Guides / PCAP vs PCAPNG

PCAP vs PCAPNG: practical differences

Both formats store captured packets. PCAP is the simpler compatibility choice; PCAPNG can preserve multiple interfaces, richer metadata and per-interface timing information.

By Stuart Mathieson6 minute readCapture formatsUpdated 25 September 2026

Capability	PCAP	PCAPNG
Multiple interfaces in one file	Generally no	Yes
Per-interface link type	One per file	Yes
Comments and capture metadata	Very limited	Extensible blocks and options
Timestamp resolution	Fixed by file variant	Declared per interface
Legacy tool compatibility	Usually widest	Check older tools
Byte order	Declared for the file	Declared per section

Why PCAPNG is usually the better capture format

PCAPNG is built from blocks. A section can describe the environment, interface-description blocks define each capture interface, and enhanced packet blocks hold packet data plus metadata. That structure lets one file preserve traffic from more than one interface and retain details such as interface names, capture filters, comments and timestamp resolution.

This matters when diagnosing timing. A parser must honour the interface's if_tsresol value and any timestamp offset. Treating every timestamp as microseconds can produce incorrect ordering or duration on captures recorded with another resolution.

Why PCAP still exists

Classic PCAP has a small global header followed by packet records. Its simplicity makes it easy to implement and broadly compatible with old appliances, scripts and forensic tools. If an older downstream system rejects PCAPNG, converting a copy to PCAP is reasonable—provided the capture has one compatible link type and you accept losing metadata.

Does PCAPNG make the packet data better?

Not by itself. The format can describe more context, but it cannot recover packets dropped by the capture interface, restore bytes truncated by the snapshot length, or decrypt encrypted traffic. Capture placement, hardware, time synchronisation and capture settings still determine evidence quality.

Convert safely

Wireshark's editcap can convert a working copy:

# PCAPNG to classic PCAP
editcap -F pcap input.pcapng output.pcap

# PCAP to PCAPNG
editcap -F pcapng input.pcap output.pcapng

After conversion, compare packet counts with capinfos. Keep the original if comments, interface attribution or fine timestamp resolution could matter later.

Which should you choose?

Choose PCAPNG for new Wireshark/tshark captures, multi-interface collection, richer provenance or high-resolution timestamps.
Choose PCAP when a required legacy tool or appliance only accepts classic PCAP.
Keep the original and convert a copy when exchanging evidence with another tool.

Manual method vs PCAPNG Analyzer

Manual method

Run capinfos to identify the format and interfaces.
Check timestamp precision and link type.
Convert a copy only when compatibility requires it.
Validate packet counts after conversion.

With PCAPNG Analyzer

Upload either .pcap or .pcapng.
The parser reads PCAPNG first and falls back to classic PCAP.
Per-interface PCAPNG timestamp resolution and offsets are honoured.
Use the same report and packet filters for either container format.

Analyse PCAP and PCAPNG in one interface

Upload either format and inspect protocol, conversation, application and packet-level results on your own server.

Compare tiers Self-host it