PCAPNG Packet Capture
| Format | PCAPNG Packet Capture |
|---|---|
| Short name | PCAPNG |
| Category | network |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The block-based successor of PCAP and Wireshark's default: section header, interface descriptions with names and per-interface time resolution, enhanced packet blocks, name resolution blocks, and comments. Can hold captures from several interfaces and link types in one file and records capture hardware, OS and application. Decryption Secrets Blocks can embed key material such as TLS session keys, allowing encrypted traffic in the same file to be decrypted.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 0A 0D 0D 0A | .... | Section header block type 0x0A0D0D0A |
| offset 8 (0x8) | 4D 3C 2B 1A | M<+. | Byte-order magic 0x1A2B3C4D (little-endian) |
| offset 8 (0x8) | 1A 2B 3C 4D | .+<M | Byte-order magic 0x1A2B3C4D (big-endian) |
Known extensions
.pcapng, .ntar
References
- PCAP Now Generic (pcapng) Capture File Format (IETF draft-ietf-opsawg-pcapng) https://datatracker.ietf.org/doc/draft-ietf-opsawg-pcapng/
- PcapNg (Wireshark wiki) https://wiki.wireshark.org/Development/PcapNg
Cite this entry
Crush Format Reference, “PCAPNG Packet Capture”. https://kalink0.github.io/crush-forensics/formats/pcapng/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction