Output formats
The two formats fragcap writes: extended pcapng and JSON Lines.
fragcap writes two output formats. Both carry the same facts; they differ in what
reads them. You choose a format per sink: --out FILE.fcapng and file: sinks
write pcapng, jsonl: sinks write JSON Lines.
pcapng
The default. fragcap writes standard pcapng, so any unmodified analyzer reads the capture as an ordinary packet trace. Compatibility is the point: the process attribution rides in each packet's comment, a field pcapng already defines, rather than in a private extension an analyzer would have to understand.
Open a .fcapng file in Wireshark or any pcapng-aware tool. The packets are there
as usual; the owning process, its role, and the attribution fidelity appear in the
per-packet comment. An analyzer that ignores comments still shows you the traffic.
JSON Lines
One JSON object per line, for programs rather than analyzers. A stream has three
record kinds, distinguished by the type field: the first line is a header,
every line in between is a packet (no type field), and the final line of a
successfully finalized stream is a trailer carrying the run's counts. A consumer
should switch on type and treat the trailer as end-of-stream, not as a
malformed packet.
{"type":"header","version":"fragcap/0.2.0","interfaces":["capture"]}
{"ts":1700000000.000000,"iface":"capture","pid":4242,"proc":"game.exe","role":"client","stage":"client","dir":"out","attr":"live","proto":"udp","src":"192.0.2.10:30000","dst":"198.51.100.5:5055","len":74,"orig_len":74,"data":"0200..."}
{"type":"trailer","packets":24,"attributed":24,"unattributed":0,"kernel_dropped":0,"interface_dropped":0,"buffer_dropped":0,"sink_dropped":0,"filter_gaps":0}Each packet line carries:
| Field | Meaning |
|---|---|
ts | The capture timestamp, seconds since the epoch. |
iface | The capturing interface. |
pid, proc | The owning process id and image name. |
role, stage | The profile role and stage that attributed the flow. |
dir | Direction relative to the capturing host: in or out. |
attr | The attribution fidelity, for example live or retained. |
proto | The transport protocol. |
src, dst | The endpoints, address:port. |
len, orig_len | The captured and original lengths. |
data | The packet bytes, hex-encoded. Omitted content under --no-payload. |
The attr field distinguishes a live socket-table match from a retained one: a
flow attributed from a connection that has since closed is marked, because a
reused port inside the retention window is the one way that answer can be wrong.
See attribution fidelity.
The trailer line carries the run's accounting: packets, attributed,
unattributed, and the discard counters kernel_dropped, interface_dropped,
buffer_dropped, sink_dropped, and filter_gaps. Every packet fragcap
observed is accounted for across these; a stream that ends without a trailer did
not finalize cleanly.
What is never in the output
Payloads are the game's own bytes, and game traffic is encrypted; fragcap records
that a conversation happened and which process owned it, not readable content.
--no-payload drops the bytes entirely and keeps the metadata, when even the
ciphertext is more than you want to store.