What is a .pcap file?
Packet Capture · Data · tcpdump / libpcap · 1988
PCAP files hold captured network traffic, packet by packet, as recorded by tools like tcpdump and Wireshark. They are the standard way to save and share a network trace for troubleshooting or security analysis.
What is a .pcap file used for?
The file starts with a magic number that also encodes byte order and timestamp precision, followed by a global header and then each packet with its own timestamp and raw bytes. The newer pcapng format extends this with more metadata.
Network engineers and security analysts open PCAP files in Wireshark to inspect protocols, follow conversations and spot anomalies. Because they can contain real traffic, treat captured files as sensitive.
What opens a .pcap file?
The .pcap format opens in the following apps, grouped by operating system. If one app does not work, try another from the same list.
Windows
- Wireshark
- tcpdump
- NetworkMiner
macOS
- Wireshark
- tcpdump
- tshark
Linux
- Wireshark
- tcpdump
- tshark
Open a .pcap file step by step
- Confirm the file really is a .pcap. Drop it into the WhatFileType identifier, which reads its signature in your browser without uploading anything.
- On Windows, open it with Wireshark or tcpdump.
- On Mac, use Wireshark or tcpdump.
- On Linux, try Wireshark or tcpdump.
- Still stuck? Convert the .pcap to pcapng, which opens more widely.
Why can't I open my .pcap file?
Almost always because no installed app understands PCAP. Install one of the apps above, or convert the file to a format your existing software already reads. If double-clicking opens the wrong program instead of nothing at all, the file association is set to the wrong app rather than the file being broken.
The other possibility is that the file is not really a .pcap at all. Drop it into the file identifier to check it by its bytes instead of its name. Nothing is uploaded.
How to convert a .pcap file
You can convert a .pcap file to pcapng, CSV, JSON using a conversion tool or the export menu of an app that opens it.
What is the .pcap file signature (magic bytes)?
A .pcap file starts with the hex bytes D4 C3 B2 A1. Programs identify PCAP by those bytes, not by the filename, so a renamed file still gives itself away.
These are the documented signatures for PCAP. For a full breakdown, see the PCAP capture file signature page.
| Hex signature | Offset | ASCII | Note |
|---|---|---|---|
| D4 C3 B2 A1 | 0 | - | little-endian, microsecond |
| A1 B2 C3 D4 | 0 | - | big-endian, microsecond |
See the full magic-numbers reference for every format.
Frequently asked questions
What is a .pcap file?
PCAP files hold captured network traffic, packet by packet, as recorded by tools like tcpdump and Wireshark. They are the standard way to save and share a network trace for troubleshooting or security analysis.
How do I open a PCAP file?
Open it in Wireshark for a full protocol view, or read it on the command line with tcpdump -r file.pcap or tshark.
What is the difference between PCAP and PCAPNG?
PCAPNG is the modern successor to PCAP, adding support for multiple interfaces, comments and richer metadata. Wireshark reads both.
Is it safe to share a PCAP file?
A capture records real traffic and may include credentials or personal data. Sanitise or anonymise it before sharing outside a trusted team.
Related formats
Sources
Details on this page were checked against authoritative references. How sources are ranked and what is deliberately left out is set out in the methodology.