Main Content


PCAPNG file writer of protocol packets

Since R2020b


    The pcapngWriter object writes generated and recovered protocol packets to a packet capture next generation (PCAPNG) file (.pcapng).

    You can write these packet types to a PCAPNG file:

    • Generated and recovered 5G NR protocol packets

    • Generated and recovered WLAN protocol packets (requires WLAN Toolbox™)

    • Generated and recovered Bluetooth low energy (LE) link layer (LL) packets (requires Bluetooth® Toolbox)



    pcapngObj = pcapngWriter creates a default PCAPNG file writer object.


    pcapngObj = pcapngWriter(Name,Value) sets properties using one or more name-value pair arguments. Enclose each property name in quotes. For example, 'ByteOrder','big-endian' specifies the byte order as big-endian.


    expand all


    The pcapngWriter object does not overwrite the existing PCAP or PCAPNG file. Each time when you create this object, specify a unique PCAP or PCAPNG file name.

    Name of the PCAPNG file, specified as a character row vector or a string scalar.

    Data Types: char | string

    Byte order, specified as 'little-endian' or 'big-endian'.

    Data Types: char | string

    Comment for the PCAPNG file, specified as a character vector or a string scalar.

    Data Types: char | string

    Object Functions

    expand all

    writeWrite protocol packet data to PCAP or PCAPNG file
    writeCustomBlockWrite custom block to PCAPNG file
    writeInterfaceDescriptionBlockWrite interface description block to PCAPNG file


    collapse all

    Create a PCAPNG file writer object, specifying the name of the PCAPNG file.

    pcapngObj = pcapngWriter('FileName','sample');

    Write the interface block for 5G New Radio (NR). 5G NR packets do not have a valid link type. As per Tcpdump, if a valid link type is not present, specify the link type of SLL packet.

    interface = '5GNR';                                       % Interface name
    linkType = 113;                                           % Link type of SLL packet
    timestamp = 300;                                          % Timestamp
    interfaceID = writeInterfaceDescriptionBlock(pcapngObj,linkType,interface);

    5G NR packets are not directly supported by Wireshark. To enable Wireshark to parse 5G NR packets, add encapsulation and metadata to the 5G NR packet.

    payload = [59; 205];                                      % MAC subPDU (contains truncated buffer status report (BSR) control element)
    radioType = 1;                                            % Frequency division duplexing
    linkDir   = 0;                                            % Uplink packet
    rntiType = 3;                                             % Cell-RNTI
    startString = [109; 97; 99; 45; 110; 114];                % Tag to indicate start of NR MAC signature
    payloadTag = 1;                                           % Payload tag for NR MAC packets
    signature = [startString; radioType; linkDir; rntiType];
    macNRInfoPacket = [signature; payloadTag; payload];

    Construct a user datagram protocol (UDP) header.

    udpPacketLength = 8 + length(macNRInfoPacket);            % Length of header (8 bytes) and payload
    udpHeader = [163; 76;                                     % Source port number
        39; 15;                                               % Destination port number
        fix(udpPacketLength/256); mod(udpPacketLength,256);   % Total length of UDP packet
        0; 0];                                                % Checksum

    Construct an IPv4 header.

    ipPacketLength = 20 + udpPacketLength;                    % Length of header (20 bytes) and payload
    ipHeader = [69;                                           % Version of IP protocol and priority or traffic class
        0;                                                    % Type of service
        fix(ipPacketLength/256);mod(ipPacketLength,256);      % Total length of the IPv4 packet
        0; 1;                                                 % Identification
        0; 0;                                                 % Flags and fragmentation offset
        64;                                                   % Time to live in seconds
        17;                                                   % Protocol number
        0; 0;                                                 % Header checksum
        127; 0; 0; 1;                                         % Source IP address
        127; 0; 0; 1];                                        % Destination IP address

    Construct an SLL header.

    sllHeader = [0; 0;                                        % Packet type
        3; 4;                                                 % Address resolution protocol hardware (ARPHRD) type
        0; 0;                                                 % Link layer address length
        0; 0; 0; 0; 0; 0; 0; 0;                               % Link layer address
        8; 0];                                                % Protocol type

    Construct an 5G NR packet by adding encapsulation and metadata.

    packet = [sllHeader; ipHeader; udpHeader; macNRInfoPacket];

    Write the 5G NR packet to the PCAPNG file.

    packetComment = 'This is NR MAC packet';                  % Packet comment


    [1] Tuexen, M. “PCAP Next Generation (Pcapng) Capture File Format.” 2020.

    [2] Group, The Tcpdump. “Tcpdump/Libpcap Public Repository.” Accessed May 20, 2020.

    [3] “Development/LibpcapFileFormat - The Wireshark Wiki.” Accessed May 20, 2020.

    Extended Capabilities

    C/C++ Code Generation
    Generate C and C++ code using MATLAB® Coder™.

    Version History

    Introduced in R2020b