From 8f7728ac9d9b1a1700f35db1a327694cf3b2c961 Mon Sep 17 00:00:00 2001
From: Huang Huang <mozillazg101@gmail.com>
Date: Sun, 3 Nov 2024 16:51:21 +0800
Subject: [PATCH] feat(output/stdout): Add -q/--quiet flag for quiet output
 (#179)

* feat(output/stdout): Add -q/--quiet flag for quiet output

* add missing files
---
 README.md                                    |  59 +++--
 README.zh-CN.md                              |  58 +++--
 cmd/list.go                                  |   2 +-
 cmd/log.go                                   |   2 +-
 cmd/options.go                               |  15 +-
 cmd/read.go                                  |  12 +-
 cmd/read_test.go                             | 132 +++++++++++
 cmd/root.go                                  |  10 +-
 go.mod                                       |   2 +-
 go.sum                                       |   4 +-
 internal/capturer/capturer.go                |   1 +
 internal/writer/stdout.go                    |   4 +-
 testdata/format/dns.pcapng                   | Bin 0 -> 848 bytes
 testdata/format/dns.pcapng.-q.out.txt        |   2 +
 testdata/format/dns.pcapng.out.txt           |   2 +
 testdata/format/mptcp.pcap                   | Bin 0 -> 1405 bytes
 testdata/format/mptcp.pcap.out.txt           |  14 ++
 testdata/format/tcp.pcapng                   | Bin 0 -> 9888 bytes
 testdata/format/tcp.pcapng.-A.out.txt        | 124 ++++++++++
 testdata/format/tcp.pcapng.-X.out.txt        | 210 +++++++++++++++++
 testdata/format/tcp.pcapng.-XX.out.txt       | 234 +++++++++++++++++++
 testdata/format/tcp.pcapng.-q.out.txt        |  24 ++
 testdata/format/tcp.pcapng.-v.out.txt        |  96 ++++++++
 testdata/format/tcp.pcapng.-x.out.txt        | 210 +++++++++++++++++
 testdata/format/tcp.pcapng.-xx.out.txt       | 234 +++++++++++++++++++
 testdata/format/tcp.pcapng.out.txt           |  24 ++
 testdata/format/tfo.pcap                     | Bin 0 -> 4744 bytes
 testdata/format/tfo.pcap.out.txt             |   4 +
 testdata/format/udp.pcap                     | Bin 0 -> 310 bytes
 testdata/format/udp.pcap.out.txt             |   4 +
 vendor/github.com/x-way/pktdump/arp.go       |   2 +-
 vendor/github.com/x-way/pktdump/format.go    | 110 +++++----
 vendor/github.com/x-way/pktdump/formatter.go |   9 +
 vendor/github.com/x-way/pktdump/mptcp.go     |  11 +-
 vendor/github.com/x-way/pktdump/options.go   |   2 +
 vendor/github.com/x-way/pktdump/unknown.go   |   2 +-
 vendor/modules.txt                           |   4 +-
 37 files changed, 1518 insertions(+), 105 deletions(-)
 create mode 100644 cmd/read_test.go
 create mode 100644 testdata/format/dns.pcapng
 create mode 100644 testdata/format/dns.pcapng.-q.out.txt
 create mode 100644 testdata/format/dns.pcapng.out.txt
 create mode 100644 testdata/format/mptcp.pcap
 create mode 100644 testdata/format/mptcp.pcap.out.txt
 create mode 100644 testdata/format/tcp.pcapng
 create mode 100644 testdata/format/tcp.pcapng.-A.out.txt
 create mode 100644 testdata/format/tcp.pcapng.-X.out.txt
 create mode 100644 testdata/format/tcp.pcapng.-XX.out.txt
 create mode 100644 testdata/format/tcp.pcapng.-q.out.txt
 create mode 100644 testdata/format/tcp.pcapng.-v.out.txt
 create mode 100644 testdata/format/tcp.pcapng.-x.out.txt
 create mode 100644 testdata/format/tcp.pcapng.-xx.out.txt
 create mode 100644 testdata/format/tcp.pcapng.out.txt
 create mode 100644 testdata/format/tfo.pcap
 create mode 100644 testdata/format/tfo.pcap.out.txt
 create mode 100644 testdata/format/udp.pcap
 create mode 100644 testdata/format/udp.pcap.out.txt
 create mode 100644 vendor/github.com/x-way/pktdump/formatter.go

diff --git a/README.md b/README.md
index a679b2ee..d8004130 100644
--- a/README.md
+++ b/README.md
@@ -41,7 +41,8 @@ Table of Contents
   * Supports filtering packets by container ID, container name and pod name.
 * Supports using pcap-filter(7) syntax for filtering packets.
 * Directly applies filters in the kernel space.
-* Supports saving captured packets in the PcapNG format for offline analysis with third-party tools such as Wireshark.
+* Supports saving captured packets in the PcapNG format for offline analysis with third-party tools such as Wireshark/tshark/tcpdump.
+* Supports packet capture for network interfaces under the specified network namespace.
 
 
 ## Installation
@@ -108,6 +109,16 @@ sudo ptcpdump -i any -w - port 80 | tcpdump -n -r -
 sudo ptcpdump -i any -w - port 80 | tshark -r -
 ```
 
+
+Capturing interfaces in other network namespaces:
+
+```
+sudo ptcpdump -i lo --netns /run/netns/foo --netns /run/netns/bar
+sudo ptcpdump -i any --netns /run/netns/foobar
+sudo ptcpdump -i any --netns /proc/26/ns/net
+```
+
+
 <p align="right"><a href="#top">🔝</a></p>
 
 
@@ -121,6 +132,13 @@ Default:
 09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: Flags [S], seq 4113492822, win 64240, length 0, ParentProc [python3.834381], Container [test], Pod [test.default]
 ```
 
+With `-q`:
+
+```
+09:32:09.718892 vethee2a302f wget.3553008 In IP 10.244.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
+09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
+```
+
 With `-v`:
 
 ```
@@ -220,6 +238,7 @@ Flags:
       --delay-before-handle-packet-events duration   Delay some durations before handle packet events
   -Q, --direction string                             Choose send/receive direction for which packets should be captured. Possible values are 'in', 'out' and 'inout' (default "inout")
       --docker-address string                        Address of Docker Engine service (default "/var/run/docker.sock")
+      --embed-keylog-to-pcapng -- CMD [ARGS]         Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
       --event-chan-size uint                         Size of event chan (default 20)
       --exec-events-worker-number uint               Number of worker to handle exec events (default 50)
   -f, --follow-forks                                 Trace child processes as they are created by currently traced processes when filter by process
@@ -230,6 +249,7 @@ Flags:
       --log-level string                             Set the logging level ("debug", "info", "warn", "error", "fatal") (default "warn")
       --micro                                        Shorthands for --time-stamp-precision=micro
       --nano                                         Shorthands for --time-stamp-precision=nano
+      --netns strings                                Path to an network namespace file or name (default [/proc/self/ns/net])
   -n, --no-convert-addr count                        Don't convert addresses (i.e., host addresses, port numbers, etc.) to names
   -t, --no-timestamp                                 Don't print a timestamp on each dump line
   -#, --number                                       Print an optional packet number at the beginning of the line
@@ -241,6 +261,7 @@ Flags:
   -A, --print-data-in-ascii                          Print each packet (minus its link level header) in ASCII
   -x, --print-data-in-hex count                      When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex
   -X, --print-data-in-hex-ascii count                When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex and ASCII
+  -q, --quiet                                        Quiet output. Print less protocol information so output lines are shorter
   -r, --read-file string                             Read packets from file (which was created with the -w option). e.g. ptcpdump.pcapng
   -c, --receive-count uint                           Exit after receiving count packets
   -s, --snapshot-length uint32                       Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes (default 262144)
@@ -248,6 +269,8 @@ Flags:
   -v, --verbose count                                When parsing and printing, produce (slightly more) verbose output
       --version                                      Print the ptcpdump and libpcap version strings and exit
   -w, --write-file string                            Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is '-'. e.g. ptcpdump.pcapng
+      --write-keylog-file -- CMD [ARGS]              Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
+
 ```
 
 <p align="right"><a href="#top">🔝</a></p>
@@ -271,21 +294,22 @@ Flags:
 | --pod-name *pod_name.namespace*                   |         | ✅                        |
 | -f, --follow-forks                                |         | ✅                        |
 | -- *command [args]*                               |         | ✅                        |
-| --oneline                                       |         | ✅                        |
+| --oneline                                         |         | ✅                        |
+| --netns *path_to_net_ns*                          |         | ✅                        |
 | --print                                           | ✅       | ✅                        |
 | -c *count*                                        | ✅       | ✅                        |
 | -Q *direction*, --direction=*direction*           | ✅       | ✅                        |
 | -D, --list-interfaces                             | ✅       | ✅                        |
 | -A                                                | ✅       | ✅                        |
-| -x                                                | ✅       | ✅                      |
-| -xx                                               | ✅       | ✅                      |
-| -X                                                | ✅       | ✅                     |
-| -XX                                               | ✅       | ✅                     |
-| -v                                                | ✅       | ✅                       |
-| -vv                                               | ✅       | ⭕                       |
-| -vvv                                              | ✅       | ⭕                       |
+| -x                                                | ✅       | ✅                        |
+| -xx                                               | ✅       | ✅                        |
+| -X                                                | ✅       | ✅                        |
+| -XX                                               | ✅       | ✅                        |
+| -v                                                | ✅       | ✅                        |
+| -vv                                               | ✅       | ⭕                        |
+| -vvv                                              | ✅       | ⭕                        |
 | -B *bufer_size*, --buffer-size=*buffer_size*      | ✅       |                          |
-| --count                                           | ✅       | ✅                       |
+| --count                                           | ✅       | ✅                        |
 | -C *file_size                                     | ✅       |                          |
 | -d                                                | ✅       |                          |
 | -dd                                               | ✅       |                          |
@@ -301,23 +325,24 @@ Flags:
 | --immediate-mode                                  | ✅       |                          |
 | -j *tstamp_type*, --time-stamp-type=*tstamp_type* | ✅       |                          |
 | -J, --list-time-stamp-types                       | ✅       |                          |
-| --time-stamp-precision=*tstamp_precision*         | ✅       | ✅                       |
-| --micro                                           | ✅       | ✅                       |
-| --nano                                            | ✅       | ✅                       |
+| --time-stamp-precision=*tstamp_precision*         | ✅       | ✅                        |
+| --micro                                           | ✅       | ✅                        |
+| --nano                                            | ✅       | ✅                        |
 | -K, --dont-verify-checksums                       | ✅       |                          |
 | -l                                                | ✅       |                          |
 | -L, --list-data-link-types                        | ✅       |                          |
 | -m *module*                                       | ✅       |                          |
 | -M *secret*                                       | ✅       |                          |
-| -n                                                | ✅       | ✅                       |
+| -n                                                | ✅       | ✅                        |
 | -N                                                | ✅       |                          |
-| -#, --number                                      | ✅       | ✅                       |
+| -#, --number                                      | ✅       | ✅                        |
 | -O, --no-optimize                                 | ✅       |                          |
 | -p, --no-promiscuous-mode                         | ✅       | ⛔                        |
+| -q                                                | ✅       | ✅                        |
 | -S, --absolute-tcp-sequence-numbers               | ✅       |                          |
-| -s *snaplen*, --snapshot-length=*snaplen*         | ✅       | ✅                       |
+| -s *snaplen*, --snapshot-length=*snaplen*         | ✅       | ✅                        |
 | -T *type*                                         | ✅       |                          |
-| -t                                                | ✅       | ✅                       |
+| -t                                                | ✅       | ✅                        |
 | -tt                                               | ✅       | ⭕                        |
 | -ttt                                              | ✅       | ⭕                        |
 | -tttt                                             | ✅       | ⭕                        |
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 51b84b65..ade838e6 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -45,6 +45,7 @@ Table of Contents
 * 直接在内核态应用过滤规则，避免在用户态应用过滤规则导致的性能问题
 * 支持以 pcap 或 PcapNG 保存捕获的流程, 可以使用 Wireshark、tcpdump、tshark 等第三方工具对保存的数据进行二次分析.
 * 以静态链接的方式编译程序，不依赖额外的系统链接库
+* 支持对指定网络命名空间下的网络接口进行抓包
 
 
 ## Installation
@@ -76,7 +77,7 @@ sudo ptcpdump -i eth0 -A -s 0 -n -v tcp and port 80 and host 10.10.1.1
 sudo ptcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0'
 ```
 
-过滤多个网络接口：
+对多个网络接口进行抓包：
 
 ```
 sudo ptcpdump -i eth0 -i lo
@@ -116,6 +117,15 @@ sudo ptcpdump -i any -w - port 80 | tcpdump -n -r -
 sudo ptcpdump -i any -w - port 80 | tshark -r -
 ```
 
+支持对其他网络命名空间下的网络接口进行抓包:
+
+```
+sudo ptcpdump -i lo --netns /run/netns/foo --netns /run/netns/bar
+sudo ptcpdump -i any --netns /run/netns/foobar
+sudo ptcpdump -i any --netns /proc/26/ns/net
+```
+
+
 <p align="right"><a href="#top">🔝</a></p>
 
 
@@ -129,6 +139,13 @@ sudo ptcpdump -i any -w - port 80 | tshark -r -
 09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: Flags [S], seq 4113492822, win 64240, length 0, ParentProc [python3.834381], Container [test], Pod [test.default]
 ```
 
+通过 `-q` 参数指定不输出协议详细信息:
+
+```
+09:32:09.718892 vethee2a302f wget.3553008 In IP 10.244.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
+09:32:09.718941 eth0 wget.3553008 Out IP 172.19.0.2.33426 > 139.178.84.217.80: tcp 0, ParentProc [python3.834381], Container [test], Pod [test.default]
+```
+
 通过 `-v` 参数以详细方式输出:
 
 ```
@@ -228,6 +245,7 @@ Flags:
       --delay-before-handle-packet-events duration   Delay some durations before handle packet events
   -Q, --direction string                             Choose send/receive direction for which packets should be captured. Possible values are 'in', 'out' and 'inout' (default "inout")
       --docker-address string                        Address of Docker Engine service (default "/var/run/docker.sock")
+      --embed-keylog-to-pcapng -- CMD [ARGS]         Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
       --event-chan-size uint                         Size of event chan (default 20)
       --exec-events-worker-number uint               Number of worker to handle exec events (default 50)
   -f, --follow-forks                                 Trace child processes as they are created by currently traced processes when filter by process
@@ -238,6 +256,7 @@ Flags:
       --log-level string                             Set the logging level ("debug", "info", "warn", "error", "fatal") (default "warn")
       --micro                                        Shorthands for --time-stamp-precision=micro
       --nano                                         Shorthands for --time-stamp-precision=nano
+      --netns strings                                Path to an network namespace file or name (default [/proc/self/ns/net])
   -n, --no-convert-addr count                        Don't convert addresses (i.e., host addresses, port numbers, etc.) to names
   -t, --no-timestamp                                 Don't print a timestamp on each dump line
   -#, --number                                       Print an optional packet number at the beginning of the line
@@ -249,6 +268,7 @@ Flags:
   -A, --print-data-in-ascii                          Print each packet (minus its link level header) in ASCII
   -x, --print-data-in-hex count                      When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex
   -X, --print-data-in-hex-ascii count                When parsing and printing, in addition to printing the headers of each packet, print the data of each packet in hex and ASCII
+  -q, --quiet                                        Quiet output. Print less protocol information so output lines are shorter
   -r, --read-file string                             Read packets from file (which was created with the -w option). e.g. ptcpdump.pcapng
   -c, --receive-count uint                           Exit after receiving count packets
   -s, --snapshot-length uint32                       Snarf snaplen bytes of data from each packet rather than the default of 262144 bytes (default 262144)
@@ -256,6 +276,8 @@ Flags:
   -v, --verbose count                                When parsing and printing, produce (slightly more) verbose output
       --version                                      Print the ptcpdump and libpcap version strings and exit
   -w, --write-file string                            Write the raw packets to file rather than parsing and printing them out. They can later be printed with the -r option. Standard output is used if file is '-'. e.g. ptcpdump.pcapng
+      --write-keylog-file -- CMD [ARGS]              Write TLS Key Log file to this path (experimental: only support unstripped Go binary and must combined with -- CMD [ARGS])
+
 ```
 
 <p align="right"><a href="#top">🔝</a></p>
@@ -282,21 +304,22 @@ Flags:
 | --pod-name *pod_name.namespace*                   |         | ✅                        |
 | -f, --follow-forks                                |         | ✅                        |
 | -- *command [args]*                               |         | ✅                        |
-| --oneline                                       |         | ✅                        |
+| --oneline                                         |         | ✅                        |
+| --netns *path_to_net_ns*                          |         | ✅                        |
 | --print                                           | ✅       | ✅                        |
 | -c *count*                                        | ✅       | ✅                        |
 | -Q *direction*, --direction=*direction*           | ✅       | ✅                        |
 | -D, --list-interfaces                             | ✅       | ✅                        |
 | -A                                                | ✅       | ✅                        |
-| -x                                                | ✅       | ✅                      |
-| -xx                                               | ✅       | ✅                      |
-| -X                                                | ✅       | ✅                     |
-| -XX                                               | ✅       | ✅                     |
-| -v                                                | ✅       | ✅                       |
-| -vv                                               | ✅       | ⭕                       |
-| -vvv                                              | ✅       | ⭕                       |
+| -x                                                | ✅       | ✅                        |
+| -xx                                               | ✅       | ✅                        |
+| -X                                                | ✅       | ✅                        |
+| -XX                                               | ✅       | ✅                        |
+| -v                                                | ✅       | ✅                        |
+| -vv                                               | ✅       | ⭕                        |
+| -vvv                                              | ✅       | ⭕                        |
 | -B *bufer_size*, --buffer-size=*buffer_size*      | ✅       |                          |
-| --count                                           | ✅       | ✅                       |
+| --count                                           | ✅       | ✅                        |
 | -C *file_size                                     | ✅       |                          |
 | -d                                                | ✅       |                          |
 | -dd                                               | ✅       |                          |
@@ -312,23 +335,24 @@ Flags:
 | --immediate-mode                                  | ✅       |                          |
 | -j *tstamp_type*, --time-stamp-type=*tstamp_type* | ✅       |                          |
 | -J, --list-time-stamp-types                       | ✅       |                          |
-| --time-stamp-precision=*tstamp_precision*         | ✅       | ✅                       |
-| --micro                                           | ✅       | ✅                       |
-| --nano                                            | ✅       | ✅                       |
+| --time-stamp-precision=*tstamp_precision*         | ✅       | ✅                        |
+| --micro                                           | ✅       | ✅                        |
+| --nano                                            | ✅       | ✅                        |
 | -K, --dont-verify-checksums                       | ✅       |                          |
 | -l                                                | ✅       |                          |
 | -L, --list-data-link-types                        | ✅       |                          |
 | -m *module*                                       | ✅       |                          |
 | -M *secret*                                       | ✅       |                          |
-| -n                                                | ✅       | ✅                       |
+| -n                                                | ✅       | ✅                        |
 | -N                                                | ✅       |                          |
-| -#, --number                                      | ✅       | ✅                       |
+| -#, --number                                      | ✅       | ✅                        |
 | -O, --no-optimize                                 | ✅       |                          |
 | -p, --no-promiscuous-mode                         | ✅       | ⛔                        |
+| -q                                                | ✅       | ✅                        |
 | -S, --absolute-tcp-sequence-numbers               | ✅       |                          |
-| -s *snaplen*, --snapshot-length=*snaplen*         | ✅       | ✅                       |
+| -s *snaplen*, --snapshot-length=*snaplen*         | ✅       | ✅                        |
 | -T *type*                                         | ✅       |                          |
-| -t                                                | ✅       | ✅                       |
+| -t                                                | ✅       | ✅                        |
 | -tt                                               | ✅       | ⭕                        |
 | -ttt                                              | ✅       | ⭕                        |
 | -tttt                                             | ✅       | ⭕                        |
diff --git a/cmd/list.go b/cmd/list.go
index c32c9904..015e649b 100644
--- a/cmd/list.go
+++ b/cmd/list.go
@@ -5,7 +5,7 @@ import (
 	"strings"
 )
 
-func listInterfaces(opts Options) error {
+func listInterfaces(opts *Options) error {
 	opts.ifaces = nil
 	devices, err := opts.GetDevices()
 	if err != nil {
diff --git a/cmd/log.go b/cmd/log.go
index a4f44b21..10a039f6 100644
--- a/cmd/log.go
+++ b/cmd/log.go
@@ -22,7 +22,7 @@ func logFatal(err error) {
 	log.Fatalf("%+v", err)
 }
 
-func setupLogger(opts Options) {
+func setupLogger(opts *Options) {
 	switch opts.logLevel {
 	case "debug":
 		log.SetLevel(plog.DebugLevel)
diff --git a/cmd/options.go b/cmd/options.go
index 8838962b..604540d3 100644
--- a/cmd/options.go
+++ b/cmd/options.go
@@ -9,6 +9,7 @@ import (
 	"github.com/mozillazg/ptcpdump/internal/types"
 	"github.com/mozillazg/ptcpdump/internal/writer"
 	"github.com/x-way/pktdump"
+	"io"
 	"os"
 	"path"
 	"strings"
@@ -50,6 +51,7 @@ type Options struct {
 
 	dontConvertAddr int
 	verbose         int
+	quiet           bool
 
 	containerId   string
 	containerName string
@@ -76,6 +78,8 @@ type Options struct {
 	netnsIds []uint32
 	pidnsIds []uint32
 
+	stdout io.Writer
+
 	netNsPaths    []string
 	devices       *types.Interfaces
 	netNSCache    *metadata.NetNsCache
@@ -162,11 +166,12 @@ func getDefaultCriRuntimeEndpoint() []string {
 	return rs
 }
 
-func (o Options) applyToStdoutWriter(w *writer.StdoutWriter) {
+func (opts *Options) applyToStdoutWriter(w *writer.StdoutWriter) {
 	w.OneLine = opts.oneLine
 	w.PrintNumber = opts.printPacketNumber
 	w.NoTimestamp = opts.dontPrintTimestamp
 	w.TimestampNano = opts.TimeStampAsNano()
+	w.Quiet = opts.quiet
 	if opts.onlyPrintCount {
 		w.DoNothing = true
 	}
@@ -259,6 +264,13 @@ func (o *Options) GetDevices() (*types.Interfaces, error) {
 	return o.devices, nil
 }
 
+func (o *Options) getStdout() io.Writer {
+	if o.stdout == nil {
+		o.stdout = os.Stdout
+	}
+	return o.stdout
+}
+
 func (o *Options) ToCapturerOptions() *capturer.Options {
 	copts := &capturer.Options{
 		Pids:                          o.pids,
@@ -269,6 +281,7 @@ func (o *Options) ToCapturerOptions() *capturer.Options {
 		DirectionIn:                   o.DirectionIn(),
 		DirectionOut:                  o.DirectionOut(),
 		OneLine:                       o.oneLine,
+		Quiet:                         o.quiet,
 		PrintPacketNumber:             o.printPacketNumber,
 		DontPrintTimestamp:            o.dontPrintTimestamp,
 		OnlyPrintCount:                o.onlyPrintCount,
diff --git a/cmd/read.go b/cmd/read.go
index 884158a3..7268fc1c 100644
--- a/cmd/read.go
+++ b/cmd/read.go
@@ -3,6 +3,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"github.com/mozillazg/ptcpdump/internal/utils"
 	"io"
 	"os"
 	"path/filepath"
@@ -12,8 +13,11 @@ import (
 	"github.com/mozillazg/ptcpdump/internal/writer"
 )
 
-func read(ctx context.Context, opts Options) error {
-	f, err := os.Open(opts.ReadPath())
+func read(ctx context.Context, opts *Options) error {
+	fpath := opts.ReadPath()
+	utils.OutStderr("reading from file %s\n", fpath)
+
+	f, err := os.Open(fpath)
 	if err != nil {
 		return err
 	}
@@ -21,10 +25,10 @@ func read(ctx context.Context, opts Options) error {
 
 	var p parser.Parser
 	pcache := metadata.NewProcessCache()
-	stdoutWriter := writer.NewStdoutWriter(os.Stdout, pcache)
+	stdoutWriter := writer.NewStdoutWriter(opts.getStdout(), pcache)
 	opts.applyToStdoutWriter(stdoutWriter)
 
-	ext := filepath.Ext(opts.ReadPath())
+	ext := filepath.Ext(fpath)
 	switch ext {
 	case extPcap:
 		pr, err := parser.NewPcapParser(f)
diff --git a/cmd/read_test.go b/cmd/read_test.go
new file mode 100644
index 00000000..620abe97
--- /dev/null
+++ b/cmd/read_test.go
@@ -0,0 +1,132 @@
+package cmd
+
+import (
+	"bytes"
+	"context"
+	"github.com/stretchr/testify/assert"
+	"os"
+	"testing"
+)
+
+func TestFormat(t *testing.T) {
+	type args struct {
+		name            string
+		opts            *Options
+		expectedOutFile string
+	}
+
+	tests := []args{
+		{
+			name: "tcp",
+			opts: &Options{
+				readFilePath: "../testdata/format/tcp.pcapng",
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.out.txt",
+		},
+		{
+			name: "tcp -v",
+			opts: &Options{
+				readFilePath: "../testdata/format/tcp.pcapng",
+				verbose:      1,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-v.out.txt",
+		},
+		{
+			name: "tcp -q",
+			opts: &Options{
+				readFilePath: "../testdata/format/tcp.pcapng",
+				quiet:        true,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-q.out.txt",
+		},
+		{
+			name: "tcp -A",
+			opts: &Options{
+				readFilePath:     "../testdata/format/tcp.pcapng",
+				printDataAsASCII: true,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-A.out.txt",
+		},
+		{
+			name: "tcp -x",
+			opts: &Options{
+				readFilePath:   "../testdata/format/tcp.pcapng",
+				printDataAsHex: 1,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-x.out.txt",
+		},
+		{
+			name: "tcp -xx",
+			opts: &Options{
+				readFilePath:   "../testdata/format/tcp.pcapng",
+				printDataAsHex: 2,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-xx.out.txt",
+		},
+		{
+			name: "tcp -X",
+			opts: &Options{
+				readFilePath:        "../testdata/format/tcp.pcapng",
+				printDataAsHexASCII: 1,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-X.out.txt",
+		},
+		{
+			name: "tcp -XX",
+			opts: &Options{
+				readFilePath:        "../testdata/format/tcp.pcapng",
+				printDataAsHexASCII: 2,
+			},
+			expectedOutFile: "../testdata/format/tcp.pcapng.-XX.out.txt",
+		},
+		{
+			name: "mptcp",
+			opts: &Options{
+				readFilePath: "../testdata/format/mptcp.pcap",
+			},
+			expectedOutFile: "../testdata/format/mptcp.pcap.out.txt",
+		},
+		{
+			name: "tfo and sack",
+			opts: &Options{
+				readFilePath: "../testdata/format/tfo.pcap",
+			},
+			expectedOutFile: "../testdata/format/tfo.pcap.out.txt",
+		},
+		{
+			name: "udp",
+			opts: &Options{
+				readFilePath: "../testdata/format/udp.pcap",
+			},
+			expectedOutFile: "../testdata/format/udp.pcap.out.txt",
+		},
+		{
+			name: "udp dns",
+			opts: &Options{
+				readFilePath: "../testdata/format/dns.pcapng",
+			},
+			expectedOutFile: "../testdata/format/dns.pcapng.out.txt",
+		},
+		{
+			name: "udp dns -q",
+			opts: &Options{
+				readFilePath: "../testdata/format/dns.pcapng",
+				quiet:        true,
+			},
+			expectedOutFile: "../testdata/format/dns.pcapng.-q.out.txt",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			output := bytes.Buffer{}
+			tt.opts.stdout = &output
+
+			err := read(context.TODO(), tt.opts)
+			assert.NoError(t, err)
+
+			expected, err := os.ReadFile(tt.expectedOutFile)
+			assert.NoError(t, err)
+			assert.Equal(t, string(expected), output.String())
+		})
+	}
+}
diff --git a/cmd/root.go b/cmd/root.go
index 3466a6fb..379af74e 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -12,7 +12,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var opts = Options{}
+var opts = &Options{}
 
 var rootCmd = &cobra.Command{
 	Use: `ptcpdump [flags] [expression] [-- command [args]]
@@ -36,7 +36,7 @@ Expression: see "man 7 pcap-filter"`,
 		" it adds process info as packet comments for each Packet when possible.\n" +
 		" More info: https://github.com/mozillazg/ptcpdump",
 	Run: func(cmd *cobra.Command, args []string) {
-		prepareOptions(&opts, os.Args, args)
+		prepareOptions(opts, os.Args, args)
 		setupLogger(opts)
 
 		err := run(opts)
@@ -125,6 +125,8 @@ func init() {
 
 	rootCmd.Flags().StringSliceVar(&opts.netNsPaths, "netns", []string{"/proc/self/ns/net"},
 		"Path to an network namespace file or name")
+	rootCmd.Flags().BoolVarP(&opts.quiet, "quiet", "q", false,
+		"Quiet output. Print less protocol information so output lines are shorter")
 
 	silenceKlog()
 }
@@ -133,7 +135,7 @@ func Execute() error {
 	return rootCmd.Execute()
 }
 
-func run(opts Options) error {
+func run(opts *Options) error {
 	ctx, stopFunc := signal.NotifyContext(
 		context.Background(), syscall.SIGINT, syscall.SIGTERM,
 	)
@@ -149,7 +151,7 @@ func run(opts Options) error {
 	case opts.ReadPath() != "":
 		return read(ctx, opts)
 	default:
-		return capture(ctx, stopFunc, &opts)
+		return capture(ctx, stopFunc, opts)
 	}
 
 	return nil
diff --git a/go.mod b/go.mod
index 723a6c10..c5380887 100644
--- a/go.mod
+++ b/go.mod
@@ -106,7 +106,7 @@ require (
 replace (
 	github.com/gopacket/gopacket => github.com/mozillazg/gopacket v0.0.0-20241026043817-048341de5231
 	// github.com/gopacket/gopacket => ../../gopacket/gopacket
-	github.com/x-way/pktdump => github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d
+	github.com/x-way/pktdump => github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1
 	// github.com/x-way/pktdump => ../../x-way/pktdump
 	k8s.io/cri-api => github.com/mozillazg/cri-api v0.32.0-alpha.1.0.20241019013855-3dc36f8743df
 	k8s.io/cri-client => github.com/mozillazg/cri-client v0.31.0-alpha.0.0.20241019023238-87687176fd67
diff --git a/go.sum b/go.sum
index 2b3b67a3..187294c7 100644
--- a/go.sum
+++ b/go.sum
@@ -191,8 +191,8 @@ github.com/mozillazg/cri-client v0.31.0-alpha.0.0.20241019023238-87687176fd67 h1
 github.com/mozillazg/cri-client v0.31.0-alpha.0.0.20241019023238-87687176fd67/go.mod h1:pFm23AAi/gIlW9FGrWPTPnGe1xsyGHPFFO/zezc4w90=
 github.com/mozillazg/gopacket v0.0.0-20241026043817-048341de5231 h1:uvhf0oGPfJ24Lc5/N2ysh9sQc71Pog67zxKiLVS4/Qg=
 github.com/mozillazg/gopacket v0.0.0-20241026043817-048341de5231/go.mod h1:WnFrU1Xkf5lWKV38uKNR9+yYtppn+ZYzOyNqMeH4oNE=
-github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d h1:3K1bsX3osp69xQnbvrXHokKRebpiENUUgGLA6OC5Jd8=
-github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d/go.mod h1:Vh2MvrLyL23PaYh0Dp2Ihg6qTmNydO2su6ngpJEp/hM=
+github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1 h1:kVgiW9P9tfqPXrIU/ZKC8XwkhHkri3s439D+RqSpF6g=
+github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1/go.mod h1:Vh2MvrLyL23PaYh0Dp2Ihg6qTmNydO2su6ngpJEp/hM=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
diff --git a/internal/capturer/capturer.go b/internal/capturer/capturer.go
index c9a12498..ad5e06d4 100644
--- a/internal/capturer/capturer.go
+++ b/internal/capturer/capturer.go
@@ -51,6 +51,7 @@ type Options struct {
 	DirectionOut   bool
 	DirectionIn    bool
 	OneLine        bool
+	Quiet          bool
 
 	PrintPacketNumber   bool
 	DontPrintTimestamp  bool
diff --git a/internal/writer/stdout.go b/internal/writer/stdout.go
index 909e2ee8..5fc4130d 100644
--- a/internal/writer/stdout.go
+++ b/internal/writer/stdout.go
@@ -22,6 +22,7 @@ type StdoutWriter struct {
 	NoTimestamp   bool
 	TimestampNano bool
 	DoNothing     bool
+	Quiet         bool
 	FormatStyle   pktdump.FormatStyle
 	DataStyle     pktdump.ContentStyle
 
@@ -85,8 +86,9 @@ func (w *StdoutWriter) Write(e *event.Packet) error {
 		HeaderStyle:   w.FormatStyle,
 		ContentStyle:  w.DataStyle,
 		ContentIndent: "        ",
+		Quiet:         w.Quiet,
 	}
-	formatedHeader := pktdump.FormatWithOptions(packet, formatOpts)
+	formatedHeader := (&pktdump.Formatter{}).FormatWithOptions(packet, formatOpts)
 	formatedData := formatOpts.FormatedContent
 
 	builder := strings.Builder{}
diff --git a/testdata/format/dns.pcapng b/testdata/format/dns.pcapng
new file mode 100644
index 0000000000000000000000000000000000000000..0300a38514b3110caa209fd709aef059895d4377
GIT binary patch
literal 848
zcmc&xKS&#46o1jP#%ogRCQjcPZ1P=lNg7Xwh_R5Nl2R!;RJi2M<lydd+#ij)L=YSV
zH*s+8RtkcHg$|uNIS3sxJG32L#3jC$JBxzQu@4^K``-8ce($~C6O&1?3jlBDrl(?f
z_9GMEB{+V=(E`h18&W1$%t$fde{%|J`M%>RoHq@>71T40w#BXXwqcs;c9Y*jVF*S*
zwX|X$xrZ?}4Lj&yOx8uGn&s&1_W}Qp0@k#)(h@ue0U*$v!~@(IBF6APSs9)1d(j!<
zM?kkdSsvudV60bdP46fy_lnuNzvNZzwx%mAFXf5_Ia|t0QNE`7EroH%Z8x~5o9o>6
zI0F9F1J!<pE?^_n%cm7#^7!-O)f&d+Q2X%b+Y%&FhuP~mEaLs_6g!`|yb)n&+(o-m
zpa6644ths1HlRSFQN5#Dj;Rl$s>F-TDdB?XAORx8_iulEee?dXLT@tEsuhLFB`H_R
ziVK#8Qv{yN>xRuWqbbh2O;2GMv51sbg}7O$sjhDO19ZNSohgZ7;xR>C^;*$G$dslG
z?nyuojb<ke;tw=f-dX!q#~gV$eW=7hgXJ$7-2TMLCe2SeKmk=Kzh3Pf?RLX)pU~iY
aB792z2I1rR&ljl4eFy(n2iiLs&3^|3^vRq6

literal 0
HcmV?d00001

diff --git a/testdata/format/dns.pcapng.-q.out.txt b/testdata/format/dns.pcapng.-q.out.txt
new file mode 100644
index 00000000..1593fed7
--- /dev/null
+++ b/testdata/format/dns.pcapng.-q.out.txt
@@ -0,0 +1,2 @@
+03:47:06.356509 ens33 dig.380281 Out IP 10.0.2.15.58682 > 114.114.114.114.53: UDP, length 52, ParentProc [bash.45198]
+03:47:06.425244 ens33 dig.380281 In IP 114.114.114.114.53 > 10.0.2.15.58682: UDP, length 56, ParentProc [bash.45198]
diff --git a/testdata/format/dns.pcapng.out.txt b/testdata/format/dns.pcapng.out.txt
new file mode 100644
index 00000000..ef1c39ad
--- /dev/null
+++ b/testdata/format/dns.pcapng.out.txt
@@ -0,0 +1,2 @@
+03:47:06.356509 ens33 dig.380281 Out IP 10.0.2.15.58682 > 114.114.114.114.53: 56213+ [1au] A? example.com. (52), ParentProc [bash.45198]
+03:47:06.425244 ens33 dig.380281 In IP 114.114.114.114.53 > 10.0.2.15.58682: 56213 1/0/1 A 93.184.215.14 (56), ParentProc [bash.45198]
diff --git a/testdata/format/mptcp.pcap b/testdata/format/mptcp.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..74bf50e1a30746c9f25f2192de3b8e1909fbbb34
GIT binary patch
literal 1405
zcmaKrOK1~O6o${e8JjRxQISvu<7`@?B4nY(YLs9fgpl}J6m-#9RoYDvrbM(@H<qfK
zT6Ce<MGFo1014tc8>LmF(1nmqXvB&rJ`qfJiRYZoO>XOSE*!`V;rs6Y-#hPLJe!qZ
zKw}vo@L}J@l?z`UnQ#(+)95P%JpgfgJ`VAw(ywa(f@XX=+Szh9bAtYvleJ>?Ab>P#
zMMH+nwq$=hy%&K%Fk%Qn^uv!$=)-q3`eJ$l1xSxQRrF}*`1I`H^}lH7THH}9RAX!D
zWMF!;5X*fJ|D64_D?^qkUyHrK89pnEo1qI$mBnom$Rfn*{>c#8DMWSjPU&X4;3!Kw
zS|;a%U}FdxeQ}mE_A9oOyeuDD(1LZYT83KL68_%;n}iq{a7Ikh9a;$b98CTQ>BdHt
z&aJM3)g^Ki3J<2C8)}U-TY(Olz51Y|cV<7*&5v85A5+lii^H6@Uwej0P-PsZThWJ?
z+LA~QTU(xF&fQZ6BsKwFfu2*nCfOXcZG6e{M>)$Ck1VORS;#iLq-B{qfb{2+63(NN
zMqivIWxwGpWkq+7KgC(7sdzn0ndxC`kCtVQi9!f6b>EhLIbxjSvNCCBvMz@+fu^#S
zBTMvKNZ<HO^2eAy=tcicIqGNP(sx^X-SfzPT^`#^ne;3#rz9lt1&zMAwU}Mt)_y9R
z-r5Y=qN+8rITMkPCD3r6auof^Z<+kVlf2!Z{0+%I_vkn`bV-r5{?j=k*S`sO&y8<_
a`>*)#`yKE5yP~^|r12iDtZU?k-pD_mAx>)m

