diff --git a/README.md b/README.md
index a679b2ee..d8004130 100644
--- a/README.md
+++ b/README.md
@@ -41,7 +41,8 @@ Table of Contents
   * Supports filtering packets by container ID, container name and pod name.
 * Supports using pcap-filter(7) syntax for filtering packets.
 * Directly applies filters in the kernel space.
-* Supports saving captured packets in the PcapNG format for offline analysis with third-party tools such as Wireshark.
+* Supports saving captured packets in the PcapNG format for offline analysis with third-party tools such as Wireshark/tshark/tcpdump.
+* Supports packet capture for network interfaces under the specified network namespace.
 
 
 ## Installation
@@ -108,6 +109,16 @@ sudo ptcpdump -i any -w - port 80 | tcpdump -n -r -
 sudo ptcpdump -i any -w - port 80 | tshark -r -
 ```
 
+
+Capturing interfaces in other network namespaces:
+
+```
+sudo ptcpdump -i lo --netns /run/netns/foo --netns /run/netns/bar
+sudo ptcpdump -i any --netns /run/netns/foobar
+sudo ptcpdump -i any --netns /proc/26/ns/net
+```
+
+
 <p align="right"><a href="#top">🔝</a></p>
 
 
@@ -121,6 +132,13 @@ Default:
 09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: Flags [S], seq 4113492822, win 64240, length 0, ParentProc [python3.834381], Container [test], Pod [test.default]
 ```
 
+With `-q`:
+
+```
+09:32:09.718892 vethee2a302f wget.3553008 In IP 10.244.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
+09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
+```
+
 With `-v`:
 
 ```
@@ -220,6 +238,7 @@ Flags:
       --delay-before-handle-packet-events duration   Delay some durations before handle packet events
   -Q, --direction string                             Choose send/receive direction for which packets should be captured. Possible values are 'in', 'out' and 'inout' (default "inout")
       --docker-address string                        Address of Docker Engine service (default "/var/run/docker.sock")
+      --embed-keylog-to-pcapng -- CMD [ARGS]         Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
       --event-chan-size uint                         Size of event chan (default 20)
       --exec-events-worker-number uint               Number of worker to handle exec events (default 50)
   -f, --follow-forks                                 Trace child processes as they are created by currently traced processes when filter by process
@@ -230,6 +249,7 @@ Flags:
       --log-level string                             Set the logging level ("debug", "info", "warn", "error", "fatal") (default "warn")
       --micro                                        Shorthands for --time-stamp-precision=micro
       --nano                                         Shorthands for --time-stamp-precision=nano
+      --netns strings                                Path to an network namespace file or name (default [/proc/self/ns/net])
   -n, --no-convert-addr count                        Don't convert addresses (i.e., host addresses, port numbers, etc.) to names
   -t, --no-timestamp                                 Don't print a timestamp on each dump line
   -#, --number                                       Print an optional packet number at the beginning of the line
@@ -241,6 +261,7 @@ Flags:
   -A, --print-data-in-ascii                          Print each packet (minus its link level header) in ASCII
   -x, --print-data-in-hex count                      When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex
   -X, --print-data-in-hex-ascii count                When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex and ASCII
+  -q, --quiet                                        Quiet output. Print less protocol information so output lines are shorter
   -r, --read-file string                             Read packets from file (which was created with the -w option). e.g. ptcpdump.pcapng
   -c, --receive-count uint                           Exit after receiving count packets
   -s, --snapshot-length uint32                       Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes (default 262144)
@@ -248,6 +269,8 @@ Flags:
   -v, --verbose count                                When parsing and printing, produce (slightly more) verbose output
       --version                                      Print the ptcpdump and libpcap version strings and exit
   -w, --write-file string                            Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is '-'. e.g. ptcpdump.pcapng
+      --write-keylog-file -- CMD [ARGS]              Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
+
 ```
 
 <p align="right"><a href="#top">🔝</a></p>
@@ -271,21 +294,22 @@ Flags:
 | --pod-name *pod_name.namespace*                   |         | ✅                        |
 | -f, --follow-forks                                |         | ✅                        |
 | -- *command [args]*                               |         | ✅                        |
-| --oneline                                       |         | ✅                        |
+| --oneline                                         |         | ✅                        |
+| --netns *path_to_net_ns*                          |         | ✅                        |
 | --print                                           | ✅       | ✅                        |
 | -c *count*                                        | ✅       | ✅                        |
 | -Q *direction*, --direction=*direction*           | ✅       | ✅                        |
 | -D, --list-interfaces                             | ✅       | ✅                        |
 | -A                                                | ✅       | ✅                        |
-| -x                                                | ✅       | ✅                      |
-| -xx                                               | ✅       | ✅                      |
-| -X                                                | ✅       | ✅                     |
-| -XX                                               | ✅       | ✅                     |
-| -v                                                | ✅       | ✅                       |
-| -vv                                               | ✅       | ⭕                       |
-| -vvv                                              | ✅       | ⭕                       |
+| -x                                                | ✅       | ✅                        |
+| -xx                                               | ✅       | ✅                        |
+| -X                                                | ✅       | ✅                        |
+| -XX                                               | ✅       | ✅                        |
+| -v                                                | ✅       | ✅                        |
+| -vv                                               | ✅       | ⭕                        |
+| -vvv                                              | ✅       | ⭕                        |
 | -B *bufer_size*, --buffer-size=*buffer_size*      | ✅       |                          |
-| --count                                           | ✅       | ✅                       |
+| --count                                           | ✅       | ✅                        |
 | -C *file_size                                     | ✅       |                          |
 | -d                                                | ✅       |                          |
 | -dd                                               | ✅       |                          |
@@ -301,23 +325,24 @@ Flags:
 | --immediate-mode                                  | ✅       |                          |
 | -j *tstamp_type*, --time-stamp-type=*tstamp_type* | ✅       |                          |
 | -J, --list-time-stamp-types                       | ✅       |                          |
-| --time-stamp-precision=*tstamp_precision*         | ✅       | ✅                       |
-| --micro                                           | ✅       | ✅                       |
-| --nano                                            | ✅       | ✅                       |
+| --time-stamp-precision=*tstamp_precision*         | ✅       | ✅                        |
+| --micro                                           | ✅       | ✅                        |
+| --nano                                            | ✅       | ✅                        |
 | -K, --dont-verify-checksums                       | ✅       |                          |
 | -l                                                | ✅       |                          |
 | -L, --list-data-link-types                        | ✅       |                          |
 | -m *module*                                       | ✅       |                          |
 | -M *secret*                                       | ✅       |                          |
-| -n                                                | ✅       | ✅                       |
+| -n                                                | ✅       | ✅                        |
 | -N                                                | ✅       |                          |
-| -#, --number                                      | ✅       | ✅                       |
+| -#, --number                                      | ✅       | ✅                        |
 | -O, --no-optimize                                 | ✅       |                          |
 | -p, --no-promiscuous-mode                         | ✅       | ⛔                        |
+| -q                                                | ✅       | ✅                        |
 | -S, --absolute-tcp-sequence-numbers               | ✅       |                          |
-| -s *snaplen*, --snapshot-length=*snaplen*         | ✅       | ✅                       |
+| -s *snaplen*, --snapshot-length=*snaplen*         | ✅       | ✅                        |
 | -T *type*                                         | ✅       |                          |
-| -t                                                | ✅       | ✅                       |
+| -t                                                | ✅       | ✅                        |
 | -tt                                               | ✅       | ⭕                        |
 | -ttt                                              | ✅       | ⭕                        |
 | -tttt                                             | ✅       | ⭕                        |
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 51b84b65..ade838e6 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -45,6 +45,7 @@ Table of Contents
 * 直接在内核态应用过滤规则，避免在用户态应用过滤规则导致的性能问题
 * 支持以 pcap 或 PcapNG 保存捕获的流程, 可以使用 Wireshark、tcpdump、tshark 等第三方工具对保存的数据进行二次分析.
 * 以静态链接的方式编译程序，不依赖额外的系统链接库
+* 支持对指定网络命名空间下的网络接口进行抓包
 
 
 ## Installation
@@ -76,7 +77,7 @@ sudo ptcpdump -i eth0 -A -s 0 -n -v tcp and port 80 and host 10.10.1.1
 sudo ptcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'
 ```
 
-过滤多个网络接口：
+对多个网络接口进行抓包：
 
 ```
 sudo ptcpdump -i eth0 -i lo
@@ -116,6 +117,15 @@ sudo ptcpdump -i any -w - port 80 | tcpdump -n -r -
 sudo ptcpdump -i any -w - port 80 | tshark -r -
 ```
 
+支持对其他网络命名空间下的网络接口进行抓包:
+
+```
+sudo ptcpdump -i lo --netns /run/netns/foo --netns /run/netns/bar
+sudo ptcpdump -i any --netns /run/netns/foobar
+sudo ptcpdump -i any --netns /proc/26/ns/net
+```
+
+
 <p align="right"><a href="#top">🔝</a></p>
 
 
@@ -129,6 +139,13 @@ sudo ptcpdump -i any -w - port 80 | tshark -r -
 09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: Flags [S], seq 4113492822, win 64240, length 0, ParentProc [python3.834381], Container [test], Pod [test.default]
 ```
 
+通过 `-q` 参数指定不输出协议详细信息:
+
+```
+09:32:09.718892 vethee2a302f wget.3553008 In IP 10.244.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
+09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
+```
+
 通过 `-v` 参数以详细方式输出:
 
 ```
@@ -228,6 +245,7 @@ Flags:
       --delay-before-handle-packet-events duration   Delay some durations before handle packet events
   -Q, --direction string                             Choose send/receive direction for which packets should be captured. Possible values are 'in', 'out' and 'inout' (default "inout")
       --docker-address string                        Address of Docker Engine service (default "/var/run/docker.sock")
+      --embed-keylog-to-pcapng -- CMD [ARGS]         Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
       --event-chan-size uint                         Size of event chan (default 20)
       --exec-events-worker-number uint               Number of worker to handle exec events (default 50)
   -f, --follow-forks                                 Trace child processes as they are created by currently traced processes when filter by process
@@ -238,6 +256,7 @@ Flags:
       --log-level string                             Set the logging level ("debug", "info", "warn", "error", "fatal") (default "warn")
       --micro                                        Shorthands for --time-stamp-precision=micro
       --nano                                         Shorthands for --time-stamp-precision=nano
+      --netns strings                                Path to an network namespace file or name (default [/proc/self/ns/net])
   -n, --no-convert-addr count                        Don't convert addresses (i.e., host addresses, port numbers, etc.) to names
   -t, --no-timestamp                                 Don't print a timestamp on each dump line
   -#, --number                                       Print an optional packet number at the beginning of the line
@@ -249,6 +268,7 @@ Flags:
   -A, --print-data-in-ascii                          Print each packet (minus its link level header) in ASCII
   -x, --print-data-in-hex count                      When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex
   -X, --print-data-in-hex-ascii count                When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex and ASCII
+  -q, --quiet                                        Quiet output. Print less protocol information so output lines are shorter
   -r, --read-file string                             Read packets from file (which was created with the -w option). e.g. ptcpdump.pcapng
   -c, --receive-count uint                           Exit after receiving count packets
   -s, --snapshot-length uint32                       Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes (default 262144)
@@ -256,6 +276,8 @@ Flags:
   -v, --verbose count                                When parsing and printing, produce (slightly more) verbose output
       --version                                      Print the ptcpdump and libpcap version strings and exit
   -w, --write-file string                            Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is '-'. e.g. ptcpdump.pcapng
+      --write-keylog-file -- CMD [ARGS]              Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
+
 ```
 
 <p align="right"><a href="#top">🔝</a></p>
@@ -282,21 +304,22 @@ Flags:
 | --pod-name *pod_name.namespace*                   |         | ✅                        |
 | -f, --follow-forks                                |         | ✅                        |
 | -- *command [args]*                               |         | ✅                        |
-| --oneline                                       |         | ✅                        |
+| --oneline                                         |         | ✅                        |
+| --netns *path_to_net_ns*                          |         | ✅                        |
 | --print                                           | ✅       | ✅                        |
 | -c *count*                                        | ✅       | ✅                        |
 | -Q *direction*, --direction=*direction*           | ✅       | ✅                        |
 | -D, --list-interfaces                             | ✅       | ✅                        |
 | -A                                                | ✅       | ✅                        |
-| -x                                                | ✅       | ✅                      |
-| -xx                                               | ✅       | ✅                      |
-| -X                                                | ✅       | ✅                     |
-| -XX                                               | ✅       | ✅                     |
-| -v                                                | ✅       | ✅                       |
-| -vv                                               | ✅       | ⭕                       |
-| -vvv                                              | ✅       | ⭕                       |
+| -x                                                | ✅       | ✅                        |
+| -xx                                               | ✅       | ✅                        |
+| -X                                                | ✅       | ✅                        |
+| -XX                                               | ✅       | ✅                        |
+| -v                                                | ✅       | ✅                        |
+| -vv                                               | ✅       | ⭕                        |
+| -vvv                                              | ✅       | ⭕                        |
 | -B *bufer_size*, --buffer-size=*buffer_size*      | ✅       |                          |
-| --count                                           | ✅       | ✅                       |
+| --count                                           | ✅       | ✅                        |
 | -C *file_size                                     | ✅       |                          |
 | -d                                                | ✅       |                          |
 | -dd                                               | ✅       |                          |
@@ -312,23 +335,24 @@ Flags:
 | --immediate-mode                                  | ✅       |                          |
 | -j *tstamp_type*, --time-stamp-type=*tstamp_type* | ✅       |                          |
 | -J, --list-time-stamp-types                       | ✅       |                          |
-| --time-stamp-precision=*tstamp_precision*         | ✅       | ✅                       |
-| --micro                                           | ✅       | ✅                       |
-| --nano                                            | ✅       | ✅                       |
+| --time-stamp-precision=*tstamp_precision*         | ✅       | ✅                        |
+| --micro                                           | ✅       | ✅                        |
+| --nano                                            | ✅       | ✅                        |
 | -K, --dont-verify-checksums                       | ✅       |                          |
 | -l                                                | ✅       |                          |
 | -L, --list-data-link-types                        | ✅       |                          |
 | -m *module*                                       | ✅       |                          |
 | -M *secret*                                       | ✅       |                          |
-| -n                                                | ✅       | ✅                       |
+| -n                                                | ✅       | ✅                        |
 | -N                                                | ✅       |                          |
-| -#, --number                                      | ✅       | ✅                       |
+| -#, --number                                      | ✅       | ✅                        |
 | -O, --no-optimize                                 | ✅       |                          |
 | -p, --no-promiscuous-mode                         | ✅       | ⛔                        |
+| -q                                                | ✅       | ✅                        |
 | -S, --absolute-tcp-sequence-numbers               | ✅       |                          |
-| -s *snaplen*, --snapshot-length=*snaplen*         | ✅       | ✅                       |
+| -s *snaplen*, --snapshot-length=*snaplen*         | ✅       | ✅                        |
 | -T *type*                                         | ✅       |                          |
-| -t                                                | ✅       | ✅                       |
+| -t                                                | ✅       | ✅                        |
 | -tt                                               | ✅       | ⭕                        |
 | -ttt                                              | ✅       | ⭕                        |
 | -tttt                                             | ✅       | ⭕                        |
diff --git a/cmd/list.go b/cmd/list.go
index c32c9904..015e649b 100644
--- a/cmd/list.go
+++ b/cmd/list.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 )
 
