{
  "schemaVersion": "1.0",
  "canonicalPage": "https://fileformat.co/ext/pcap",
  "inspectorUrl": "https://fileformat.co/inspect",
  "spec": {
    "slug": "pcap",
    "extension": ".pcap",
    "aliases": [
      ".dmp"
    ],
    "name": "libpcap Network Packet Capture",
    "shortName": "PCAP",
    "category": "devtools-security",
    "tier": 1,
    "summary": "Classic 24-byte header packet capture format produced by `tcpdump` and Wireshark, encoding host endianness and timestamp precision directly in its 4-byte magic number.",
    "technicalNotes": "If bytes `0..3` read `D4 C3 B2 A1`, fields are little-endian with microsecond timestamps; `A1 B2 C3 D4` indicates big-endian; `4D 3C B2 A1` indicates nanosecond resolution.",
    "mimeTypes": [
      "application/vnd.tcpdump.pcap",
      "application/x-pcap"
    ],
    "identifiers": {
      "pronomPuid": "fmt/779",
      "specUrl": "https://www.ietf.org/archive/id/draft-gharris-opsawg-pcap-01.html"
    },
    "binarySignature": {
      "endianness": "mixed",
      "magicBytes": [
        {
          "offset": 0,
          "hex": "D4 C3 B2 A1",
          "description": "Little-endian microsecond libpcap magic (0xA1B2C3D4)"
        },
        {
          "offset": 0,
          "hex": "A1 B2 C3 D4",
          "description": "Big-endian microsecond libpcap variant (legacy tcpdump on BE hosts)"
        },
        {
          "offset": 0,
          "hex": "4D 3C B2 A1",
          "description": "Little-endian nanosecond-resolution variant (0xA1B23C4D)"
        },
        {
          "offset": 0,
          "hex": "A1 B2 3C 4D",
          "description": "Big-endian nanosecond-resolution variant"
        }
      ],
      "containerFamily": null,
      "headerLayout": [
        {
          "offset": "0x00 - 0x03",
          "byteOffset": 0,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint32",
          "fieldName": "magic_number",
          "description": "0xA1B2C3D4 (µs) or 0xA1B23C4D (ns) determines endianness"
        },
        {
          "offset": "0x04 - 0x07",
          "byteOffset": 4,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint16[2]",
          "fieldName": "version",
          "description": "Major.Minor version (2.4)"
        },
        {
          "offset": "0x10 - 0x13",
          "byteOffset": 16,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint32",
          "fieldName": "snaplen",
          "description": "Max captured bytes per packet (e.g. 65535)"
        },
        {
          "offset": "0x14 - 0x17",
          "byteOffset": 20,
          "byteLength": 4,
          "lengthLabel": "4 B",
          "dataType": "uint32",
          "fieldName": "network",
          "description": "Link-layer header type (1 = Ethernet)"
        }
      ]
    },
    "securityProfile": {
      "riskLevel": "medium",
      "allowsArbitraryCodeOrMacros": false,
      "xxeRisk": false,
      "polyglotPrependRisk": false,
      "pickleDeserializationRisk": false,
      "uploadValidationNotes": "PCAP captures may contain cleartext HTTP/DNS/DB credentials or internal IP topologies; enforce `incl_len <= snaplen` when parsing untrusted packet records."
    },
    "codeSnippets": {
      "python": "import struct, sys\nwith open(sys.argv[1], \"rb\") as f:\n    hdr = f.read(24)\n    magic = struct.unpack(\"<I\", hdr[:4])[0]\n    endian = \"<\" if magic in (0xA1B2C3D4, 0xA1B23C4D) else \">\"\n    _, maj, min_v, _, _, snaplen, net = struct.unpack(endian + \"IHHiIII\", hdr)\n    print(f\"PCAP v{maj}.{min_v} snaplen={snaplen} linktype={net}\")",
      "typescript": "export async function readPcapHeader(file: File) {\n  const dv = new DataView(await file.slice(0, 24).arrayBuffer());\n  const le = dv.getUint32(0, true) === 0xa1b2c3d4;\n  return { snaplen: dv.getUint32(16, le), linkType: dv.getUint32(20, le) };\n}",
      "rust": "use std::{fs::File, io::Read};\nfn main() -> std::io::Result<()> {\n    let mut h = [0u8; 24];\n    File::open(std::env::args().nth(1).expect(\"usage: <prog> <file>\"))?.read_exact(&mut h)?;\n    println!(\"PCAP magic: {:02X?}\", &h[0..4]);\n    Ok(())\n}",
      "go": "package main\nimport (\"encoding/binary\"; \"fmt\"; \"io\"; \"os\")\nfunc main() {\n    f, err := os.Open(os.Args[1])\n    if err != nil {\n        fmt.Fprintln(os.Stderr, \"open:\", err)\n        os.Exit(1)\n    }\n    defer f.Close()\n    h := make([]byte, 24)\n    if _, err := io.ReadFull(f, h); err != nil {\n        fmt.Fprintln(os.Stderr, \"read:\", err)\n        os.Exit(1)\n    }\n    fmt.Printf(\"PCAP snaplen=%d\\n\", binary.LittleEndian.Uint32(h[16:20]))\n}"
    },
    "relatedFormats": [
      "har",
      "wasm",
      "sqlite"
    ],
    "verifiedAt": "2026-11-14T16:09:03Z"
  },
  "samples": [
    {
      "id": "pcap-minimal",
      "filename": "minimal-ethernet.pcap",
      "variant": "minimal",
      "title": "Minimal libpcap Capture (1 Ethernet Frame)",
      "description": "24-byte little-endian microsecond PCAP v2.4 header (`D4 C3 B2 A1`) plus one 42-byte Ethernet frame.",
      "localPath": "/fixtures/v1/pcap/minimal-ethernet.pcap",
      "cdnUrl": "https://fileformat.co/fixtures/v1/pcap/minimal-ethernet.pcap",
      "sizeBytes": 82,
      "sha256": "8e6bf3f1ae8790e789ba3972cec94620b890fed7d3f6b9212467fcd5cedf3e48",
      "expectValid": true
    },
    {
      "id": "pcap-realistic",
      "filename": "three-frames-capture.pcap",
      "variant": "realistic",
      "title": "Multi-Packet Ethernet PCAP Trace",
      "description": "Three sequential packet records with incrementing microsecond timestamps.",
      "localPath": "/fixtures/v1/pcap/three-frames-capture.pcap",
      "cdnUrl": "https://fileformat.co/fixtures/v1/pcap/three-frames-capture.pcap",
      "sizeBytes": 198,
      "sha256": "289189333aa50832b63f984ebcbd5f8d9a71316a5e9864e07781e193478711c8",
      "expectValid": true
    },
    {
      "id": "pcap-edge-case",
      "filename": "snaplen-truncated-packet.pcap",
      "variant": "edge-case",
      "title": "Truncated Packet Payload at EOF",
      "description": "Packet record `incl_len` exceeds remaining bytes at EOF—tests packet parser bounds checks.",
      "localPath": "/fixtures/v1/pcap/snaplen-truncated-packet.pcap",
      "cdnUrl": "https://fileformat.co/fixtures/v1/pcap/snaplen-truncated-packet.pcap",
      "sizeBytes": 72,
      "sha256": "a5ce5c7570b15f92fc0a3896b4254af5f94891bd5a7528c7847319864b0175d0",
      "expectValid": false,
      "edgeCaseTag": "Truncated Packet Frame"
    }
  ]
}