What is the PCAPNG file format?
A .pcapng file contains data packets captured over a network, saved in the PCAP Next Generation (PCAPNG) format. The data packets stored in a .pcapng file are used by network protocol analyzer applications, such as Wireshark, to monitor and administer network traffic. PCAPNG supersedes the older .pcap format and became Wireshark's default save format in version 1.8 (2012).
The format organizes data into several typed blocks in a structured format. Key block types include:
- Section Header Block (SHB) - opens a capture section; includes Byte-Order Magic (
1A 2B 3C 4D) for automatic endianness detection - Interface Description Block (IDB) - records link-layer type and interface metadata for each capture source
- Enhanced Packet Block (EPB) - stores individual frames with precise timestamps and optional per-packet flags
- Name Resolution Block (NRB) - maps IP addresses to hostnames
- Interface Statistics Block (ISB) - holds per-interface capture statistics
Information saved across these blocks can be used to reconstruct the captured data. The file is identified by magic bytes 0A 0D 0D 0A at offset 0; the registered MIME type is application/x-pcapng.
Security & safety
RISK: MEDIUMA pcapng file is passive data and cannot execute on its own, but it is sensitive: a capture can contain clear-text passwords, session cookies/tokens, internal IPs and hostnames, and full payloads of unencrypted traffic. Treat captures as confidential - do NOT upload sensitive ones to public online analyzers, and sanitize before sharing. Capturing traffic on networks you do not own or administer may be illegal. There is a secondary technical risk: historically, parser bugs in analysis tools (including Wireshark dissectors) have been exploited by maliciously crafted capture files, so keep Wireshark updated and be cautious opening untrusted captures.
Format details
in a nutshellFULL NAMEPCAP Next Generation Capture File
DEVELOPERWireshark / IETF OPSAWG (community standard)since circa 2010 (Wireshark 1.8 made it the default save format in 2012)
CATEGORYData Files
MIME TYPEapplication/x-pcapng
TYPEBinary network packet capture (block-structured)
STANDARDOpen · royalty-free
MAGIC BYTES · FILE SIGNATURE
OFFSET
00010203
HEX
0A0D0D0A
ASCII
····
A pcapng file begins with a Section Header Block: the first 4 bytes are the block type 0A 0D 0D 0A, the block total length follows, and a Byte-Order Magic value 1A 2B 3C 4D appears at offset 8 (byte-swapped if the file is big-endian). This distinguishes pcapng from the OLDER classic pcap format, whose magic is D4 C3 B2 A1 (little-endian) / A1 B2 C3 D4 (big-endian) at offset 0. Wireshark auto-detects both.
Programs that open PCAPNG files
Windows3 apps
Wireshark
Open-source File > Open the .pcapng; Wireshark decodes every protocol layer and lets you filter, follow streams and inspect packets. 
CapLoader
Paid Fast loader for very large captures; opens .pcapng to triage flows, then hand individual flows to Wireshark. 
NetworkMiner
Freemium Open the .pcapng to extract files, images, credentials and host info for forensic/security analysis (free edition available). 
macOS1 app
Linux2 apps
tcpdump
Open-source tcpdump -r file.pcapng prints the packets in the terminal (modern libpcap reads pcapng).
