{
 "id": "pcap",
 "name": "PCAP",
 "category": "other",
 "identifiers": {
  "extensions": [
   "pcap",
   "cap",
   "dmp"
  ],
  "mime": [
   "application/vnd.tcpdump.pcap"
  ],
  "puid": [
   "fmt/779",
   "fmt/780"
  ],
  "wikidata": [
   "Q28009435"
  ],
  "magic": [
   {
    "offset": 0,
    "hex": "a1b2c3d4",
    "notes": "pcap Big Endian"
   },
   {
    "offset": 0,
    "hex": "d4c3b2a1",
    "notes": "pcap Little Endian"
   }
  ],
  "signatures": [
   {
    "name": "pcap Big Endian",
    "sequences": [
     {
      "position": "bof",
      "offset": 0,
      "pattern": "a1b2c3d4"
     }
    ]
   },
   {
    "name": "pcap Little Endian",
    "sequences": [
     {
      "position": "bof",
      "offset": 0,
      "pattern": "d4c3b2a1"
     }
    ]
   }
  ]
 },
 "status": "readable",
 "summary": "The pcap file format was invented for use by tcpdump, a packet analyser used to examine and interpret network traffic.",
 "tools": [
  {
   "name": "PhotoRec",
   "url": "http://www.cgsecurity.org/wiki/PhotoRec",
   "reads": true,
   "writes": false,
   "license": "GNU General Public License",
   "open_source": true
  },
  {
   "name": "Q127161383",
   "url": "https://tsduck.io/",
   "reads": true,
   "writes": false,
   "license": "2-clause BSD License",
   "open_source": true
  },
  {
   "name": "tcpdump",
   "url": "https://www.tcpdump.org/",
   "reads": true,
   "writes": false,
   "license": "3-clause BSD License",
   "open_source": true
  },
  {
   "name": "Windump",
   "url": "https://www.wikidata.org/wiki/Q6167969",
   "reads": true,
   "writes": false
  }
 ],
 "projects": [
  {
   "name": "File Formats Wiki",
   "url": "http://fileformats.archiveteam.org/wiki/PCAP",
   "kind": "wiki"
  },
  {
   "name": "PRONOM fmt/779",
   "url": "https://www.nationalarchives.gov.uk/PRONOM/fmt/779",
   "kind": "format-doc"
  },
  {
   "name": "Wikidata Q28009435",
   "url": "https://www.wikidata.org/wiki/Q28009435",
   "kind": "wiki"
  }
 ],
 "provenance": {
  "sources": [
   "ffw",
   "pronom",
   "wikidata"
  ]
 },
 "updated": "2026-10-24",
 "aliases": [],
 "structure": [],
 "parsers": [],
 "conversions": [],
 "samples": [],
 "claims": [],
 "verification": []
}