Glossary
pcap
pcap is the classic packet capture file format: a 24-byte header followed by timestamped packet records, with one link type and snaplen per file.
pcap (packet capture) is the classic file format for recorded network traffic, written by tcpdump and other libpcap-based tools. A file starts with a 24-byte header holding a magic number, a version, the snaplen and the link-layer type, followed by one 16-byte record header and the captured bytes for each packet.
The magic number gives both the writer's byte order and the timestamp resolution: microseconds (0xA1B2C3D4) or nanoseconds (0xA1B23C4D). Because the link type and snaplen are global, a pcap file cannot mix interfaces of different types; its successor pcapng can. The format is being documented by the IETF in the PCAP Capture File Format draft. See pcap vs pcapng for a full comparison.