pcap
file format used by libpcap for storing network packet data
TLDR
Read pcap with tcpdump
$ tcpdump -r [capture.pcap]
Read with tsharkcopy
$ tshark -r [capture.pcap]
Write pcapcopy
$ tcpdump -i [eth0] -w [capture.pcap]
Filter and readcopy
$ tcpdump -r [capture.pcap] 'port 80'
Convert with editcapcopy
$ editcap [input.pcap] [output.pcapng]
copy
SYNOPSIS
pcap - packet capture file format
DESCRIPTION
pcap (Packet Capture) is the file format used by libpcap for storing network packet data. It's the standard format for network captures, used by tcpdump, Wireshark, and many security tools.
FILE STRUCTURE
$ Global Header (24 bytes)
├── Magic Number (0xa1b2c3d4)
├── Version
├── Timestamp offset
├── Snap length
└── Link type
Packet Records
├── Timestamp
├── Captured length
├── Original length
└── Packet data
├── Magic Number (0xa1b2c3d4)
├── Version
├── Timestamp offset
├── Snap length
└── Link type
Packet Records
├── Timestamp
├── Captured length
├── Original length
└── Packet data
copy
TOOLS
$ tcpdump - CLI capture/read
wireshark - GUI analysis
tshark - CLI analysis
editcap - Edit captures
mergecap - Merge captures
wireshark - GUI analysis
tshark - CLI analysis
editcap - Edit captures
mergecap - Merge captures
copy
CAVEATS
pcap is binary format. pcapng offers more features. Large captures need significant storage.
HISTORY
The pcap format and libpcap were developed at Lawrence Berkeley Laboratory by Van Jacobson, Craig Leres, and Steven McCanne.