Bluetooth LE LL 252 = Wireshark Upper PDU 253 = Netlink 254 = Bluetooth Linux Monitor 255 = Bluetooth BREDR BB 256 = Bluetooth LE LL with PHDR 257 = PROFIBUS Data Link 258 = Apple PKTAP 259 = EPON 260 = IPMI HPM.2 261 = Z-Wave R1/R2 262 = Z-Wave R3 263 = WattStopper DLM 264 = ISO 14443 265 = RDS 266 = USB Darwin 267 = Openflow 268 = SDLC 269 = TI LLN Sniffer 270 = LoRaTap 271 = Vsock 272 = Nordic BLE 273 = DOCSIS 31 XRA31 274 = Ethernet MPacket 275 = DisplayPort AUX 276 = Linux SLL2 277 = Sercos Monitor 278 = Openvizsla 279 = Elektrobit EBHSR 280 = VPP Dispatch 281 = DSA Tag BRCM 282 = DSA Tag BRCM Prepend 283 = IEEE 802.15.4 Tap 284 = DSA Tag DSA 285 = DSA Tag EDSA 286 = ELEE 287 = Z-Wave Serial 288 = USB 2.0 289 = ATSC ALP
> 'PCAPVersion' | PCAPVersion | no |
> 'SHB-2' | Hardware | no |
> 'SHB-3' | OperatingSystem | no |
> 'SHB-4' | UserApplication | no |
> 'TimeStamp' | TimeStamp | no |

(This document generated automatically by Image::ExifTool::BuildTagLookup)
Last revised Mar 11, 2025

<-- ExifTool Tag Names