PCAP (Packet Capture File)
Definition
A binary file format that stores raw network traffic captured from a network interface. Tools such as Wireshark, tcpdump, and Zeek read PCAP files and decode the encapsulated protocol headers at each layer.
- Format
- Binary, records raw network traffic from an interface
- Reader tools
- Wireshark, tcpdump, Zeek
- Content
- Encapsulated protocol headers at each network layer
Common questions
Why do investigators need multiple tools to work with the same PCAP file?+
Different tools specialise in different tasks: tcpdump for quick command-line filtering, Wireshark for interactive protocol decoding and inspection, and Zeek for automated extraction of connection logs and file objects, so an investigation often moves the same file between them.
What determines how much of a network conversation a single PCAP file shows?+
The placement of the capture point and any filters applied at capture time. A file taken from a single host's interface only shows that host's traffic, while a span port on a core switch can capture traffic for an entire network segment.
Related terms
- DNS Query Log
- A record maintained by a DNS resolver listing each domain name query, the requesting IP address, the response, and the timestamp. DNS...
- Encapsulation
- The process by which each OSI layer wraps the payload from the layer above it inside its own header (and sometimes trailer)....
- Protocol Data Unit (PDU)
- The named unit of data at each OSI layer: a frame at Layer 2, a packet at Layer 3, a segment at...
- Server Name Indication (SNI)
- A TLS extension sent in plaintext in the Client Hello message that identifies the hostname the client intends to reach. SNI is...
- TCP Three-Way Handshake
- The connection establishment sequence in TCP: the client sends SYN, the server responds SYN-ACK, and the client completes with ACK. The timestamps...