literal 0
HcmV?d00001

diff --git a/testdata/format/mptcp.pcap.out.txt b/testdata/format/mptcp.pcap.out.txt
new file mode 100644
index 00000000..51183051
--- /dev/null
+++ b/testdata/format/mptcp.pcap.out.txt
@@ -0,0 +1,14 @@
+02:55:35.698856 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [S], seq 412382786, win 65495, options [mss 65495,sackOK,TS val 642407978 ecr 0,nop,wscale 7,mptcp 4 capable v1 flags [H]], length 0
+02:55:35.698936 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [S.], seq 2707981557, ack 412382787, win 65483, options [mss 65495,sackOK,TS val 642407978 ecr 642407978,nop,wscale 7,mptcp 12 capable v1 flags [H] {0xe356a8f252e41976}], length 0
+02:55:35.699025 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [.], seq 412382787, ack 2707981558, win 512, options [nop,nop,TS val 642407978 ecr 642407978,mptcp 20 capable v1 flags [H] {0xfe7b93dc894dcb73,0xe356a8f252e41976}], length 0
+02:55:38.509583 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [P.], seq 412382787:412382792, ack 2707981558, win 512, options [nop,nop,TS val 642410789 ecr 642407978,mptcp 22 capable v1 flags [H] {0xfe7b93dc894dcb73,0xe356a8f252e41976,data_len=5},nop,nop], length 5
+02:55:38.509749 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [.], seq 2707981558, ack 412382792, win 512, options [nop,nop,TS val 642410789 ecr 642410789,mptcp 12 dss ack 3891854986895050400], length 0
+02:55:39.975370 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [P.], seq 412382792:412382796, ack 2707981558, win 512, options [nop,nop,TS val 642412254 ecr 642410789,mptcp 22 dss ack 2876660120 seq 3891854986895050400 subseq 6 len 4,nop,nop], length 4
+02:55:39.975475 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [.], seq 2707981558, ack 412382796, win 512, options [nop,nop,TS val 642412254 ecr 642412254,mptcp 12 dss ack 3891854986895050404], length 0
+02:55:41.167860 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [.], seq 412382796, ack 2707981558, win 512, options [nop,nop,TS val 642412255 ecr 642412254,mptcp 22 dss fin ack 2876660120 seq 3891854986895050404 subseq 0 len 1,nop,nop], length 0
+02:55:41.168004 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [.], seq 2707981558, ack 412382796, win 512, options [nop,nop,TS val 642413447 ecr 642412255,mptcp 12 dss ack 3891854986895050405], length 0
+02:55:41.168074 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [.], seq 2707981558, ack 412382796, win 512, options [nop,nop,TS val 642413447 ecr 642412255,mptcp 26 dss fin ack 3891854986895050405 seq 16853452819136928152 subseq 0 len 1,nop,nop], length 0
+02:55:41.168388 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [.], seq 412382796, ack 2707981558, win 512, options [nop,nop,TS val 642413447 ecr 642413447,mptcp 8 dss ack 2876660121], length 0
+02:55:41.168407 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [F.], seq 412382796, ack 2707981558, win 512, options [nop,nop,TS val 642413447 ecr 642413447,mptcp 8 dss ack 2876660121], length 0
+02:55:41.168427 IP 127.0.0.1.12345 > 127.0.0.1.34204: Flags [F.], seq 2707981558, ack 412382797, win 512, options [nop,nop,TS val 642413447 ecr 642413447,mptcp 12 dss ack 3891854986895050405], length 0
+02:55:41.168438 IP 127.0.0.1.34204 > 127.0.0.1.12345: Flags [.], seq 412382797, ack 2707981559, win 512, options [nop,nop,TS val 642413448 ecr 642413447,mptcp 8 dss ack 2876660121], length 0
diff --git a/testdata/format/tcp.pcapng b/testdata/format/tcp.pcapng
new file mode 100644
index 0000000000000000000000000000000000000000..811c28934630517eb61aa1b572773042592fb207
GIT binary patch
literal 9888
zcmeHM+iw(A9G=~lOGg$el1NAhhZPfp?3~$4m$D3Xp%+?0%SyLVYLrZ8Pj@Ho&MY%$
zdm%=fXk%hE`a}p8ECG!^iSY)$_y-ul7eY*Ykpy{bF!2QgtiLmtcDmG+SRYJwPIEHT
zGjq<I{mys3-}js0Lm_^O<G6n5*)0J$R-Mw!wQ^;ulyj9*8I6fTEGdWq4llH&P=V62
znZh`)(n4iKQ1lWm=_l1<Q9hZ+ZdWeIt>WZTE}4L_o8Y{tYLy8%XJra1duG}>R;wJ`
zzlMWnmL?-2_ZZjAaWIE<o_;ORqXq6~B@LDJpK^|N{~%Y?S$mpONBguKnMk4NE~F7U
zVD@Qxj-*gRj3wLR(e{Msv}a^mNFiJ{bOoEFIEpnBLx+EQK6~zJs4v1KEbMkRZ@#|f
zz4=4X#;Uih<+?de8s3)X(yMQtc>_AIdaGw!dfojE-?BUBg4G)jL_naqdZRhGmVft`
zUC*=jKvUBiHhwRc>FY|Nc%m)YCi0!79L%_48hAw2uu?IK{C*>ErVu-|)&`a)8rv<1
z@E1+Bi=v1%osQ}iEf?TE;4-p7G`cWiEXms~_PBZd__%JoY8Lb|HVviz8ZRuiGlV@4
zmjNged6YQ?VXcGg=R#q4*5W#O<&=*rTi<_yE8`|B%i&r)ak>t!Y>%Z^OW(PC-Il)9
zbGzfsCxEk;=QdV<sO2l;tk2gf=)iNU&iJ_gM|{nA^mXpf59bd6ms#}|OJ5Vi$kNyI
zE?*sey$qb)G}Rj99y|j|8nCt1*4IYTRfZ$eRWF{qf1dU6v`o&U$0=7&T|6&(_<7~-
zx%tz8F{|EU@$;SG?G`@|Ez8f%z|Ys0^7CMK7A=Hr)SJy_a8!tf_+H(lU~86y_Ygm1
z5+kxd4{_bL0eH929u>q8zh6;E85(!uogqHNHxlRB+Az+0*QodVIe(4*2Y%1pNA4PV
zb?LQh=j-Uw%#UmzUHZe_M~*MqwC;ZE`l;4H)z|r2olkAN;N!VMonISdc^Kr#;P1A4
zaq7-JIA_&cES;a9xoYuq&$9evI)8IP=SP?iag<$z)HH#5)FMHUt05~{3-N=*7$Zgs
z4XUMbkyy8iLK0;rX+hU;T!=z~7Yp%SGKJiBP^P<(7()a47>bFp1d7H}ZDK0kh7R^;
zLwu*MX+)u_u0e<>>L#(8D1?kicCrlpDVd<SKug8FN<lVELibhZXrz7dw!=irvurt$
z+|y{Wgsnf@S6&{hpPu!3&>)_|jaM!Yyzy!vF?Z(xaD!EEaq^O|<@-Kz^}x<cTGvBf
za<wL2F+CVzI@37sdt4vw#k24Fc^}Ue#w#zLcVGIn9-ccaex7}ppVJqn9$%6-`~0-x
z|E-?Sd^}gk&mB#Rek%C>$9JBD_{yrcF#Qa+%v@vq{Cum+Psi_HwfsK#sp|bDeriP8
z-gTrido0rpIdlJElo>j3xUUn1BN)FB@5Hz(+ht!!2x1iD?tw6moDycAHQ?3x`1rUm
z9v5^YkF!TDLzKWKHB^NPIhqT1@Dejg9acZ7K;)c#%0`h&gv!<{_y{>sQOEX$!F4TI
ztT0mS|MrFd#%sag?rbEg(jw{THVoZB1~JRJW)cb8t@g9=;=`p8JvZs;T!=o@6PgwW
zFFThN=c`CU!sR8G`-y4Fd2oeGEvZm@pFKY|3?dWdqO8fb!(?7{kjk`T3Ij*7$9s+p
z4RoOhcvD(XwLB`xR4EV>(E>qvb&P0e=xE>K;1affk7U8$!8cS)WP5{oP46E0?blEI
zJ!0o0{vNS6YD4Z3*N3}%#Org0U#{zOp0a$-IX8|h`f%_$t$}-<_eQ?Yv3$;3gLQq5
zk7v!db@m<G<>zvF&DK}Gtm7MJeq#K*^t;PX+viMQ0H3p=#)m6@p2*(Ay?yK}AI}x~
uaIb#e*!y)IJcpmQ^mEqbr=y=6Zg)&ytogpm_^J5sF&?yh<Kwvke*OjKGMX&_

