pcapfix

PCAP (Packet Capture) is an API designed to capture network traffic, while PCAPNG (Packet Capture Next Generation) represents a modern implementation of PCAP. For example, Windows uses a port of the PCAP library (libpcap), known as WinPcap.

pcapfix is a command-line application developed to help you fix broken PCAP and PCAPNG files, in an effort to extract and inspect information about packets captured over the network.

It works top down, looking for an intact, only slightly damaged global header in the PCAP files, and restores its original form if it has any corrupt bytes. If a global header cannot be found because it doesn't exist, then the utility automatically creates one and inserts it into the beginning of the file.

In the next phase, the program scans the file for any PCAP headers that follow the global header to make sure the values are correct, at least in appearance. If this isn't the case, then it attempts to repair the packets responsible for the errors.

When it comes to PCAPNG, pcapfix checks all packets headers from the start. The section header and interface description block must exist or they will be automatically created (just like with the global header of PCAP files). The lightweight app makes sure the block sizes and option fields are correct. Otherwise, the invalid entries are repaired or, if this is unsuccessful, they are skipped and modified to produce a valid PCAPNG file.

The syntax for the binary release of pcapfix is "pcapfix [OPTIONS] filename". Besides pointing out the PCAP or PCAPNG file you want to scan for errors, you can ask the tool to tell the app it's a PCAPNG file (-n) since the default is set to PCAP, create a new file instead of overwriting the original one (-o <file>), or set the data link type (-t <nr>). You can enable deep scan mode (-d) and turn on verbosity (-v).

Unfortunately, the developer is no longer releasing binary forms of pcapfix. However, you can still download and use the last published binary from Softpedia. Nevertheless, the project is in active development, so you can get the newest source code. All aspects considered, pcapfix provides a straightforward solution for fixing broken PCAP and PCAPNG files.