What Is PCAP?
PCAP (Packet CAPture) is the de facto standard file format for recording network traffic. A PCAP file is a binary capture of raw network packets — every frame that crossed a network interface during a recording session, with precise timestamps measured to microsecond (PCAP) or nanosecond (PCAPNG) resolution.
PCAP files are generated by tools like Wireshark, tcpdump, tshark, and the libpcap/WinPcap/Npcap libraries that underpin them all. They are the universal language of network analysis: security engineers capture traffic looking for intrusions, developers debug protocol implementations, network engineers diagnose connectivity problems, and academic researchers replay realistic traffic in lab environments — all using PCAP files.
PCAP vs PCAPNG
There are two related formats: the original PCAP and the newer PCAPNG (PCAP Next Generation, standardized as RFC 9443 in 2023).
| Feature | PCAP | PCAPNG |
|---|---|---|
| Year introduced | 1988 (libpcap) | 2004 (draft) / 2023 (RFC 9443) |
| File magic | D4 C3 B2 A1 (little-endian) |
0A 0D 0D 0A |
| Multiple interfaces | No (single link type) | Yes (multiple section header blocks) |
| Packet comments | No | Yes (per-packet annotations) |
| Interface statistics | No | Yes (end-of-capture stats) |
| Timestamps | Microsecond (1 µs) | Nanosecond (1 ns) |
| Compression | No | Optional block-level |
| Tool support | Universal | Wireshark 1.8+ / tshark / tcpdump |
| Extension | .pcap |
.pcapng or .npcap |
PCAP remains the most widely supported format — nearly every network tool reads it. PCAPNG is the preferred format when you need the richer metadata (multiple interfaces, per-packet comments, high-resolution timestamps, capture statistics).
PCAP File Structure
A PCAP file has a simple structure:
Global Header (24 bytes)
├── Magic Number (4 bytes) — 0xA1B2C3D4 or 0xA1B23C4D for nanosecond
├── Major Version (2 bytes) — always 2
├── Minor Version (2 bytes) — always 4
├── Timezone Offset (4 bytes) — always 0 in practice
├── Timestamp Accuracy (4 bytes) — always 0 in practice
├── Snapshot Length (4 bytes) — max bytes captured per packet (typically 65535)
└── Link-Layer Type (4 bytes) — e.g., 1=Ethernet, 105=IEEE 802.11 WiFi
Packet Record 1 (variable length)
├── Timestamp Seconds (4 bytes)
├── Timestamp Microseconds (4 bytes)
├── Captured Length (4 bytes) — bytes stored in file
├── Original Length (4 bytes) — actual packet size (may differ if truncated)
└── Packet Data (Captured Length bytes)
Packet Record 2 ...
Packet Record N ...
The Snapshot Length determines whether packets are captured whole or truncated. A snapshot of 65535 bytes captures full Ethernet frames; a snapshot of 96 bytes captures only headers for bandwidth-efficient bulk collection.
PCAPNG Block Structure
PCAPNG uses a more extensible block-based format:
Section Header Block (SHB) — starts each capture section
Interface Description Block (IDB) — describes each capture interface
Enhanced Packet Block (EPB) — the modern packet container
├── Interface ID
├── Timestamp (64-bit microseconds or nanoseconds)
├── Captured Packet Length
├── Original Packet Length
├── Packet Data
└── Options (comments, flags, checksums)
Interface Statistics Block (ISB) — end-of-capture statistics
Capturing Traffic with tcpdump
tcpdump is the standard CLI tool for capturing PCAP files on Linux/macOS:
# Capture all traffic on eth0, write to file
tcpdump -i eth0 -w capture.pcap
# Capture with a filter (only HTTP and HTTPS)
tcpdump -i eth0 -w web_traffic.pcap 'port 80 or port 443'
# Capture only the first 1000 packets
tcpdump -i eth0 -c 1000 -w sample.pcap
# Capture in PCAPNG format (requires tcpdump 4.99+)
tcpdump -i eth0 --pcapng -w capture.pcapng
# Capture with larger snapshot length (full packet bodies)
tcpdump -i eth0 -s 0 -w full_capture.pcap
# Read an existing PCAP file
tcpdump -r capture.pcap -n 'tcp port 80'
BPF filter syntax (Berkeley Packet Filter) is the standard for specifying what to capture:
# Only DNS queries
tcpdump -i any -w dns.pcap 'udp port 53'
# Traffic to/from a specific IP
tcpdump -i eth0 -w host.pcap 'host 192.168.1.100'
# ICMP (ping) traffic only
tcpdump -i eth0 -w pings.pcap 'icmp'