-func listInterfaces(opts Options) error {
+func listInterfaces(opts *Options) error {
 	opts.ifaces = nil
 	devices, err := opts.GetDevices()
 	if err != nil {
diff --git a/cmd/log.go b/cmd/log.go
index a4f44b21..10a039f6 100644
--- a/cmd/log.go
+++ b/cmd/log.go
@@ -22,7 +22,7 @@ func logFatal(err error) {
 	log.Fatalf("%+v", err)
 }
 
-func setupLogger(opts Options) {
+func setupLogger(opts *Options) {
 	switch opts.logLevel {
 	case "debug":
 		log.SetLevel(plog.DebugLevel)
diff --git a/cmd/options.go b/cmd/options.go
index 8838962b..604540d3 100644
--- a/cmd/options.go
+++ b/cmd/options.go
@@ -9,6 +9,7 @@ import (
 	"github.com/mozillazg/ptcpdump/internal/types"
 	"github.com/mozillazg/ptcpdump/internal/writer"
 	"github.com/x-way/pktdump"
+	"io"
 	"os"
 	"path"
 	"strings"
@@ -50,6 +51,7 @@ type Options struct {
 
 	dontConvertAddr int
 	verbose         int
+	quiet           bool
 
 	containerId   string
 	containerName string
@@ -76,6 +78,8 @@ type Options struct {
 	netnsIds []uint32
 	pidnsIds []uint32
 
+	stdout io.Writer
+
 	netNsPaths    []string
 	devices       *types.Interfaces
 	netNSCache    *metadata.NetNsCache
@@ -162,11 +166,12 @@ func getDefaultCriRuntimeEndpoint() []string {
 	return rs
 }
 
-func (o Options) applyToStdoutWriter(w *writer.StdoutWriter) {
+func (opts *Options) applyToStdoutWriter(w *writer.StdoutWriter) {
 	w.OneLine = opts.oneLine
 	w.PrintNumber = opts.printPacketNumber
 	w.NoTimestamp = opts.dontPrintTimestamp
 	w.TimestampNano = opts.TimeStampAsNano()
+	w.Quiet = opts.quiet
 	if opts.onlyPrintCount {
 		w.DoNothing = true
 	}
@@ -259,6 +264,13 @@ func (o *Options) GetDevices() (*types.Interfaces, error) {
 	return o.devices, nil
 }
 
+func (o *Options) getStdout() io.Writer {
+	if o.stdout == nil {
+		o.stdout = os.Stdout
+	}
+	return o.stdout
+}
+
 func (o *Options) ToCapturerOptions() *capturer.Options {
 	copts := &capturer.Options{
 		Pids:                          o.pids,
@@ -269,6 +281,7 @@ func (o *Options) ToCapturerOptions() *capturer.Options {
 		DirectionIn:                   o.DirectionIn(),
 		DirectionOut:                  o.DirectionOut(),
 		OneLine:                       o.oneLine,
+		Quiet:                         o.quiet,
 		PrintPacketNumber:             o.printPacketNumber,
 		DontPrintTimestamp:            o.dontPrintTimestamp,
 		OnlyPrintCount:                o.onlyPrintCount,
diff --git a/cmd/read.go b/cmd/read.go
index 884158a3..7268fc1c 100644
--- a/cmd/read.go
+++ b/cmd/read.go
@@ -3,6 +3,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"github.com/mozillazg/ptcpdump/internal/utils"
 	"io"
 	"os"
 	"path/filepath"
@@ -12,8 +13,11 @@ import (
 	"github.com/mozillazg/ptcpdump/internal/writer"
 )
 
-func read(ctx context.Context, opts Options) error {
-	f, err := os.Open(opts.ReadPath())
+func read(ctx context.Context, opts *Options) error {
+	fpath := opts.ReadPath()
+	utils.OutStderr("reading from file %s\n", fpath)
+
+	f, err := os.Open(fpath)
 	if err != nil {
 		return err
 	}
@@ -21,10 +25,10 @@ func read(ctx context.Context, opts Options) error {
 
 	var p parser.Parser
 	pcache := metadata.NewProcessCache()
-	stdoutWriter := writer.NewStdoutWriter(os.Stdout, pcache)
+	stdoutWriter := writer.NewStdoutWriter(opts.getStdout(), pcache)
 	opts.applyToStdoutWriter(stdoutWriter)
 
-	ext := filepath.Ext(opts.ReadPath())
+	ext := filepath.Ext(fpath)
 	switch ext {
 	case extPcap:
 		pr, err := parser.NewPcapParser(f)
diff --git a/cmd/read_test.go b/cmd/read_test.go
new file mode 100644
index 00000000..620abe97
--- /dev/null
+++ b/cmd/read_test.go
@@ -0,0 +1,132 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"github.com/stretchr/testify/assert"
+	"os"
+	"testing"
+)
+
+func TestFormat(t *testing.T) {
+	type args struct {
+		name            string
+		opts            *Options
+		expectedOutFile string
+	}
+
+	tests := []args{
+		{
+			name: "tcp",
+			opts: &Options{
+				readFilePath: "../testdata/format/tcp.pcapng",
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.out.txt",
+		},
+		{
+			name: "tcp -v",
+			opts: &Options{
+				readFilePath: "../testdata/format/tcp.pcapng",
+				verbose:      1,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-v.out.txt",
+		},
+		{
+			name: "tcp -q",
+			opts: &Options{
+				readFilePath: "../testdata/format/tcp.pcapng",
+				quiet:        true,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-q.out.txt",
+		},
+		{
+			name: "tcp -A",
+			opts: &Options{
+				readFilePath:     "../testdata/format/tcp.pcapng",
+				printDataAsASCII: true,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-A.out.txt",
+		},
+		{
+			name: "tcp -x",
+			opts: &Options{
+				readFilePath:   "../testdata/format/tcp.pcapng",
+				printDataAsHex: 1,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-x.out.txt",
+		},
+		{
+			name: "tcp -xx",
+			opts: &Options{
+				readFilePath:   "../testdata/format/tcp.pcapng",
+				printDataAsHex: 2,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-xx.out.txt",
+		},
+		{
+			name: "tcp -X",
+			opts: &Options{
+				readFilePath:        "../testdata/format/tcp.pcapng",
+				printDataAsHexASCII: 1,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-X.out.txt",
+		},
+		{
+			name: "tcp -XX",
+			opts: &Options{
+				readFilePath:        "../testdata/format/tcp.pcapng",
+				printDataAsHexASCII: 2,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-XX.out.txt",
+		},
+		{
+			name: "mptcp",
+			opts: &Options{
+				readFilePath: "../testdata/format/mptcp.pcap",
+			},
+			expectedOutFile: "../testdata/format/mptcp.pcap.out.txt",
+		},
+		{
+			name: "tfo and sack",
+			opts: &Options{
+				readFilePath: "../testdata/format/tfo.pcap",
+			},
+			expectedOutFile: "../testdata/format/tfo.pcap.out.txt",
+		},
+		{
+			name: "udp",
+			opts: &Options{
+				readFilePath: "../testdata/format/udp.pcap",
+			},
+			expectedOutFile: "../testdata/format/udp.pcap.out.txt",
+		},
+		{
+			name: "udp dns",
+			opts: &Options{
+				readFilePath: "../testdata/format/dns.pcapng",
+			},
+			expectedOutFile: "../testdata/format/dns.pcapng.out.txt",
+		},
+		{
+			name: "udp dns -q",
+			opts: &Options{
+				readFilePath: "../testdata/format/dns.pcapng",
+				quiet:        true,
+			},
+			expectedOutFile: "../testdata/format/dns.pcapng.-q.out.txt",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output := bytes.Buffer{}
+			tt.opts.stdout = &output
+
+			err := read(context.TODO(), tt.opts)
+			assert.NoError(t, err)
+
+			expected, err := os.ReadFile(tt.expectedOutFile)
+			assert.NoError(t, err)
+			assert.Equal(t, string(expected), output.String())
+		})
+	}
+}
diff --git a/cmd/root.go b/cmd/root.go
index 3466a6fb..379af74e 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -12,7 +12,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var opts = Options{}
+var opts = &Options{}
 
 var rootCmd = &cobra.Command{
 	Use: `ptcpdump [flags] [expression] [-- command [args]]
@@ -36,7 +36,7 @@ Expression: see "man 7 pcap-filter"`,
 		" it adds process info as packet comments for each Packet when possible.\n" +
 		" More info: https://github.com/mozillazg/ptcpdump",
 	Run: func(cmd *cobra.Command, args []string) {
-		prepareOptions(&opts, os.Args, args)
+		prepareOptions(opts, os.Args, args)
 		setupLogger(opts)
 
 		err := run(opts)
@@ -125,6 +125,8 @@ func init() {
 
 	rootCmd.Flags().StringSliceVar(&opts.netNsPaths, "netns", []string{"/proc/self/ns/net"},
 		"Path to an network namespace file or name")
+	rootCmd.Flags().BoolVarP(&opts.quiet, "quiet", "q", false,
+		"Quiet output. Print less protocol information so output lines are shorter")
 
 	silenceKlog()
 }
@@ -133,7 +135,7 @@ func Execute() error {
 	return rootCmd.Execute()
 }
 
-func run(opts Options) error {
+func run(opts *Options) error {
 	ctx, stopFunc := signal.NotifyContext(
 		context.Background(), syscall.SIGINT, syscall.SIGTERM,
 	)
@@ -149,7 +151,7 @@ func run(opts Options) error {
 	case opts.ReadPath() != "":
 		return read(ctx, opts)
 	default:
-		return capture(ctx, stopFunc, &opts)
+		return capture(ctx, stopFunc, opts)
 	}
 
 	return nil
diff --git a/go.mod b/go.mod
index 723a6c10..c5380887 100644
--- a/go.mod
+++ b/go.mod
@@ -106,7 +106,7 @@ require (
 replace (
 	github.com/gopacket/gopacket => github.com/mozillazg/gopacket v0.0.0-20241026043817-048341de5231
 	// github.com/gopacket/gopacket => ../../gopacket/gopacket
-	github.com/x-way/pktdump => github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d
+	github.com/x-way/pktdump => github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1
 	// github.com/x-way/pktdump => ../../x-way/pktdump
 	k8s.io/cri-api => github.com/mozillazg/cri-api v0.32.0-alpha.1.0.20241019013855-3dc36f8743df
 	k8s.io/cri-client => github.com/mozillazg/cri-client v0.31.0-alpha.0.0.20241019023238-87687176fd67
diff --git a/go.sum b/go.sum
index 2b3b67a3..187294c7 100644
--- a/go.sum
+++ b/go.sum
@@ -191,8 +191,8 @@ github.com/mozillazg/cri-client v0.31.0-alpha.0.0.20241019023238-87687176fd67 h1
 github.com/mozillazg/cri-client v0.31.0-alpha.0.0.20241019023238-87687176fd67/go.mod h1:pFm23AAi/gIlW9FGrWPTPnGe1xsyGHPFFO/zezc4w90=
 github.com/mozillazg/gopacket v0.0.0-20241026043817-048341de5231 h1:uvhf0oGPfJ24Lc5/N2ysh9sQc71Pog67zxKiLVS4/Qg=
 github.com/mozillazg/gopacket v0.0.0-20241026043817-048341de5231/go.mod h1:WnFrU1Xkf5lWKV38uKNR9+yYtppn+ZYzOyNqMeH4oNE=
-github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d h1:3K1bsX3osp69xQnbvrXHokKRebpiENUUgGLA6OC5Jd8=
-github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d/go.mod h1:Vh2MvrLyL23PaYh0Dp2Ihg6qTmNydO2su6ngpJEp/hM=
+github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1 h1:kVgiW9P9tfqPXrIU/ZKC8XwkhHkri3s439D+RqSpF6g=
+github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1/go.mod h1:Vh2MvrLyL23PaYh0Dp2Ihg6qTmNydO2su6ngpJEp/hM=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
diff --git a/internal/capturer/capturer.go b/internal/capturer/capturer.go
index c9a12498..ad5e06d4 100644
--- a/internal/capturer/capturer.go
+++ b/internal/capturer/capturer.go
@@ -51,6 +51,7 @@ type Options struct {
 	DirectionOut   bool
 	DirectionIn    bool
 	OneLine        bool
+	Quiet          bool
 
 	PrintPacketNumber   bool
 	DontPrintTimestamp  bool
diff --git a/internal/writer/stdout.go b/internal/writer/stdout.go
index 909e2ee8..5fc4130d 100644
--- a/internal/writer/stdout.go
+++ b/internal/writer/stdout.go
@@ -22,6 +22,7 @@ type StdoutWriter struct {
 	NoTimestamp   bool
 	TimestampNano bool
 	DoNothing     bool
+	Quiet         bool
 	FormatStyle   pktdump.FormatStyle
 	DataStyle     pktdump.ContentStyle
 
