diff --git a/PcapNGFormatAnalys.py b/PcapNGFormatAnalys.py
new file mode 100644
index 0000000..21ee58b
--- /dev/null
+++ b/PcapNGFormatAnalys.py
@@ -0,0 +1,278 @@
+#!/usr/bin/evn python
+# -*- coding:utf-8 -*-
+
+import binascii  
+import sys
+import os
+import subprocess
+import json
+import struct
+
+class SectionHeaderBlock_a: # SHB
+
+    def __init__(self, data):
+
+        self._Block_Type = data[0:4]
+        self._Block_Length = data[4:8]
+        self._Byte_Order_Magic = data[8:12]
+        self._Major_Version = data[12:14]
+        self._Minor_Version = data[14:16]
+        self._Section_Length = data[16:24]
+        self._decimal_number = int.from_bytes(self._Block_Length, byteorder='little')
+    
+    def display_content(self):
+        print(binascii.b2a_hex(self._Block_Type))
+        print(binascii.b2a_hex(self._Block_Length))
+        print(binascii.b2a_hex(self._Byte_Order_Magic))
+        print(binascii.b2a_hex(self._Major_Version))
+        print(binascii.b2a_hex(self._Minor_Version))
+        print(binascii.b2a_hex(self._Section_Length))
+        print(self._decimal_number)
+
+class SectionHeaderBlock_b: # SHB
+    def __init__(self, data, Block_Length):
+        self._Options = data[0:Block_Length - 24 - 4 ]
+        self._Block_Length_redundant = data[Block_Length - 24 - 4 : Block_Length - 24]
+    
+    def display_content(self):
+        print(binascii.b2a_hex(self._Options))
+        print(binascii.b2a_hex(self._Block_Length_redundant))
+
+class InterfaceDescriptionBlock: # IDB
+    def __init__(self, data):
+        self._Block_Type = data[0:4]
+        self._Block_Length = data[4:8]
+        self._decimal_number = int.from_bytes(self._Block_Length, byteorder='little')
+
+    def display_content(self):
+        print(binascii.b2a_hex(self._Block_Type))
+        print(binascii.b2a_hex(self._Block_Length))    
+        print(self._decimal_number)    
+
+class PacketBlocks_a: # PB
+    def __init__(self, data):
+        self._Block_Type = data[0:4]
+        self._Block_Length = data[4:8]
+        self._Block_Length_int = int.from_bytes(self._Block_Length, byteorder='little')
+        self._Interface_ID = data[8:12]
+        self._Timestamp_Upper = data[12:16]
+        self._Timestamp_Lower = data[16:20]
+        self._Captured_Packet_Length = data[20:24]
+        self._Captured_Packet_Length_int = int.from_bytes(self._Captured_Packet_Length, byteorder='little')
+        self._Original_Packet_Length = data[24:28]
+        self._Original_Packet_Length_int = int.from_bytes(self._Original_Packet_Length, byteorder='little')
+
+    def display_content(self):
+        print('Block_Type', binascii.b2a_hex(self._Block_Type))
+        print('Block_Length', binascii.b2a_hex(self._Block_Length))    
+        print('Block_Length_int', self._Block_Length_int)    
+        print('Interface_ID', binascii.b2a_hex(self._Interface_ID))
+        print('Timestamp_Upper', binascii.b2a_hex(self._Timestamp_Upper))
+        print('Timestamp_Lower', binascii.b2a_hex(self._Timestamp_Lower))
+        print('Captured_Packet_Length', binascii.b2a_hex(self._Captured_Packet_Length))
+        print('Captured_Packet_Length_int', self._Captured_Packet_Length_int) 
+        print('Original_Packet_Length', binascii.b2a_hex(self._Original_Packet_Length))
+        print('Original_Packet_Length_int', self._Original_Packet_Length_int) 
+
+class PacketBlocks_b: # PB
+    def __init__(self, data, Block_Length, Packet_Length):
+        self._Packet_Data= data[0:Packet_Length]
+        self._Options = data[Packet_Length:Block_Length - 32]
+        self._Block_Total_Length_redundant  = data[Block_Length - 32: Block_Length - 28]
+
+    def display_content(self):
+        print('Packet_Data', binascii.b2a_hex(self._Packet_Data))
+        print('Options', binascii.b2a_hex(self._Options))      
+        print('Block_Total_Length_redundant', binascii.b2a_hex(self._Block_Total_Length_redundant))
+
+class PB_Options: 
+    def __init__(self, data):
+        self._Option_Code= data[0:2]
+        self._Option_Length = data[2:4]
+        self._Option_Length_int = int.from_bytes(self._Option_Length, byteorder='little')
+        self._Option_Value = data[4:self._Option_Length_int + 4]
+        self._End_of_Options = data[self._Option_Length_int + 4 : ]
+
+    def display_content(self):
+        print(binascii.b2a_hex(self._Option_Code))
+        print(binascii.b2a_hex(self._Option_Length))    
+        print(self._Option_Length_int)  
+        print(binascii.b2a_hex(self._Option_Value))
+        print(binascii.b2a_hex(self._End_of_Options))
+
+def ExtractPacketsCommentStr(input_file_path, appsketch_api, pcap_file_id):
+    # Use tshark to extract the five_tuple info
+    tshark_cmd = ['tshark', '-r', input_file_path, '-T', 'fields', '-e', 'frame.number', '-e', 'tcp.stream', '-e', 'udp.stream']
+    ret_str = subprocess.run(tshark_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+    decoded_result = ret_str.stdout
+    list_1 = decoded_result.splitlines()
+    list_output = []
+    for i in range(0, len(list_1)) :
+        list_2 = list_1[i].split("\t")
+        list_output.append(list_2)
+
+    comment_str_list = []
+    for i in range(len(list_output)):
+        # frame_id  = list_output[i][0]
+        session_dict = {}
+        if list_output[i][1] != '':
+            proto = 'tcp'
+            stream_id = list_output[i][1]
+        elif list_output[i][1] == '' and list_output[i][2] != '':
+            proto = 'udp'
+            stream_id = list_output[i][2]          
+        else:
+            proto = 'other'
+            stream_id = ''
+        session_dict['session'] = appsketch_api + 'session/' + pcap_file_id + '/' + proto + '/' + stream_id
+        comment_str_list.append(session_dict)
+        
+    return comment_str_list
+
+def TransferPcapNG(input_file_path):
+    with open(input_file_path, 'rb') as f:
+        first_four_bytes = f.read(4)
+    if first_four_bytes == bytes.fromhex('0a0d0d0a') or first_four_bytes == bytes.fromhex('0A0D0D0A'):
+        return input_file_path
+    else:
+        # Get the file name (including extension)
+        file_name_with_extension = os.path.basename(input_file_path)
+        # Remove the extension
+        transfer_file_path = os.path.splitext(file_name_with_extension)[0] + '.pcapng'
+        # Get the directory path without the file name
+        directory_path = os.path.dirname(input_file_path)
+
+        tshark_cmd = ['tshark', '-r', input_file_path, '-w', directory_path + '/' + transfer_file_path]
+        subprocess.run(tshark_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
+        input_file_path = './output/Transfer.pcapng'
+        return directory_path + '/' + transfer_file_path
+
+if __name__=="__main__":
+
+    input_file_path = TransferPcapNG(sys.argv[1])
+    output_file_path = sys.argv[2]
+    appsketch_api = 'https://sg.appsketch.gdnt-cloud.com/'
+
+    # Get the file name (including extension)
+    file_name_with_extension = os.path.basename(input_file_path)
+    # Remove the extension
+    pcap_file_id = os.path.splitext(file_name_with_extension)[0]
+
+    comment_str_list = ExtractPacketsCommentStr(input_file_path, appsketch_api, pcap_file_id)
+    # for i, pkt in enumerate(comment_str_list):
+    #     print(comment_str_list[i])
+
+    binfile_r = open(input_file_path, 'rb') 
+    binfile_w = open(input_file_path, 'rb') 
+    binfile_output = open(output_file_path, 'wb') 
+
+    size = os.path.getsize(input_file_path)
+
+    # Read Pcapng SHB
+    section_header_block_a = SectionHeaderBlock_a(binfile_r.read(24))
+    # section_header_block_a.display_content()
+    SHB_length = section_header_block_a._decimal_number
+    # Remaining bytes read
+    binfile_r.read(SHB_length - 24)
+
+    # Read Pcapng IDB
+    interface_description_block = InterfaceDescriptionBlock(binfile_r.read(8))
+    # interface_description_block.display_content()
+    IDB_length = interface_description_block._decimal_number
+    # Remaining bytes read
+    binfile_r.read(IDB_length - 8 )
+
+    # 4Byte alignment
+    # Get the number of bytes currently read
+    current_position = binfile_r.tell()
+    # Calculate the next 4-byte aligned position
+    aligned_position = (current_position + 3) & ~3
+
+    align_null_bytes_SHB = bytes.fromhex('')
+    for i in range(aligned_position - current_position):
+        align_null_bytes_SHB +=  bytes.fromhex('00')
+
+    write_data = binfile_w.read(current_position)    
+    binfile_output.write(write_data)
+    binfile_output.write(align_null_bytes_SHB)
+    binfile_w.close()
+
+    # Packets Traversal Add Option
+    for i in range(len(comment_str_list)):
+        # Read Pcapng Packet Blocks 
+        packet_block_a = PacketBlocks_a(binfile_r.read(28))   
+        # packet_block_a.display_content()
+
+        packet_block_data = binfile_r.read(packet_block_a._Captured_Packet_Length_int)
+        # print('Packet_Data', binascii.b2a_hex(packet_block_data))
+
+        # 4Byte alignment
+        # Get the number of bytes currently read
+        current_position = binfile_r.tell()
+        # Calculate the next 4-byte aligned position
+        aligned_position = (current_position + 3) & ~3
+        align_null_bytes_PB_a = bytes.fromhex('')
+        for j in range(aligned_position - current_position):
+            align_null_bytes_PB_a +=  bytes.fromhex('00')
+
+        # 使用 `json.dumps` 方法将 JSON 对象格式化为带缩进的字符串
+        remark_str = json.dumps(comment_str_list[i], indent=4)
+        
+        for j in range(4 - len(remark_str.encode('utf-8')) % 4):
+            binary_str = '00'
+            char = chr(int(binary_str, 2))
+            remark_str += char
+
+        Block_Type  =  packet_block_a._Block_Type 
+        # Modify Block_Length
+        # Block_Length = packet_block_a._Block_Length
+        Block_Length = struct.pack('<I', packet_block_a._Block_Length_int + 8 + len(remark_str))
+
+        Interface_ID = packet_block_a._Interface_ID
+        Timestamp_Upper = packet_block_a._Timestamp_Upper
+        Timestamp_Lower = packet_block_a._Timestamp_Lower
+        Captured_Packet_Length = packet_block_a._Captured_Packet_Length
+        Original_Packet_Length = packet_block_a._Original_Packet_Length
+
+        # Modify Option_Length
+        Option_Code = bytes.fromhex('0100')
+        Option_Length = struct.pack('<H', len(remark_str))
+        Option_Value = remark_str.encode('utf-8')
+        End_of_Options = bytes.fromhex('00000000')
+
+        current_position = 2 + 2 + len(remark_str) + 4
+        aligned_position = (current_position + 3) & ~3
+        align_null_bytes_PB_b = bytes.fromhex('')
+        for j in range(aligned_position - current_position):
+            align_null_bytes_PB_b +=  bytes.fromhex('00')
+        
+        # Modify Block_Total_Length_Redundant
+        Block_Total_Length_Redundant = struct.pack('<I', packet_block_a._Block_Length_int + 8 + len(remark_str))
+        
+        write_data = Block_Type + Block_Length + Interface_ID + Timestamp_Upper + Timestamp_Lower + Captured_Packet_Length + Original_Packet_Length + \
+                    packet_block_data + align_null_bytes_PB_a + \
+                    Option_Code + Option_Length + Option_Value + End_of_Options + align_null_bytes_PB_b + \
+                    Block_Total_Length_Redundant 
+
+        binfile_output.write(write_data)
+        binfile_r.read(4)
+
+        if binfile_r.tell() == size:
+            break
+
+        # Get the number of bytes currently read
+        current_position = binfile_r.tell()
+        # Calculate the next 4-byte aligned position
+        aligned_position = (current_position + 3) & ~3
+        # Move the file pointer to a 4-byte aligned position
+        binfile_r.seek(aligned_position)
+    
+    try:
+        os.remove(input_file_path)
+        print(f"File '{input_file_path}' has been deleted successfully.")
+    except FileNotFoundError:
+        print(f"File '{input_file_path}' does not exist.")
+    except PermissionError:
+        print(f"Permission denied: '{input_file_path}'.")
+    except Exception as e:
+        print(f"An error occurred: {e}")
\ No newline at end of file