# Stripping layer 2 in pcap

DevFeed: [Stripping layer 2 in pcap](<https://devfeed.tech/articles/stripping-layer-2-in-pcap-38921.md>)

Original publisher: [Read original article](<https://idea.popcount.org/2013-01-29-stripping-layer-2-in-pcap>)

Author: Marek

Published: 2013-01-28T23:00:00Z

Content type: tutorial

Language: en

Sources: [Marek Majkowski](<https://devfeed.tech/sources/marek-majkowski.md>)

Topics: [Network](<https://devfeed.tech/topics/network.md>), [TCP/IP](<https://devfeed.tech/topics/tcp-ip.md>), [Code](<https://devfeed.tech/topics/code.md>), [Decoding](<https://devfeed.tech/topics/decoding.md>)

Tags: [code](<https://devfeed.tech/tags/code.md>), [decoding](<https://devfeed.tech/tags/decoding.md>), [network](<https://devfeed.tech/tags/network.md>), [tcp-ip](<https://devfeed.tech/tags/tcp-ip.md>)

## AI overview

The article explains why extracting IP headers from captured TCP/IP packets requires removing the layer 2 header first. It discusses data-link types, hardcoded offsets, VLAN headers, and differing strategies for decoding packet layouts.

## Source excerpt

Stripping layer 2 in pcap Say you want to sniff TCP/IP packets on your network. That's pretty easy, right? Use , receive packets from the network interface and we're done. But before you can extract the IP header from a received packet you need to strip layer 2 header. It's not that easy. tries to help only a bit - it is possible to get the data link type of the network interface. But this is useless without the knowledge of how to extract IP from given data link type.