Web1 app
A-Packets
Free Upload a .pcapng to analyze flows in the browser - use only with non-sensitive captures (it leaves your machine). Technical details
deep spec| Magic bytes | 0A 0D 0D 0A at byte offset 0 (Section Header Block type identifier); Byte-Order Magic 1A 2B 3C 4D at offset 8 inside the SHB determines file endianness |
| MIME type | application/x-pcapng |
| Endianness support | Both little-endian and big-endian files are valid; readers detect byte order from the Byte-Order Magic field in the Section Header Block |
| Block architecture | All data is stored in typed, length-prefixed blocks; each block begins with a 32-bit type field and a 32-bit total-length field, making the format self-describing and forward-extensible |
| Multi-interface capture | A single file can hold packets from multiple network interfaces simultaneously, each described by its own Interface Description Block (IDB) |
| Timestamp resolution | Configurable per interface via IDB options; default is microsecond (10⁻⁶ s) precision; nanosecond (10⁻⁹ s) precision is also supported |
| Core block types | Section Header (SHB), Interface Description (IDB), Enhanced Packet (EPB), Simple Packet (SPB), Name Resolution (NRB), Interface Statistics (ISB), Decryption Secrets (DSB) |
| Block options / TLV metadata | Every block type supports optional TLV-encoded fields for comments, interface names, OS descriptions, and custom vendor extensions |
| Link-layer type encoding | Stored in each IDB using libpcap LINKTYPE codes (e.g., LINKTYPE_ETHERNET = 1, LINKTYPE_RAW = 101); different interfaces in the same file may carry different link types |
| Decryption Secrets Block (DSB) | Introduced circa 2019; embeds TLS or WireGuard session keys (SSLKEYLOGFILE-compatible) directly in the capture, enabling in-file decryption in Wireshark |
| Section concatenation | Multiple Section Header Blocks can appear sequentially in one file, allowing separate capture sessions to be appended without re-encoding |
| Snapshot length (snaplen) | Maximum bytes captured per packet is defined per interface in the IDB; commonly 65535 bytes or 262144 bytes in modern capture tools |
| Native compression | Not built into the format; files are commonly gzip-compressed externally and referenced with a .pcapng.gz extension to reduce storage size |
| Released | circa 2010 (Wireshark 1.8 made it the default save format in 2012) |
| Open standard | Yes · royalty-free |
| Specification | www.ietf.org |
PCAPNG conversions
Possible
.PCAPNG .PCAPGUIDE
Yes, PCAPNG converts to PCAP -- the fastest way is one command: editcap -F pcap in.pcapng out.pcap.
How to convert
.PCAPNG .CSVGUIDE
Yes -- Wireshark exports packet data to CSV in a few clicks, and tshark does the same from the command line…
How to convert
.PCAPNG .JSONGUIDE
Yes - run tshark -r file.pcapng -T json and you get JSON output immediately from the command line.
How to convert
.PCAPNG .TXTGUIDE
Yes, you can export a PCAPNG file to plain text - the fastest way is one tshark command in a terminal, or…
How to convert
Community Q&A
asked by usersNo questions yet - be the first to ask about PCAPNG files.
Frequently asked questions
How do I open a PCAPNG file?
Use Wireshark (free for Windows, macOS and Linux) - File > Open the .pcapng and it decodes every protocol layer. On Linux/macOS you can also read it with 'tshark -r file.pcapng' or 'tcpdump -r file.pcapng'.
What is the difference between PCAPNG and PCAP?
PCAP is the older classic libpcap format; PCAPNG (next generation) is the newer, default Wireshark format that adds multiple interfaces per file, nanosecond timestamps and per-packet comments/metadata. Wireshark opens both.
How do I convert PCAPNG to PCAP?
In Wireshark choose File > Save As and pick the 'pcap' format, or run 'editcap -F pcap in.pcapng out.pcap'. It's lossy - pcapng-only features (extra interfaces, nanosecond times, comments) are dropped.
Why does my tool ask for .pcap when I have a .pcapng?
Older or simpler tools were written for classic pcap. Many actually read pcapng fine despite the label; if one truly doesn't, convert with editcap or Wireshark's Save As. The capture data is the same packets either way.
Can a PCAPNG file contain passwords or private data?
Yes - it stores the raw traffic, so any clear-text credentials, cookies or unencrypted content are visible in the packets. Treat captures as confidential and avoid uploading sensitive ones to public online tools.
How do I read a PCAPNG without installing software?
Upload it to a browser-based analyzer like A-Packets - but only for non-sensitive captures, since the file leaves your machine. For anything confidential, install Wireshark locally instead.
References
1IETF OPSAWG - PCAP Next Generation (PCAPNG) Capture File Formatwww.ietf.org
2Wireshark Wiki - Development/PcapNgwiki.wireshark.org