@@ -85,8 +86,9 @@ func (w *StdoutWriter) Write(e *event.Packet) error {
 		HeaderStyle:   w.FormatStyle,
 		ContentStyle:  w.DataStyle,
 		ContentIndent: "        ",
+		Quiet:         w.Quiet,
 	}
-	formatedHeader := pktdump.FormatWithOptions(packet, formatOpts)
+	formatedHeader := (&pktdump.Formatter{}).FormatWithOptions(packet, formatOpts)
 	formatedData := formatOpts.FormatedContent
 
 	builder := strings.Builder{}
diff --git a/testdata/format/dns.pcapng b/testdata/format/dns.pcapng
new file mode 100644
index 00000000..0300a385
Binary files /dev/null and b/testdata/format/dns.pcapng differ
diff --git a/testdata/format/dns.pcapng.-q.out.txt b/testdata/format/dns.pcapng.-q.out.txt
new file mode 100644
index 00000000..1593fed7
--- /dev/null
+++ b/testdata/format/dns.pcapng.-q.out.txt
@@ -0,0 +1,2 @@
+03:47:06.356509 ens33 dig.380281 Out IP 10.0.2.15.58682 > 114.114.114.114.53: UDP, length 52, ParentProc [bash.45198]
+03:47:06.425244 ens33 dig.380281 In IP 114.114.114.114.53 > 10.0.2.15.58682: UDP, length 56, ParentProc [bash.45198]
diff --git a/testdata/format/dns.pcapng.out.txt b/testdata/format/dns.pcapng.out.txt
new file mode 100644
index 00000000..ef1c39ad
--- /dev/null
+++ b/testdata/format/dns.pcapng.out.txt
@@ -0,0 +1,2 @@
+03:47:06.356509 ens33 dig.380281 Out IP 10.0.2.15.58682 > 114.114.114.114.53: 56213+ [1au] A? example.com. (52), ParentProc [bash.45198]
+03:47:06.425244 ens33 dig.380281 In IP 114.114.114.114.53 > 10.0.2.15.58682: 56213 1/0/1 A 93.184.215.14 (56), ParentProc [bash.45198]
diff --git a/testdata/format/mptcp.pcap b/testdata/format/mptcp.pcap
new file mode 100644
index 00000000..74bf50e1
Binary files /dev/null and b/testdata/format/mptcp.pcap differ
diff --git a/testdata/format/mptcp.pcap.out.txt b/testdata/format/mptcp.pcap.out.txt
new file mode 100644
index 00000000..51183051
--- /dev/null
+++ b/testdata/format/mptcp.pcap.out.txt
@@ -0,0 +1,14 @@
+02:55:35.698856 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [S], seq 412382786, win 65495, options [mss 65495,sackOK,TS val 642407978 ecr 0,nop,wscale 7,mptcp 4 capable v1 flags [H]], length 0
+02:55:35.698936 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [S.], seq 2707981557, ack 412382787, win 65483, options [mss 65495,sackOK,TS val 642407978 ecr 642407978,nop,wscale 7,mptcp 12 capable v1 flags [H] {0xe356a8f252e41976}], length 0
+02:55:35.699025 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [.], seq 412382787, ack 2707981558, win 512, options [nop,nop,TS val 642407978 ecr 642407978,mptcp 20 capable v1 flags [H] {0xfe7b93dc894dcb73,0xe356a8f252e41976}], length 0
+02:55:38.509583 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [P.], seq 412382787:412382792, ack 2707981558, win 512, options [nop,nop,TS val 642410789 ecr 642407978,mptcp 22 capable v1 flags [H] {0xfe7b93dc894dcb73,0xe356a8f252e41976,data_len=5},nop,nop], length 5
+02:55:38.509749 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [.], seq 2707981558, ack 412382792, win 512, options [nop,nop,TS val 642410789 ecr 642410789,mptcp 12 dss ack 3891854986895050400], length 0
+02:55:39.975370 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [P.], seq 412382792:412382796, ack 2707981558, win 512, options [nop,nop,TS val 642412254 ecr 642410789,mptcp 22 dss ack 2876660120 seq 3891854986895050400 subseq 6 len 4,nop,nop], length 4
+02:55:39.975475 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [.], seq 2707981558, ack 412382796, win 512, options [nop,nop,TS val 642412254 ecr 642412254,mptcp 12 dss ack 3891854986895050404], length 0
+02:55:41.167860 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [.], seq 412382796, ack 2707981558, win 512, options [nop,nop,TS val 642412255 ecr 642412254,mptcp 22 dss fin ack 2876660120 seq 3891854986895050404 subseq 0 len 1,nop,nop], length 0
+02:55:41.168004 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [.], seq 2707981558, ack 412382796, win 512, options [nop,nop,TS val 642413447 ecr 642412255,mptcp 12 dss ack 3891854986895050405], length 0
+02:55:41.168074 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [.], seq 2707981558, ack 412382796, win 512, options [nop,nop,TS val 642413447 ecr 642412255,mptcp 26 dss fin ack 3891854986895050405 seq 16853452819136928152 subseq 0 len 1,nop,nop], length 0
+02:55:41.168388 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [.], seq 412382796, ack 2707981558, win 512, options [nop,nop,TS val 642413447 ecr 642413447,mptcp 8 dss ack 2876660121], length 0
+02:55:41.168407 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [F.], seq 412382796, ack 2707981558, win 512, options [nop,nop,TS val 642413447 ecr 642413447,mptcp 8 dss ack 2876660121], length 0
+02:55:41.168427 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [F.], seq 2707981558, ack 412382797, win 512, options [nop,nop,TS val 642413447 ecr 642413447,mptcp 12 dss ack 3891854986895050405], length 0
+02:55:41.168438 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [.], seq 412382797, ack 2707981559, win 512, options [nop,nop,TS val 642413448 ecr 642413447,mptcp 8 dss ack 2876660121], length 0
diff --git a/testdata/format/tcp.pcapng b/testdata/format/tcp.pcapng
new file mode 100644
index 00000000..811c2893
Binary files /dev/null and b/testdata/format/tcp.pcapng differ
diff --git a/testdata/format/tcp.pcapng.-A.out.txt b/testdata/format/tcp.pcapng.-A.out.txt
new file mode 100644
index 00000000..2d3db52a
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-A.out.txt
@@ -0,0 +1,124 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+E..<Z.@.@............F.@.............0.........
+..,Q........
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+E..<Z.@.@............F.@.............0.........
+..,Q........
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+E..<..@.@.<..........@.F.>...........0.........
+..,Q..,Q....
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+E..<..@.@.<..........@.F.>...........0.........
+..,Q..,Q....
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+E..4Z @.@............F.@.....>.......(.....
+..,Q..,Q
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+E..4Z @.@............F.@.....>.......(.....
+..,Q..,Q
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+E...Z!@.@..J.........F.@.....>.......~.....
+..,Q..,QGET /notfound HTTP/1.1
+Host: 127.0.0.1:8000
+User-Agent: curl/7.81.0
+Accept: */*
+
+
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+E...Z!@.@..J.........F.@.....>.......~.....
+..,Q..,QGET /notfound HTTP/1.1
+Host: 127.0.0.1:8000
+User-Agent: curl/7.81.0
+Accept: */*
+
+
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+E..4..@.@............@.F.>...........(.....
+..,Q..,Q
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+E..4..@.@............@.F.>...........(.....
+..,Q..,Q
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+E.....@.@..9.........@.F.>.................
+..,b..,QHTTP/1.0 404 File not found
+Server: SimpleHTTP/0.6 Python/3.10.12
+Date: Sat, 02 Nov 2024 13:50:35 GMT
+Connection: close
+Content-Type: text/html;charset=utf-8
+Content-Length: 469
+
+
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+E.....@.@..9.........@.F.>.................
+..,b..,QHTTP/1.0 404 File not found
+Server: SimpleHTTP/0.6 Python/3.10.12
+Date: Sat, 02 Nov 2024 13:50:35 GMT
+Connection: close
+Content-Type: text/html;charset=utf-8
+Content-Length: 469
+
+
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z"@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z"@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z$@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z$@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+E..	..@.@............@.F.>.................
+..,b..,b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
+        "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+    <head>
+        <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
+        <title>Error response</title>
+    </head>
+    <body>
+        <h1>Error response</h1>
+        <p>Error code: 404</p>
+        <p>Message: File not found.</p>
+        <p>Error code explanation: HTTPStatus.NOT_FOUND - Nothing matches the given URI.</p>
+    </body>
+</html>
+
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+E..	..@.@............@.F.>.................
+..,b..,b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
+        "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+    <head>
+        <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
+        <title>Error response</title>
+    </head>
+    <body>
+        <h1>Error response</h1>
+        <p>Error code: 404</p>
+        <p>Message: File not found.</p>
+        <p>Error code explanation: HTTPStatus.NOT_FOUND - Nothing matches the given URI.</p>
+    </body>
+</html>
+
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z#@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z#@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4..@.@............@.F.>...........(.....
+..,c..,b
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4..@.@............@.F.>...........(.....
+..,c..,b
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+E..4Z%@.@............F.@.....>.......(.....
+..,c..,c
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+E..4Z%@.@............F.@.....>.......(.....
+..,c..,c
diff --git a/testdata/format/tcp.pcapng.-X.out.txt b/testdata/format/tcp.pcapng.-X.out.txt
new file mode 100644
index 00000000..c7d4ec8a
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-X.out.txt
@@ -0,0 +1,210 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 5a1f 4000 4006 e29a 7f00 0001  E..<Z.@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb7 0000 0000  .....F.@........
+        0x0020:  a002 ffd7 fe30 0000 0204 ffd7 0402 080a  .....0..........
+        0x0030:  8cdc 2c51 0000 0000 0103 0307            ..,Q........
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 5a1f 4000 4006 e29a 7f00 0001  E..<Z.@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb7 0000 0000  .....F.@........
+        0x0020:  a002 ffd7 fe30 0000 0204 ffd7 0402 080a  .....0..........
+        0x0030:  8cdc 2c51 0000 0000 0103 0307            ..,Q........
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 0000 4000 4006 3cba 7f00 0001  E..<..@.@.<.....
+        0x0010:  7f00 0001 1f40 e546 e73e 8313 0cfd 0fb8  .....@.F.>......
+        0x0020:  a012 ffcb fe30 0000 0204 ffd7 0402 080a  .....0..........
+        0x0030:  8cdc 2c51 8cdc 2c51 0103 0307            ..,Q..,Q....
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 0000 4000 4006 3cba 7f00 0001  E..<..@.@.<.....
+        0x0010:  7f00 0001 1f40 e546 e73e 8313 0cfd 0fb8  .....@.F.>......
+        0x0020:  a012 ffcb fe30 0000 0204 ffd7 0402 080a  .....0..........
+        0x0030:  8cdc 2c51 8cdc 2c51 0103 0307            ..,Q..,Q....
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a20 4000 4006 e2a1 7f00 0001  E..4Z @.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314  .....F.@.....>..
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c51  .....(........,Q
+        0x0030:  8cdc 2c51                                ..,Q
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a20 4000 4006 e2a1 7f00 0001  E..4Z @.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314  .....F.@.....>..
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c51  .....(........,Q
+        0x0030:  8cdc 2c51                                ..,Q
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  4500 008a 5a21 4000 4006 e24a 7f00 0001  E...Z!@.@..J....
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314  .....F.@.....>..
+        0x0020:  8018 0200 fe7e 0000 0101 080a 8cdc 2c51  .....~........,Q
+        0x0030:  8cdc 2c51 4745 5420 2f6e 6f74 666f 756e  ..,QGET /notfoun
+        0x0040:  6420 4854 5450 2f31 2e31 0d0a 486f 7374  d HTTP/1.1..Host
+        0x0050:  3a20 3132 372e 302e 302e 313a 3830 3030  : 127.0.0.1:8000
+        0x0060:  0d0a 5573 6572 2d41 6765 6e74 3a20 6375  ..User-Agent: cu
+        0x0070:  726c 2f37 2e38 312e 300d 0a41 6363 6570  rl/7.81.0..Accep
+        0x0080:  743a 202a 2f2a 0d0a 0d0a                 t: */*....
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  4500 008a 5a21 4000 4006 e24a 7f00 0001  E...Z!@.@..J....
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314  .....F.@.....>..
+        0x0020:  8018 0200 fe7e 0000 0101 080a 8cdc 2c51  .....~........,Q
+        0x0030:  8cdc 2c51 4745 5420 2f6e 6f74 666f 756e  ..,QGET /notfoun
+        0x0040:  6420 4854 5450 2f31 2e31 0d0a 486f 7374  d HTTP/1.1..Host
+        0x0050:  3a20 3132 372e 302e 302e 313a 3830 3030  : 127.0.0.1:8000
+        0x0060:  0d0a 5573 6572 2d41 6765 6e74 3a20 6375  ..User-Agent: cu
+        0x0070:  726c 2f37 2e38 312e 300d 0a41 6363 6570  rl/7.81.0..Accep
+        0x0080:  743a 202a 2f2a 0d0a 0d0a                 t: */*....
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bcd 4000 4006 b0f4 7f00 0001  E..4..@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e  .....@.F.>......
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c51  .....(........,Q
+        0x0030:  8cdc 2c51                                ..,Q
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bcd 4000 4006 b0f4 7f00 0001  E..4..@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e  .....@.F.>......
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c51  .....(........,Q
+        0x0030:  8cdc 2c51                                ..,Q
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  4500 00ee 8bce 4000 4006 b039 7f00 0001  E.....@.@..9....
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e  .....@.F.>......
+        0x0020:  8018 0200 fee2 0000 0101 080a 8cdc 2c62  ..............,b
+        0x0030:  8cdc 2c51 4854 5450 2f31 2e30 2034 3034  ..,QHTTP/1.0 404
+        0x0040:  2046 696c 6520 6e6f 7420 666f 756e 640d   File not found.
+        0x0050:  0a53 6572 7665 723a 2053 696d 706c 6548  .Server: SimpleH
+        0x0060:  5454 502f 302e 3620 5079 7468 6f6e 2f33  TTP/0.6 Python/3
+        0x0070:  2e31 302e 3132 0d0a 4461 7465 3a20 5361  .10.12..Date: Sa
+        0x0080:  742c 2030 3220 4e6f 7620 3230 3234 2031  t, 02 Nov 2024 1
+        0x0090:  333a 3530 3a33 3520 474d 540d 0a43 6f6e  3:50:35 GMT..Con
+        0x00a0:  6e65 6374 696f 6e3a 2063 6c6f 7365 0d0a  nection: close..
+        0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465  Content-Type: te
+        0x00c0:  7874 2f68 746d 6c3b 6368 6172 7365 743d  xt/html;charset=
+        0x00d0:  7574 662d 380d 0a43 6f6e 7465 6e74 2d4c  utf-8..Content-L
+        0x00e0:  656e 6774 683a 2034 3639 0d0a 0d0a       ength: 469....
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  4500 00ee 8bce 4000 4006 b039 7f00 0001  E.....@.@..9....
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e  .....@.F.>......
+        0x0020:  8018 0200 fee2 0000 0101 080a 8cdc 2c62  ..............,b
+        0x0030:  8cdc 2c51 4854 5450 2f31 2e30 2034 3034  ..,QHTTP/1.0 404
+        0x0040:  2046 696c 6520 6e6f 7420 666f 756e 640d   File not found.
+        0x0050:  0a53 6572 7665 723a 2053 696d 706c 6548  .Server: SimpleH
+        0x0060:  5454 502f 302e 3620 5079 7468 6f6e 2f33  TTP/0.6 Python/3
+        0x0070:  2e31 302e 3132 0d0a 4461 7465 3a20 5361  .10.12..Date: Sa
+        0x0080:  742c 2030 3220 4e6f 7620 3230 3234 2031  t, 02 Nov 2024 1
+        0x0090:  333a 3530 3a33 3520 474d 540d 0a43 6f6e  3:50:35 GMT..Con
+        0x00a0:  6e65 6374 696f 6e3a 2063 6c6f 7365 0d0a  nection: close..
+        0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465  Content-Type: te
+        0x00c0:  7874 2f68 746d 6c3b 6368 6172 7365 743d  xt/html;charset=
+        0x00d0:  7574 662d 380d 0a43 6f6e 7465 6e74 2d4c  utf-8..Content-L
+        0x00e0:  656e 6774 683a 2034 3639 0d0a 0d0a       ength: 469....
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a22 4000 4006 e29f 7f00 0001  E..4Z"@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 83ce  .....F.@.....>..
