PCAP vs PCAPNG: File Format Differences Explained
PCAP vs PCAPNG compared block by block: headers, interfaces, timestamp resolution, metadata, which tools write which format and how to convert safely.
TL;DR. Classic pcap is a 24-byte file header followed by packet records, with one link-layer type, one snaplen and one timestamp resolution for the whole file. pcapng is a sequence of typed blocks: it can describe several capture interfaces with different link types and timestamp resolutions, and it stores metadata such as interface names, comments, name resolution, statistics and even decryption secrets. Wireshark and dumpcap write pcapng by default; tcpdump writes pcap. Converting pcapng to pcap works only when every packet shares one link type, and it drops metadata. Keep the original file as evidence and convert copies.
Both formats are now being specified by the IETF Operations and Management Area Working Group, in the PCAP Capture File Format draft and the PCAP Now Generic (pcapng) draft. The details below follow those documents.
Classic pcap: one header, then records
A classic pcap file has a fixed layout.
| Part | Size | Fields |
|---|---|---|
| File header | 24 bytes | magic number, major and minor version, two reserved fields, SnapLen, LinkType |
| Packet record header | 16 bytes per packet | timestamp seconds, timestamp fraction, captured length, original length |
| Packet data | captured length | the bytes from the link layer up |
The magic number does two jobs. It tells the reader the byte order of the writer (A1 B2 C3 D4 read big-endian, D4 C3 B2 A1 little-endian), and it selects the timestamp resolution: 0xA1B2C3D4 means the fraction is in microseconds, 0xA1B23C4D means nanoseconds.
Everything else is global. There is one LinkType for the file (Ethernet, Linux cooked capture, raw IP, BSD loopback...), so a capture taken on two different kinds of interface cannot live in one pcap file. There is one SnapLen: the maximum number of bytes kept per packet. When a record's captured length is smaller than its original length, the packet was cut, and anything past the cut is gone for good. That matters later for TCP reassembly and file extraction.
The format's strength is its simplicity. Almost every network tool written in the last twenty-five years can read it, and a parser fits in a few dozen lines.
pcapng: a stream of typed blocks
pcapng replaces the fixed header with blocks. Every block starts with a block type and a total length, and repeats the total length at the end, so a reader can skip blocks it does not understand and even walk the file backwards. Most blocks can carry options (typed key/value fields), which is how metadata is added without breaking older readers.
The draft defines these blocks:
| Block | Role |
|---|---|
| Section Header Block (SHB) | Starts a section. Holds the byte-order magic 0x1A2B3C4D and options such as the hardware, OS and capturing application. |
| Interface Description Block (IDB) | One per interface: link type, snaplen, and options like if_name, if_description, if_tsresol, if_tsoffset, the capture filter. |
| Enhanced Packet Block (EPB) | A packet: interface ID, 64-bit timestamp, captured and original length, data, optional comments and flags. |
| Simple Packet Block (SPB) | A minimal packet record with no timestamp, tied to the first interface. |
| Name Resolution Block (NRB) | Address-to-name mappings observed at capture time. |
| Interface Statistics Block (ISB) | Counters such as packets received and dropped by the interface. |
| Decryption Secrets Block (DSB) | Session secrets, for example a TLS key log, stored inside the capture. |
| Custom Block | Vendor-specific data. |
Older files may also contain the obsolete Packet Block, which EPB replaced.
Several interfaces in one file
Because the link type lives in the IDB, a single pcapng file can hold packets from an Ethernet adapter and from a loopback adapter at the same time, and every EPB points at its interface by index. A file can also contain several sections, each starting with its own SHB. Concatenating two pcapng files therefore produces a valid pcapng file.
Timestamp resolution per interface
An EPB timestamp is a 64-bit count of units since 1970. The unit is set per interface by if_tsresol, and when the option is absent the draft specifies microseconds, the same as classic pcap. A capture can therefore mix a microsecond interface and a nanosecond interface, and if_tsoffset can shift an interface's clock by a fixed number of seconds. A reader that ignores these options will print wrong times, which is one of the classic bugs in home-made parsers.
The fictional sample capture that ships with PCAP Parser shows this: it has an Ethernet interface at microsecond resolution and a BSD loopback interface at nanosecond resolution, in the same file.
