How does it work?

At the core of libpcapnav is the ability to resynchronize to the sequence of packets contained in a tcpdump trace file at arbitrary location of the file position indicator. The algorithm that does this is based on Vern Paxson's method in the tcpslice tool, with a few modifications: