What is pcap?

pcap (packet capture) is the standard file format for saving captured network packets, written by tcpdump and read by Wireshark and most other analysis tools.

The format comes from libpcap, the capture library behind tcpdump, and is deliberately simple. A file starts with a short global header: a magic number that identifies the format and its byte order, a version, the snapshot length (the most bytes kept from any one packet) and a link-layer type such as Ethernet, which tells readers how to decode each packet. After that, every packet gets a small record header with its timestamp, the number of bytes captured and the packet's original length, followed by the raw bytes exactly as they appeared on the wire. Its successor, pcapng ("next generation"), is built from typed blocks instead, so one file can hold packets from several interfaces with different link types, plus comments and capture metadata. Wireshark saves pcapng by default; most tools read both.

In practice you capture on the device where the problem is, often a router or server without a graphical interface, with tcpdump -w file.pcap, then copy the file to a laptop and explore it in Wireshark, or read it back with tcpdump -r file.pcap and a different filter. Capture filters, written in BPF syntax, keep files small by recording only what matters; on a busy link, a ring buffer of several files avoids filling the disk. Two common surprises: if the snapshot length is set too small the payload is cut off, and on hosts with segmentation offload a capture can show packets larger than the MTU, because the capture point sits before the network card splits them. Treat pcap files as sensitive, since they can contain passwords, cookies and private data. The Packets That Never Come Back lesson uses tcpdump captures to find where packets die.