Side-by-side comparison
| pcap | pcapng | |
|---|---|---|
| Structure | fixed header + records | typed blocks with options |
| Link types per file | one | one per interface, several interfaces |
| Timestamp resolution | µs or ns, whole file | per interface (if_tsresol), µs by default |
| Interface names, OS, application | no | yes (IDB and SHB options) |
| Per-packet comments and flags | no | yes (EPB options) |
| Name resolution, statistics | no | NRB, ISB |
| Embedded decryption secrets | no | DSB |
| Default writer | tcpdump, libpcap-based tools | Wireshark, dumpcap, tshark |
| Tool support | near universal | wide, but not every legacy tool |
Which tools write which format
- Wireshark, dumpcap and tshark write pcapng by default. tshark can write classic pcap with
-F pcap, as documented in the tshark manual. - tcpdump writes classic pcap. Add
-s 0(or a large value) so packets are not truncated by a small snaplen on older builds. - Windows pktmon and netsh trace record to ETL, which is neither format. Convert the ETL to pcapng first; the tool guide for opening a capture online covers that case.
File extensions are only a hint. Many .pcap files are really pcapng, and the reverse happens too. A good reader identifies the format from the first bytes, not the name. PCAP Parser does exactly that, and it names formats it cannot read (compressed captures, Solaris snoop, Microsoft Network Monitor, the modified pcap variant) instead of failing silently.
How to convert between pcap and pcapng
The Wireshark suite ships the right tools. editcap rewrites a file in another format with -F:
# pcapng -> classic pcap (microseconds)
editcap -F pcap capture.pcapng capture.pcap
# pcapng -> classic pcap keeping nanosecond timestamps
editcap -F nsecpcap capture.pcapng capture.pcap
# classic pcap -> pcapng
editcap -F pcapng capture.pcap capture.pcapng
# check the result: file type, encapsulation, interfaces, precision
capinfos capture.pcap
When pcapng to pcap fails
If the pcapng contains interfaces with different link types, the classic format cannot represent it. Split by interface first, then convert each part:
tshark -r capture.pcapng -Y "frame.interface_id == 0" -F pcap -w eth0.pcap
Expect to lose, in any pcapng to pcap conversion: interface names and descriptions, comments, per-packet flags, name resolution and statistics blocks, and any Decryption Secrets Block. That last one is worth knowing: editcap can add a TLS key log to a pcapng with --inject-secrets, and the conversion to pcap throws it away.
Conversion and evidence handling
Conversion rewrites every record header, so the output file has a different hash from the original. For casework, hash and keep the original, convert a working copy, and note the command in your case notes. Never "upgrade" the only copy.
What a parser has to support
If you are choosing or writing a tool, the checklist is short but strict:
- Both pcap magics in both byte orders, microsecond and nanosecond.
- pcapng SHB, IDB, EPB and SPB, plus the obsolete Packet Block.
- Several interfaces and several sections, each with its own byte order.
if_tsresolandif_tsoffsetper interface.- Clear reporting of packets cut by the snaplen and of link types it does not decode.
PCAP Parser meets that list: it reads classic pcap in both byte orders at µs and ns, and pcapng with SHB, IDB, EPB, SPB and the obsolete Packet Block, several interfaces and sections, per-interface resolution and offset. It detects Decryption Secrets Blocks and tells you they are present, but it does not decrypt TLS. For a walkthrough of what it shows once the file is open, see how to use PCAP Parser.
FAQ
Is pcapng better than pcap?
pcapng carries more: several interfaces with different link types, per-interface timestamp resolution, comments, name resolution and statistics. Classic pcap is simpler and supported by more old tools. For evidence, keep the original file in whatever format it was captured in.
Can every pcapng file be converted to pcap?
No. Classic pcap has one link type and one snaplen per file. A pcapng with interfaces of different link types has to be split per interface first, and comments, interface names and embedded secrets are lost in the conversion.
How do I tell which format a file is, whatever its extension?
Look at the first four bytes. Classic pcap starts with a magic number such as A1 B2 C3 D4 or D4 C3 B2 A1; pcapng starts with the Section Header Block type 0A 0D 0D 0A. capinfos from the Wireshark suite also prints the file type.