This wiki has been migrated to and is now deprecated. Please use that site instead.

libpcap file format (.pcap)

The libpcap file format is used by a wide range of open (and closed) source programs.


The current libpcap file format version 2.4 is available for quite a long time now.

Programs supporting this file type

Timestamp resolution

The common timestamp resolution is 1 us. A special libpcap format is available (supported by Ethereal only), providing 1 ns timestamp resolution.


The libpcap support is fully functional. Ethereal supports reading and writing of this format.

Detailled information about the file type support can be found in the source code files wiretap/libpcap.c and .h.

Example capture file

XXX - Add a simple example capture file to the SampleCaptures page and link from here (see below). Keep this file short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.