Why convert CAP to PCAP?
Both .cap and .pcap share the same MIME type and almost always hold identical libpcap binary data - the only difference is the extension the capturing tool chose to write. Many scripts and tools in the network-analysis ecosystem filter by extension and require .pcap, making a rename or re-save necessary for compatibility.
How to convert CAP to PCAP
Wireshark OPEN-SOURCE
Open the .cap via File > Open, then go to File > Save As and select "Wireshark/tcpdump/... - pcap" in the format dropdown to write a proper .pcap.
editcap FREE
Run editcap -F pcap input.cap output.pcap on the command line; editcap ships with Wireshark and handles format re-encoding on Windows, macOS, and Linux.
About these formats
.CAP
Packet Capture file (network trace) - primary meaning
A CAP file is almost always a network packet capture - a recorded snapshot of network traffic from a sniffer such as Wireshark, tcpdump, or a router. Open it with free Wireshark on Windows,…
Open .CAP details →
.PCAP
Packet Capture (libpcap) File
A .pcap file is a recorded snapshot of network traffic captured by a tool such as Wireshark or tcpdump. Open it in Wireshark (free, Windows/macOS/Linux) - it decodes every protocol layer…
Open .PCAP details →Quality & what to watch
- If the
.capwas written by Wireshark, tcpdump, or airodump-ng it is already libpcap - renaming the extension to.pcapis sufficient and no re-encoding is needed. - Captures from Microsoft Network Monitor use a proprietary header; renaming those without re-saving through Wireshark will produce a broken file.
- The conversion does not strip any payload data; sensitive content such as credentials or session tokens remains in the output
.pcap.
Frequently asked questions
Can I just rename `.cap` to `.pcap` without any tool?
Will renaming change WPA handshake data in an airodump-ng capture?
.cap is valid libpcap. Renaming it to .pcap leaves all packet data, including WPA handshakes, exactly intact.
