You can check the kcap layout diagram in the source code docs:

https://github.com/rabbitstack/fibratus/blob/ee26bbc73999895...