Pcap Format

Table of Contents

Pcap

Pcap as a format was born at the same time as tcpdump/libpcap which used it. Technically, this would place place it at 1988 when tcpdump was created. However, I think it’s fairer to place it at 1999 when tcpdump.org was launched and became more well-known.

Pcap is the most common capture type because libpcap has had support and been around for more than 20 years. As an older format, it allocates fewer fields for packet and capture metadata.

Pcap Links

Pcap Docs

• 2015-08, Guy Harris, Wireshark’s Libpcap File Format
• Tcpdump, Link-Layer Header Types

Libpcap Programming

• 2002, Tim Carstens, Programming with pcap
• 2001, Martin Casado, Packet Analysis