PCAP File Documentation

Overview

Feature Value
File Extension .pcap
MIME Type application/vnd.tcpdump.pcap
Primary Use Network Packet Capture
Developed By TCPDump team
Format Type Binary
Complexity Low to Medium
Data Integrity High
Compatibility High with Network Analysis Tools
Header (Global Header) Yes, 24 bytes
Packets Header Yes, 16 bytes per packet
Timestamp Precision Microseconds
File Signature (Magic Number) d4 c3 b2 a1 or a1 b2 c3 d4 (depending on byte ordering)
Maximum File Size Depends on the file system limits
Time Zone Offset Stored in Global Header
Network Data Link Type Defined in Global Header
Snap Length (snaplen) Maximum capture length
Version Number Stored in Global Header
Timestamps Accuracy High
Support for Packet Slicing Yes
Operating System Compatibility Windows, Linux, macOS, and more