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a22 4000 4006 e29f 7f00 0001  E..4Z"@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 83ce  .....F.@.....>..
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a24 4000 4006 e29d 7f00 0001  E..4Z$@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3  .....F.@.....>..
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a24 4000 4006 e29d 7f00 0001  E..4Z$@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3  .....F.@.....>..
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0209 8bcf 4000 4006 af1d 7f00 0001  E.....@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 83ce 0cfd 100e  .....@.F.>......
+        0x0020:  8018 0200 fffd 0000 0101 080a 8cdc 2c62  ..............,b
+        0x0030:  8cdc 2c62 3c21 444f 4354 5950 4520 4854  ..,b<!DOCTYPE HT
+        0x0040:  4d4c 2050 5542 4c49 4320 222d 2f2f 5733  ML PUBLIC "-//W3
+        0x0050:  432f 2f44 5444 2048 544d 4c20 342e 3031  C//DTD HTML 4.01
+        0x0060:  2f2f 454e 220a 2020 2020 2020 2020 2268  //EN".        "h
+        0x0070:  7474 703a 2f2f 7777 772e 7733 2e6f 7267  ttp://www.w3.org
+        0x0080:  2f54 522f 6874 6d6c 342f 7374 7269 6374  /TR/html4/strict
+        0x0090:  2e64 7464 223e 0a3c 6874 6d6c 3e0a 2020  .dtd">.<html>.  
+        0x00a0:  2020 3c68 6561 643e 0a20 2020 2020 2020    <head>.       
+        0x00b0:  203c 6d65 7461 2068 7474 702d 6571 7569   <meta http-equi
+        0x00c0:  763d 2243 6f6e 7465 6e74 2d54 7970 6522  v="Content-Type"
+        0x00d0:  2063 6f6e 7465 6e74 3d22 7465 7874 2f68   content="text/h
+        0x00e0:  746d 6c3b 6368 6172 7365 743d 7574 662d  tml;charset=utf-
+        0x00f0:  3822 3e0a 2020 2020 2020 2020 3c74 6974  8">.        <tit
+        0x0100:  6c65 3e45 7272 6f72 2072 6573 706f 6e73  le>Error respons
+        0x0110:  653c 2f74 6974 6c65 3e0a 2020 2020 3c2f  e</title>.    </
+        0x0120:  6865 6164 3e0a 2020 2020 3c62 6f64 793e  head>.    <body>
+        0x0130:  0a20 2020 2020 2020 203c 6831 3e45 7272  .        <h1>Err
+        0x0140:  6f72 2072 6573 706f 6e73 653c 2f68 313e  or response</h1>
+        0x0150:  0a20 2020 2020 2020 203c 703e 4572 726f  .        <p>Erro
+        0x0160:  7220 636f 6465 3a20 3430 343c 2f70 3e0a  r code: 404</p>.
+        0x0170:  2020 2020 2020 2020 3c70 3e4d 6573 7361          <p>Messa
+        0x0180:  6765 3a20 4669 6c65 206e 6f74 2066 6f75  ge: File not fou
+        0x0190:  6e64 2e3c 2f70 3e0a 2020 2020 2020 2020  nd.</p>.        
+        0x01a0:  3c70 3e45 7272 6f72 2063 6f64 6520 6578  <p>Error code ex
+        0x01b0:  706c 616e 6174 696f 6e3a 2048 5454 5053  planation: HTTPS
+        0x01c0:  7461 7475 732e 4e4f 545f 464f 554e 4420  tatus.NOT_FOUND 
+        0x01d0:  2d20 4e6f 7468 696e 6720 6d61 7463 6865  - Nothing matche
+        0x01e0:  7320 7468 6520 6769 7665 6e20 5552 492e  s the given URI.
+        0x01f0:  3c2f 703e 0a20 2020 203c 2f62 6f64 793e  </p>.    </body>
+        0x0200:  0a3c 2f68 746d 6c3e 0a                   .</html>.
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0209 8bcf 4000 4006 af1d 7f00 0001  E.....@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 83ce 0cfd 100e  .....@.F.>......
+        0x0020:  8018 0200 fffd 0000 0101 080a 8cdc 2c62  ..............,b
+        0x0030:  8cdc 2c62 3c21 444f 4354 5950 4520 4854  ..,b<!DOCTYPE HT
+        0x0040:  4d4c 2050 5542 4c49 4320 222d 2f2f 5733  ML PUBLIC "-//W3
+        0x0050:  432f 2f44 5444 2048 544d 4c20 342e 3031  C//DTD HTML 4.01
+        0x0060:  2f2f 454e 220a 2020 2020 2020 2020 2268  //EN".        "h
+        0x0070:  7474 703a 2f2f 7777 772e 7733 2e6f 7267  ttp://www.w3.org
+        0x0080:  2f54 522f 6874 6d6c 342f 7374 7269 6374  /TR/html4/strict
+        0x0090:  2e64 7464 223e 0a3c 6874 6d6c 3e0a 2020  .dtd">.<html>.  
+        0x00a0:  2020 3c68 6561 643e 0a20 2020 2020 2020    <head>.       
+        0x00b0:  203c 6d65 7461 2068 7474 702d 6571 7569   <meta http-equi
+        0x00c0:  763d 2243 6f6e 7465 6e74 2d54 7970 6522  v="Content-Type"
+        0x00d0:  2063 6f6e 7465 6e74 3d22 7465 7874 2f68   content="text/h
+        0x00e0:  746d 6c3b 6368 6172 7365 743d 7574 662d  tml;charset=utf-
+        0x00f0:  3822 3e0a 2020 2020 2020 2020 3c74 6974  8">.        <tit
+        0x0100:  6c65 3e45 7272 6f72 2072 6573 706f 6e73  le>Error respons
+        0x0110:  653c 2f74 6974 6c65 3e0a 2020 2020 3c2f  e</title>.    </
+        0x0120:  6865 6164 3e0a 2020 2020 3c62 6f64 793e  head>.    <body>
+        0x0130:  0a20 2020 2020 2020 203c 6831 3e45 7272  .        <h1>Err
+        0x0140:  6f72 2072 6573 706f 6e73 653c 2f68 313e  or response</h1>
+        0x0150:  0a20 2020 2020 2020 203c 703e 4572 726f  .        <p>Erro
+        0x0160:  7220 636f 6465 3a20 3430 343c 2f70 3e0a  r code: 404</p>.
+        0x0170:  2020 2020 2020 2020 3c70 3e4d 6573 7361          <p>Messa
+        0x0180:  6765 3a20 4669 6c65 206e 6f74 2066 6f75  ge: File not fou
+        0x0190:  6e64 2e3c 2f70 3e0a 2020 2020 2020 2020  nd.</p>.        
+        0x01a0:  3c70 3e45 7272 6f72 2063 6f64 6520 6578  <p>Error code ex
+        0x01b0:  706c 616e 6174 696f 6e3a 2048 5454 5053  planation: HTTPS
+        0x01c0:  7461 7475 732e 4e4f 545f 464f 554e 4420  tatus.NOT_FOUND 
+        0x01d0:  2d20 4e6f 7468 696e 6720 6d61 7463 6865  - Nothing matche
+        0x01e0:  7320 7468 6520 6769 7665 6e20 5552 492e  s the given URI.
+        0x01f0:  3c2f 703e 0a20 2020 203c 2f62 6f64 793e  </p>.    </body>
+        0x0200:  0a3c 2f68 746d 6c3e 0a                   .</html>.
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a23 4000 4006 e29e 7f00 0001  E..4Z#@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3  .....F.@.....>..
+        0x0020:  8010 01fc fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a23 4000 4006 e29e 7f00 0001  E..4Z#@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3  .....F.@.....>..
+        0x0020:  8010 01fc fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bd0 4000 4006 b0f1 7f00 0001  E..4..@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 85a3 0cfd 100f  .....@.F.>......
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c63  .....(........,c
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bd0 4000 4006 b0f1 7f00 0001  E..4..@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 85a3 0cfd 100f  .....@.F.>......
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c63  .....(........,c
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a25 4000 4006 e29c 7f00 0001  E..4Z%@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100f e73e 85a4  .....F.@.....>..
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c63  .....(........,c
+        0x0030:  8cdc 2c63                                ..,c
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a25 4000 4006 e29c 7f00 0001  E..4Z%@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100f e73e 85a4  .....F.@.....>..
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c63  .....(........,c
+        0x0030:  8cdc 2c63                                ..,c
diff --git a/testdata/format/tcp.pcapng.-XX.out.txt b/testdata/format/tcp.pcapng.-XX.out.txt
new file mode 100644
index 00000000..7ee61da1
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-XX.out.txt
@@ -0,0 +1,234 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  003c 5a1f 4000 4006 e29a 7f00 0001 7f00  .<Z.@.@.........
+        0x0020:  0001 e546 1f40 0cfd 0fb7 0000 0000 a002  ...F.@..........
+        0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 8cdc  ...0............
+        0x0040:  2c51 0000 0000 0103 0307                 ,Q........
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  003c 5a1f 4000 4006 e29a 7f00 0001 7f00  .<Z.@.@.........
+        0x0020:  0001 e546 1f40 0cfd 0fb7 0000 0000 a002  ...F.@..........
+        0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 8cdc  ...0............
+        0x0040:  2c51 0000 0000 0103 0307                 ,Q........
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00  .<..@.@.<.......
+        0x0020:  0001 1f40 e546 e73e 8313 0cfd 0fb8 a012  ...@.F.>........
+        0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 8cdc  ...0............
+        0x0040:  2c51 8cdc 2c51 0103 0307                 ,Q..,Q....
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00  .<..@.@.<.......
+        0x0020:  0001 1f40 e546 e73e 8313 0cfd 0fb8 a012  ...@.F.>........
+        0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 8cdc  ...0............
+        0x0040:  2c51 8cdc 2c51 0103 0307                 ,Q..,Q....
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a20 4000 4006 e2a1 7f00 0001 7f00  .4Z @.@.........
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8010  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c51 8cdc  ...(........,Q..
+        0x0040:  2c51                                     ,Q
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a20 4000 4006 e2a1 7f00 0001 7f00  .4Z @.@.........
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8010  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c51 8cdc  ...(........,Q..
+        0x0040:  2c51                                     ,Q
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  008a 5a21 4000 4006 e24a 7f00 0001 7f00  ..Z!@.@..J......
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8018  ...F.@.....>....
+        0x0030:  0200 fe7e 0000 0101 080a 8cdc 2c51 8cdc  ...~........,Q..
+        0x0040:  2c51 4745 5420 2f6e 6f74 666f 756e 6420  ,QGET /notfound 
+        0x0050:  4854 5450 2f31 2e31 0d0a 486f 7374 3a20  HTTP/1.1..Host: 
+        0x0060:  3132 372e 302e 302e 313a 3830 3030 0d0a  127.0.0.1:8000..
+        0x0070:  5573 6572 2d41 6765 6e74 3a20 6375 726c  User-Agent: curl
+        0x0080:  2f37 2e38 312e 300d 0a41 6363 6570 743a  /7.81.0..Accept:
+        0x0090:  202a 2f2a 0d0a 0d0a                       */*....
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  008a 5a21 4000 4006 e24a 7f00 0001 7f00  ..Z!@.@..J......
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8018  ...F.@.....>....
+        0x0030:  0200 fe7e 0000 0101 080a 8cdc 2c51 8cdc  ...~........,Q..
+        0x0040:  2c51 4745 5420 2f6e 6f74 666f 756e 6420  ,QGET /notfound 
+        0x0050:  4854 5450 2f31 2e31 0d0a 486f 7374 3a20  HTTP/1.1..Host: 
+        0x0060:  3132 372e 302e 302e 313a 3830 3030 0d0a  127.0.0.1:8000..
+        0x0070:  5573 6572 2d41 6765 6e74 3a20 6375 726c  User-Agent: curl
+        0x0080:  2f37 2e38 312e 300d 0a41 6363 6570 743a  /7.81.0..Accept:
+        0x0090:  202a 2f2a 0d0a 0d0a                       */*....
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 8bcd 4000 4006 b0f4 7f00 0001 7f00  .4..@.@.........
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8010  ...@.F.>........
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c51 8cdc  ...(........,Q..
+        0x0040:  2c51                                     ,Q
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 8bcd 4000 4006 b0f4 7f00 0001 7f00  .4..@.@.........
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8010  ...@.F.>........
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c51 8cdc  ...(........,Q..
+        0x0040:  2c51                                     ,Q
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  00ee 8bce 4000 4006 b039 7f00 0001 7f00  ....@.@..9......
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8018  ...@.F.>........
+        0x0030:  0200 fee2 0000 0101 080a 8cdc 2c62 8cdc  ............,b..
+        0x0040:  2c51 4854 5450 2f31 2e30 2034 3034 2046  ,QHTTP/1.0 404 F
+        0x0050:  696c 6520 6e6f 7420 666f 756e 640d 0a53  ile not found..S
+        0x0060:  6572 7665 723a 2053 696d 706c 6548 5454  erver: SimpleHTT
+        0x0070:  502f 302e 3620 5079 7468 6f6e 2f33 2e31  P/0.6 Python/3.1
+        0x0080:  302e 3132 0d0a 4461 7465 3a20 5361 742c  0.12..Date: Sat,
+        0x0090:  2030 3220 4e6f 7620 3230 3234 2031 333a   02 Nov 2024 13:
+        0x00a0:  3530 3a33 3520 474d 540d 0a43 6f6e 6e65  50:35 GMT..Conne
+        0x00b0:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f  ction: close..Co
+        0x00c0:  6e74 656e 742d 5479 7065 3a20 7465 7874  ntent-Type: text
+        0x00d0:  2f68 746d 6c3b 6368 6172 7365 743d 7574  /html;charset=ut
+        0x00e0:  662d 380d 0a43 6f6e 7465 6e74 2d4c 656e  f-8..Content-Len
+        0x00f0:  6774 683a 2034 3639 0d0a 0d0a            gth: 469....
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  00ee 8bce 4000 4006 b039 7f00 0001 7f00  ....@.@..9......
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8018  ...@.F.>........
+        0x0030:  0200 fee2 0000 0101 080a 8cdc 2c62 8cdc  ............,b..
+        0x0040:  2c51 4854 5450 2f31 2e30 2034 3034 2046  ,QHTTP/1.0 404 F
+        0x0050:  696c 6520 6e6f 7420 666f 756e 640d 0a53  ile not found..S
+        0x0060:  6572 7665 723a 2053 696d 706c 6548 5454  erver: SimpleHTT
+        0x0070:  502f 302e 3620 5079 7468 6f6e 2f33 2e31  P/0.6 Python/3.1
+        0x0080:  302e 3132 0d0a 4461 7465 3a20 5361 742c  0.12..Date: Sat,
+        0x0090:  2030 3220 4e6f 7620 3230 3234 2031 333a   02 Nov 2024 13:
+        0x00a0:  3530 3a33 3520 474d 540d 0a43 6f6e 6e65  50:35 GMT..Conne
+        0x00b0:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f  ction: close..Co
+        0x00c0:  6e74 656e 742d 5479 7065 3a20 7465 7874  ntent-Type: text
+        0x00d0:  2f68 746d 6c3b 6368 6172 7365 743d 7574  /html;charset=ut
+        0x00e0:  662d 380d 0a43 6f6e 7465 6e74 2d4c 656e  f-8..Content-Len
+        0x00f0:  6774 683a 2034 3639 0d0a 0d0a            gth: 469....
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a22 4000 4006 e29f 7f00 0001 7f00  .4Z"@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 83ce 8010  ...F.@.....>....
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a22 4000 4006 e29f 7f00 0001 7f00  .4Z"@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 83ce 8010  ...F.@.....>....
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a24 4000 4006 e29d 7f00 0001 7f00  .4Z$@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8011  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a24 4000 4006 e29d 7f00 0001 7f00  .4Z$@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8011  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0209 8bcf 4000 4006 af1d 7f00 0001 7f00  ....@.@.........
+        0x0020:  0001 1f40 e546 e73e 83ce 0cfd 100e 8018  ...@.F.>........
+        0x0030:  0200 fffd 0000 0101 080a 8cdc 2c62 8cdc  ............,b..
+        0x0040:  2c62 3c21 444f 4354 5950 4520 4854 4d4c  ,b<!DOCTYPE HTML
+        0x0050:  2050 5542 4c49 4320 222d 2f2f 5733 432f   PUBLIC "-//W3C/
+        0x0060:  2f44 5444 2048 544d 4c20 342e 3031 2f2f  /DTD HTML 4.01//
+        0x0070:  454e 220a 2020 2020 2020 2020 2268 7474  EN".        "htt
+        0x0080:  703a 2f2f 7777 772e 7733 2e6f 7267 2f54  p://www.w3.org/T
+        0x0090:  522f 6874 6d6c 342f 7374 7269 6374 2e64  R/html4/strict.d
+        0x00a0:  7464 223e 0a3c 6874 6d6c 3e0a 2020 2020  td">.<html>.    
+        0x00b0:  3c68 6561 643e 0a20 2020 2020 2020 203c  <head>.        <
+        0x00c0:  6d65 7461 2068 7474 702d 6571 7569 763d  meta http-equiv=
+        0x00d0:  2243 6f6e 7465 6e74 2d54 7970 6522 2063  "Content-Type" c
+        0x00e0:  6f6e 7465 6e74 3d22 7465 7874 2f68 746d  ontent="text/htm
+        0x00f0:  6c3b 6368 6172 7365 743d 7574 662d 3822  l;charset=utf-8"
+        0x0100:  3e0a 2020 2020 2020 2020 3c74 6974 6c65  >.        <title
+        0x0110:  3e45 7272 6f72 2072 6573 706f 6e73 653c  >Error response<
+        0x0120:  2f74 6974 6c65 3e0a 2020 2020 3c2f 6865  /title>.    </he
+        0x0130:  6164 3e0a 2020 2020 3c62 6f64 793e 0a20  ad>.    <body>. 
+        0x0140:  2020 2020 2020 203c 6831 3e45 7272 6f72         <h1>Error
+        0x0150:  2072 6573 706f 6e73 653c 2f68 313e 0a20   response</h1>. 
+        0x0160:  2020 2020 2020 203c 703e 4572 726f 7220         <p>Error 
+        0x0170:  636f 6465 3a20 3430 343c 2f70 3e0a 2020  code: 404</p>.  
