Glossary
pcapng
pcapng (PCAP Next Generation) is a block-based capture format that stores several interfaces, per-interface timestamp resolution and metadata.
pcapng (PCAP Next Generation, or "PCAP Now Generic" in the IETF draft) is the block-based successor of pcap and the default output of Wireshark, dumpcap and tshark. A file is a sequence of typed blocks: a Section Header Block, one Interface Description Block per capture interface, Enhanced or Simple Packet Blocks for the packets, and optional blocks for name resolution, interface statistics, decryption secrets and custom data.
Each interface has its own link-layer type, snaplen and timestamp resolution, so one file can mix, for example, Ethernet and loopback traffic. Options add comments, interface names and the capturing OS. The format is specified in the IETF pcapng draft; the differences are explained in pcap vs pcapng.