{
 "id": "pcap-next-generation-packet-capture",
 "name": "pcap Next Generation Packet Capture",
 "category": "other",
 "identifiers": {
  "extensions": [
   "pcapng"
  ],
  "mime": [
   "application/vnd.tcpdump.pcap"
  ],
  "puid": [
   "fmt/780"
  ],
  "wikidata": [
   "Q28009440"
  ],
  "magic": [
   {
    "offset": 0,
    "hex": "0a0d0d0a",
    "notes": "pcap-ng Big Endian"
   }
  ],
  "signatures": [
   {
    "name": "pcap-ng Big Endian",
    "sequences": [
     {
      "position": "bof",
      "offset": 0,
      "pattern": "0a0d0d0a{4}1a2b3c4d"
     }
    ]
   },
   {
    "name": "pcap-ng Little Endian",
    "sequences": [
     {
      "position": "bof",
      "offset": 0,
      "pattern": "0a0d0d0a{4}4d3c2b1a"
     }
    ]
   }
  ]
 },
 "status": "unknown",
 "summary": "The pcap Next Generation Capture file format is intended to overcome limitations in the pcap Packet Capture format.",
 "projects": [
  {
   "name": "PRONOM fmt/780",
   "url": "https://www.nationalarchives.gov.uk/PRONOM/fmt/780",
   "kind": "format-doc"
  },
  {
   "name": "Wikidata Q28009440",
   "url": "https://www.wikidata.org/wiki/Q28009440",
   "kind": "wiki"
  }
 ],
 "provenance": {
  "sources": [
   "pronom",
   "wikidata"
  ]
 },
 "updated": "2026-10-20",
 "aliases": [],
 "structure": [],
 "parsers": [],
 "tools": [
  {
   "name": "PhotoRec",
   "url": "http://www.cgsecurity.org/wiki/PhotoRec",
   "reads": true,
   "writes": false,
   "license": "GNU General Public License",
   "open_source": true,
   "via": "pcap"
  },
  {
   "name": "Q127161383",
   "url": "https://tsduck.io/",
   "reads": true,
   "writes": false,
   "license": "2-clause BSD License",
   "open_source": true,
   "via": "pcap"
  },
  {
   "name": "tcpdump",
   "url": "https://www.tcpdump.org/",
   "reads": true,
   "writes": false,
   "license": "3-clause BSD License",
   "open_source": true,
   "via": "pcap"
  },
  {
   "name": "Windump",
   "url": "https://www.wikidata.org/wiki/Q6167969",
   "reads": true,
   "writes": false,
   "via": "pcap"
  }
 ],
 "conversions": [],
 "samples": [],
 "claims": [],
 "verification": [],
 "family": "pcap"
}