+        0x0180:  2020 2020 2020 3c70 3e4d 6573 7361 6765        <p>Message
+        0x0190:  3a20 4669 6c65 206e 6f74 2066 6f75 6e64  : File not found
+        0x01a0:  2e3c 2f70 3e0a 2020 2020 2020 2020 3c70  .</p>.        <p
+        0x01b0:  3e45 7272 6f72 2063 6f64 6520 6578 706c  >Error code expl
+        0x01c0:  616e 6174 696f 6e3a 2048 5454 5053 7461  anation: HTTPSta
+        0x01d0:  7475 732e 4e4f 545f 464f 554e 4420 2d20  tus.NOT_FOUND - 
+        0x01e0:  4e6f 7468 696e 6720 6d61 7463 6865 7320  Nothing matches 
+        0x01f0:  7468 6520 6769 7665 6e20 5552 492e 3c2f  the given URI.</
+        0x0200:  703e 0a20 2020 203c 2f62 6f64 793e 0a3c  p>.    </body>.<
+        0x0210:  2f68 746d 6c3e 0a                        /html>.
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0209 8bcf 4000 4006 af1d 7f00 0001 7f00  ....@.@.........
+        0x0020:  0001 1f40 e546 e73e 83ce 0cfd 100e 8018  ...@.F.>........
+        0x0030:  0200 fffd 0000 0101 080a 8cdc 2c62 8cdc  ............,b..
+        0x0040:  2c62 3c21 444f 4354 5950 4520 4854 4d4c  ,b<!DOCTYPE HTML
+        0x0050:  2050 5542 4c49 4320 222d 2f2f 5733 432f   PUBLIC "-//W3C/
+        0x0060:  2f44 5444 2048 544d 4c20 342e 3031 2f2f  /DTD HTML 4.01//
+        0x0070:  454e 220a 2020 2020 2020 2020 2268 7474  EN".        "htt
+        0x0080:  703a 2f2f 7777 772e 7733 2e6f 7267 2f54  p://www.w3.org/T
+        0x0090:  522f 6874 6d6c 342f 7374 7269 6374 2e64  R/html4/strict.d
+        0x00a0:  7464 223e 0a3c 6874 6d6c 3e0a 2020 2020  td">.<html>.    
+        0x00b0:  3c68 6561 643e 0a20 2020 2020 2020 203c  <head>.        <
+        0x00c0:  6d65 7461 2068 7474 702d 6571 7569 763d  meta http-equiv=
+        0x00d0:  2243 6f6e 7465 6e74 2d54 7970 6522 2063  "Content-Type" c
+        0x00e0:  6f6e 7465 6e74 3d22 7465 7874 2f68 746d  ontent="text/htm
+        0x00f0:  6c3b 6368 6172 7365 743d 7574 662d 3822  l;charset=utf-8"
+        0x0100:  3e0a 2020 2020 2020 2020 3c74 6974 6c65  >.        <title
+        0x0110:  3e45 7272 6f72 2072 6573 706f 6e73 653c  >Error response<
+        0x0120:  2f74 6974 6c65 3e0a 2020 2020 3c2f 6865  /title>.    </he
+        0x0130:  6164 3e0a 2020 2020 3c62 6f64 793e 0a20  ad>.    <body>. 
+        0x0140:  2020 2020 2020 203c 6831 3e45 7272 6f72         <h1>Error
+        0x0150:  2072 6573 706f 6e73 653c 2f68 313e 0a20   response</h1>. 
+        0x0160:  2020 2020 2020 203c 703e 4572 726f 7220         <p>Error 
+        0x0170:  636f 6465 3a20 3430 343c 2f70 3e0a 2020  code: 404</p>.  
+        0x0180:  2020 2020 2020 3c70 3e4d 6573 7361 6765        <p>Message
+        0x0190:  3a20 4669 6c65 206e 6f74 2066 6f75 6e64  : File not found
+        0x01a0:  2e3c 2f70 3e0a 2020 2020 2020 2020 3c70  .</p>.        <p
+        0x01b0:  3e45 7272 6f72 2063 6f64 6520 6578 706c  >Error code expl
+        0x01c0:  616e 6174 696f 6e3a 2048 5454 5053 7461  anation: HTTPSta
+        0x01d0:  7475 732e 4e4f 545f 464f 554e 4420 2d20  tus.NOT_FOUND - 
+        0x01e0:  4e6f 7468 696e 6720 6d61 7463 6865 7320  Nothing matches 
+        0x01f0:  7468 6520 6769 7665 6e20 5552 492e 3c2f  the given URI.</
+        0x0200:  703e 0a20 2020 203c 2f62 6f64 793e 0a3c  p>.    </body>.<
+        0x0210:  2f68 746d 6c3e 0a                        /html>.
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a23 4000 4006 e29e 7f00 0001 7f00  .4Z#@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8010  ...F.@.....>....
+        0x0030:  01fc fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a23 4000 4006 e29e 7f00 0001 7f00  .4Z#@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8010  ...F.@.....>....
+        0x0030:  01fc fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 8bd0 4000 4006 b0f1 7f00 0001 7f00  .4..@.@.........
+        0x0020:  0001 1f40 e546 e73e 85a3 0cfd 100f 8011  ...@.F.>........
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc  ...(........,c..
+        0x0040:  2c62                                     ,b
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 8bd0 4000 4006 b0f1 7f00 0001 7f00  .4..@.@.........
+        0x0020:  0001 1f40 e546 e73e 85a3 0cfd 100f 8011  ...@.F.>........
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc  ...(........,c..
+        0x0040:  2c62                                     ,b
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a25 4000 4006 e29c 7f00 0001 7f00  .4Z%@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100f e73e 85a4 8010  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc  ...(........,c..
+        0x0040:  2c63                                     ,c
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a25 4000 4006 e29c 7f00 0001 7f00  .4Z%@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100f e73e 85a4 8010  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc  ...(........,c..
+        0x0040:  2c63                                     ,c
diff --git a/testdata/format/tcp.pcapng.-q.out.txt b/testdata/format/tcp.pcapng.-q.out.txt
new file mode 100644
index 00000000..d31e6c4c
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-q.out.txt
@@ -0,0 +1,24 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 86, ParentProc [ptcpdump.345626]
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 86, ParentProc [ptcpdump.345626]
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 186, ParentProc [ptcpdump.345626]
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 186, ParentProc [ptcpdump.345626]
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 469, ParentProc [ptcpdump.345626]
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 469, ParentProc [ptcpdump.345626]
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
diff --git a/testdata/format/tcp.pcapng.-v.out.txt b/testdata/format/tcp.pcapng.-v.out.txt
new file mode 100644
index 00000000..d1b37c63
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-v.out.txt
@@ -0,0 +1,96 @@
+13:50:35.524360 lo Out IP (tos 0x0, ttl 64, id 23071, offset 0, flags [DF], proto TCP (6), length 60)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], cksum 0xfe30, seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.524995 lo In IP (tos 0x0, ttl 64, id 23071, offset 0, flags [DF], proto TCP (6), length 60)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], cksum 0xfe30, seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525108 lo Out IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], cksum 0xfe30, seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525211 lo In IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], cksum 0xfe30, seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525339 lo Out IP (tos 0x0, ttl 64, id 23072, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525396 lo In IP (tos 0x0, ttl 64, id 23072, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525536 lo Out IP (tos 0x0, ttl 64, id 23073, offset 0, flags [DF], proto TCP (6), length 138)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], cksum 0xfe7e, seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525652 lo In IP (tos 0x0, ttl 64, id 23073, offset 0, flags [DF], proto TCP (6), length 138)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], cksum 0xfe7e, seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525721 lo Out IP (tos 0x0, ttl 64, id 35789, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], cksum 0xfe28, seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525804 lo In IP (tos 0x0, ttl 64, id 35789, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], cksum 0xfe28, seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.558547 lo Out IP (tos 0x0, ttl 64, id 35790, offset 0, flags [DF], proto TCP (6), length 238)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], cksum 0xfee2, seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.558929 lo In IP (tos 0x0, ttl 64, id 35790, offset 0, flags [DF], proto TCP (6), length 238)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], cksum 0xfee2, seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559171 lo Out IP (tos 0x0, ttl 64, id 23074, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559277 lo In IP (tos 0x0, ttl 64, id 23074, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559705 lo Out IP (tos 0x0, ttl 64, id 23076, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], cksum 0xfe28, seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559765 lo In IP (tos 0x0, ttl 64, id 23076, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], cksum 0xfe28, seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559522 lo Out IP (tos 0x0, ttl 64, id 35791, offset 0, flags [DF], proto TCP (6), length 521)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], cksum 0xfffd, seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559608 lo In IP (tos 0x0, ttl 64, id 35791, offset 0, flags [DF], proto TCP (6), length 521)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], cksum 0xfffd, seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559705 lo Out IP (tos 0x0, ttl 64, id 23075, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559768 lo In IP (tos 0x0, ttl 64, id 23075, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.560427 lo Out IP (tos 0x0, ttl 64, id 35792, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], cksum 0xfe28, seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.560491 lo In IP (tos 0x0, ttl 64, id 35792, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], cksum 0xfe28, seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.560549 lo Out IP (tos 0x0, ttl 64, id 23077, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.560602 lo In IP (tos 0x0, ttl 64, id 23077, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
diff --git a/testdata/format/tcp.pcapng.-x.out.txt b/testdata/format/tcp.pcapng.-x.out.txt
new file mode 100644
index 00000000..51cd70f5
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-x.out.txt
@@ -0,0 +1,210 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 5a1f 4000 4006 e29a 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb7 0000 0000
+        0x0020:  a002 ffd7 fe30 0000 0204 ffd7 0402 080a
+        0x0030:  8cdc 2c51 0000 0000 0103 0307
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 5a1f 4000 4006 e29a 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb7 0000 0000
+        0x0020:  a002 ffd7 fe30 0000 0204 ffd7 0402 080a
+        0x0030:  8cdc 2c51 0000 0000 0103 0307
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 0000 4000 4006 3cba 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8313 0cfd 0fb8
+        0x0020:  a012 ffcb fe30 0000 0204 ffd7 0402 080a
+        0x0030:  8cdc 2c51 8cdc 2c51 0103 0307
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 0000 4000 4006 3cba 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8313 0cfd 0fb8
+        0x0020:  a012 ffcb fe30 0000 0204 ffd7 0402 080a
+        0x0030:  8cdc 2c51 8cdc 2c51 0103 0307
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a20 4000 4006 e2a1 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a20 4000 4006 e2a1 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  4500 008a 5a21 4000 4006 e24a 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314
+        0x0020:  8018 0200 fe7e 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51 4745 5420 2f6e 6f74 666f 756e
+        0x0040:  6420 4854 5450 2f31 2e31 0d0a 486f 7374
+        0x0050:  3a20 3132 372e 302e 302e 313a 3830 3030
+        0x0060:  0d0a 5573 6572 2d41 6765 6e74 3a20 6375
+        0x0070:  726c 2f37 2e38 312e 300d 0a41 6363 6570
+        0x0080:  743a 202a 2f2a 0d0a 0d0a
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  4500 008a 5a21 4000 4006 e24a 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314
+        0x0020:  8018 0200 fe7e 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51 4745 5420 2f6e 6f74 666f 756e
+        0x0040:  6420 4854 5450 2f31 2e31 0d0a 486f 7374
+        0x0050:  3a20 3132 372e 302e 302e 313a 3830 3030
+        0x0060:  0d0a 5573 6572 2d41 6765 6e74 3a20 6375
+        0x0070:  726c 2f37 2e38 312e 300d 0a41 6363 6570
+        0x0080:  743a 202a 2f2a 0d0a 0d0a
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bcd 4000 4006 b0f4 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bcd 4000 4006 b0f4 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  4500 00ee 8bce 4000 4006 b039 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e
+        0x0020:  8018 0200 fee2 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c51 4854 5450 2f31 2e30 2034 3034
+        0x0040:  2046 696c 6520 6e6f 7420 666f 756e 640d
+        0x0050:  0a53 6572 7665 723a 2053 696d 706c 6548
+        0x0060:  5454 502f 302e 3620 5079 7468 6f6e 2f33
+        0x0070:  2e31 302e 3132 0d0a 4461 7465 3a20 5361
+        0x0080:  742c 2030 3220 4e6f 7620 3230 3234 2031
+        0x0090:  333a 3530 3a33 3520 474d 540d 0a43 6f6e
+        0x00a0:  6e65 6374 696f 6e3a 2063 6c6f 7365 0d0a
+        0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465
+        0x00c0:  7874 2f68 746d 6c3b 6368 6172 7365 743d
+        0x00d0:  7574 662d 380d 0a43 6f6e 7465 6e74 2d4c
+        0x00e0:  656e 6774 683a 2034 3639 0d0a 0d0a
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  4500 00ee 8bce 4000 4006 b039 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e
+        0x0020:  8018 0200 fee2 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c51 4854 5450 2f31 2e30 2034 3034
+        0x0040:  2046 696c 6520 6e6f 7420 666f 756e 640d
+        0x0050:  0a53 6572 7665 723a 2053 696d 706c 6548
+        0x0060:  5454 502f 302e 3620 5079 7468 6f6e 2f33
+        0x0070:  2e31 302e 3132 0d0a 4461 7465 3a20 5361
+        0x0080:  742c 2030 3220 4e6f 7620 3230 3234 2031
+        0x0090:  333a 3530 3a33 3520 474d 540d 0a43 6f6e
+        0x00a0:  6e65 6374 696f 6e3a 2063 6c6f 7365 0d0a
+        0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465
+        0x00c0:  7874 2f68 746d 6c3b 6368 6172 7365 743d
+        0x00d0:  7574 662d 380d 0a43 6f6e 7465 6e74 2d4c
+        0x00e0:  656e 6774 683a 2034 3639 0d0a 0d0a
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a22 4000 4006 e29f 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 83ce
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a22 4000 4006 e29f 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 83ce
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a24 4000 4006 e29d 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a24 4000 4006 e29d 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0209 8bcf 4000 4006 af1d 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 83ce 0cfd 100e
+        0x0020:  8018 0200 fffd 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62 3c21 444f 4354 5950 4520 4854
+        0x0040:  4d4c 2050 5542 4c49 4320 222d 2f2f 5733
+        0x0050:  432f 2f44 5444 2048 544d 4c20 342e 3031
+        0x0060:  2f2f 454e 220a 2020 2020 2020 2020 2268
+        0x0070:  7474 703a 2f2f 7777 772e 7733 2e6f 7267
+        0x0080:  2f54 522f 6874 6d6c 342f 7374 7269 6374
+        0x0090:  2e64 7464 223e 0a3c 6874 6d6c 3e0a 2020
+        0x00a0:  2020 3c68 6561 643e 0a20 2020 2020 2020
+        0x00b0:  203c 6d65 7461 2068 7474 702d 6571 7569
+        0x00c0:  763d 2243 6f6e 7465 6e74 2d54 7970 6522
+        0x00d0:  2063 6f6e 7465 6e74 3d22 7465 7874 2f68
+        0x00e0:  746d 6c3b 6368 6172 7365 743d 7574 662d
+        0x00f0:  3822 3e0a 2020 2020 2020 2020 3c74 6974
+        0x0100:  6c65 3e45 7272 6f72 2072 6573 706f 6e73
+        0x0110:  653c 2f74 6974 6c65 3e0a 2020 2020 3c2f
+        0x0120:  6865 6164 3e0a 2020 2020 3c62 6f64 793e
+        0x0130:  0a20 2020 2020 2020 203c 6831 3e45 7272
+        0x0140:  6f72 2072 6573 706f 6e73 653c 2f68 313e
+        0x0150:  0a20 2020 2020 2020 203c 703e 4572 726f
+        0x0160:  7220 636f 6465 3a20 3430 343c 2f70 3e0a
+        0x0170:  2020 2020 2020 2020 3c70 3e4d 6573 7361
+        0x0180:  6765 3a20 4669 6c65 206e 6f74 2066 6f75
+        0x0190:  6e64 2e3c 2f70 3e0a 2020 2020 2020 2020
+        0x01a0:  3c70 3e45 7272 6f72 2063 6f64 6520 6578
