Compare
PCAP vs PCAPNG
PCAP is a widely supported classic packet-capture format; PCAPNG is extensible and can retain multiple interfaces and more capture metadata.
Which format should you choose?
Consider PCAP for compatibility with older analyzers; choose PCAPNG to retain multiple interfaces, comments, or per-interface timestamp precision. After conversion, check which metadata and timestamp resolution remain.
Good fit for PCAP
Recording and analyzing network packets · Exchanging captures with widely supported tools
- Opening captures in libpcap-compatible tools such as tcpdump
- Prioritizing compatibility with existing analyzers
Good fit for PCAPNG
Recording and analyzing network packets · Saving captures with interface and capture details
- Inspecting packets in Wireshark
- Recording timestamps and information from multiple interfaces
Basic information
| Field | PCAP | PCAPNG |
|---|---|---|
| Extension | .pcap, .cap | .pcapng |
| MIME type | application/octet-stream | application/octet-stream |
| Common uses | Recording and analyzing network packets · Exchanging captures with widely supported tools | Recording and analyzing network packets · Saving captures with interface and capture details |
| How to open | Open it with Wireshark, tcpdump, or another compatible analyzer. Some captures use the .cap extension, so do not rely on the extension alone; inspect the file with capture software. | Wireshark is the common choice. If another tool cannot read the file, check which capture formats it supports before converting. |
| Export or convert | Consider PCAPNG when you need to retain multiple interfaces or comments. Converting PCAPNG to PCAP can broaden tool compatibility but may discard interface details, comments, or timestamp precision; inspect the result. | Converting to pcap may improve compatibility, but can discard details such as interface information, comments, or timestamp precision. Review the converted capture as well. |
Choose by use case
Opening captures in libpcap-compatible tools such as tcpdump
Recording and analyzing network packets · Exchanging captures with widely supported tools
PCAPPrioritizing compatibility with existing analyzers
Recording and analyzing network packets · Exchanging captures with widely supported tools
PCAPInspecting packets in Wireshark
Recording and analyzing network packets · Saving captures with interface and capture details
PCAPNGRecording timestamps and information from multiple interfaces
Recording and analyzing network packets · Saving captures with interface and capture details
PCAPNGKey point 1
PCAP stores packets with a link-layer type and timestamps in a simple, widely supported format; PCAPNG uses blocks for extensible interface and capture details.
More on the differencesKey point 2
PCAPNG can represent multiple interfaces and different timestamp resolutions per interface. Classic PCAP generally uses one capture configuration and a fixed microsecond or nanosecond resolution.
More on the differencesMore on the differences
Use PCAP when legacy-tool compatibility is essential and PCAPNG when richer capture context matters. Validate the converted packet data, interface mapping, comments, and timestamp precision.
- PCAP is the classic libpcap capture format and is supported by many tools. PCAPNG is its extensible successor, with blocks for interfaces and additional metadata.
- A PCAPNG file can describe multiple capture interfaces and per-interface timestamp resolution; common PCAP files have more limited capture context.
- Conversion can change or discard metadata and reduce timestamp precision. Keep the source capture and treat both formats as potentially sensitive.
Frequently asked questions
Does PCAPNG always work in more tools than PCAP?
No. PCAP is often supported by older tools, while PCAPNG support varies. Check the target analyzer before choosing or converting.