SNOOP
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
Sun Snoop Capture Preview.
At a glance
| Purpose | A Sun snoop packet capture (RFC 1761): a header and packet records, big-endian. |
| Extensions | .snoop |
| Poka parser | poka-snoop |
| Viewer | poka-tree-viewer |
| Depth tier | Parser with a shared viewer (see Depth tiers) |
| Breadth tier | B4 Summary (see Breadth tiers) |
How much Poka reads
B4 Summary. The container and metadata are read and summarised (counts, properties, structure), but the main content is not rendered.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-snoop/src/main.rs (423 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has sample.snoop, read by no test. Covers .snoop and .snp. The tree shows the capture summary (version, link type, packet and drop counts), an EtherType histogram and a sample of the first packets. Judgement: B4: the capture is summarised, but packets are only sampled and not dissected.
What Poka does not read
- Packets are sampled, not listed in full
- Protocols above the EtherType are not dissected
- Only the first 30 packets are shown
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- snoop (snoop-rs) (candidate; MIT; Rust; https://lib.rs/crates/snoop) — Parser, reader and writer for snoop files; no runtime dependencies; version 1.0.2 (19 February 2026). Repository: ripx80/snoop-rs.
- Wireshark (libwiretap) (reference; GPL-2.0-or-later; C; https://gitlab.com/wireshark/wireshark) — copyleft; Wireshark reads snoop and atmsnoop captures per its file format reference; GPL makes it unsuitable to link into a permissive Rust/wasm tool.
Sources
- parsers/poka-snoop/src/main.rs
- parsers/poka-snoop/plugin.json