+        0x01b0:  706c 616e 6174 696f 6e3a 2048 5454 5053
+        0x01c0:  7461 7475 732e 4e4f 545f 464f 554e 4420
+        0x01d0:  2d20 4e6f 7468 696e 6720 6d61 7463 6865
+        0x01e0:  7320 7468 6520 6769 7665 6e20 5552 492e
+        0x01f0:  3c2f 703e 0a20 2020 203c 2f62 6f64 793e
+        0x0200:  0a3c 2f68 746d 6c3e 0a
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0209 8bcf 4000 4006 af1d 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 83ce 0cfd 100e
+        0x0020:  8018 0200 fffd 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62 3c21 444f 4354 5950 4520 4854
+        0x0040:  4d4c 2050 5542 4c49 4320 222d 2f2f 5733
+        0x0050:  432f 2f44 5444 2048 544d 4c20 342e 3031
+        0x0060:  2f2f 454e 220a 2020 2020 2020 2020 2268
+        0x0070:  7474 703a 2f2f 7777 772e 7733 2e6f 7267
+        0x0080:  2f54 522f 6874 6d6c 342f 7374 7269 6374
+        0x0090:  2e64 7464 223e 0a3c 6874 6d6c 3e0a 2020
+        0x00a0:  2020 3c68 6561 643e 0a20 2020 2020 2020
+        0x00b0:  203c 6d65 7461 2068 7474 702d 6571 7569
+        0x00c0:  763d 2243 6f6e 7465 6e74 2d54 7970 6522
+        0x00d0:  2063 6f6e 7465 6e74 3d22 7465 7874 2f68
+        0x00e0:  746d 6c3b 6368 6172 7365 743d 7574 662d
+        0x00f0:  3822 3e0a 2020 2020 2020 2020 3c74 6974
+        0x0100:  6c65 3e45 7272 6f72 2072 6573 706f 6e73
+        0x0110:  653c 2f74 6974 6c65 3e0a 2020 2020 3c2f
+        0x0120:  6865 6164 3e0a 2020 2020 3c62 6f64 793e
+        0x0130:  0a20 2020 2020 2020 203c 6831 3e45 7272
+        0x0140:  6f72 2072 6573 706f 6e73 653c 2f68 313e
+        0x0150:  0a20 2020 2020 2020 203c 703e 4572 726f
+        0x0160:  7220 636f 6465 3a20 3430 343c 2f70 3e0a
+        0x0170:  2020 2020 2020 2020 3c70 3e4d 6573 7361
+        0x0180:  6765 3a20 4669 6c65 206e 6f74 2066 6f75
+        0x0190:  6e64 2e3c 2f70 3e0a 2020 2020 2020 2020
+        0x01a0:  3c70 3e45 7272 6f72 2063 6f64 6520 6578
+        0x01b0:  706c 616e 6174 696f 6e3a 2048 5454 5053
+        0x01c0:  7461 7475 732e 4e4f 545f 464f 554e 4420
+        0x01d0:  2d20 4e6f 7468 696e 6720 6d61 7463 6865
+        0x01e0:  7320 7468 6520 6769 7665 6e20 5552 492e
+        0x01f0:  3c2f 703e 0a20 2020 203c 2f62 6f64 793e
+        0x0200:  0a3c 2f68 746d 6c3e 0a
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a23 4000 4006 e29e 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3
+        0x0020:  8010 01fc fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a23 4000 4006 e29e 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3
+        0x0020:  8010 01fc fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bd0 4000 4006 b0f1 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 85a3 0cfd 100f
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c63
+        0x0030:  8cdc 2c62
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bd0 4000 4006 b0f1 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 85a3 0cfd 100f
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c63
+        0x0030:  8cdc 2c62
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a25 4000 4006 e29c 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100f e73e 85a4
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c63
+        0x0030:  8cdc 2c63
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a25 4000 4006 e29c 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100f e73e 85a4
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c63
+        0x0030:  8cdc 2c63
diff --git a/testdata/format/tcp.pcapng.-xx.out.txt b/testdata/format/tcp.pcapng.-xx.out.txt
new file mode 100644
index 00000000..35c1ba85
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-xx.out.txt
@@ -0,0 +1,234 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  003c 5a1f 4000 4006 e29a 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb7 0000 0000 a002
+        0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 8cdc
+        0x0040:  2c51 0000 0000 0103 0307
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  003c 5a1f 4000 4006 e29a 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb7 0000 0000 a002
+        0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 8cdc
+        0x0040:  2c51 0000 0000 0103 0307
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8313 0cfd 0fb8 a012
+        0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 8cdc
+        0x0040:  2c51 8cdc 2c51 0103 0307
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8313 0cfd 0fb8 a012
+        0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 8cdc
+        0x0040:  2c51 8cdc 2c51 0103 0307
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a20 4000 4006 e2a1 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8010
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a20 4000 4006 e2a1 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8010
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  008a 5a21 4000 4006 e24a 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8018
+        0x0030:  0200 fe7e 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51 4745 5420 2f6e 6f74 666f 756e 6420
+        0x0050:  4854 5450 2f31 2e31 0d0a 486f 7374 3a20
+        0x0060:  3132 372e 302e 302e 313a 3830 3030 0d0a
+        0x0070:  5573 6572 2d41 6765 6e74 3a20 6375 726c
+        0x0080:  2f37 2e38 312e 300d 0a41 6363 6570 743a
+        0x0090:  202a 2f2a 0d0a 0d0a
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  008a 5a21 4000 4006 e24a 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8018
+        0x0030:  0200 fe7e 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51 4745 5420 2f6e 6f74 666f 756e 6420
+        0x0050:  4854 5450 2f31 2e31 0d0a 486f 7374 3a20
+        0x0060:  3132 372e 302e 302e 313a 3830 3030 0d0a
+        0x0070:  5573 6572 2d41 6765 6e74 3a20 6375 726c
+        0x0080:  2f37 2e38 312e 300d 0a41 6363 6570 743a
+        0x0090:  202a 2f2a 0d0a 0d0a
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 8bcd 4000 4006 b0f4 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8010
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 8bcd 4000 4006 b0f4 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8010
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  00ee 8bce 4000 4006 b039 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8018
+        0x0030:  0200 fee2 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c51 4854 5450 2f31 2e30 2034 3034 2046
+        0x0050:  696c 6520 6e6f 7420 666f 756e 640d 0a53
+        0x0060:  6572 7665 723a 2053 696d 706c 6548 5454
+        0x0070:  502f 302e 3620 5079 7468 6f6e 2f33 2e31
+        0x0080:  302e 3132 0d0a 4461 7465 3a20 5361 742c
+        0x0090:  2030 3220 4e6f 7620 3230 3234 2031 333a
+        0x00a0:  3530 3a33 3520 474d 540d 0a43 6f6e 6e65
+        0x00b0:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f
+        0x00c0:  6e74 656e 742d 5479 7065 3a20 7465 7874
+        0x00d0:  2f68 746d 6c3b 6368 6172 7365 743d 7574
+        0x00e0:  662d 380d 0a43 6f6e 7465 6e74 2d4c 656e
+        0x00f0:  6774 683a 2034 3639 0d0a 0d0a
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  00ee 8bce 4000 4006 b039 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8018
+        0x0030:  0200 fee2 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c51 4854 5450 2f31 2e30 2034 3034 2046
+        0x0050:  696c 6520 6e6f 7420 666f 756e 640d 0a53
+        0x0060:  6572 7665 723a 2053 696d 706c 6548 5454
+        0x0070:  502f 302e 3620 5079 7468 6f6e 2f33 2e31
+        0x0080:  302e 3132 0d0a 4461 7465 3a20 5361 742c
+        0x0090:  2030 3220 4e6f 7620 3230 3234 2031 333a
+        0x00a0:  3530 3a33 3520 474d 540d 0a43 6f6e 6e65
+        0x00b0:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f
+        0x00c0:  6e74 656e 742d 5479 7065 3a20 7465 7874
+        0x00d0:  2f68 746d 6c3b 6368 6172 7365 743d 7574
+        0x00e0:  662d 380d 0a43 6f6e 7465 6e74 2d4c 656e
+        0x00f0:  6774 683a 2034 3639 0d0a 0d0a
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a22 4000 4006 e29f 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 83ce 8010
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a22 4000 4006 e29f 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 83ce 8010
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a24 4000 4006 e29d 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8011
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a24 4000 4006 e29d 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8011
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0209 8bcf 4000 4006 af1d 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 83ce 0cfd 100e 8018
+        0x0030:  0200 fffd 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62 3c21 444f 4354 5950 4520 4854 4d4c
+        0x0050:  2050 5542 4c49 4320 222d 2f2f 5733 432f
+        0x0060:  2f44 5444 2048 544d 4c20 342e 3031 2f2f
+        0x0070:  454e 220a 2020 2020 2020 2020 2268 7474
+        0x0080:  703a 2f2f 7777 772e 7733 2e6f 7267 2f54
+        0x0090:  522f 6874 6d6c 342f 7374 7269 6374 2e64
+        0x00a0:  7464 223e 0a3c 6874 6d6c 3e0a 2020 2020
+        0x00b0:  3c68 6561 643e 0a20 2020 2020 2020 203c
+        0x00c0:  6d65 7461 2068 7474 702d 6571 7569 763d
+        0x00d0:  2243 6f6e 7465 6e74 2d54 7970 6522 2063
+        0x00e0:  6f6e 7465 6e74 3d22 7465 7874 2f68 746d
+        0x00f0:  6c3b 6368 6172 7365 743d 7574 662d 3822
+        0x0100:  3e0a 2020 2020 2020 2020 3c74 6974 6c65
+        0x0110:  3e45 7272 6f72 2072 6573 706f 6e73 653c
+        0x0120:  2f74 6974 6c65 3e0a 2020 2020 3c2f 6865
+        0x0130:  6164 3e0a 2020 2020 3c62 6f64 793e 0a20
+        0x0140:  2020 2020 2020 203c 6831 3e45 7272 6f72
+        0x0150:  2072 6573 706f 6e73 653c 2f68 313e 0a20
+        0x0160:  2020 2020 2020 203c 703e 4572 726f 7220
+        0x0170:  636f 6465 3a20 3430 343c 2f70 3e0a 2020
+        0x0180:  2020 2020 2020 3c70 3e4d 6573 7361 6765
+        0x0190:  3a20 4669 6c65 206e 6f74 2066 6f75 6e64
+        0x01a0:  2e3c 2f70 3e0a 2020 2020 2020 2020 3c70
+        0x01b0:  3e45 7272 6f72 2063 6f64 6520 6578 706c
+        0x01c0:  616e 6174 696f 6e3a 2048 5454 5053 7461
+        0x01d0:  7475 732e 4e4f 545f 464f 554e 4420 2d20
+        0x01e0:  4e6f 7468 696e 6720 6d61 7463 6865 7320
+        0x01f0:  7468 6520 6769 7665 6e20 5552 492e 3c2f
+        0x0200:  703e 0a20 2020 203c 2f62 6f64 793e 0a3c
+        0x0210:  2f68 746d 6c3e 0a
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0209 8bcf 4000 4006 af1d 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 83ce 0cfd 100e 8018
+        0x0030:  0200 fffd 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62 3c21 444f 4354 5950 4520 4854 4d4c
+        0x0050:  2050 5542 4c49 4320 222d 2f2f 5733 432f
+        0x0060:  2f44 5444 2048 544d 4c20 342e 3031 2f2f
+        0x0070:  454e 220a 2020 2020 2020 2020 2268 7474
+        0x0080:  703a 2f2f 7777 772e 7733 2e6f 7267 2f54
+        0x0090:  522f 6874 6d6c 342f 7374 7269 6374 2e64
+        0x00a0:  7464 223e 0a3c 6874 6d6c 3e0a 2020 2020
+        0x00b0:  3c68 6561 643e 0a20 2020 2020 2020 203c
+        0x00c0:  6d65 7461 2068 7474 702d 6571 7569 763d
+        0x00d0:  2243 6f6e 7465 6e74 2d54 7970 6522 2063
+        0x00e0:  6f6e 7465 6e74 3d22 7465 7874 2f68 746d
+        0x00f0:  6c3b 6368 6172 7365 743d 7574 662d 3822
+        0x0100:  3e0a 2020 2020 2020 2020 3c74 6974 6c65
+        0x0110:  3e45 7272 6f72 2072 6573 706f 6e73 653c
+        0x0120:  2f74 6974 6c65 3e0a 2020 2020 3c2f 6865
+        0x0130:  6164 3e0a 2020 2020 3c62 6f64 793e 0a20
+        0x0140:  2020 2020 2020 203c 6831 3e45 7272 6f72
+        0x0150:  2072 6573 706f 6e73 653c 2f68 313e 0a20
+        0x0160:  2020 2020 2020 203c 703e 4572 726f 7220
+        0x0170:  636f 6465 3a20 3430 343c 2f70 3e0a 2020
+        0x0180:  2020 2020 2020 3c70 3e4d 6573 7361 6765
+        0x0190:  3a20 4669 6c65 206e 6f74 2066 6f75 6e64
+        0x01a0:  2e3c 2f70 3e0a 2020 2020 2020 2020 3c70
+        0x01b0:  3e45 7272 6f72 2063 6f64 6520 6578 706c
+        0x01c0:  616e 6174 696f 6e3a 2048 5454 5053 7461
+        0x01d0:  7475 732e 4e4f 545f 464f 554e 4420 2d20
+        0x01e0:  4e6f 7468 696e 6720 6d61 7463 6865 7320
+        0x01f0:  7468 6520 6769 7665 6e20 5552 492e 3c2f
+        0x0200:  703e 0a20 2020 203c 2f62 6f64 793e 0a3c
+        0x0210:  2f68 746d 6c3e 0a
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a23 4000 4006 e29e 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8010
+        0x0030:  01fc fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a23 4000 4006 e29e 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8010
+        0x0030:  01fc fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 8bd0 4000 4006 b0f1 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 85a3 0cfd 100f 8011
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc
+        0x0040:  2c62
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 8bd0 4000 4006 b0f1 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 85a3 0cfd 100f 8011
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc
+        0x0040:  2c62
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a25 4000 4006 e29c 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100f e73e 85a4 8010
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc
+        0x0040:  2c63
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a25 4000 4006 e29c 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100f e73e 85a4 8010
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc
+        0x0040:  2c63
diff --git a/testdata/format/tcp.pcapng.out.txt b/testdata/format/tcp.pcapng.out.txt
new file mode 100644
index 00000000..3e84a906
--- /dev/null
+++ b/testdata/format/tcp.pcapng.out.txt
@@ -0,0 +1,24 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
diff --git a/testdata/format/tfo.pcap b/testdata/format/tfo.pcap
new file mode 100644
index 00000000..1616d55c
Binary files /dev/null and b/testdata/format/tfo.pcap differ
diff --git a/testdata/format/tfo.pcap.out.txt b/testdata/format/tfo.pcap.out.txt
new file mode 100644
index 00000000..db89cdc3
--- /dev/null
+++ b/testdata/format/tfo.pcap.out.txt
@@ -0,0 +1,4 @@
+19:21:01.433721 IP 10.0.1.2.46282 > 10.0.1.1.10054: Flags [S], seq 3162925789, win 64240, options [mss 1460,sackOK,TS val 3692057751 ecr 0,nop,wscale 7,tfo  cookiereq,nop,nop,mptcp 4 capable v1 flags [H]], length 0
+19:21:01.436537 IP 10.0.1.1.10054 > 10.0.1.2.46282: Flags [S.], seq 4060522904, ack 3162925790, win 65160, options [mss 1460,nop,nop,sackOK,nop,wscale 7,tfo  cookie 2657f58b2de43e0e,nop,nop,mptcp 12 capable v1 flags [H] {0x5ad4e6265b0cf688}], length 0
+19:21:01.438160 IP 10.0.1.2.46282 > 10.0.1.1.10054: Flags [.], seq 3162925790, ack 4060522905, win 502, options [mptcp 20 capable v1 flags [H] {0x22b4a70514e01c86,0x5ad4e6265b0cf688}], length 0
+19:21:01.442667 IP 10.0.1.2.46282 > 10.0.1.1.10054: Flags [P.], seq 3162925790:3162930098, ack 4060522905, win 502, options [mptcp 22 capable v1 flags [H] {0x22b4a70514e01c86,0x5ad4e6265b0cf688,data_len=8192},nop,nop], length 4308
diff --git a/testdata/format/udp.pcap b/testdata/format/udp.pcap
new file mode 100644
index 00000000..bf6279d6
Binary files /dev/null and b/testdata/format/udp.pcap differ
diff --git a/testdata/format/udp.pcap.out.txt b/testdata/format/udp.pcap.out.txt
new file mode 100644
index 00000000..d6f7e15f
--- /dev/null
+++ b/testdata/format/udp.pcap.out.txt
@@ -0,0 +1,4 @@
+15:08:45.910679 IP 192.168.0.134.47808 > 192.168.0.24.47808: UDP, length 6
+15:08:45.910728 IP 192.168.0.134.47808 > 192.168.0.24.47808: UDP, length 12
+15:08:45.916723 IP 192.168.0.24.47808 > 192.168.0.134.47808: UDP, length 6
+15:08:45.919556 IP 192.168.0.24.47808 > 192.168.0.255.47808: UDP, length 18
diff --git a/vendor/github.com/x-way/pktdump/arp.go b/vendor/github.com/x-way/pktdump/arp.go
index 49d42f18..e0808729 100644
--- a/vendor/github.com/x-way/pktdump/arp.go
+++ b/vendor/github.com/x-way/pktdump/arp.go
@@ -8,7 +8,7 @@ import (
 	"github.com/gopacket/gopacket/layers"
 )
 