literal 0
HcmV?d00001

diff --git a/testdata/format/tcp.pcapng.-A.out.txt b/testdata/format/tcp.pcapng.-A.out.txt
new file mode 100644
index 00000000..2d3db52a
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-A.out.txt
@@ -0,0 +1,124 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+E..<Z.@.@............F.@.............0.........
+..,Q........
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+E..<Z.@.@............F.@.............0.........
+..,Q........
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+E..<..@.@.<..........@.F.>...........0.........
+..,Q..,Q....
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+E..<..@.@.<..........@.F.>...........0.........
+..,Q..,Q....
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+E..4Z @.@............F.@.....>.......(.....
+..,Q..,Q
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+E..4Z @.@............F.@.....>.......(.....
+..,Q..,Q
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+E...Z!@.@..J.........F.@.....>.......~.....
+..,Q..,QGET /notfound HTTP/1.1
+Host: 127.0.0.1:8000
+User-Agent: curl/7.81.0
+Accept: */*
+
+
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+E...Z!@.@..J.........F.@.....>.......~.....
+..,Q..,QGET /notfound HTTP/1.1
+Host: 127.0.0.1:8000
+User-Agent: curl/7.81.0
+Accept: */*
+
+
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+E..4..@.@............@.F.>...........(.....
+..,Q..,Q
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+E..4..@.@............@.F.>...........(.....
+..,Q..,Q
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+E.....@.@..9.........@.F.>.................
+..,b..,QHTTP/1.0 404 File not found
+Server: SimpleHTTP/0.6 Python/3.10.12
+Date: Sat, 02 Nov 2024 13:50:35 GMT
+Connection: close
+Content-Type: text/html;charset=utf-8
+Content-Length: 469
+
+
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+E.....@.@..9.........@.F.>.................
+..,b..,QHTTP/1.0 404 File not found
+Server: SimpleHTTP/0.6 Python/3.10.12
+Date: Sat, 02 Nov 2024 13:50:35 GMT
+Connection: close
+Content-Type: text/html;charset=utf-8
+Content-Length: 469
+
+
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z"@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z"@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z$@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z$@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+E..	..@.@............@.F.>.................
+..,b..,b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
+        "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+    <head>
+        <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
+        <title>Error response</title>
+    </head>
+    <body>
+        <h1>Error response</h1>
+        <p>Error code: 404</p>
+        <p>Message: File not found.</p>
+        <p>Error code explanation: HTTPStatus.NOT_FOUND - Nothing matches the given URI.</p>
+    </body>
+</html>
+
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+E..	..@.@............@.F.>.................
+..,b..,b<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
+        "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+    <head>
+        <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
+        <title>Error response</title>
+    </head>
+    <body>
+        <h1>Error response</h1>
+        <p>Error code: 404</p>
+        <p>Message: File not found.</p>
+        <p>Error code explanation: HTTPStatus.NOT_FOUND - Nothing matches the given URI.</p>
+    </body>
+</html>
+
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z#@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4Z#@.@............F.@.....>.......(.....
+..,b..,b
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4..@.@............@.F.>...........(.....
+..,c..,b
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+E..4..@.@............@.F.>...........(.....
+..,c..,b
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+E..4Z%@.@............F.@.....>.......(.....
+..,c..,c
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+E..4Z%@.@............F.@.....>.......(.....
+..,c..,c
diff --git a/testdata/format/tcp.pcapng.-X.out.txt b/testdata/format/tcp.pcapng.-X.out.txt
new file mode 100644
index 00000000..c7d4ec8a
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-X.out.txt
@@ -0,0 +1,210 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 5a1f 4000 4006 e29a 7f00 0001  E..<Z.@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb7 0000 0000  .....F.@........
+        0x0020:  a002 ffd7 fe30 0000 0204 ffd7 0402 080a  .....0..........
+        0x0030:  8cdc 2c51 0000 0000 0103 0307            ..,Q........
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 5a1f 4000 4006 e29a 7f00 0001  E..<Z.@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb7 0000 0000  .....F.@........
+        0x0020:  a002 ffd7 fe30 0000 0204 ffd7 0402 080a  .....0..........
+        0x0030:  8cdc 2c51 0000 0000 0103 0307            ..,Q........
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 0000 4000 4006 3cba 7f00 0001  E..<..@.@.<.....
+        0x0010:  7f00 0001 1f40 e546 e73e 8313 0cfd 0fb8  .....@.F.>......
+        0x0020:  a012 ffcb fe30 0000 0204 ffd7 0402 080a  .....0..........
+        0x0030:  8cdc 2c51 8cdc 2c51 0103 0307            ..,Q..,Q....
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 0000 4000 4006 3cba 7f00 0001  E..<..@.@.<.....
+        0x0010:  7f00 0001 1f40 e546 e73e 8313 0cfd 0fb8  .....@.F.>......
+        0x0020:  a012 ffcb fe30 0000 0204 ffd7 0402 080a  .....0..........
+        0x0030:  8cdc 2c51 8cdc 2c51 0103 0307            ..,Q..,Q....
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a20 4000 4006 e2a1 7f00 0001  E..4Z @.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314  .....F.@.....>..
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c51  .....(........,Q
+        0x0030:  8cdc 2c51                                ..,Q
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a20 4000 4006 e2a1 7f00 0001  E..4Z @.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314  .....F.@.....>..
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c51  .....(........,Q
+        0x0030:  8cdc 2c51                                ..,Q
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  4500 008a 5a21 4000 4006 e24a 7f00 0001  E...Z!@.@..J....
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314  .....F.@.....>..
+        0x0020:  8018 0200 fe7e 0000 0101 080a 8cdc 2c51  .....~........,Q
+        0x0030:  8cdc 2c51 4745 5420 2f6e 6f74 666f 756e  ..,QGET /notfoun
+        0x0040:  6420 4854 5450 2f31 2e31 0d0a 486f 7374  d HTTP/1.1..Host
+        0x0050:  3a20 3132 372e 302e 302e 313a 3830 3030  : 127.0.0.1:8000
+        0x0060:  0d0a 5573 6572 2d41 6765 6e74 3a20 6375  ..User-Agent: cu
+        0x0070:  726c 2f37 2e38 312e 300d 0a41 6363 6570  rl/7.81.0..Accep
+        0x0080:  743a 202a 2f2a 0d0a 0d0a                 t: */*....
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  4500 008a 5a21 4000 4006 e24a 7f00 0001  E...Z!@.@..J....
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314  .....F.@.....>..
+        0x0020:  8018 0200 fe7e 0000 0101 080a 8cdc 2c51  .....~........,Q
+        0x0030:  8cdc 2c51 4745 5420 2f6e 6f74 666f 756e  ..,QGET /notfoun
+        0x0040:  6420 4854 5450 2f31 2e31 0d0a 486f 7374  d HTTP/1.1..Host
+        0x0050:  3a20 3132 372e 302e 302e 313a 3830 3030  : 127.0.0.1:8000
+        0x0060:  0d0a 5573 6572 2d41 6765 6e74 3a20 6375  ..User-Agent: cu
+        0x0070:  726c 2f37 2e38 312e 300d 0a41 6363 6570  rl/7.81.0..Accep
+        0x0080:  743a 202a 2f2a 0d0a 0d0a                 t: */*....
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bcd 4000 4006 b0f4 7f00 0001  E..4..@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e  .....@.F.>......
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c51  .....(........,Q
+        0x0030:  8cdc 2c51                                ..,Q
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bcd 4000 4006 b0f4 7f00 0001  E..4..@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e  .....@.F.>......
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c51  .....(........,Q
+        0x0030:  8cdc 2c51                                ..,Q
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  4500 00ee 8bce 4000 4006 b039 7f00 0001  E.....@.@..9....
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e  .....@.F.>......
+        0x0020:  8018 0200 fee2 0000 0101 080a 8cdc 2c62  ..............,b
+        0x0030:  8cdc 2c51 4854 5450 2f31 2e30 2034 3034  ..,QHTTP/1.0 404
+        0x0040:  2046 696c 6520 6e6f 7420 666f 756e 640d   File not found.
+        0x0050:  0a53 6572 7665 723a 2053 696d 706c 6548  .Server: SimpleH
+        0x0060:  5454 502f 302e 3620 5079 7468 6f6e 2f33  TTP/0.6 Python/3
+        0x0070:  2e31 302e 3132 0d0a 4461 7465 3a20 5361  .10.12..Date: Sa
+        0x0080:  742c 2030 3220 4e6f 7620 3230 3234 2031  t, 02 Nov 2024 1
+        0x0090:  333a 3530 3a33 3520 474d 540d 0a43 6f6e  3:50:35 GMT..Con
+        0x00a0:  6e65 6374 696f 6e3a 2063 6c6f 7365 0d0a  nection: close..
+        0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465  Content-Type: te
+        0x00c0:  7874 2f68 746d 6c3b 6368 6172 7365 743d  xt/html;charset=
+        0x00d0:  7574 662d 380d 0a43 6f6e 7465 6e74 2d4c  utf-8..Content-L
+        0x00e0:  656e 6774 683a 2034 3639 0d0a 0d0a       ength: 469....
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  4500 00ee 8bce 4000 4006 b039 7f00 0001  E.....@.@..9....
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e  .....@.F.>......
+        0x0020:  8018 0200 fee2 0000 0101 080a 8cdc 2c62  ..............,b
+        0x0030:  8cdc 2c51 4854 5450 2f31 2e30 2034 3034  ..,QHTTP/1.0 404
+        0x0040:  2046 696c 6520 6e6f 7420 666f 756e 640d   File not found.
+        0x0050:  0a53 6572 7665 723a 2053 696d 706c 6548  .Server: SimpleH
+        0x0060:  5454 502f 302e 3620 5079 7468 6f6e 2f33  TTP/0.6 Python/3
+        0x0070:  2e31 302e 3132 0d0a 4461 7465 3a20 5361  .10.12..Date: Sa
+        0x0080:  742c 2030 3220 4e6f 7620 3230 3234 2031  t, 02 Nov 2024 1
+        0x0090:  333a 3530 3a33 3520 474d 540d 0a43 6f6e  3:50:35 GMT..Con
+        0x00a0:  6e65 6374 696f 6e3a 2063 6c6f 7365 0d0a  nection: close..
+        0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465  Content-Type: te
+        0x00c0:  7874 2f68 746d 6c3b 6368 6172 7365 743d  xt/html;charset=
+        0x00d0:  7574 662d 380d 0a43 6f6e 7465 6e74 2d4c  utf-8..Content-L
+        0x00e0:  656e 6774 683a 2034 3639 0d0a 0d0a       ength: 469....
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a22 4000 4006 e29f 7f00 0001  E..4Z"@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 83ce  .....F.@.....>..
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a22 4000 4006 e29f 7f00 0001  E..4Z"@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 83ce  .....F.@.....>..
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a24 4000 4006 e29d 7f00 0001  E..4Z$@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3  .....F.@.....>..
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a24 4000 4006 e29d 7f00 0001  E..4Z$@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3  .....F.@.....>..
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0209 8bcf 4000 4006 af1d 7f00 0001  E.....@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 83ce 0cfd 100e  .....@.F.>......
+        0x0020:  8018 0200 fffd 0000 0101 080a 8cdc 2c62  ..............,b
+        0x0030:  8cdc 2c62 3c21 444f 4354 5950 4520 4854  ..,b<!DOCTYPE HT
+        0x0040:  4d4c 2050 5542 4c49 4320 222d 2f2f 5733  ML PUBLIC "-//W3
+        0x0050:  432f 2f44 5444 2048 544d 4c20 342e 3031  C//DTD HTML 4.01
+        0x0060:  2f2f 454e 220a 2020 2020 2020 2020 2268  //EN".        "h
+        0x0070:  7474 703a 2f2f 7777 772e 7733 2e6f 7267  ttp://www.w3.org
+        0x0080:  2f54 522f 6874 6d6c 342f 7374 7269 6374  /TR/html4/strict
+        0x0090:  2e64 7464 223e 0a3c 6874 6d6c 3e0a 2020  .dtd">.<html>.  
+        0x00a0:  2020 3c68 6561 643e 0a20 2020 2020 2020    <head>.       
+        0x00b0:  203c 6d65 7461 2068 7474 702d 6571 7569   <meta http-equi
+        0x00c0:  763d 2243 6f6e 7465 6e74 2d54 7970 6522  v="Content-Type"
+        0x00d0:  2063 6f6e 7465 6e74 3d22 7465 7874 2f68   content="text/h
+        0x00e0:  746d 6c3b 6368 6172 7365 743d 7574 662d  tml;charset=utf-
+        0x00f0:  3822 3e0a 2020 2020 2020 2020 3c74 6974  8">.        <tit
+        0x0100:  6c65 3e45 7272 6f72 2072 6573 706f 6e73  le>Error respons
+        0x0110:  653c 2f74 6974 6c65 3e0a 2020 2020 3c2f  e</title>.    </
+        0x0120:  6865 6164 3e0a 2020 2020 3c62 6f64 793e  head>.    <body>
+        0x0130:  0a20 2020 2020 2020 203c 6831 3e45 7272  .        <h1>Err
+        0x0140:  6f72 2072 6573 706f 6e73 653c 2f68 313e  or response</h1>
+        0x0150:  0a20 2020 2020 2020 203c 703e 4572 726f  .        <p>Erro
+        0x0160:  7220 636f 6465 3a20 3430 343c 2f70 3e0a  r code: 404</p>.
+        0x0170:  2020 2020 2020 2020 3c70 3e4d 6573 7361          <p>Messa
+        0x0180:  6765 3a20 4669 6c65 206e 6f74 2066 6f75  ge: File not fou
+        0x0190:  6e64 2e3c 2f70 3e0a 2020 2020 2020 2020  nd.</p>.        
+        0x01a0:  3c70 3e45 7272 6f72 2063 6f64 6520 6578  <p>Error code ex
+        0x01b0:  706c 616e 6174 696f 6e3a 2048 5454 5053  planation: HTTPS
+        0x01c0:  7461 7475 732e 4e4f 545f 464f 554e 4420  tatus.NOT_FOUND 
+        0x01d0:  2d20 4e6f 7468 696e 6720 6d61 7463 6865  - Nothing matche
+        0x01e0:  7320 7468 6520 6769 7665 6e20 5552 492e  s the given URI.
+        0x01f0:  3c2f 703e 0a20 2020 203c 2f62 6f64 793e  </p>.    </body>
+        0x0200:  0a3c 2f68 746d 6c3e 0a                   .</html>.
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0209 8bcf 4000 4006 af1d 7f00 0001  E.....@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 83ce 0cfd 100e  .....@.F.>......
+        0x0020:  8018 0200 fffd 0000 0101 080a 8cdc 2c62  ..............,b
+        0x0030:  8cdc 2c62 3c21 444f 4354 5950 4520 4854  ..,b<!DOCTYPE HT
+        0x0040:  4d4c 2050 5542 4c49 4320 222d 2f2f 5733  ML PUBLIC "-//W3
+        0x0050:  432f 2f44 5444 2048 544d 4c20 342e 3031  C//DTD HTML 4.01
+        0x0060:  2f2f 454e 220a 2020 2020 2020 2020 2268  //EN".        "h
+        0x0070:  7474 703a 2f2f 7777 772e 7733 2e6f 7267  ttp://www.w3.org
+        0x0080:  2f54 522f 6874 6d6c 342f 7374 7269 6374  /TR/html4/strict
+        0x0090:  2e64 7464 223e 0a3c 6874 6d6c 3e0a 2020  .dtd">.<html>.  
+        0x00a0:  2020 3c68 6561 643e 0a20 2020 2020 2020    <head>.       
+        0x00b0:  203c 6d65 7461 2068 7474 702d 6571 7569   <meta http-equi
+        0x00c0:  763d 2243 6f6e 7465 6e74 2d54 7970 6522  v="Content-Type"
+        0x00d0:  2063 6f6e 7465 6e74 3d22 7465 7874 2f68   content="text/h
+        0x00e0:  746d 6c3b 6368 6172 7365 743d 7574 662d  tml;charset=utf-
+        0x00f0:  3822 3e0a 2020 2020 2020 2020 3c74 6974  8">.        <tit
+        0x0100:  6c65 3e45 7272 6f72 2072 6573 706f 6e73  le>Error respons
+        0x0110:  653c 2f74 6974 6c65 3e0a 2020 2020 3c2f  e</title>.    </
+        0x0120:  6865 6164 3e0a 2020 2020 3c62 6f64 793e  head>.    <body>
+        0x0130:  0a20 2020 2020 2020 203c 6831 3e45 7272  .        <h1>Err
+        0x0140:  6f72 2072 6573 706f 6e73 653c 2f68 313e  or response</h1>
+        0x0150:  0a20 2020 2020 2020 203c 703e 4572 726f  .        <p>Erro
+        0x0160:  7220 636f 6465 3a20 3430 343c 2f70 3e0a  r code: 404</p>.
+        0x0170:  2020 2020 2020 2020 3c70 3e4d 6573 7361          <p>Messa
+        0x0180:  6765 3a20 4669 6c65 206e 6f74 2066 6f75  ge: File not fou
+        0x0190:  6e64 2e3c 2f70 3e0a 2020 2020 2020 2020  nd.</p>.        
+        0x01a0:  3c70 3e45 7272 6f72 2063 6f64 6520 6578  <p>Error code ex
+        0x01b0:  706c 616e 6174 696f 6e3a 2048 5454 5053  planation: HTTPS
+        0x01c0:  7461 7475 732e 4e4f 545f 464f 554e 4420  tatus.NOT_FOUND 
+        0x01d0:  2d20 4e6f 7468 696e 6720 6d61 7463 6865  - Nothing matche
+        0x01e0:  7320 7468 6520 6769 7665 6e20 5552 492e  s the given URI.
+        0x01f0:  3c2f 703e 0a20 2020 203c 2f62 6f64 793e  </p>.    </body>
+        0x0200:  0a3c 2f68 746d 6c3e 0a                   .</html>.
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a23 4000 4006 e29e 7f00 0001  E..4Z#@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3  .....F.@.....>..
+        0x0020:  8010 01fc fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a23 4000 4006 e29e 7f00 0001  E..4Z#@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3  .....F.@.....>..
+        0x0020:  8010 01fc fe28 0000 0101 080a 8cdc 2c62  .....(........,b
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bd0 4000 4006 b0f1 7f00 0001  E..4..@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 85a3 0cfd 100f  .....@.F.>......
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c63  .....(........,c
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bd0 4000 4006 b0f1 7f00 0001  E..4..@.@.......
+        0x0010:  7f00 0001 1f40 e546 e73e 85a3 0cfd 100f  .....@.F.>......
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c63  .....(........,c
+        0x0030:  8cdc 2c62                                ..,b
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a25 4000 4006 e29c 7f00 0001  E..4Z%@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100f e73e 85a4  .....F.@.....>..
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c63  .....(........,c
+        0x0030:  8cdc 2c63                                ..,c
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a25 4000 4006 e29c 7f00 0001  E..4Z%@.@.......
+        0x0010:  7f00 0001 e546 1f40 0cfd 100f e73e 85a4  .....F.@.....>..
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c63  .....(........,c
+        0x0030:  8cdc 2c63                                ..,c
diff --git a/testdata/format/tcp.pcapng.-XX.out.txt b/testdata/format/tcp.pcapng.-XX.out.txt
new file mode 100644
index 00000000..7ee61da1
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-XX.out.txt
@@ -0,0 +1,234 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  003c 5a1f 4000 4006 e29a 7f00 0001 7f00  .<Z.@.@.........
+        0x0020:  0001 e546 1f40 0cfd 0fb7 0000 0000 a002  ...F.@..........
+        0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 8cdc  ...0............
+        0x0040:  2c51 0000 0000 0103 0307                 ,Q........
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  003c 5a1f 4000 4006 e29a 7f00 0001 7f00  .<Z.@.@.........
+        0x0020:  0001 e546 1f40 0cfd 0fb7 0000 0000 a002  ...F.@..........
+        0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 8cdc  ...0............
+        0x0040:  2c51 0000 0000 0103 0307                 ,Q........
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00  .<..@.@.<.......
+        0x0020:  0001 1f40 e546 e73e 8313 0cfd 0fb8 a012  ...@.F.>........
+        0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 8cdc  ...0............
+        0x0040:  2c51 8cdc 2c51 0103 0307                 ,Q..,Q....
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00  .<..@.@.<.......
+        0x0020:  0001 1f40 e546 e73e 8313 0cfd 0fb8 a012  ...@.F.>........
+        0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 8cdc  ...0............
+        0x0040:  2c51 8cdc 2c51 0103 0307                 ,Q..,Q....
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a20 4000 4006 e2a1 7f00 0001 7f00  .4Z @.@.........
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8010  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c51 8cdc  ...(........,Q..
+        0x0040:  2c51                                     ,Q
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a20 4000 4006 e2a1 7f00 0001 7f00  .4Z @.@.........
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8010  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c51 8cdc  ...(........,Q..
+        0x0040:  2c51                                     ,Q
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  008a 5a21 4000 4006 e24a 7f00 0001 7f00  ..Z!@.@..J......
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8018  ...F.@.....>....
+        0x0030:  0200 fe7e 0000 0101 080a 8cdc 2c51 8cdc  ...~........,Q..
+        0x0040:  2c51 4745 5420 2f6e 6f74 666f 756e 6420  ,QGET /notfound 
+        0x0050:  4854 5450 2f31 2e31 0d0a 486f 7374 3a20  HTTP/1.1..Host: 
+        0x0060:  3132 372e 302e 302e 313a 3830 3030 0d0a  127.0.0.1:8000..
+        0x0070:  5573 6572 2d41 6765 6e74 3a20 6375 726c  User-Agent: curl
+        0x0080:  2f37 2e38 312e 300d 0a41 6363 6570 743a  /7.81.0..Accept:
+        0x0090:  202a 2f2a 0d0a 0d0a                       */*....
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  008a 5a21 4000 4006 e24a 7f00 0001 7f00  ..Z!@.@..J......
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8018  ...F.@.....>....
+        0x0030:  0200 fe7e 0000 0101 080a 8cdc 2c51 8cdc  ...~........,Q..
+        0x0040:  2c51 4745 5420 2f6e 6f74 666f 756e 6420  ,QGET /notfound 
+        0x0050:  4854 5450 2f31 2e31 0d0a 486f 7374 3a20  HTTP/1.1..Host: 
+        0x0060:  3132 372e 302e 302e 313a 3830 3030 0d0a  127.0.0.1:8000..
+        0x0070:  5573 6572 2d41 6765 6e74 3a20 6375 726c  User-Agent: curl
+        0x0080:  2f37 2e38 312e 300d 0a41 6363 6570 743a  /7.81.0..Accept:
+        0x0090:  202a 2f2a 0d0a 0d0a                       */*....
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 8bcd 4000 4006 b0f4 7f00 0001 7f00  .4..@.@.........
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8010  ...@.F.>........
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c51 8cdc  ...(........,Q..
+        0x0040:  2c51                                     ,Q
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 8bcd 4000 4006 b0f4 7f00 0001 7f00  .4..@.@.........
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8010  ...@.F.>........
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c51 8cdc  ...(........,Q..
+        0x0040:  2c51                                     ,Q
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  00ee 8bce 4000 4006 b039 7f00 0001 7f00  ....@.@..9......
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8018  ...@.F.>........
+        0x0030:  0200 fee2 0000 0101 080a 8cdc 2c62 8cdc  ............,b..
