Revision history  [back]

In order for Wireshark to be able to read your packets, they need to be stored in one of the file formats Wireshark understands. The oldest and simplest format Wireshark can read is the pcap format, as outlined on https://wiki.wireshark.org/Development/LibpcapFileFormat.

Simply put, you need to have the following elements:

1. A pcap file header
2. Per packet:
   1. A pcap packet header
   2. The raw packet data

You can also use the newer and more versatile pcapng format as described on https://github.com/pcapng/pcapng