What is the CAP file format?
A .cap file is a packet capture file generated by a network packet-sniffing program. These files are also called trace files and are used by numerous packet analyser tools to record live network traffic. .cap files store raw network packets collected by the sniffing program so the data can be evaluated later, or loaded into a different tool entirely.
The .cap extension is ambiguous: many tools write files with this name but different internal layouts. The most common is the classic .pcap layout from the libpcap library (magic bytes D4 C3 B2 A1 little-endian or A1 B2 C3 D4 big-endian), used by tcpdump since the early 1990s. Microsoft Network Monitor uses its own proprietary header (GMBU or RTSS depending on version), while NetScout Sniffer produces yet another binary layout. Wireshark auto-detects the variant on open.
.cap files can be accessed using the free Wireshark or, on Windows, Microsoft Network Monitor (now legacy). Other applications that support .cap files include tcpdump on the command line, NetScout's Sniffer Analysis, and Klos PacketView Pro, among others.
Security & safety
RISK: MEDIUMA .cap is passive data and cannot execute, but it is sensitive: a network capture can contain clear-text passwords, session cookies, internal IPs/hostnames and other private traffic - treat captures as confidential and do NOT upload sensitive ones to public online analysers. In Wi-Fi auditing a .cap may hold a WPA handshake intended for password cracking; capturing traffic on networks you don't own may be illegal. Also beware files that are .cap by extension but actually an executable or a different format - verify the magic bytes.
Format details
in a nutshellPrograms that open CAP files
Windows2 apps
Wireshark
Open-source File > Open the .cap; Wireshark auto-detects libpcap/NetMon/Sniffer formats and decodes every protocol layer. 
Microsoft Network Monitor / Message Analyzer (legacy)
Free Opens .cap captures it created. Note: NetMon 3.4 and Message Analyzer are retired by Microsoft - use Wireshark for new work. 
macOS1 app
Linux2 apps
Wireshark
Open-source Open in Wireshark, or inspect on the command line with tshark/tcpdump -r file.cap.
A-Packets
Free Upload a .cap/.pcap to analyse it in the browser (use only with non-sensitive captures). Technical details
deep spec| Format category | Binary network packet capture (trace file) |
| Primary internal layout | Classic libpcap / pcap - most common variant |
| Little-endian magic bytes | D4 C3 B2 A1 at byte offset 0 |
| Big-endian magic bytes | A1 B2 C3 D4 at byte offset 0 |
| Microsoft Network Monitor header | GMBU (v1) or RTSS (v2) - proprietary, incompatible with libpcap |
| MIME type | application/vnd.tcpdump.pcap |
| Extension ambiguity | Same .cap name used by libpcap, Microsoft Network Monitor, NAI/NetScout Sniffer, and unrelated applications - identify by magic bytes, not extension |
| Link-layer type field | 32-bit integer in libpcap global header identifying the data-link medium (e.g. Ethernet = 1, IEEE 802.11 Wi-Fi = 105) |
| Timestamp resolution | Microseconds in classic pcap; nanoseconds in the pcap-ns variant (magic 4D 3C B2 A1 / A1 B2 3C 4D) |
| Snapshot length (snaplen) | Per-file cap on bytes saved per packet; commonly set to 65535 or 262144 bytes |
| Per-packet record structure | Capture timestamp (seconds + microseconds), captured packet length, original wire length, raw packet bytes |
| Successor format | .pcapng - adds per-interface metadata, block comments, and multiple link-layer types in one file |
| Byte order detection | Determined at open from magic bytes; both little-endian and big-endian files are valid and in wide use |
| Primary originating tool | tcpdump / libpcap (Unix/Linux, early 1990s), with .cap later adopted by Windows sniffers including Microsoft Network Monitor |
| Released | libpcap/tcpdump format early 1990s; .cap used by many sniffers |
| Open standard | Yes · royalty-free |
| Specification | datatracker.ietf.org |
CAP conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about CAP files.