-func formatARP(arp *layers.ARP, length int, opts *Options) string {
+func (f *Formatter) formatARP(arp *layers.ARP, length int) string {
 	builder := strings.Builder{}
 	builder.WriteString("ARP")
 
diff --git a/vendor/github.com/x-way/pktdump/format.go b/vendor/github.com/x-way/pktdump/format.go
index 0c37e5e0..586f370b 100644
--- a/vendor/github.com/x-way/pktdump/format.go
+++ b/vendor/github.com/x-way/pktdump/format.go
@@ -10,8 +10,13 @@ import (
 	"github.com/gopacket/gopacket/layers"
 )
 
-func formatPacketTCP(tcp *layers.TCP, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketTCP(tcp *layers.TCP, src, dst string, length int) string {
 	length -= int(tcp.DataOffset) * 4
+
+	if f.opts.Quiet {
+		return fmt.Sprintf("%s.%d > %s.%d: tcp %d", src, tcp.SrcPort, dst, tcp.DstPort, length)
+	}
+
 	flags := ""
 	if tcp.FIN {
 		flags += "F"
@@ -44,7 +49,7 @@ func formatPacketTCP(tcp *layers.TCP, src, dst string, length int, style FormatS
 		flags = "none"
 	}
 	out := fmt.Sprintf("%s.%d > %s.%d: Flags [%s]", src, tcp.SrcPort, dst, tcp.DstPort, flags)
-	if style >= FormatStyleVerbose {
+	if f.opts.HeaderStyle >= FormatStyleVerbose {
 		out += fmt.Sprintf(", cksum 0x%x", tcp.Checksum)
 	}
 	if length > 0 || tcp.SYN || tcp.FIN || tcp.RST || tcp.ACK {
@@ -105,7 +110,7 @@ func formatPacketTCP(tcp *layers.TCP, src, dst string, length int, style FormatS
 	return out
 }
 
-func formatPacketSIP(sip *layers.SIP, src, dst string, srcPort, dstPort int, style FormatStyle) string {
+func (f *Formatter) formatPacketSIP(sip *layers.SIP, src, dst string, srcPort, dstPort int) string {
 	sipStr := "SIP: "
 	if sip.IsResponse {
 		sipStr += fmt.Sprintf("%s %d %s", sip.Version, sip.ResponseCode, sip.ResponseStatus)
@@ -115,7 +120,7 @@ func formatPacketSIP(sip *layers.SIP, src, dst string, srcPort, dstPort int, sty
 	return fmt.Sprintf("%s.%d > %s.%d: %s", src, srcPort, dst, dstPort, sipStr)
 }
 
-func formatPacketICMPv6(packet *gopacket.Packet, icmp *layers.ICMPv6, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketICMPv6(packet *gopacket.Packet, icmp *layers.ICMPv6, src, dst string, length int) string {
 	switch icmpType := icmp.TypeCode.Type(); icmpType {
 	case layers.ICMPv6TypeEchoRequest:
 		if echoLayer := (*packet).Layer(layers.LayerTypeICMPv6Echo); echoLayer != nil {
@@ -131,7 +136,7 @@ func formatPacketICMPv6(packet *gopacket.Packet, icmp *layers.ICMPv6, src, dst s
 	return fmt.Sprintf("%s > %s: ICMP6, length %d", src, dst, length)
 }
 
-func formatPacketICMPv4(icmp *layers.ICMPv4, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketICMPv4(icmp *layers.ICMPv4, src, dst string, length int) string {
 	switch icmpType := icmp.TypeCode.Type(); icmpType {
 	case layers.ICMPv4TypeEchoRequest:
 		return fmt.Sprintf("%s > %s: ICMP echo request, id %d, seq %d, length %d", src, dst, icmp.Id, icmp.Seq, length)
@@ -142,7 +147,7 @@ func formatPacketICMPv4(icmp *layers.ICMPv4, src, dst string, length int, style
 	}
 }
 
-func formatPacketDNS(dns *layers.DNS, src, dst string, srcPort, dstPort, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketDNS(dns *layers.DNS, src, dst string, srcPort, dstPort, length int) string {
 	dnsStr := ""
 	if dns.QR {
 		dnsStr = fmt.Sprintf("%d", dns.ID)
@@ -305,24 +310,28 @@ func formatPacketDNS(dns *layers.DNS, src, dst string, srcPort, dstPort, length
 	return fmt.Sprintf("%s.%d > %s.%d: %s (%d)", src, srcPort, dst, dstPort, dnsStr, length)
 }
 
-func formatPacketUDP(packet *gopacket.Packet, udp *layers.UDP, src, dst string, style FormatStyle) string {
+func (f *Formatter) formatPacketUDP(packet *gopacket.Packet, udp *layers.UDP, src, dst string) string {
 	length := int(udp.Length) - 8
-	if udp.SrcPort == 53 || udp.DstPort == 53 || udp.SrcPort == 5353 || udp.DstPort == 5353 {
-		if dnsLayer := (*packet).Layer(layers.LayerTypeDNS); dnsLayer != nil {
-			dns, _ := dnsLayer.(*layers.DNS)
-			return formatPacketDNS(dns, src, dst, int(udp.SrcPort), int(udp.DstPort), length, style)
+
+	if !f.opts.Quiet {
+		if udp.SrcPort == 53 || udp.DstPort == 53 || udp.SrcPort == 5353 || udp.DstPort == 5353 {
+			if dnsLayer := (*packet).Layer(layers.LayerTypeDNS); dnsLayer != nil {
+				dns, _ := dnsLayer.(*layers.DNS)
+				return f.formatPacketDNS(dns, src, dst, int(udp.SrcPort), int(udp.DstPort), length)
+			}
 		}
-	}
-	if udp.DstPort == 5060 || udp.SrcPort == 5060 {
-		if sipLayer := (*packet).Layer(layers.LayerTypeSIP); sipLayer != nil {
-			sip, _ := sipLayer.(*layers.SIP)
-			return formatPacketSIP(sip, src, dst, int(udp.SrcPort), int(udp.DstPort), style)
+		if udp.DstPort == 5060 || udp.SrcPort == 5060 {
+			if sipLayer := (*packet).Layer(layers.LayerTypeSIP); sipLayer != nil {
+				sip, _ := sipLayer.(*layers.SIP)
+				return f.formatPacketSIP(sip, src, dst, int(udp.SrcPort), int(udp.DstPort))
+			}
 		}
 	}
+
 	return fmt.Sprintf("%s.%d > %s.%d: UDP, length %d", src, udp.SrcPort, dst, udp.DstPort, length)
 }
 
-func formatPacketOSPF(ospf layers.OSPF, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketOSPF(ospf layers.OSPF, src, dst string, length int) string {
 	var ospfType string
 	switch ospf.Type {
 	case layers.OSPFHello:
@@ -345,7 +354,7 @@ func formatPacketOSPF(ospf layers.OSPF, src, dst string, length int, style Forma
 	return fmt.Sprintf("%s > %s: OSPFv%d, %s, length %d", src, dst, ospf.Version, ospfType, length)
 }
 
-func formatPacketGRE(gre *layers.GRE, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketGRE(gre *layers.GRE, src, dst string, length int) string {
 	out := fmt.Sprintf("%s > %s: GREv%d", src, dst, gre.Version)
 	switch gre.Version {
 	case 0:
@@ -376,9 +385,9 @@ func formatPacketGRE(gre *layers.GRE, src, dst string, length int, style FormatS
 		out += fmt.Sprintf(", length %d: ", length)
 		switch gre.Protocol {
 		case layers.EthernetTypeIPv4:
-			out += FormatWithStyle(gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypeIPv4, gopacket.Default), style)
+			out += FormatWithStyle(gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypeIPv4, gopacket.Default), f.opts.HeaderStyle)
 		case layers.EthernetTypeIPv6:
-			out += FormatWithStyle(gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypeIPv6, gopacket.Default), style)
+			out += FormatWithStyle(gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypeIPv6, gopacket.Default), f.opts.HeaderStyle)
 		default:
 			out += fmt.Sprintf("gre-proto-0x%x", gre.Protocol&0xffff)
 		}
@@ -401,7 +410,7 @@ func formatPacketGRE(gre *layers.GRE, src, dst string, length int, style FormatS
 			case layers.EthernetTypePPP:
 				if pppLayer := gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypePPP, gopacket.Default).Layer(layers.LayerTypePPP); pppLayer != nil {
 					ppp, _ := pppLayer.(*layers.PPP)
-					out += formatPacketPPP(ppp, style)
+					out += f.formatPacketPPP(ppp)
 				}
 			default:
 				out += fmt.Sprintf("gre-proto-0x%x", gre.Protocol&0xffff)
@@ -413,12 +422,12 @@ func formatPacketGRE(gre *layers.GRE, src, dst string, length int, style FormatS
 	return out
 }
 
-func formatPacketPPP(ppp *layers.PPP, style FormatStyle) string {
+func (f *Formatter) formatPacketPPP(ppp *layers.PPP) string {
 	switch ppp.PPPType {
 	case layers.PPPTypeIPv4:
-		return FormatWithStyle(gopacket.NewPacket(ppp.LayerPayload(), layers.LayerTypeIPv4, gopacket.Default), style)
+		return FormatWithStyle(gopacket.NewPacket(ppp.LayerPayload(), layers.LayerTypeIPv4, gopacket.Default), f.opts.HeaderStyle)
 	case layers.PPPTypeIPv6:
-		return FormatWithStyle(gopacket.NewPacket(ppp.LayerPayload(), layers.LayerTypeIPv6, gopacket.Default), style)
+		return FormatWithStyle(gopacket.NewPacket(ppp.LayerPayload(), layers.LayerTypeIPv6, gopacket.Default), f.opts.HeaderStyle)
 	case layers.PPPTypeMPLSUnicast:
 		return fmt.Sprintf("MPLS, length %d", len(ppp.LayerPayload()))
 	case layers.PPPTypeMPLSMulticast:
@@ -428,7 +437,7 @@ func formatPacketPPP(ppp *layers.PPP, style FormatStyle) string {
 	}
 }
 
-func formatIPv4(ipv4 *layers.IPv4, opts *Options) string {
+func (f *Formatter) formatIPv4(ipv4 *layers.IPv4) string {
 	fields := []string{}
 	fields = append(fields, fmt.Sprintf("tos 0x%x", ipv4.TOS))
 	fields = append(fields, fmt.Sprintf("ttl %d", ipv4.TTL))
@@ -445,7 +454,7 @@ func formatIPv4(ipv4 *layers.IPv4, opts *Options) string {
 	return strings.Join(fields, ", ")
 }
 
-func formatIPv6(ipv6 *layers.IPv6, opts *Options) string {
+func (f *Formatter) formatIPv6(ipv6 *layers.IPv6) string {
 	fields := []string{}
 	fields = append(fields, fmt.Sprintf("flowlabel 0x%x", ipv6.FlowLabel))
 	fields = append(fields, fmt.Sprintf("hlim %d", ipv6.HopLimit))
@@ -455,7 +464,7 @@ func formatIPv6(ipv6 *layers.IPv6, opts *Options) string {
 	return strings.Join(fields, ", ")
 }
 
-func formatLinkLayer(packet gopacket.Packet, opts *Options) string {
+func (f *Formatter) formatLinkLayer(packet gopacket.Packet) string {
 	var layer gopacket.Layer
 	if layer = packet.LinkLayer(); layer == nil {
 		return ""
@@ -469,14 +478,14 @@ func formatLinkLayer(packet gopacket.Packet, opts *Options) string {
 		length = len(layer.LayerPayload())
 		break
 	default:
-		return formatUnknown(layer, packet, opts)
+		return f.formatUnknown(layer, packet)
 	}
 
 	switch nextLayerType {
 	case layers.LayerTypeARP:
 		if ly := packet.Layer(layers.LayerTypeARP); ly != nil {
 			arp, _ := ly.(*layers.ARP)
-			return formatARP(arp, length, opts)
+			return f.formatARP(arp, length)
 		}
 	}
 
@@ -489,25 +498,26 @@ func Format(packet gopacket.Packet) string {
 }
 
 func FormatWithStyle(packet gopacket.Packet, style FormatStyle) string {
-	return FormatWithOptions(packet, &Options{HeaderStyle: style})
+	return NewFormatter(&Options{HeaderStyle: style}).formatWithOptions(packet)
 }
 
-func FormatWithOptions(packet gopacket.Packet, opts *Options) string {
-	data := formatWithOptions(packet, opts)
+func (f *Formatter) FormatWithOptions(packet gopacket.Packet, opts *Options) string {
+	f.opts = opts
+	data := f.formatWithOptions(packet)
 	opts.formatContent()
 	return data
 }
 
-func formatWithOptions(packet gopacket.Packet, opts *Options) string {
+func (f *Formatter) formatWithOptions(packet gopacket.Packet) string {
 	var net gopacket.Layer
-	if opts.needFormatLink() && packet.LinkLayer() != nil {
-		opts.rawContent = append(opts.rawContent, packet.LinkLayer().LayerContents()...)
+	if f.opts.needFormatLink() && packet.LinkLayer() != nil {
+		f.opts.rawContent = append(f.opts.rawContent, packet.LinkLayer().LayerContents()...)
 	}
 	if net = packet.NetworkLayer(); net == nil {
-		return formatLinkLayer(packet, opts)
+		return f.formatLinkLayer(packet)
 	}
-	opts.rawContent = append(opts.rawContent, net.LayerContents()...)
-	style := opts.HeaderStyle
+	f.opts.rawContent = append(f.opts.rawContent, net.LayerContents()...)
+	style := f.opts.HeaderStyle
 
 	var prefix, src, dst string
 	var nextLayerType gopacket.LayerType
@@ -517,7 +527,7 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 	case *layers.IPv4:
 		prefix = fmt.Sprintf("IP ")
 		if style >= FormatStyleVerbose {
-			prefix = fmt.Sprintf("IP (%s)\n    ", formatIPv4(net, opts))
+			prefix = fmt.Sprintf("IP (%s)\n    ", f.formatIPv4(net))
 		}
 		nextLayerType = net.NextLayerType()
 		nextLayerPayload = net.LayerPayload()
@@ -527,7 +537,7 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 	case *layers.IPv6:
 		prefix = "IP6 "
 		if style >= FormatStyleVerbose {
-			prefix = fmt.Sprintf("IP6 (%s)\n    ", formatIPv6(net, opts))
+			prefix = fmt.Sprintf("IP6 (%s)\n    ", f.formatIPv6(net))
 		}
 		nextLayerType = net.NextLayerType()
 		nextLayerPayload = net.LayerPayload()
@@ -535,13 +545,13 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 		dst = net.DstIP.String()
 		length = int(net.Length)
 	default:
-		return formatUnknown(net, packet, opts)
+		return f.formatUnknown(net, packet)
 	}
 
 	if packet.TransportLayer() != nil {
-		opts.rawContent = append(opts.rawContent, packet.TransportLayer().LayerContents()...)
+		f.opts.rawContent = append(f.opts.rawContent, packet.TransportLayer().LayerContents()...)
 		if packet.ApplicationLayer() != nil {
-			opts.rawContent = append(opts.rawContent, packet.ApplicationLayer().LayerContents()...)
+			f.opts.rawContent = append(f.opts.rawContent, packet.ApplicationLayer().LayerContents()...)
 		}
 	}
 
@@ -549,17 +559,17 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 	case layers.LayerTypeUDP:
 		if udpLayer := packet.Layer(layers.LayerTypeUDP); udpLayer != nil {
 			udp, _ := udpLayer.(*layers.UDP)
-			return prefix + formatPacketUDP(&packet, udp, src, dst, style)
+			return prefix + f.formatPacketUDP(&packet, udp, src, dst)
 		}
 	case layers.LayerTypeTCP:
 		if tcpLayer := packet.Layer(layers.LayerTypeTCP); tcpLayer != nil {
 			tcp, _ := tcpLayer.(*layers.TCP)
-			return prefix + formatPacketTCP(tcp, src, dst, length, style)
+			return prefix + f.formatPacketTCP(tcp, src, dst, length)
 		}
 	case layers.LayerTypeICMPv6:
 		if icmpLayer := packet.Layer(layers.LayerTypeICMPv6); icmpLayer != nil {
 			icmp, _ := icmpLayer.(*layers.ICMPv6)
-			return prefix + formatPacketICMPv6(&packet, icmp, src, dst, length, style)
+			return prefix + f.formatPacketICMPv6(&packet, icmp, src, dst, length)
 		}
 	case layers.LayerTypeOSPF:
 		if ospfLayer := packet.Layer(layers.LayerTypeOSPF); ospfLayer != nil {
@@ -568,20 +578,20 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 				if ospfLayer.AuType == 2 {
 					length -= 16
 				}
-				return prefix + formatPacketOSPF(ospfLayer.OSPF, src, dst, length, style)
+				return prefix + f.formatPacketOSPF(ospfLayer.OSPF, src, dst, length)
 			case *layers.OSPFv3:
-				return prefix + formatPacketOSPF(ospfLayer.OSPF, src, dst, length, style)
+				return prefix + f.formatPacketOSPF(ospfLayer.OSPF, src, dst, length)
 			}
 		}
 	case layers.LayerTypeGRE:
 		if greLayer := packet.Layer(layers.LayerTypeGRE); greLayer != nil {
 			gre, _ := greLayer.(*layers.GRE)
-			return prefix + formatPacketGRE(gre, src, dst, length, style)
+			return prefix + f.formatPacketGRE(gre, src, dst, length)
 		}
 	case layers.LayerTypeICMPv4:
 		if icmpLayer := packet.Layer(layers.LayerTypeICMPv4); icmpLayer != nil {
 			icmp, _ := icmpLayer.(*layers.ICMPv4)
-			return prefix + formatPacketICMPv4(icmp, src, dst, length, style)
+			return prefix + f.formatPacketICMPv4(icmp, src, dst, length)
 		}
 	case layers.LayerTypeIPv4:
 		fallthrough
diff --git a/vendor/github.com/x-way/pktdump/formatter.go b/vendor/github.com/x-way/pktdump/formatter.go
new file mode 100644
index 00000000..bfbb2496
--- /dev/null
+++ b/vendor/github.com/x-way/pktdump/formatter.go
@@ -0,0 +1,9 @@
+package pktdump
+
+type Formatter struct {
+	opts *Options
+}
+
+func NewFormatter(opts *Options) *Formatter {
+	return &Formatter{opts: opts}
+}
diff --git a/vendor/github.com/x-way/pktdump/mptcp.go b/vendor/github.com/x-way/pktdump/mptcp.go
index 247850fd..3a7b302e 100644
--- a/vendor/github.com/x-way/pktdump/mptcp.go
+++ b/vendor/github.com/x-way/pktdump/mptcp.go
@@ -502,8 +502,15 @@ func mptcpPrint(options *mptcpPrintOptions, opt layers.TCPOption) string {
 	buf.WriteString(fmt.Sprintf(" %d", length))
 	buf.WriteString(fmt.Sprintf(" %s", MPTCPPrintOptions[subtype].Name))
 
-	// Call the corresponding print function for the subtype.
-	MPTCPPrintOptions[subtype].Print(options, opt, &buf)
+	func() {
+		defer func() {
+			if err := recover(); err != nil {
+				buf.WriteString("[bad opt]")
+			}
+		}()
+		// Call the corresponding print function for the subtype.
+		MPTCPPrintOptions[subtype].Print(options, opt, &buf)
+	}()
 
 	return buf.String()
 }
diff --git a/vendor/github.com/x-way/pktdump/options.go b/vendor/github.com/x-way/pktdump/options.go
index f1132e31..9c8cc959 100644
--- a/vendor/github.com/x-way/pktdump/options.go
+++ b/vendor/github.com/x-way/pktdump/options.go
@@ -10,6 +10,8 @@ type Options struct {
 
 	rawContent      []byte
 	FormatedContent []byte
+
+	Quiet bool
 }
 
 const (
diff --git a/vendor/github.com/x-way/pktdump/unknown.go b/vendor/github.com/x-way/pktdump/unknown.go
index d7ffdea3..769e43b2 100644
--- a/vendor/github.com/x-way/pktdump/unknown.go
+++ b/vendor/github.com/x-way/pktdump/unknown.go
@@ -5,7 +5,7 @@ import (
 	"github.com/gopacket/gopacket"
 )
 
-func formatUnknown(layer gopacket.Layer, packet gopacket.Packet, opts *Options) string {
+func (f *Formatter) formatUnknown(layer gopacket.Layer, packet gopacket.Packet) string {
 	return fmt.Sprintf("%s, %s, length %d", layer.LayerType().String(),
 		packet.LinkLayer().LinkFlow().String(), len(layer.LayerPayload()))
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0c44d01f..5e46c785 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -390,7 +390,7 @@ github.com/tklauser/numcpus
 # github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74
 ## explicit; go 1.12
 github.com/vishvananda/netns
-# github.com/x-way/pktdump v0.0.5 => github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d
+# github.com/x-way/pktdump v0.0.5 => github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1
 ## explicit; go 1.19
 github.com/x-way/pktdump
 # github.com/yusufpapurcu/wmi v1.2.4
@@ -595,6 +595,6 @@ k8s.io/utils/exec
 rsc.io/binaryregexp
 rsc.io/binaryregexp/syntax
 # github.com/gopacket/gopacket => github.com/mozillazg/gopacket v0.0.0-20241026043817-048341de5231
-# github.com/x-way/pktdump => github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d
+# github.com/x-way/pktdump => github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1
 # k8s.io/cri-api => github.com/mozillazg/cri-api v0.32.0-alpha.1.0.20241019013855-3dc36f8743df
 # k8s.io/cri-client => github.com/mozillazg/cri-client v0.31.0-alpha.0.0.20241019023238-87687176fd67