+        0x0040:  2c51 4854 5450 2f31 2e30 2034 3034 2046  ,QHTTP/1.0 404 F
+        0x0050:  696c 6520 6e6f 7420 666f 756e 640d 0a53  ile not found..S
+        0x0060:  6572 7665 723a 2053 696d 706c 6548 5454  erver: SimpleHTT
+        0x0070:  502f 302e 3620 5079 7468 6f6e 2f33 2e31  P/0.6 Python/3.1
+        0x0080:  302e 3132 0d0a 4461 7465 3a20 5361 742c  0.12..Date: Sat,
+        0x0090:  2030 3220 4e6f 7620 3230 3234 2031 333a   02 Nov 2024 13:
+        0x00a0:  3530 3a33 3520 474d 540d 0a43 6f6e 6e65  50:35 GMT..Conne
+        0x00b0:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f  ction: close..Co
+        0x00c0:  6e74 656e 742d 5479 7065 3a20 7465 7874  ntent-Type: text
+        0x00d0:  2f68 746d 6c3b 6368 6172 7365 743d 7574  /html;charset=ut
+        0x00e0:  662d 380d 0a43 6f6e 7465 6e74 2d4c 656e  f-8..Content-Len
+        0x00f0:  6774 683a 2034 3639 0d0a 0d0a            gth: 469....
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  00ee 8bce 4000 4006 b039 7f00 0001 7f00  ....@.@..9......
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8018  ...@.F.>........
+        0x0030:  0200 fee2 0000 0101 080a 8cdc 2c62 8cdc  ............,b..
+        0x0040:  2c51 4854 5450 2f31 2e30 2034 3034 2046  ,QHTTP/1.0 404 F
+        0x0050:  696c 6520 6e6f 7420 666f 756e 640d 0a53  ile not found..S
+        0x0060:  6572 7665 723a 2053 696d 706c 6548 5454  erver: SimpleHTT
+        0x0070:  502f 302e 3620 5079 7468 6f6e 2f33 2e31  P/0.6 Python/3.1
+        0x0080:  302e 3132 0d0a 4461 7465 3a20 5361 742c  0.12..Date: Sat,
+        0x0090:  2030 3220 4e6f 7620 3230 3234 2031 333a   02 Nov 2024 13:
+        0x00a0:  3530 3a33 3520 474d 540d 0a43 6f6e 6e65  50:35 GMT..Conne
+        0x00b0:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f  ction: close..Co
+        0x00c0:  6e74 656e 742d 5479 7065 3a20 7465 7874  ntent-Type: text
+        0x00d0:  2f68 746d 6c3b 6368 6172 7365 743d 7574  /html;charset=ut
+        0x00e0:  662d 380d 0a43 6f6e 7465 6e74 2d4c 656e  f-8..Content-Len
+        0x00f0:  6774 683a 2034 3639 0d0a 0d0a            gth: 469....
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a22 4000 4006 e29f 7f00 0001 7f00  .4Z"@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 83ce 8010  ...F.@.....>....
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a22 4000 4006 e29f 7f00 0001 7f00  .4Z"@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 83ce 8010  ...F.@.....>....
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a24 4000 4006 e29d 7f00 0001 7f00  .4Z$@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8011  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a24 4000 4006 e29d 7f00 0001 7f00  .4Z$@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8011  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0209 8bcf 4000 4006 af1d 7f00 0001 7f00  ....@.@.........
+        0x0020:  0001 1f40 e546 e73e 83ce 0cfd 100e 8018  ...@.F.>........
+        0x0030:  0200 fffd 0000 0101 080a 8cdc 2c62 8cdc  ............,b..
+        0x0040:  2c62 3c21 444f 4354 5950 4520 4854 4d4c  ,b<!DOCTYPE HTML
+        0x0050:  2050 5542 4c49 4320 222d 2f2f 5733 432f   PUBLIC "-//W3C/
+        0x0060:  2f44 5444 2048 544d 4c20 342e 3031 2f2f  /DTD HTML 4.01//
+        0x0070:  454e 220a 2020 2020 2020 2020 2268 7474  EN".        "htt
+        0x0080:  703a 2f2f 7777 772e 7733 2e6f 7267 2f54  p://www.w3.org/T
+        0x0090:  522f 6874 6d6c 342f 7374 7269 6374 2e64  R/html4/strict.d
+        0x00a0:  7464 223e 0a3c 6874 6d6c 3e0a 2020 2020  td">.<html>.    
+        0x00b0:  3c68 6561 643e 0a20 2020 2020 2020 203c  <head>.        <
+        0x00c0:  6d65 7461 2068 7474 702d 6571 7569 763d  meta http-equiv=
+        0x00d0:  2243 6f6e 7465 6e74 2d54 7970 6522 2063  "Content-Type" c
+        0x00e0:  6f6e 7465 6e74 3d22 7465 7874 2f68 746d  ontent="text/htm
+        0x00f0:  6c3b 6368 6172 7365 743d 7574 662d 3822  l;charset=utf-8"
+        0x0100:  3e0a 2020 2020 2020 2020 3c74 6974 6c65  >.        <title
+        0x0110:  3e45 7272 6f72 2072 6573 706f 6e73 653c  >Error response<
+        0x0120:  2f74 6974 6c65 3e0a 2020 2020 3c2f 6865  /title>.    </he
+        0x0130:  6164 3e0a 2020 2020 3c62 6f64 793e 0a20  ad>.    <body>. 
+        0x0140:  2020 2020 2020 203c 6831 3e45 7272 6f72         <h1>Error
+        0x0150:  2072 6573 706f 6e73 653c 2f68 313e 0a20   response</h1>. 
+        0x0160:  2020 2020 2020 203c 703e 4572 726f 7220         <p>Error 
+        0x0170:  636f 6465 3a20 3430 343c 2f70 3e0a 2020  code: 404</p>.  
+        0x0180:  2020 2020 2020 3c70 3e4d 6573 7361 6765        <p>Message
+        0x0190:  3a20 4669 6c65 206e 6f74 2066 6f75 6e64  : File not found
+        0x01a0:  2e3c 2f70 3e0a 2020 2020 2020 2020 3c70  .</p>.        <p
+        0x01b0:  3e45 7272 6f72 2063 6f64 6520 6578 706c  >Error code expl
+        0x01c0:  616e 6174 696f 6e3a 2048 5454 5053 7461  anation: HTTPSta
+        0x01d0:  7475 732e 4e4f 545f 464f 554e 4420 2d20  tus.NOT_FOUND - 
+        0x01e0:  4e6f 7468 696e 6720 6d61 7463 6865 7320  Nothing matches 
+        0x01f0:  7468 6520 6769 7665 6e20 5552 492e 3c2f  the given URI.</
+        0x0200:  703e 0a20 2020 203c 2f62 6f64 793e 0a3c  p>.    </body>.<
+        0x0210:  2f68 746d 6c3e 0a                        /html>.
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0209 8bcf 4000 4006 af1d 7f00 0001 7f00  ....@.@.........
+        0x0020:  0001 1f40 e546 e73e 83ce 0cfd 100e 8018  ...@.F.>........
+        0x0030:  0200 fffd 0000 0101 080a 8cdc 2c62 8cdc  ............,b..
+        0x0040:  2c62 3c21 444f 4354 5950 4520 4854 4d4c  ,b<!DOCTYPE HTML
+        0x0050:  2050 5542 4c49 4320 222d 2f2f 5733 432f   PUBLIC "-//W3C/
+        0x0060:  2f44 5444 2048 544d 4c20 342e 3031 2f2f  /DTD HTML 4.01//
+        0x0070:  454e 220a 2020 2020 2020 2020 2268 7474  EN".        "htt
+        0x0080:  703a 2f2f 7777 772e 7733 2e6f 7267 2f54  p://www.w3.org/T
+        0x0090:  522f 6874 6d6c 342f 7374 7269 6374 2e64  R/html4/strict.d
+        0x00a0:  7464 223e 0a3c 6874 6d6c 3e0a 2020 2020  td">.<html>.    
+        0x00b0:  3c68 6561 643e 0a20 2020 2020 2020 203c  <head>.        <
+        0x00c0:  6d65 7461 2068 7474 702d 6571 7569 763d  meta http-equiv=
+        0x00d0:  2243 6f6e 7465 6e74 2d54 7970 6522 2063  "Content-Type" c
+        0x00e0:  6f6e 7465 6e74 3d22 7465 7874 2f68 746d  ontent="text/htm
+        0x00f0:  6c3b 6368 6172 7365 743d 7574 662d 3822  l;charset=utf-8"
+        0x0100:  3e0a 2020 2020 2020 2020 3c74 6974 6c65  >.        <title
+        0x0110:  3e45 7272 6f72 2072 6573 706f 6e73 653c  >Error response<
+        0x0120:  2f74 6974 6c65 3e0a 2020 2020 3c2f 6865  /title>.    </he
+        0x0130:  6164 3e0a 2020 2020 3c62 6f64 793e 0a20  ad>.    <body>. 
+        0x0140:  2020 2020 2020 203c 6831 3e45 7272 6f72         <h1>Error
+        0x0150:  2072 6573 706f 6e73 653c 2f68 313e 0a20   response</h1>. 
+        0x0160:  2020 2020 2020 203c 703e 4572 726f 7220         <p>Error 
+        0x0170:  636f 6465 3a20 3430 343c 2f70 3e0a 2020  code: 404</p>.  
+        0x0180:  2020 2020 2020 3c70 3e4d 6573 7361 6765        <p>Message
+        0x0190:  3a20 4669 6c65 206e 6f74 2066 6f75 6e64  : File not found
+        0x01a0:  2e3c 2f70 3e0a 2020 2020 2020 2020 3c70  .</p>.        <p
+        0x01b0:  3e45 7272 6f72 2063 6f64 6520 6578 706c  >Error code expl
+        0x01c0:  616e 6174 696f 6e3a 2048 5454 5053 7461  anation: HTTPSta
+        0x01d0:  7475 732e 4e4f 545f 464f 554e 4420 2d20  tus.NOT_FOUND - 
+        0x01e0:  4e6f 7468 696e 6720 6d61 7463 6865 7320  Nothing matches 
+        0x01f0:  7468 6520 6769 7665 6e20 5552 492e 3c2f  the given URI.</
+        0x0200:  703e 0a20 2020 203c 2f62 6f64 793e 0a3c  p>.    </body>.<
+        0x0210:  2f68 746d 6c3e 0a                        /html>.
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a23 4000 4006 e29e 7f00 0001 7f00  .4Z#@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8010  ...F.@.....>....
+        0x0030:  01fc fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a23 4000 4006 e29e 7f00 0001 7f00  .4Z#@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8010  ...F.@.....>....
+        0x0030:  01fc fe28 0000 0101 080a 8cdc 2c62 8cdc  ...(........,b..
+        0x0040:  2c62                                     ,b
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 8bd0 4000 4006 b0f1 7f00 0001 7f00  .4..@.@.........
+        0x0020:  0001 1f40 e546 e73e 85a3 0cfd 100f 8011  ...@.F.>........
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc  ...(........,c..
+        0x0040:  2c62                                     ,b
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 8bd0 4000 4006 b0f1 7f00 0001 7f00  .4..@.@.........
+        0x0020:  0001 1f40 e546 e73e 85a3 0cfd 100f 8011  ...@.F.>........
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc  ...(........,c..
+        0x0040:  2c62                                     ,b
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a25 4000 4006 e29c 7f00 0001 7f00  .4Z%@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100f e73e 85a4 8010  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc  ...(........,c..
+        0x0040:  2c63                                     ,c
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500  ..............E.
+        0x0010:  0034 5a25 4000 4006 e29c 7f00 0001 7f00  .4Z%@.@.........
+        0x0020:  0001 e546 1f40 0cfd 100f e73e 85a4 8010  ...F.@.....>....
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc  ...(........,c..
+        0x0040:  2c63                                     ,c
diff --git a/testdata/format/tcp.pcapng.-q.out.txt b/testdata/format/tcp.pcapng.-q.out.txt
new file mode 100644
index 00000000..d31e6c4c
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-q.out.txt
@@ -0,0 +1,24 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 86, ParentProc [ptcpdump.345626]
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 86, ParentProc [ptcpdump.345626]
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 186, ParentProc [ptcpdump.345626]
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 186, ParentProc [ptcpdump.345626]
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 469, ParentProc [ptcpdump.345626]
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 469, ParentProc [ptcpdump.345626]
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: tcp 0, ParentProc [ptcpdump.345626]
diff --git a/testdata/format/tcp.pcapng.-v.out.txt b/testdata/format/tcp.pcapng.-v.out.txt
new file mode 100644
index 00000000..d1b37c63
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-v.out.txt
@@ -0,0 +1,96 @@
+13:50:35.524360 lo Out IP (tos 0x0, ttl 64, id 23071, offset 0, flags [DF], proto TCP (6), length 60)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], cksum 0xfe30, seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.524995 lo In IP (tos 0x0, ttl 64, id 23071, offset 0, flags [DF], proto TCP (6), length 60)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], cksum 0xfe30, seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525108 lo Out IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], cksum 0xfe30, seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525211 lo In IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], cksum 0xfe30, seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525339 lo Out IP (tos 0x0, ttl 64, id 23072, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525396 lo In IP (tos 0x0, ttl 64, id 23072, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525536 lo Out IP (tos 0x0, ttl 64, id 23073, offset 0, flags [DF], proto TCP (6), length 138)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], cksum 0xfe7e, seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525652 lo In IP (tos 0x0, ttl 64, id 23073, offset 0, flags [DF], proto TCP (6), length 138)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], cksum 0xfe7e, seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525721 lo Out IP (tos 0x0, ttl 64, id 35789, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], cksum 0xfe28, seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.525804 lo In IP (tos 0x0, ttl 64, id 35789, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], cksum 0xfe28, seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.558547 lo Out IP (tos 0x0, ttl 64, id 35790, offset 0, flags [DF], proto TCP (6), length 238)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], cksum 0xfee2, seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.558929 lo In IP (tos 0x0, ttl 64, id 35790, offset 0, flags [DF], proto TCP (6), length 238)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], cksum 0xfee2, seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559171 lo Out IP (tos 0x0, ttl 64, id 23074, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559277 lo In IP (tos 0x0, ttl 64, id 23074, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559705 lo Out IP (tos 0x0, ttl 64, id 23076, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], cksum 0xfe28, seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559765 lo In IP (tos 0x0, ttl 64, id 23076, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], cksum 0xfe28, seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559522 lo Out IP (tos 0x0, ttl 64, id 35791, offset 0, flags [DF], proto TCP (6), length 521)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], cksum 0xfffd, seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559608 lo In IP (tos 0x0, ttl 64, id 35791, offset 0, flags [DF], proto TCP (6), length 521)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], cksum 0xfffd, seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559705 lo Out IP (tos 0x0, ttl 64, id 23075, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.559768 lo In IP (tos 0x0, ttl 64, id 23075, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.560427 lo Out IP (tos 0x0, ttl 64, id 35792, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], cksum 0xfe28, seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.560491 lo In IP (tos 0x0, ttl 64, id 35792, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], cksum 0xfe28, seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.560549 lo Out IP (tos 0x0, ttl 64, id 23077, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
+13:50:35.560602 lo In IP (tos 0x0, ttl 64, id 23077, offset 0, flags [DF], proto TCP (6), length 52)
+    127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], cksum 0xfe28, seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0
+    Process (pid 345650, cmd /usr/bin/curl, args curl http://127.0.0.1:8000/notfound)
+    ParentProc (pid 345626, cmd /go_workshop/src/github.com/mozillazg/ptcpdump/ptcpdump, args ptcpdump -- curl http://127.0.0.1:8000/notfound)
diff --git a/testdata/format/tcp.pcapng.-x.out.txt b/testdata/format/tcp.pcapng.-x.out.txt
new file mode 100644
index 00000000..51cd70f5
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-x.out.txt
@@ -0,0 +1,210 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 5a1f 4000 4006 e29a 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb7 0000 0000
+        0x0020:  a002 ffd7 fe30 0000 0204 ffd7 0402 080a
+        0x0030:  8cdc 2c51 0000 0000 0103 0307
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 5a1f 4000 4006 e29a 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb7 0000 0000
+        0x0020:  a002 ffd7 fe30 0000 0204 ffd7 0402 080a
+        0x0030:  8cdc 2c51 0000 0000 0103 0307
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 0000 4000 4006 3cba 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8313 0cfd 0fb8
+        0x0020:  a012 ffcb fe30 0000 0204 ffd7 0402 080a
+        0x0030:  8cdc 2c51 8cdc 2c51 0103 0307
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 003c 0000 4000 4006 3cba 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8313 0cfd 0fb8
+        0x0020:  a012 ffcb fe30 0000 0204 ffd7 0402 080a
+        0x0030:  8cdc 2c51 8cdc 2c51 0103 0307
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a20 4000 4006 e2a1 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a20 4000 4006 e2a1 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  4500 008a 5a21 4000 4006 e24a 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314
+        0x0020:  8018 0200 fe7e 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51 4745 5420 2f6e 6f74 666f 756e
+        0x0040:  6420 4854 5450 2f31 2e31 0d0a 486f 7374
+        0x0050:  3a20 3132 372e 302e 302e 313a 3830 3030
+        0x0060:  0d0a 5573 6572 2d41 6765 6e74 3a20 6375
+        0x0070:  726c 2f37 2e38 312e 300d 0a41 6363 6570
+        0x0080:  743a 202a 2f2a 0d0a 0d0a
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  4500 008a 5a21 4000 4006 e24a 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 0fb8 e73e 8314
+        0x0020:  8018 0200 fe7e 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51 4745 5420 2f6e 6f74 666f 756e
+        0x0040:  6420 4854 5450 2f31 2e31 0d0a 486f 7374
+        0x0050:  3a20 3132 372e 302e 302e 313a 3830 3030
+        0x0060:  0d0a 5573 6572 2d41 6765 6e74 3a20 6375
+        0x0070:  726c 2f37 2e38 312e 300d 0a41 6363 6570
+        0x0080:  743a 202a 2f2a 0d0a 0d0a
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bcd 4000 4006 b0f4 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bcd 4000 4006 b0f4 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c51
+        0x0030:  8cdc 2c51
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  4500 00ee 8bce 4000 4006 b039 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e
+        0x0020:  8018 0200 fee2 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c51 4854 5450 2f31 2e30 2034 3034
+        0x0040:  2046 696c 6520 6e6f 7420 666f 756e 640d
+        0x0050:  0a53 6572 7665 723a 2053 696d 706c 6548
+        0x0060:  5454 502f 302e 3620 5079 7468 6f6e 2f33
+        0x0070:  2e31 302e 3132 0d0a 4461 7465 3a20 5361
+        0x0080:  742c 2030 3220 4e6f 7620 3230 3234 2031
+        0x0090:  333a 3530 3a33 3520 474d 540d 0a43 6f6e
+        0x00a0:  6e65 6374 696f 6e3a 2063 6c6f 7365 0d0a
+        0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465
+        0x00c0:  7874 2f68 746d 6c3b 6368 6172 7365 743d
+        0x00d0:  7574 662d 380d 0a43 6f6e 7465 6e74 2d4c
+        0x00e0:  656e 6774 683a 2034 3639 0d0a 0d0a
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  4500 00ee 8bce 4000 4006 b039 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 8314 0cfd 100e
+        0x0020:  8018 0200 fee2 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c51 4854 5450 2f31 2e30 2034 3034
+        0x0040:  2046 696c 6520 6e6f 7420 666f 756e 640d
+        0x0050:  0a53 6572 7665 723a 2053 696d 706c 6548
+        0x0060:  5454 502f 302e 3620 5079 7468 6f6e 2f33
+        0x0070:  2e31 302e 3132 0d0a 4461 7465 3a20 5361
+        0x0080:  742c 2030 3220 4e6f 7620 3230 3234 2031
+        0x0090:  333a 3530 3a33 3520 474d 540d 0a43 6f6e
+        0x00a0:  6e65 6374 696f 6e3a 2063 6c6f 7365 0d0a
+        0x00b0:  436f 6e74 656e 742d 5479 7065 3a20 7465
+        0x00c0:  7874 2f68 746d 6c3b 6368 6172 7365 743d
+        0x00d0:  7574 662d 380d 0a43 6f6e 7465 6e74 2d4c
+        0x00e0:  656e 6774 683a 2034 3639 0d0a 0d0a
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a22 4000 4006 e29f 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 83ce
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a22 4000 4006 e29f 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 83ce
+        0x0020:  8010 01ff fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a24 4000 4006 e29d 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a24 4000 4006 e29d 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0209 8bcf 4000 4006 af1d 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 83ce 0cfd 100e
+        0x0020:  8018 0200 fffd 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62 3c21 444f 4354 5950 4520 4854
+        0x0040:  4d4c 2050 5542 4c49 4320 222d 2f2f 5733
+        0x0050:  432f 2f44 5444 2048 544d 4c20 342e 3031
+        0x0060:  2f2f 454e 220a 2020 2020 2020 2020 2268
+        0x0070:  7474 703a 2f2f 7777 772e 7733 2e6f 7267
+        0x0080:  2f54 522f 6874 6d6c 342f 7374 7269 6374
+        0x0090:  2e64 7464 223e 0a3c 6874 6d6c 3e0a 2020
+        0x00a0:  2020 3c68 6561 643e 0a20 2020 2020 2020
+        0x00b0:  203c 6d65 7461 2068 7474 702d 6571 7569
+        0x00c0:  763d 2243 6f6e 7465 6e74 2d54 7970 6522
+        0x00d0:  2063 6f6e 7465 6e74 3d22 7465 7874 2f68
+        0x00e0:  746d 6c3b 6368 6172 7365 743d 7574 662d
+        0x00f0:  3822 3e0a 2020 2020 2020 2020 3c74 6974
+        0x0100:  6c65 3e45 7272 6f72 2072 6573 706f 6e73
+        0x0110:  653c 2f74 6974 6c65 3e0a 2020 2020 3c2f
+        0x0120:  6865 6164 3e0a 2020 2020 3c62 6f64 793e
+        0x0130:  0a20 2020 2020 2020 203c 6831 3e45 7272
+        0x0140:  6f72 2072 6573 706f 6e73 653c 2f68 313e
+        0x0150:  0a20 2020 2020 2020 203c 703e 4572 726f
+        0x0160:  7220 636f 6465 3a20 3430 343c 2f70 3e0a
+        0x0170:  2020 2020 2020 2020 3c70 3e4d 6573 7361
+        0x0180:  6765 3a20 4669 6c65 206e 6f74 2066 6f75
+        0x0190:  6e64 2e3c 2f70 3e0a 2020 2020 2020 2020
+        0x01a0:  3c70 3e45 7272 6f72 2063 6f64 6520 6578
+        0x01b0:  706c 616e 6174 696f 6e3a 2048 5454 5053
+        0x01c0:  7461 7475 732e 4e4f 545f 464f 554e 4420
+        0x01d0:  2d20 4e6f 7468 696e 6720 6d61 7463 6865
+        0x01e0:  7320 7468 6520 6769 7665 6e20 5552 492e
+        0x01f0:  3c2f 703e 0a20 2020 203c 2f62 6f64 793e
+        0x0200:  0a3c 2f68 746d 6c3e 0a
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0209 8bcf 4000 4006 af1d 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 83ce 0cfd 100e
+        0x0020:  8018 0200 fffd 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62 3c21 444f 4354 5950 4520 4854
+        0x0040:  4d4c 2050 5542 4c49 4320 222d 2f2f 5733
+        0x0050:  432f 2f44 5444 2048 544d 4c20 342e 3031
+        0x0060:  2f2f 454e 220a 2020 2020 2020 2020 2268
+        0x0070:  7474 703a 2f2f 7777 772e 7733 2e6f 7267
+        0x0080:  2f54 522f 6874 6d6c 342f 7374 7269 6374
+        0x0090:  2e64 7464 223e 0a3c 6874 6d6c 3e0a 2020
+        0x00a0:  2020 3c68 6561 643e 0a20 2020 2020 2020
