PCAPs

PCAP stands for packet capture and refers to both a file format and the corresponding API used to capture and store network traffic. PCAP files preserve a sequence of packets as they appeared on a network, typically including a timestamp, the length of the captured portion, the original packet length, and the raw packet data. A PCAP file begins with a global header describing the capture session, followed by per-packet records.

The data in a PCAP can include link-layer headers (such as Ethernet or Wi-Fi) and the packet payload. The format supports multiple link-layer types, which allows analysis by a range of tools and on different network interfaces. Each recorded packet is stored with metadata that enables precise sequencing and timing for analysis, replay, or auditing.

Common tools that create and read PCAPs include tcpdump and Wireshark, as well as their command-line counterparts such as tshark. Underlying capture libraries include libpcap on Unix-like systems and WinPcap or Npcap on Windows. PCAP is widely used for network troubleshooting, protocol development, performance monitoring, and security investigations.

PCAPNG is a newer variant designed to address limitations of the original PCAP format. It provides richer metadata, supports multiple interfaces in a single capture, and offers more flexible options for large or complex captures. Many modern tools can read both PCAP and PCAPNG files, though compatibility and features may vary.

Legal and privacy considerations are important when capturing traffic. PCAP data can contain sensitive information, so captures should be performed with authorization, with filters applied to limit data collection, and with appropriate protections for stored data.