# TCP SYN packets (new connections)
tcpdump -i eth0 -w synscans.pcap 'tcp[tcpflags] & tcp-syn != 0'
Analyzing PCAP Files with tshark
tshark is Wireshark's command-line equivalent, excellent for scripted analysis:
# List all conversations (IP pairs)
tshark -r capture.pcap -q -z conv,ip
# Extract all HTTP hosts visited
tshark -r capture.pcap -Y 'http.request' -T fields -e http.host -e http.request.uri
# Extract DNS query names
tshark -r capture.pcap -Y 'dns.qry.name' -T fields -e dns.qry.name | sort -u
# Count packets by protocol
tshark -r capture.pcap -q -z io,phs
# Follow a specific TCP stream and dump as ASCII
tshark -r capture.pcap -q -z follow,tcp,ascii,0
# Export all TLS certificates from a capture
tshark -r capture.pcap --export-objects tls,./certs/
# Filter by IP and save subset
tshark -r large_capture.pcap -Y 'ip.addr == 10.0.0.5' -w filtered.pcap
Python Analysis with Scapy and PyShark
# pip install scapy pyshark
# Scapy — packet crafting and analysis
from scapy.all import rdpcap, IP, TCP
packets = rdpcap('capture.pcap')
for pkt in packets:
if IP in pkt and TCP in pkt:
print(f"{pkt[IP].src}:{pkt[TCP].sport} -> {pkt[IP].dst}:{pkt[TCP].dport}")
# PyShark — wraps tshark with Python interface
import pyshark
cap = pyshark.FileCapture('capture.pcap', display_filter='http')
for pkt in cap:
if hasattr(pkt, 'http'):
print(pkt.http.host)
cap.close()
Security Analysis Use Cases
PCAP files are central to security operations:
Intrusion Detection Replay: captured traffic is replayed against IDS/IPS engines (Snort, Suricata) to test rule sets without live traffic.
Malware Analysis: capturing network traffic while executing a malware sample in a sandbox reveals C2 (command-and-control) servers, exfiltration destinations, and protocols used.
Threat Hunting: hunting for indicators of compromise (IOCs) across historical PCAP archives. Tools like Zeek (formerly Bro) analyze PCAP files and produce high-level log summaries.
CTF Forensics: Capture the Flag competitions almost always include PCAP analysis challenges where contestants extract hidden messages or credentials from network captures.
Converting and Reducing PCAP Files
# Convert PCAP to PCAPNG
editcap -F pcapng capture.pcap capture.pcapng
# Convert PCAPNG to PCAP
editcap -F pcap capture.pcapng capture.pcap
# Split a large capture into 100 MB chunks
editcap -c 100000 large.pcap chunk_.pcap
# Remove duplicate packets
editcap -d capture.pcap deduped.pcap
# Truncate packets to 96 bytes (headers only)
editcap -s 96 full.pcap headers_only.pcap
# Merge multiple PCAP files, sorted by timestamp
mergecap -w merged.pcap capture1.pcap capture2.pcap capture3.pcap
Privacy and Legal Considerations
PCAP files capture everything — passwords transmitted over unencrypted protocols (HTTP, FTP, Telnet), email contents, cookie values, and any unencrypted personal data flowing over the network. This has significant privacy and legal implications:
- Never capture traffic on networks you do not own or administer without authorization — it is illegal in most jurisdictions under computer fraud and wiretapping laws.
- Sanitize before sharing: use
editcaportcpdumpBPF filters to remove sensitive data before sharing captures for debugging. Tools likepktanoncan anonymize IP addresses. - GDPR and data protection: in Europe, storing PCAP files containing user traffic may constitute processing of personal data. Retention policies and appropriate safeguards apply.
- TLS traffic: most modern web traffic is encrypted. A PCAP of HTTPS traffic shows encrypted blobs — you need TLS session keys (via
SSLKEYLOGFILE) to decrypt it, which requires cooperation from the client.
File Size Considerations
PCAP files grow quickly. A 1 Gbps link fully captured produces approximately 7.5 GB per minute. Practical strategies:
- Use BPF filters to capture only relevant traffic
- Use short snapshot lengths (e.g., 96 bytes for header-only captures)
- Rotate capture files with time-based or size-based splitting (
tcpdump -G 60 -C 100) - Compress with gzip — PCAP compresses 10:1 or better for typical traffic
Related conversions
Frequent conversions across the catalogue: