In the pcap format, each packet contains a header with a time resolution that is only accurate to microseconds (10^-6 seconds). One of the major complaints of the older pcap format is its limitations with regards to resolution on packet time stamps. This also opens the door to new analysis approaches that take advantage of this capability. This opens the door to capture files with packets from multiple interfaces. Each packet can be associated with a specific interface. This issue is solved by pcapng which allows a capture file to define multiple interfaces using “Interface Description Blocks”. The interface information for each packet is lost. This makes it difficult to mingle packets from different interfaces in the same capture file. While the pcap format does contain some information about the capture interface, the interface information is part of the common header and not stored on a per packet basis. Supports captures from multiple interfaces Through the use of standardized blocks and fields, the pcapng format is logical, extensible, and future proof. The result is an IETF (Internet Engineering Task Force) Internet Draft that specifies the “next generation” (ng) pcap file format. The proponents of pcapng took a different route and sought standardization. These libraries have been used to create a number of tools throughout the years, both proprietary and open sourced, but all able to output packet captures to disk using the pcap file format.

In Microsoft Windows, it is implemented through the WinPcap library. In Unix/Linux, this is implemented through the libpcap library. The original “.pcap” file format is part of an API for performing captures on a network interface.

The goal of pcapng is to address some of the shortfalls of pcap and create a flexible format for the future.ĬloudShark’s pcapng support unifies pcapng’s per packet comment capability with CloudShark’s annotation capabilities. A new format called “pcapng” has been under development for a number of years. While pcap continues to be used today, it does have some limitations that make other formats more attractive. And while vendors have created new formats over the years, most tools support conversion into the pcap format. Almost all capture tools support the pcap format. The pcap capture file format has been the universal packet capture format since the early days of computer networking.

Pcapng wireshark