How to open a .pcap file
Quick, free ways to open PCAP on any system.
A .pcap file is a Packet Capture. If double-clicking does nothing, your computer simply does not have an app that reads PCAP yet. Here is how to fix that on each operating system, using free software wherever possible.
Open a .pcap file step by step
- Confirm the file really is a .pcap. Drop it into the WhatFileType file identifier, which reads its signature without uploading anything.
- On Windows, open it with Wireshark or tcpdump.
- On Mac, use Wireshark or tcpdump.
- On Linux, try Wireshark or tcpdump.
- Still stuck? Convert the .pcap to pcapng, which opens more widely.
Best apps to open .pcap files
Windows
- Wireshark
- tcpdump
- NetworkMiner
macOS
- Wireshark
- tcpdump
- tshark
Linux
- Wireshark
- tcpdump
- tshark
!
Before you open it: Safe to open in an analyser like Wireshark. Note that a capture can contain sensitive data such as passwords sent in the clear, so handle it carefully.
Frequently asked questions
Why can't I open my .pcap file?
Almost always because no installed app understands PCAP. Install one of the apps above, or convert the file to a format your existing software already reads.
How do I open a PCAP file?
Open it in Wireshark for a full protocol view, or read it on the command line with tcpdump -r file.pcap or tshark.
What is the difference between PCAP and PCAPNG?
PCAPNG is the modern successor to PCAP, adding support for multiple interfaces, comments and richer metadata. Wireshark reads both.