+        0x00b0:  203c 6d65 7461 2068 7474 702d 6571 7569
+        0x00c0:  763d 2243 6f6e 7465 6e74 2d54 7970 6522
+        0x00d0:  2063 6f6e 7465 6e74 3d22 7465 7874 2f68
+        0x00e0:  746d 6c3b 6368 6172 7365 743d 7574 662d
+        0x00f0:  3822 3e0a 2020 2020 2020 2020 3c74 6974
+        0x0100:  6c65 3e45 7272 6f72 2072 6573 706f 6e73
+        0x0110:  653c 2f74 6974 6c65 3e0a 2020 2020 3c2f
+        0x0120:  6865 6164 3e0a 2020 2020 3c62 6f64 793e
+        0x0130:  0a20 2020 2020 2020 203c 6831 3e45 7272
+        0x0140:  6f72 2072 6573 706f 6e73 653c 2f68 313e
+        0x0150:  0a20 2020 2020 2020 203c 703e 4572 726f
+        0x0160:  7220 636f 6465 3a20 3430 343c 2f70 3e0a
+        0x0170:  2020 2020 2020 2020 3c70 3e4d 6573 7361
+        0x0180:  6765 3a20 4669 6c65 206e 6f74 2066 6f75
+        0x0190:  6e64 2e3c 2f70 3e0a 2020 2020 2020 2020
+        0x01a0:  3c70 3e45 7272 6f72 2063 6f64 6520 6578
+        0x01b0:  706c 616e 6174 696f 6e3a 2048 5454 5053
+        0x01c0:  7461 7475 732e 4e4f 545f 464f 554e 4420
+        0x01d0:  2d20 4e6f 7468 696e 6720 6d61 7463 6865
+        0x01e0:  7320 7468 6520 6769 7665 6e20 5552 492e
+        0x01f0:  3c2f 703e 0a20 2020 203c 2f62 6f64 793e
+        0x0200:  0a3c 2f68 746d 6c3e 0a
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a23 4000 4006 e29e 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3
+        0x0020:  8010 01fc fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a23 4000 4006 e29e 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100e e73e 85a3
+        0x0020:  8010 01fc fe28 0000 0101 080a 8cdc 2c62
+        0x0030:  8cdc 2c62
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bd0 4000 4006 b0f1 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 85a3 0cfd 100f
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c63
+        0x0030:  8cdc 2c62
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 8bd0 4000 4006 b0f1 7f00 0001
+        0x0010:  7f00 0001 1f40 e546 e73e 85a3 0cfd 100f
+        0x0020:  8011 0200 fe28 0000 0101 080a 8cdc 2c63
+        0x0030:  8cdc 2c62
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a25 4000 4006 e29c 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100f e73e 85a4
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c63
+        0x0030:  8cdc 2c63
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  4500 0034 5a25 4000 4006 e29c 7f00 0001
+        0x0010:  7f00 0001 e546 1f40 0cfd 100f e73e 85a4
+        0x0020:  8010 0200 fe28 0000 0101 080a 8cdc 2c63
+        0x0030:  8cdc 2c63
diff --git a/testdata/format/tcp.pcapng.-xx.out.txt b/testdata/format/tcp.pcapng.-xx.out.txt
new file mode 100644
index 00000000..35c1ba85
--- /dev/null
+++ b/testdata/format/tcp.pcapng.-xx.out.txt
@@ -0,0 +1,234 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  003c 5a1f 4000 4006 e29a 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb7 0000 0000 a002
+        0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 8cdc
+        0x0040:  2c51 0000 0000 0103 0307
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  003c 5a1f 4000 4006 e29a 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb7 0000 0000 a002
+        0x0030:  ffd7 fe30 0000 0204 ffd7 0402 080a 8cdc
+        0x0040:  2c51 0000 0000 0103 0307
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8313 0cfd 0fb8 a012
+        0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 8cdc
+        0x0040:  2c51 8cdc 2c51 0103 0307
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  003c 0000 4000 4006 3cba 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8313 0cfd 0fb8 a012
+        0x0030:  ffcb fe30 0000 0204 ffd7 0402 080a 8cdc
+        0x0040:  2c51 8cdc 2c51 0103 0307
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a20 4000 4006 e2a1 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8010
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a20 4000 4006 e2a1 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8010
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  008a 5a21 4000 4006 e24a 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8018
+        0x0030:  0200 fe7e 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51 4745 5420 2f6e 6f74 666f 756e 6420
+        0x0050:  4854 5450 2f31 2e31 0d0a 486f 7374 3a20
+        0x0060:  3132 372e 302e 302e 313a 3830 3030 0d0a
+        0x0070:  5573 6572 2d41 6765 6e74 3a20 6375 726c
+        0x0080:  2f37 2e38 312e 300d 0a41 6363 6570 743a
+        0x0090:  202a 2f2a 0d0a 0d0a
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  008a 5a21 4000 4006 e24a 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 0fb8 e73e 8314 8018
+        0x0030:  0200 fe7e 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51 4745 5420 2f6e 6f74 666f 756e 6420
+        0x0050:  4854 5450 2f31 2e31 0d0a 486f 7374 3a20
+        0x0060:  3132 372e 302e 302e 313a 3830 3030 0d0a
+        0x0070:  5573 6572 2d41 6765 6e74 3a20 6375 726c
+        0x0080:  2f37 2e38 312e 300d 0a41 6363 6570 743a
+        0x0090:  202a 2f2a 0d0a 0d0a
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 8bcd 4000 4006 b0f4 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8010
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 8bcd 4000 4006 b0f4 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8010
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c51 8cdc
+        0x0040:  2c51
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  00ee 8bce 4000 4006 b039 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8018
+        0x0030:  0200 fee2 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c51 4854 5450 2f31 2e30 2034 3034 2046
+        0x0050:  696c 6520 6e6f 7420 666f 756e 640d 0a53
+        0x0060:  6572 7665 723a 2053 696d 706c 6548 5454
+        0x0070:  502f 302e 3620 5079 7468 6f6e 2f33 2e31
+        0x0080:  302e 3132 0d0a 4461 7465 3a20 5361 742c
+        0x0090:  2030 3220 4e6f 7620 3230 3234 2031 333a
+        0x00a0:  3530 3a33 3520 474d 540d 0a43 6f6e 6e65
+        0x00b0:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f
+        0x00c0:  6e74 656e 742d 5479 7065 3a20 7465 7874
+        0x00d0:  2f68 746d 6c3b 6368 6172 7365 743d 7574
+        0x00e0:  662d 380d 0a43 6f6e 7465 6e74 2d4c 656e
+        0x00f0:  6774 683a 2034 3639 0d0a 0d0a
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  00ee 8bce 4000 4006 b039 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 8314 0cfd 100e 8018
+        0x0030:  0200 fee2 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c51 4854 5450 2f31 2e30 2034 3034 2046
+        0x0050:  696c 6520 6e6f 7420 666f 756e 640d 0a53
+        0x0060:  6572 7665 723a 2053 696d 706c 6548 5454
+        0x0070:  502f 302e 3620 5079 7468 6f6e 2f33 2e31
+        0x0080:  302e 3132 0d0a 4461 7465 3a20 5361 742c
+        0x0090:  2030 3220 4e6f 7620 3230 3234 2031 333a
+        0x00a0:  3530 3a33 3520 474d 540d 0a43 6f6e 6e65
+        0x00b0:  6374 696f 6e3a 2063 6c6f 7365 0d0a 436f
+        0x00c0:  6e74 656e 742d 5479 7065 3a20 7465 7874
+        0x00d0:  2f68 746d 6c3b 6368 6172 7365 743d 7574
+        0x00e0:  662d 380d 0a43 6f6e 7465 6e74 2d4c 656e
+        0x00f0:  6774 683a 2034 3639 0d0a 0d0a
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a22 4000 4006 e29f 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 83ce 8010
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a22 4000 4006 e29f 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 83ce 8010
+        0x0030:  01ff fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a24 4000 4006 e29d 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8011
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a24 4000 4006 e29d 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8011
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0209 8bcf 4000 4006 af1d 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 83ce 0cfd 100e 8018
+        0x0030:  0200 fffd 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62 3c21 444f 4354 5950 4520 4854 4d4c
+        0x0050:  2050 5542 4c49 4320 222d 2f2f 5733 432f
+        0x0060:  2f44 5444 2048 544d 4c20 342e 3031 2f2f
+        0x0070:  454e 220a 2020 2020 2020 2020 2268 7474
+        0x0080:  703a 2f2f 7777 772e 7733 2e6f 7267 2f54
+        0x0090:  522f 6874 6d6c 342f 7374 7269 6374 2e64
+        0x00a0:  7464 223e 0a3c 6874 6d6c 3e0a 2020 2020
+        0x00b0:  3c68 6561 643e 0a20 2020 2020 2020 203c
+        0x00c0:  6d65 7461 2068 7474 702d 6571 7569 763d
+        0x00d0:  2243 6f6e 7465 6e74 2d54 7970 6522 2063
+        0x00e0:  6f6e 7465 6e74 3d22 7465 7874 2f68 746d
+        0x00f0:  6c3b 6368 6172 7365 743d 7574 662d 3822
+        0x0100:  3e0a 2020 2020 2020 2020 3c74 6974 6c65
+        0x0110:  3e45 7272 6f72 2072 6573 706f 6e73 653c
+        0x0120:  2f74 6974 6c65 3e0a 2020 2020 3c2f 6865
+        0x0130:  6164 3e0a 2020 2020 3c62 6f64 793e 0a20
+        0x0140:  2020 2020 2020 203c 6831 3e45 7272 6f72
+        0x0150:  2072 6573 706f 6e73 653c 2f68 313e 0a20
+        0x0160:  2020 2020 2020 203c 703e 4572 726f 7220
+        0x0170:  636f 6465 3a20 3430 343c 2f70 3e0a 2020
+        0x0180:  2020 2020 2020 3c70 3e4d 6573 7361 6765
+        0x0190:  3a20 4669 6c65 206e 6f74 2066 6f75 6e64
+        0x01a0:  2e3c 2f70 3e0a 2020 2020 2020 2020 3c70
+        0x01b0:  3e45 7272 6f72 2063 6f64 6520 6578 706c
+        0x01c0:  616e 6174 696f 6e3a 2048 5454 5053 7461
+        0x01d0:  7475 732e 4e4f 545f 464f 554e 4420 2d20
+        0x01e0:  4e6f 7468 696e 6720 6d61 7463 6865 7320
+        0x01f0:  7468 6520 6769 7665 6e20 5552 492e 3c2f
+        0x0200:  703e 0a20 2020 203c 2f62 6f64 793e 0a3c
+        0x0210:  2f68 746d 6c3e 0a
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0209 8bcf 4000 4006 af1d 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 83ce 0cfd 100e 8018
+        0x0030:  0200 fffd 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62 3c21 444f 4354 5950 4520 4854 4d4c
+        0x0050:  2050 5542 4c49 4320 222d 2f2f 5733 432f
+        0x0060:  2f44 5444 2048 544d 4c20 342e 3031 2f2f
+        0x0070:  454e 220a 2020 2020 2020 2020 2268 7474
+        0x0080:  703a 2f2f 7777 772e 7733 2e6f 7267 2f54
+        0x0090:  522f 6874 6d6c 342f 7374 7269 6374 2e64
+        0x00a0:  7464 223e 0a3c 6874 6d6c 3e0a 2020 2020
+        0x00b0:  3c68 6561 643e 0a20 2020 2020 2020 203c
+        0x00c0:  6d65 7461 2068 7474 702d 6571 7569 763d
+        0x00d0:  2243 6f6e 7465 6e74 2d54 7970 6522 2063
+        0x00e0:  6f6e 7465 6e74 3d22 7465 7874 2f68 746d
+        0x00f0:  6c3b 6368 6172 7365 743d 7574 662d 3822
+        0x0100:  3e0a 2020 2020 2020 2020 3c74 6974 6c65
+        0x0110:  3e45 7272 6f72 2072 6573 706f 6e73 653c
+        0x0120:  2f74 6974 6c65 3e0a 2020 2020 3c2f 6865
+        0x0130:  6164 3e0a 2020 2020 3c62 6f64 793e 0a20
+        0x0140:  2020 2020 2020 203c 6831 3e45 7272 6f72
+        0x0150:  2072 6573 706f 6e73 653c 2f68 313e 0a20
+        0x0160:  2020 2020 2020 203c 703e 4572 726f 7220
+        0x0170:  636f 6465 3a20 3430 343c 2f70 3e0a 2020
+        0x0180:  2020 2020 2020 3c70 3e4d 6573 7361 6765
+        0x0190:  3a20 4669 6c65 206e 6f74 2066 6f75 6e64
+        0x01a0:  2e3c 2f70 3e0a 2020 2020 2020 2020 3c70
+        0x01b0:  3e45 7272 6f72 2063 6f64 6520 6578 706c
+        0x01c0:  616e 6174 696f 6e3a 2048 5454 5053 7461
+        0x01d0:  7475 732e 4e4f 545f 464f 554e 4420 2d20
+        0x01e0:  4e6f 7468 696e 6720 6d61 7463 6865 7320
+        0x01f0:  7468 6520 6769 7665 6e20 5552 492e 3c2f
+        0x0200:  703e 0a20 2020 203c 2f62 6f64 793e 0a3c
+        0x0210:  2f68 746d 6c3e 0a
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a23 4000 4006 e29e 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8010
+        0x0030:  01fc fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a23 4000 4006 e29e 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100e e73e 85a3 8010
+        0x0030:  01fc fe28 0000 0101 080a 8cdc 2c62 8cdc
+        0x0040:  2c62
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 8bd0 4000 4006 b0f1 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 85a3 0cfd 100f 8011
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc
+        0x0040:  2c62
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 8bd0 4000 4006 b0f1 7f00 0001 7f00
+        0x0020:  0001 1f40 e546 e73e 85a3 0cfd 100f 8011
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc
+        0x0040:  2c62
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a25 4000 4006 e29c 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100f e73e 85a4 8010
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc
+        0x0040:  2c63
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+        0x0000:  0000 0000 0000 0000 0000 0000 0800 4500
+        0x0010:  0034 5a25 4000 4006 e29c 7f00 0001 7f00
+        0x0020:  0001 e546 1f40 0cfd 100f e73e 85a4 8010
+        0x0030:  0200 fe28 0000 0101 080a 8cdc 2c63 8cdc
+        0x0040:  2c63
diff --git a/testdata/format/tcp.pcapng.out.txt b/testdata/format/tcp.pcapng.out.txt
new file mode 100644
index 00000000..3e84a906
--- /dev/null
+++ b/testdata/format/tcp.pcapng.out.txt
@@ -0,0 +1,24 @@
+13:50:35.524360 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+13:50:35.524995 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [S], seq 217911223, win 65495, options [mss 65495,sackOK,TS val 2363239505 ecr 0,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525108 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525211 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [S.], seq 3879633683, ack 217911224, win 65483, options [mss 65495,sackOK,TS val 2363239505 ecr 2363239505,nop,wscale 7], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525339 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525396 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911224, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525536 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+13:50:35.525652 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [P.], seq 217911224:217911310, ack 3879633684, win 512, options [nop,nop,TS val 2363239505 ecr 2363239505], length 86, ParentProc [ptcpdump.345626]
+13:50:35.525721 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+13:50:35.525804 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [.], seq 3879633684, ack 217911310, win 511, options [nop,nop,TS val 2363239505 ecr 2363239505], length 0, ParentProc [ptcpdump.345626]
+13:50:35.558547 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+13:50:35.558929 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633684:3879633870, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239505], length 186, ParentProc [ptcpdump.345626]
+13:50:35.559171 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559277 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879633870, win 511, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559765 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [F.], seq 217911310, ack 3879634339, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559522 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+13:50:35.559608 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [P.], seq 3879633870:3879634339, ack 217911310, win 512, options [nop,nop,TS val 2363239522 ecr 2363239522], length 469, ParentProc [ptcpdump.345626]
+13:50:35.559705 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.559768 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911310, ack 3879634339, win 508, options [nop,nop,TS val 2363239522 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.560427 lo curl.345650 Out IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.560491 lo curl.345650 In IP 127.0.0.1.8000 > 127.0.0.1.58694: Flags [F.], seq 3879634339, ack 217911311, win 512, options [nop,nop,TS val 2363239523 ecr 2363239522], length 0, ParentProc [ptcpdump.345626]
+13:50:35.560549 lo curl.345650 Out IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
+13:50:35.560602 lo curl.345650 In IP 127.0.0.1.58694 > 127.0.0.1.8000: Flags [.], seq 217911311, ack 3879634340, win 512, options [nop,nop,TS val 2363239523 ecr 2363239523], length 0, ParentProc [ptcpdump.345626]
diff --git a/testdata/format/tfo.pcap b/testdata/format/tfo.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..1616d55cb124dd782a0a1c173e36186fe57d87a5
GIT binary patch
literal 4744
zcmZveWl$7e+lO}-SQ?~}R63*)SXmk+mPS}o5TsGMmhO@eP)Y>phDBIJx<i^(kd|(g
zT4I4$|IfVhyz!iw-<SK`b6xYB^W~ts>pp@2xPbpYx3>TQH4p&EfnjYSAHV>kKNo*P
z@UI0N01y{EYQg<viU$CA3;-x2<KzMIU=MC001)&i!1^KXCoNHq3xC%;K$pL0Apigf
z7q1={L_jou=V|)iIS>a2pA7^Avfu)N|9Hy40Lwq~zxlTZ0KWNAJ;`eJk4FOl`0L>)
z|Lgec;(k&;bObKT_~Tk!ro4%vRrr?&2*d^b!zbc`pT-NU$&&r?kN|-u=nXDYlCzk<
zzT_G(K<AI^Z~pE3U%jBn_<wo{{-0ipf1H_lcYtTKA^-pjH4w;FUxG)y%oO!M`TU(=
z01pM=pZsS&1vT>ZU%r*Wf8y8D1JAe#|L|%5KmXpJ{yI2|D65>kFEq>7bEU+>!NRP#
z9I*6u9Nk+R%q!;h9@6=#YqHq;S>Zjd3{{ggmh{uj9+|={CquBqrGd|=ch_@uc|~Ps
zy4ET5)R)=-awP|H%Pm7vHLY)KwzR)4LMN}3#x5~b@)hm-sj2U{<5<lEkf!5gBtR-B
z5s~Sj)nGl2@<fs)*y4MZD^CpczJ6fTxgX&NyA!uZLi+u;$Dg0GE#=;2EAW~(nWP|f
zgd2~l^j_ac(KGPQUk8VVz9^BXb!>@a=#<=2^S_<K8oWzjkxLiIcU}+tvNxEU21vj&
z?INj=o{H|5n1TQqB9%jo6lZ)CkXPYW<y{sv0xdVY4Q%Aky`>|m`o3FaCM%D@N<Bmp
zdj(4gFWXoB$rSRahMikzv7t6C9r+(t{8`NdG_PI!v9TdNb?eRMZ<+`Lwp^Jn*7w-_
zX+(djU*xqk+piVucqs_wu`#|>e5Qc%5c9E;mdlZZ$R_7^(#GqVSf3wt$5VZbl6ze-
ziu-)mI<v{QAo)8&NT~~FVu$wmLMDaD(M-}WTJ4bEpB6-KCa-&>RqAa%v-i^6j^Z<n
zAW84n?461EI1)fOCdDf_Ej=JEAh#f@-}ogEeGB@Pl4M85Wi86NYzI=u504yHsKz<&
z=rc>%^`_2CJg$=anqWK~Yadq-<eWo55D%pnV`q)DQqVl^$mk?E(!g-_SsxXsTS9BG
zGgHK+(dYEp3)h-+mi@OZ1*0v9v#=^D)JBzNoT*jS3n{fwuC^_@hE)DcoIy9Ryg4hg
z4OB~ZSJOn5Jnvb-%HA4q(s<q$4Wjm+R}i3FI<Mip1sL)8M#r5pPliT)$=CA6v<{G^
z3ypc7hwF$`jp#W{jk)6v*1_tpULrW2qRg?+wk`|rJNkH?$PLLfo(zsQhxnbe8rQCs
zu&$#F&%euDN*<Xprx`rqjCj}_JzBFwGK@rp#2@=ll<`?j8l0~_oN+r>x|?xzDeH}R
zN?mp)UT|F#%l>%13B3+}yR9q9zia|U)q$q4f_bSjIMt2=!OhQ$RUPAwKbp7r=F2JT
zu4(*&SU-DwHP4+}?8e{y`skj>aNX%*XyWc-lv_m+cwbeMhX^v$Z%E&eM)63IO3Uv7
z-!bvNMPME)DT<Bhy~zT>vlDz)vSzhPL{gdAvPep=75wG|jeqAPTM7$WC%r?Nf=?k=
zG`Ks(oa~_S0~5b(X!K&}-o|rhdze9kI`e}333&x4g-po@=W81eYhx<Wk^<+Wjrelk
z8Do6VSg~(k{UcEsY3!8r9rhQQPZS4*=j83m34LBsUVyB;H~iC}g1T_*_Dz!QhEG;?
zUnxtuSG?_q1RJ20TJeVGx8qkx=cH<IC((f!rAoFtpH;JcezCUDPuO@#CqpZp;G!&f
zmafZ!bXL+YDK+A1s+A+0G`*9r6#fP|3#Jl}w`Sl^t1*=5nMH3>91WY*({q^G?3R(e
zL_PBx?Af52Dhavi!S?I&Fk7XK9WcX!q%@B=YvssO;;#AE&zAxX^QLZ=X2g%B2tyv~
z)*RGtOd2Wp5*}=CAvo%EjJd>{m%aKLvxcaUrX(<gnSFx}v}U3@*Tnpb8jl38XeoG0
zu;bl44M))ymU2vj(C}iKa|H0XiUvcpr|`mpu7sSKtNpG2o8x(qxn1k;3P0x(9%UY@
z&&GZl#7pUGg?oo}p;|8io3+L`N??znM;QK3PP4rhJwc8S6B!xjzRXJyVQ1ybULXrv
zyPn^5kH_RLLrHp9y-&LskM>$I7yFdSn_G#2r8Lj5D=ZIw|H3QV)f9ppxd?gW@tu)r
zH97P+VHF0dq<F8!?tDL?b`Ue?nevO8MRsh`sO+5?TdW?`aA<H16D+)LJ%snOt%8;A
zdoDE+-c8TE+n_K6CjVR?;o11TBO0!|s!v!>34>lBJ4!VM)ko-THrZewVN#+$y*zr9
zVUe{%0s{PHg2ig#zGRfH&s@K*3SskPf1a+azmK$38x&l6<lp*Duv(}0RfHrvJO7ku
z+DSemUvI9%44lc05Gs@tPtD<$N=k<yd5lul4$=|*WQHav_J@CnfWe1G<@_N;XAx-}
z=U4)SkS}Wz`BNRlQy1e{j{VBY_M5er1nKN=4e3CIyfPi!%yzbzq!8xd#x8)7W64@s
zKiw&gx#Y-*wf1RO(t3wKs8XIK+f5a5sqLlC``#ITe|Pktu!}46?rKqn#L2_cPOaP6
zddAa$q66Ho1p}NSmQ)q`tP$=I^MK3FJzjkZ>xg8Y?G@gNd-VdnZvC|~yXfJNK5CH$
z5??#q)ng+%IV0tjV(>ErTKXo$Frp%4mj6!r^6n2>>9PdPUGrs(FX?gG`#0S!<onG|
zxFs)jtJIB5KZf8Y()ZYGS-Y&H8<UP4q;o%jicF!#k#6HP2@Vx;&~qGKz37%?13HC}
z6k&l3RY{(tX5;<9t5>7$Z$qChxic+cYk;l6-)AH&wW31C$WkCStqbz|8YMR}2cm7=
zre>b3n;+wb+W}bh&4Z1Zf^>Olq;+uL8!a4Cci&;>GRmT+<xoLkzhrz!O2J!$#CR75
zB#hk`1FLmz>TtLE(q5i8j{m3&#M_!FtNLZgJ9~2AW5doeL4B^+Jze9_^5z*pr@@B)
zp_Ly#Z_idE8;@N_i}dDUFo9Q`n&f!^yR}2XJ&(gOO8#sgvfShvqA^g$+b$BzNoFw|
zl^v)@d@B~_YWtJJOA2m5?>X1JPODg8!5L=Sqtz<5f)9~+X#p|oysL@Wtk*GDZgRN{
zYTz*f-BuEd-!@Ds^JB^%q>)t&=4lM4p_}LY15Sijpdt%o6XA$bO+EJR%?D=-9OVq3
zQv?J1;0)-+5<KT4L5uX632RD*v%`kN-<RfIT}NB}g=AKAWkwkW)f>LijB*Ox3M?zZ
zh5n+Fn@67D0Y~qM@ADz?b?&1d(Ix?T9P1OA4Bjb-x^G(I4yhyxnvi+>74lehLUCDw
zRQ>NwvN-)hvRAI~vf*Mx(PSVy5tJ03GUO}bR@D=U^slO?E8L!<nR<94hnNWQw^tZn
zP4Rq^Fuv3kKZ!5@C^DzbRXJ<WRmVnhZ4~)4U*pgQw0e!a=%agE61Z5!GQd=l<rOuw
zD&byRifT;zirpDJ!&=@&PCeX{%wBI`rQ(`Hf74#OyG*do+c!)q<L?;|3Ic^>6shA-
ztISwOdN@4+q8My*c6uG6n~2i%A>!Zfw9TQ%(t=stD*c3zllBf1WcwjoL7K+SO+An2
z!FC#`#C@V~C$TS@3k{}!wb|c1d7!xwI8y0|)H7;=IJ`jyuRMoE*aIW`Io?T$ul5#-
zs3iDnRs^p9dbx`~G-tH#ctQbnJQS7?Ye;*5V0pn{JJdXH0Qf#8YtGLWA-T*Nl43u|
z$>r87m3FvArzYAQmY~C1QR~`aeZ@4ZY+655sjge4uN^fi;!|49ShkF-kGEOSzGgpb
zVXQh~TWE;O*&;JvuBY-f_Z9H1gt#sFtMN~AI1Qk|^m8V^4=W;WxyjOU(X_iR*sVa(
zlgP-h<vAn5Uy3EBJQ)&uJcP5N+A3eF873#xM=Tk*b#&07&TqjfsWfNJi21%)#`y$>
z`4DRNm#7*9@662Becl)N$Bf~6zJlRicX}5LaE8XLf*|uZa<;1o!N>iwXCHLQ`57zY
z9G#obXu4KEW^xR4?Eicap8x5#TQSe3s#3OrZtJ&N*2V%whY#QSNT>7;O1!E^Fc?(H
z8!^U5DL#EG=tD!h^<G4ZDrT?&3KvdD(3aFpSLN1LgRm)Hqq=WF#|FuMQ_a_DywM@M
z(Se(NMOAsXA_Y_~N}uu>_r;z_!d3-v+F-cNK5{Fn{?k9L@I+sq4s{cmy)0%nO&XfE
z5`0whgw06OsckDPTMKWrBt4wG%}2+akGGe2F9!q<8xS3I!P%4;BgPsXWn3N$5r&^J
zolbka)=rAdklQYg(Al7aK}d0guSYECO$iiS!vUo+>pD-R_pB}Sc<Hq-t3a&*I&ZEa
zOzwQ%voU8pR`IS+zP5j9ccWYrP(0lc#WVCNRdEs&tZ#8)u0tgRrjKKr(lYCu`4G@j
zwPp5SOKk!%sBu~1Mw@&VPtSq4v;)o@M?7e^iLb~+%R@4=AmcC8o<#j+ci&e(mg%&+
zQM`lKSH?%&<(JA77ZdPW_~l((r+b+lQxiJ$h1h!n<x9o-uRyiy7S<Dud@7fBw&8!C
zPEXQa+p>z!2d&FzU{1e5^ewt@JLKse6|TZBQOhjYZplF0mIAH?4<dPRYG*ev0e6WJ
zofhmD`l3*MoA*u4XKNc}xn0UZS8*Ec-^{6u5Mcgqv7qFjSyG**u`+`8waB9NW;(NH
zZjL!j4Y97nD81YE*@Ze*3f-B+RhntBumMc?^g8F7Lq4J3X4yn(Yllm}VSZ*eS^Xwg
zJ<@YOx_H72kw%zY?D&dAyglO-&bVKmS7RZ(=XX8~jf<|!q3Yhq&VHKE8V&JA%zVY5
zUmZD@DPe1Z?9?A&UAjmlxKIWIrk@#i!&EohB1Dc4V#zU0bKBHa)P(n@Wu_0lwMVUL
zim=X~dYBD0X=a#XDRx4Bc(o0>sO+l)_ORZSh1Q=|e{zHwh)nfbDV(wyvW&{B2IOQ<
zQ2Hfs#3=C@;a3$zy^ce@p7@$Y69ZN0ZAte0Ou=`~o><k^=iRt}wPA3P_>KRFGY!^H
z0CYlK2*L6qjuj(+GmsEd5;tNxWpwa{!-yK4h_T6(y{*4*;?m6mkV4bF74s+wb#wT`
z_?H}C->zOj2!}3q316trJdBOUcpupJbwQ;kb{?NJsa7hmNIlzUHeD}k(qw;|L5{v8
zt)Zui2$Rj`(v#RThv$0KO%PqIrB%q)4vZ=_6;*TX#JHq#-#=o0H?qru+-o1_gsWT7
z#ZB4OnoHZ!^l>MmTMQop64_@*>U-SKYaK=C<MefBan50aIW%vy+jnqGbGem)lQG;?
za*d`sK#+{9s`2zKQ!a@fTLRiUEAX<^uC*B2?Uj>dW5N@mBdvN!Jz*P^Q<M}7h*@Xm
zAv23^I%Muj35+!P-JX!xzm#1*doDz5xX4<^pYPR*aon*Wh}ftJhkReCJp3?YeU*0N
z=qV7n4PK|~cQW}LN+*wCip;ajj=siQLl=(MHhPL(JeX)XRfpf3+pyW0&YD-{(QIiZ
zJci&TVtVQaCMQeJ6m>iB-_NCV&P9=47b}sRD8=&m9-1_b<k7y#fsBc%HogBqy_w$s
zXz4tx&y>|k@ds=eZ)uI=Ma7J2+Sx`hEr^FlDerRjTzzo$0aL8obE~?YIdz3E9t&1B
zjrk{R{-VG9Vx98I-Y=0e2GB^880V+T^O+wv5knmR{JFc^#kn6D*TwSkVJZ2zT9a0<
zYZ(gGRIjf3+y^qIH@(F?e11q+BU~-<N!?+_du@x(q6e&+Pr~$*avp%=Dhbp!8wU>5
zisZZ`gvHE{bRJ8I`I+E_97Ues|2#2wWdl7Zdau{}I{*1Y7chDwkOQe6@0kR~H05$t
zps1snDn=cAN~9@?ntS1kUuYU!--sm$XN!7Eb9p6Zqh`uhYyusle`8c<3{o1M-W!`x
zKb2xbdQTwyVvY?OE<3!SdhP^ebJjW06QXqy8Yzs$Nz@qfckMmBB!zVXyXAUo^2Mzh
eJ`21#oqMVERGA<!`-FwW^BfoVOgCTrnEwK_NaQpC

literal 0
HcmV?d00001

diff --git a/testdata/format/tfo.pcap.out.txt b/testdata/format/tfo.pcap.out.txt
new file mode 100644
index 00000000..db89cdc3
--- /dev/null
+++ b/testdata/format/tfo.pcap.out.txt
@@ -0,0 +1,4 @@
+19:21:01.433721 IP 10.0.1.2.46282 > 10.0.1.1.10054: Flags [S], seq 3162925789, win 64240, options [mss 1460,sackOK,TS val 3692057751 ecr 0,nop,wscale 7,tfo  cookiereq,nop,nop,mptcp 4 capable v1 flags [H]], length 0
+19:21:01.436537 IP 10.0.1.1.10054 > 10.0.1.2.46282: Flags [S.], seq 4060522904, ack 3162925790, win 65160, options [mss 1460,nop,nop,sackOK,nop,wscale 7,tfo  cookie 2657f58b2de43e0e,nop,nop,mptcp 12 capable v1 flags [H] {0x5ad4e6265b0cf688}], length 0
+19:21:01.438160 IP 10.0.1.2.46282 > 10.0.1.1.10054: Flags [.], seq 3162925790, ack 4060522905, win 502, options [mptcp 20 capable v1 flags [H] {0x22b4a70514e01c86,0x5ad4e6265b0cf688}], length 0
+19:21:01.442667 IP 10.0.1.2.46282 > 10.0.1.1.10054: Flags [P.], seq 3162925790:3162930098, ack 4060522905, win 502, options [mptcp 22 capable v1 flags [H] {0x22b4a70514e01c86,0x5ad4e6265b0cf688,data_len=8192},nop,nop], length 4308
diff --git a/testdata/format/udp.pcap b/testdata/format/udp.pcap
new file mode 100644
index 0000000000000000000000000000000000000000..bf6279d6cd5ca78d3ade68f0c6f01fc32ee6ec27
GIT binary patch
literal 310
zcmca|c+)~A1{MYwumLg{85lm)cCh<~KjmdG0P;bY;lW7;fu#(xoO_((IT&0S7?iZa
z85kM_85j<%U}ytkiCqVF9bn*_^R<zcf$dcSNPh=VzZp;~2xI8i(2BsKU!;tyk&}Uk
zQQ`l820j4}kSU-4@G^j01;P;fA!b2b5qO4yK~C_b0LTR(mq1*>z|hFRzy{KQ03fqi
lIQZaZ{Raaiv-ASbg3LP61vTqG*eofaSu6}f5VK+K0ss=zRHOg^

literal 0
HcmV?d00001

diff --git a/testdata/format/udp.pcap.out.txt b/testdata/format/udp.pcap.out.txt
new file mode 100644
index 00000000..d6f7e15f
--- /dev/null
+++ b/testdata/format/udp.pcap.out.txt
@@ -0,0 +1,4 @@
+15:08:45.910679 IP 192.168.0.134.47808 > 192.168.0.24.47808: UDP, length 6
+15:08:45.910728 IP 192.168.0.134.47808 > 192.168.0.24.47808: UDP, length 12
+15:08:45.916723 IP 192.168.0.24.47808 > 192.168.0.134.47808: UDP, length 6
+15:08:45.919556 IP 192.168.0.24.47808 > 192.168.0.255.47808: UDP, length 18
diff --git a/vendor/github.com/x-way/pktdump/arp.go b/vendor/github.com/x-way/pktdump/arp.go
index 49d42f18..e0808729 100644
--- a/vendor/github.com/x-way/pktdump/arp.go
+++ b/vendor/github.com/x-way/pktdump/arp.go
@@ -8,7 +8,7 @@ import (
 	"github.com/gopacket/gopacket/layers"
 )
 
-func formatARP(arp *layers.ARP, length int, opts *Options) string {
+func (f *Formatter) formatARP(arp *layers.ARP, length int) string {
 	builder := strings.Builder{}
 	builder.WriteString("ARP")
 
diff --git a/vendor/github.com/x-way/pktdump/format.go b/vendor/github.com/x-way/pktdump/format.go
index 0c37e5e0..586f370b 100644
--- a/vendor/github.com/x-way/pktdump/format.go
+++ b/vendor/github.com/x-way/pktdump/format.go
@@ -10,8 +10,13 @@ import (
 	"github.com/gopacket/gopacket/layers"
 )
 
-func formatPacketTCP(tcp *layers.TCP, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketTCP(tcp *layers.TCP, src, dst string, length int) string {
 	length -= int(tcp.DataOffset) * 4
+
+	if f.opts.Quiet {
+		return fmt.Sprintf("%s.%d > %s.%d: tcp %d", src, tcp.SrcPort, dst, tcp.DstPort, length)
+	}
+
 	flags := ""
 	if tcp.FIN {
 		flags += "F"
@@ -44,7 +49,7 @@ func formatPacketTCP(tcp *layers.TCP, src, dst string, length int, style FormatS
 		flags = "none"
 	}
 	out := fmt.Sprintf("%s.%d > %s.%d: Flags [%s]", src, tcp.SrcPort, dst, tcp.DstPort, flags)
-	if style >= FormatStyleVerbose {
+	if f.opts.HeaderStyle >= FormatStyleVerbose {
 		out += fmt.Sprintf(", cksum 0x%x", tcp.Checksum)
 	}
 	if length > 0 || tcp.SYN || tcp.FIN || tcp.RST || tcp.ACK {
@@ -105,7 +110,7 @@ func formatPacketTCP(tcp *layers.TCP, src, dst string, length int, style FormatS
 	return out
 }
 
-func formatPacketSIP(sip *layers.SIP, src, dst string, srcPort, dstPort int, style FormatStyle) string {
+func (f *Formatter) formatPacketSIP(sip *layers.SIP, src, dst string, srcPort, dstPort int) string {
 	sipStr := "SIP: "
 	if sip.IsResponse {
 		sipStr += fmt.Sprintf("%s %d %s", sip.Version, sip.ResponseCode, sip.ResponseStatus)
@@ -115,7 +120,7 @@ func formatPacketSIP(sip *layers.SIP, src, dst string, srcPort, dstPort int, sty
 	return fmt.Sprintf("%s.%d > %s.%d: %s", src, srcPort, dst, dstPort, sipStr)
 }
 
-func formatPacketICMPv6(packet *gopacket.Packet, icmp *layers.ICMPv6, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketICMPv6(packet *gopacket.Packet, icmp *layers.ICMPv6, src, dst string, length int) string {
 	switch icmpType := icmp.TypeCode.Type(); icmpType {
 	case layers.ICMPv6TypeEchoRequest:
 		if echoLayer := (*packet).Layer(layers.LayerTypeICMPv6Echo); echoLayer != nil {
@@ -131,7 +136,7 @@ func formatPacketICMPv6(packet *gopacket.Packet, icmp *layers.ICMPv6, src, dst s
 	return fmt.Sprintf("%s > %s: ICMP6, length %d", src, dst, length)
 }
 
