The pcap-ng Packet Capture Format


While pcap is supported in Wireshark/TShark as well, their default format is now the pcap Next Generation Capture File Format (pcap-ng). Rather than being limited to dump network packets only, pcap-ng allows for saving a range of data types using a generic block format. This format is backward-compatible with the fields of the libpcap format. The structure of pcapng files is specified by IETF (see Fig. 1) and is still under development.

The structure of pcap-ng files
Fig. 1. The general structure
of pcap-ng files

The details of the block structure depends on the block type; the list of block types includes section header blocks, interface description blocks, simple and enhanced packet blocks, name resolution blocks, interface statistics blocks, systemd journal export blocks, decryption secrets blocks, and custom blocks. Further types are under development.