PCAPng
Definition
PCAP Next Generation file format. Block-structured (SHB, IDB, EPB, ISB, DSB), supports multiple interfaces in one file, per-packet comments, name resolution, and a Decryption Secrets Block that carries TLS keys or WireGuard keys for offline decryption.
- Full name
- PCAP Next Generation
- Structure
- Block-structured: SHB, IDB, EPB, ISB, DSB
- Key feature
- Decryption Secrets Block carries TLS or WireGuard keys for offline decryption
- Advantage over PCAP
- Multiple interfaces, comments, name resolution in one file
Common questions
What does the Decryption Secrets Block let an analyst do that a plain PCAP file cannot?+
It stores key material such as TLS session keys or WireGuard keys alongside the capture, so a tool like Wireshark can decrypt the encrypted payload offline during analysis without needing separate key files or live access to the endpoint.
Are the block types in a PCAPng file mandatory in every capture?+
No, only a Section Header Block and at least one Interface Description Block are required to make the file valid. Enhanced Packet Blocks, Interface Statistics Blocks and the Decryption Secrets Block are added only when the capturing tool has that data to include.
Related terms
- BPF (Berkeley Packet Filter)
- A kernel-level packet filtering mechanism used by tcpdump, Wireshark, and most capture tools to select which packets are written to disk. BPF...
- JA3 / JA3S
- An MD5 fingerprint of the ordered fields of a TLS Client Hello (JA3) or Server Hello (JA3S). Allows identification of client software...
- Monitor Mode
- An 802.11 radio mode that captures every wireless frame in range, including management and control frames, without associating to an access point....
- Network Tap
- A hardware device inserted inline in a network cable path that passively copies the electrical or optical signal to one or more...
- Promiscuous Mode
- A network interface operating mode in which the card passes all received frames to the capture software, not just frames addressed to...