-func formatPacketICMPv4(icmp *layers.ICMPv4, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketICMPv4(icmp *layers.ICMPv4, src, dst string, length int) string {
 	switch icmpType := icmp.TypeCode.Type(); icmpType {
 	case layers.ICMPv4TypeEchoRequest:
 		return fmt.Sprintf("%s > %s: ICMP echo request, id %d, seq %d, length %d", src, dst, icmp.Id, icmp.Seq, length)
@@ -142,7 +147,7 @@ func formatPacketICMPv4(icmp *layers.ICMPv4, src, dst string, length int, style
 	}
 }
 
-func formatPacketDNS(dns *layers.DNS, src, dst string, srcPort, dstPort, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketDNS(dns *layers.DNS, src, dst string, srcPort, dstPort, length int) string {
 	dnsStr := ""
 	if dns.QR {
 		dnsStr = fmt.Sprintf("%d", dns.ID)
@@ -305,24 +310,28 @@ func formatPacketDNS(dns *layers.DNS, src, dst string, srcPort, dstPort, length
 	return fmt.Sprintf("%s.%d > %s.%d: %s (%d)", src, srcPort, dst, dstPort, dnsStr, length)
 }
 
-func formatPacketUDP(packet *gopacket.Packet, udp *layers.UDP, src, dst string, style FormatStyle) string {
+func (f *Formatter) formatPacketUDP(packet *gopacket.Packet, udp *layers.UDP, src, dst string) string {
 	length := int(udp.Length) - 8
-	if udp.SrcPort == 53 || udp.DstPort == 53 || udp.SrcPort == 5353 || udp.DstPort == 5353 {
-		if dnsLayer := (*packet).Layer(layers.LayerTypeDNS); dnsLayer != nil {
-			dns, _ := dnsLayer.(*layers.DNS)
-			return formatPacketDNS(dns, src, dst, int(udp.SrcPort), int(udp.DstPort), length, style)
+
+	if !f.opts.Quiet {
+		if udp.SrcPort == 53 || udp.DstPort == 53 || udp.SrcPort == 5353 || udp.DstPort == 5353 {
+			if dnsLayer := (*packet).Layer(layers.LayerTypeDNS); dnsLayer != nil {
+				dns, _ := dnsLayer.(*layers.DNS)
+				return f.formatPacketDNS(dns, src, dst, int(udp.SrcPort), int(udp.DstPort), length)
+			}
 		}
-	}
-	if udp.DstPort == 5060 || udp.SrcPort == 5060 {
-		if sipLayer := (*packet).Layer(layers.LayerTypeSIP); sipLayer != nil {
-			sip, _ := sipLayer.(*layers.SIP)
-			return formatPacketSIP(sip, src, dst, int(udp.SrcPort), int(udp.DstPort), style)
+		if udp.DstPort == 5060 || udp.SrcPort == 5060 {
+			if sipLayer := (*packet).Layer(layers.LayerTypeSIP); sipLayer != nil {
+				sip, _ := sipLayer.(*layers.SIP)
+				return f.formatPacketSIP(sip, src, dst, int(udp.SrcPort), int(udp.DstPort))
+			}
 		}
 	}
+
 	return fmt.Sprintf("%s.%d > %s.%d: UDP, length %d", src, udp.SrcPort, dst, udp.DstPort, length)
 }
 
-func formatPacketOSPF(ospf layers.OSPF, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketOSPF(ospf layers.OSPF, src, dst string, length int) string {
 	var ospfType string
 	switch ospf.Type {
 	case layers.OSPFHello:
@@ -345,7 +354,7 @@ func formatPacketOSPF(ospf layers.OSPF, src, dst string, length int, style Forma
 	return fmt.Sprintf("%s > %s: OSPFv%d, %s, length %d", src, dst, ospf.Version, ospfType, length)
 }
 
-func formatPacketGRE(gre *layers.GRE, src, dst string, length int, style FormatStyle) string {
+func (f *Formatter) formatPacketGRE(gre *layers.GRE, src, dst string, length int) string {
 	out := fmt.Sprintf("%s > %s: GREv%d", src, dst, gre.Version)
 	switch gre.Version {
 	case 0:
@@ -376,9 +385,9 @@ func formatPacketGRE(gre *layers.GRE, src, dst string, length int, style FormatS
 		out += fmt.Sprintf(", length %d: ", length)
 		switch gre.Protocol {
 		case layers.EthernetTypeIPv4:
-			out += FormatWithStyle(gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypeIPv4, gopacket.Default), style)
+			out += FormatWithStyle(gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypeIPv4, gopacket.Default), f.opts.HeaderStyle)
 		case layers.EthernetTypeIPv6:
-			out += FormatWithStyle(gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypeIPv6, gopacket.Default), style)
+			out += FormatWithStyle(gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypeIPv6, gopacket.Default), f.opts.HeaderStyle)
 		default:
 			out += fmt.Sprintf("gre-proto-0x%x", gre.Protocol&0xffff)
 		}
@@ -401,7 +410,7 @@ func formatPacketGRE(gre *layers.GRE, src, dst string, length int, style FormatS
 			case layers.EthernetTypePPP:
 				if pppLayer := gopacket.NewPacket(gre.LayerPayload(), layers.LayerTypePPP, gopacket.Default).Layer(layers.LayerTypePPP); pppLayer != nil {
 					ppp, _ := pppLayer.(*layers.PPP)
-					out += formatPacketPPP(ppp, style)
+					out += f.formatPacketPPP(ppp)
 				}
 			default:
 				out += fmt.Sprintf("gre-proto-0x%x", gre.Protocol&0xffff)
@@ -413,12 +422,12 @@ func formatPacketGRE(gre *layers.GRE, src, dst string, length int, style FormatS
 	return out
 }
 
-func formatPacketPPP(ppp *layers.PPP, style FormatStyle) string {
+func (f *Formatter) formatPacketPPP(ppp *layers.PPP) string {
 	switch ppp.PPPType {
 	case layers.PPPTypeIPv4:
-		return FormatWithStyle(gopacket.NewPacket(ppp.LayerPayload(), layers.LayerTypeIPv4, gopacket.Default), style)
+		return FormatWithStyle(gopacket.NewPacket(ppp.LayerPayload(), layers.LayerTypeIPv4, gopacket.Default), f.opts.HeaderStyle)
 	case layers.PPPTypeIPv6:
-		return FormatWithStyle(gopacket.NewPacket(ppp.LayerPayload(), layers.LayerTypeIPv6, gopacket.Default), style)
+		return FormatWithStyle(gopacket.NewPacket(ppp.LayerPayload(), layers.LayerTypeIPv6, gopacket.Default), f.opts.HeaderStyle)
 	case layers.PPPTypeMPLSUnicast:
 		return fmt.Sprintf("MPLS, length %d", len(ppp.LayerPayload()))
 	case layers.PPPTypeMPLSMulticast:
@@ -428,7 +437,7 @@ func formatPacketPPP(ppp *layers.PPP, style FormatStyle) string {
 	}
 }
 
-func formatIPv4(ipv4 *layers.IPv4, opts *Options) string {
+func (f *Formatter) formatIPv4(ipv4 *layers.IPv4) string {
 	fields := []string{}
 	fields = append(fields, fmt.Sprintf("tos 0x%x", ipv4.TOS))
 	fields = append(fields, fmt.Sprintf("ttl %d", ipv4.TTL))
@@ -445,7 +454,7 @@ func formatIPv4(ipv4 *layers.IPv4, opts *Options) string {
 	return strings.Join(fields, ", ")
 }
 
-func formatIPv6(ipv6 *layers.IPv6, opts *Options) string {
+func (f *Formatter) formatIPv6(ipv6 *layers.IPv6) string {
 	fields := []string{}
 	fields = append(fields, fmt.Sprintf("flowlabel 0x%x", ipv6.FlowLabel))
 	fields = append(fields, fmt.Sprintf("hlim %d", ipv6.HopLimit))
@@ -455,7 +464,7 @@ func formatIPv6(ipv6 *layers.IPv6, opts *Options) string {
 	return strings.Join(fields, ", ")
 }
 
-func formatLinkLayer(packet gopacket.Packet, opts *Options) string {
+func (f *Formatter) formatLinkLayer(packet gopacket.Packet) string {
 	var layer gopacket.Layer
 	if layer = packet.LinkLayer(); layer == nil {
 		return ""
@@ -469,14 +478,14 @@ func formatLinkLayer(packet gopacket.Packet, opts *Options) string {
 		length = len(layer.LayerPayload())
 		break
 	default:
-		return formatUnknown(layer, packet, opts)
+		return f.formatUnknown(layer, packet)
 	}
 
 	switch nextLayerType {
 	case layers.LayerTypeARP:
 		if ly := packet.Layer(layers.LayerTypeARP); ly != nil {
 			arp, _ := ly.(*layers.ARP)
-			return formatARP(arp, length, opts)
+			return f.formatARP(arp, length)
 		}
 	}
 
@@ -489,25 +498,26 @@ func Format(packet gopacket.Packet) string {
 }
 
 func FormatWithStyle(packet gopacket.Packet, style FormatStyle) string {
-	return FormatWithOptions(packet, &Options{HeaderStyle: style})
+	return NewFormatter(&Options{HeaderStyle: style}).formatWithOptions(packet)
 }
 
-func FormatWithOptions(packet gopacket.Packet, opts *Options) string {
-	data := formatWithOptions(packet, opts)
+func (f *Formatter) FormatWithOptions(packet gopacket.Packet, opts *Options) string {
+	f.opts = opts
+	data := f.formatWithOptions(packet)
 	opts.formatContent()
 	return data
 }
 
-func formatWithOptions(packet gopacket.Packet, opts *Options) string {
+func (f *Formatter) formatWithOptions(packet gopacket.Packet) string {
 	var net gopacket.Layer
-	if opts.needFormatLink() && packet.LinkLayer() != nil {
-		opts.rawContent = append(opts.rawContent, packet.LinkLayer().LayerContents()...)
+	if f.opts.needFormatLink() && packet.LinkLayer() != nil {
+		f.opts.rawContent = append(f.opts.rawContent, packet.LinkLayer().LayerContents()...)
 	}
 	if net = packet.NetworkLayer(); net == nil {
-		return formatLinkLayer(packet, opts)
+		return f.formatLinkLayer(packet)
 	}
-	opts.rawContent = append(opts.rawContent, net.LayerContents()...)
-	style := opts.HeaderStyle
+	f.opts.rawContent = append(f.opts.rawContent, net.LayerContents()...)
+	style := f.opts.HeaderStyle
 
 	var prefix, src, dst string
 	var nextLayerType gopacket.LayerType
@@ -517,7 +527,7 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 	case *layers.IPv4:
 		prefix = fmt.Sprintf("IP ")
 		if style >= FormatStyleVerbose {
-			prefix = fmt.Sprintf("IP (%s)\n    ", formatIPv4(net, opts))
+			prefix = fmt.Sprintf("IP (%s)\n    ", f.formatIPv4(net))
 		}
 		nextLayerType = net.NextLayerType()
 		nextLayerPayload = net.LayerPayload()
@@ -527,7 +537,7 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 	case *layers.IPv6:
 		prefix = "IP6 "
 		if style >= FormatStyleVerbose {
-			prefix = fmt.Sprintf("IP6 (%s)\n    ", formatIPv6(net, opts))
+			prefix = fmt.Sprintf("IP6 (%s)\n    ", f.formatIPv6(net))
 		}
 		nextLayerType = net.NextLayerType()
 		nextLayerPayload = net.LayerPayload()
@@ -535,13 +545,13 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 		dst = net.DstIP.String()
 		length = int(net.Length)
 	default:
-		return formatUnknown(net, packet, opts)
+		return f.formatUnknown(net, packet)
 	}
 
 	if packet.TransportLayer() != nil {
-		opts.rawContent = append(opts.rawContent, packet.TransportLayer().LayerContents()...)
+		f.opts.rawContent = append(f.opts.rawContent, packet.TransportLayer().LayerContents()...)
 		if packet.ApplicationLayer() != nil {
-			opts.rawContent = append(opts.rawContent, packet.ApplicationLayer().LayerContents()...)
+			f.opts.rawContent = append(f.opts.rawContent, packet.ApplicationLayer().LayerContents()...)
 		}
 	}
 
@@ -549,17 +559,17 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 	case layers.LayerTypeUDP:
 		if udpLayer := packet.Layer(layers.LayerTypeUDP); udpLayer != nil {
 			udp, _ := udpLayer.(*layers.UDP)
-			return prefix + formatPacketUDP(&packet, udp, src, dst, style)
+			return prefix + f.formatPacketUDP(&packet, udp, src, dst)
 		}
 	case layers.LayerTypeTCP:
 		if tcpLayer := packet.Layer(layers.LayerTypeTCP); tcpLayer != nil {
 			tcp, _ := tcpLayer.(*layers.TCP)
-			return prefix + formatPacketTCP(tcp, src, dst, length, style)
+			return prefix + f.formatPacketTCP(tcp, src, dst, length)
 		}
 	case layers.LayerTypeICMPv6:
 		if icmpLayer := packet.Layer(layers.LayerTypeICMPv6); icmpLayer != nil {
 			icmp, _ := icmpLayer.(*layers.ICMPv6)
-			return prefix + formatPacketICMPv6(&packet, icmp, src, dst, length, style)
+			return prefix + f.formatPacketICMPv6(&packet, icmp, src, dst, length)
 		}
 	case layers.LayerTypeOSPF:
 		if ospfLayer := packet.Layer(layers.LayerTypeOSPF); ospfLayer != nil {
@@ -568,20 +578,20 @@ func formatWithOptions(packet gopacket.Packet, opts *Options) string {
 				if ospfLayer.AuType == 2 {
 					length -= 16
 				}
-				return prefix + formatPacketOSPF(ospfLayer.OSPF, src, dst, length, style)
+				return prefix + f.formatPacketOSPF(ospfLayer.OSPF, src, dst, length)
 			case *layers.OSPFv3:
-				return prefix + formatPacketOSPF(ospfLayer.OSPF, src, dst, length, style)
+				return prefix + f.formatPacketOSPF(ospfLayer.OSPF, src, dst, length)
 			}
 		}
 	case layers.LayerTypeGRE:
 		if greLayer := packet.Layer(layers.LayerTypeGRE); greLayer != nil {
 			gre, _ := greLayer.(*layers.GRE)
-			return prefix + formatPacketGRE(gre, src, dst, length, style)
+			return prefix + f.formatPacketGRE(gre, src, dst, length)
 		}
 	case layers.LayerTypeICMPv4:
 		if icmpLayer := packet.Layer(layers.LayerTypeICMPv4); icmpLayer != nil {
 			icmp, _ := icmpLayer.(*layers.ICMPv4)
-			return prefix + formatPacketICMPv4(icmp, src, dst, length, style)
+			return prefix + f.formatPacketICMPv4(icmp, src, dst, length)
 		}
 	case layers.LayerTypeIPv4:
 		fallthrough
diff --git a/vendor/github.com/x-way/pktdump/formatter.go b/vendor/github.com/x-way/pktdump/formatter.go
new file mode 100644
index 00000000..bfbb2496
--- /dev/null
+++ b/vendor/github.com/x-way/pktdump/formatter.go
@@ -0,0 +1,9 @@
+package pktdump
+
+type Formatter struct {
+	opts *Options
+}
+
+func NewFormatter(opts *Options) *Formatter {
+	return &Formatter{opts: opts}
+}
diff --git a/vendor/github.com/x-way/pktdump/mptcp.go b/vendor/github.com/x-way/pktdump/mptcp.go
index 247850fd..3a7b302e 100644
--- a/vendor/github.com/x-way/pktdump/mptcp.go
+++ b/vendor/github.com/x-way/pktdump/mptcp.go
@@ -502,8 +502,15 @@ func mptcpPrint(options *mptcpPrintOptions, opt layers.TCPOption) string {
 	buf.WriteString(fmt.Sprintf(" %d", length))
 	buf.WriteString(fmt.Sprintf(" %s", MPTCPPrintOptions[subtype].Name))
 
-	// Call the corresponding print function for the subtype.
-	MPTCPPrintOptions[subtype].Print(options, opt, &buf)
+	func() {
+		defer func() {
+			if err := recover(); err != nil {
+				buf.WriteString("[bad opt]")
+			}
+		}()
+		// Call the corresponding print function for the subtype.
+		MPTCPPrintOptions[subtype].Print(options, opt, &buf)
+	}()
 
 	return buf.String()
 }
diff --git a/vendor/github.com/x-way/pktdump/options.go b/vendor/github.com/x-way/pktdump/options.go
index f1132e31..9c8cc959 100644
--- a/vendor/github.com/x-way/pktdump/options.go
+++ b/vendor/github.com/x-way/pktdump/options.go
@@ -10,6 +10,8 @@ type Options struct {
 
 	rawContent      []byte
 	FormatedContent []byte
+
+	Quiet bool
 }
 
 const (
diff --git a/vendor/github.com/x-way/pktdump/unknown.go b/vendor/github.com/x-way/pktdump/unknown.go
index d7ffdea3..769e43b2 100644
--- a/vendor/github.com/x-way/pktdump/unknown.go
+++ b/vendor/github.com/x-way/pktdump/unknown.go
@@ -5,7 +5,7 @@ import (
 	"github.com/gopacket/gopacket"
 )
 
-func formatUnknown(layer gopacket.Layer, packet gopacket.Packet, opts *Options) string {
+func (f *Formatter) formatUnknown(layer gopacket.Layer, packet gopacket.Packet) string {
 	return fmt.Sprintf("%s, %s, length %d", layer.LayerType().String(),
 		packet.LinkLayer().LinkFlow().String(), len(layer.LayerPayload()))
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 0c44d01f..5e46c785 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -390,7 +390,7 @@ github.com/tklauser/numcpus
 # github.com/vishvananda/netns v0.0.0-20211101163701-50045581ed74
 ## explicit; go 1.12
 github.com/vishvananda/netns
-# github.com/x-way/pktdump v0.0.5 => github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d
+# github.com/x-way/pktdump v0.0.5 => github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1
 ## explicit; go 1.19
 github.com/x-way/pktdump
 # github.com/yusufpapurcu/wmi v1.2.4
@@ -595,6 +595,6 @@ k8s.io/utils/exec
 rsc.io/binaryregexp
 rsc.io/binaryregexp/syntax
 # github.com/gopacket/gopacket => github.com/mozillazg/gopacket v0.0.0-20241026043817-048341de5231
-# github.com/x-way/pktdump => github.com/mozillazg/pktdump v0.0.9-0.20241003022253-cbafa8b6312d
+# github.com/x-way/pktdump => github.com/mozillazg/pktdump v0.0.9-0.20241102131745-63c34f34f0d1
 # k8s.io/cri-api => github.com/mozillazg/cri-api v0.32.0-alpha.1.0.20241019013855-3dc36f8743df
 # k8s.io/cri-client => github.com/mozillazg/cri-client v0.31.0-alpha.0.0.20241019023238-87687176fd67