PCAP Packet Capture
| Format | PCAP Packet Capture |
|---|---|
| Short name | PCAP |
| Category | network |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The classic libpcap capture format written by tcpdump, Wireshark and many network devices: a global header with link type and snapshot length, then one record per packet with a timestamp (microsecond or nanosecond resolution, UTC), the captured length, the original packet length and the captured bytes. Packets longer than the snapshot length are truncated; the differing lengths make such truncation visible.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | D4 C3 B2 A1 | .... | Magic 0xA1B2C3D4 little-endian (microseconds) |
| offset 0 (0x0) | A1 B2 C3 D4 | .... | Magic 0xA1B2C3D4 big-endian (microseconds) |
| offset 0 (0x0) | 4D 3C B2 A1 | M<.. | Magic 0xA1B23C4D little-endian (nanoseconds) |
| offset 0 (0x0) | A1 B2 3C 4D | ..<M | Magic 0xA1B23C4D big-endian (nanoseconds) |
Known extensions
.pcap, .cap
References
- pcap-savefile(5) — libpcap file format (tcpdump) https://www.tcpdump.org/manpages/pcap-savefile.5.html
- PCAP Capture File Format (IETF draft-ietf-opsawg-pcap) https://datatracker.ietf.org/doc/draft-ietf-opsawg-pcap/
- ForensicsWiki — PCAP https://forensics.wiki/pcap/
Cite this entry
Crush Format Reference, “PCAP Packet Capture”. https://kalink0.github.io/crush-forensics/formats/pcap/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction