What is a .pcap file?
Packet Capture · Data · tcpdump / libpcap · 1988
PCAP files hold captured network traffic, packet by packet, as recorded by tools like tcpdump and Wireshark. They are the standard way to save and share a network trace for troubleshooting or security analysis.
What is a .pcap file used for?
The file starts with a magic number that also encodes byte order and timestamp precision, followed by a global header and then each packet with its own timestamp and raw bytes. The newer pcapng format extends this with more metadata.
Network engineers and security analysts open PCAP files in Wireshark to inspect protocols, follow conversations and spot anomalies. Because they can contain real traffic, treat captured files as sensitive.
How to open a .pcap file
The .pcap format opens in the following apps, grouped by operating system. If one app does not work, try another from the same list. For a step-by-step walkthrough, see how to open a .pcap file.
Windows
- Wireshark
- tcpdump
- NetworkMiner
macOS
- Wireshark
- tcpdump
- tshark
Linux
- Wireshark
- tcpdump
- tshark
How to convert a .pcap file
You can convert a .pcap file to pcapng, CSV, JSON using a conversion tool or the export menu of an app that opens it.
.pcap file signature (magic bytes)
Programs recognise a .pcap file by the bytes at the start of the file, not by its name. These are the signatures for PCAP. For a full breakdown, see the PCAP file signature page.
| Hex signature | Offset | Note |
|---|---|---|
| D4 C3 B2 A1 | 0 | little-endian, microsecond |
| A1 B2 C3 D4 | 0 | big-endian, microsecond |
See the full magic-numbers reference for every format.
Frequently asked questions
What is a .pcap file?
PCAP files hold captured network traffic, packet by packet, as recorded by tools like tcpdump and Wireshark. They are the standard way to save and share a network trace for troubleshooting or security analysis.
How do I open a PCAP file?
Open it in Wireshark for a full protocol view, or read it on the command line with tcpdump -r file.pcap or tshark.
What is the difference between PCAP and PCAPNG?
PCAPNG is the modern successor to PCAP, adding support for multiple interfaces, comments and richer metadata. Wireshark reads both.
Is it safe to share a PCAP file?
A capture records real traffic and may include credentials or personal data. Sanitise or anonymise it before sharing outside a trusted team.
Related formats
Sources
Details on this page were checked against authoritative references: