A PCAP parser reads the container structure of a packet capture file — the global header, link-layer type and per-packet records with their timestamps and lengths — so you can inspect a capture without a full protocol analyser.
What is the PCAP / PCAPNG Parser?
The classic PCAP format is deliberately simple: a 24-byte global header with a magic number, version, timezone, snaplen and link type, then a sequence of records, each with a timestamp, a captured length, an original length and the packet bytes. The magic number also encodes endianness and whether timestamps are microsecond or nanosecond resolution.
PCAPNG replaced it with a block-based format that can hold multiple interfaces, per-packet comments, name resolution and capture metadata in one file. It is the default for modern Wireshark, which is why a file that older tools reject is usually PCAPNG rather than corrupt.
The field worth checking first in any capture is snaplen against the original length: if packets were captured with a small snaplen, the payload is truncated and no amount of analysis will recover it — a mistake that only reveals itself when you go looking for the data that isn't there.
How to use the PCAP / PCAPNG Parser
- Load the capture file — it is parsed locally in your browser.
- Read the global header: link type, snaplen and timestamp resolution.
- Scan the packet records for timestamps and any length truncation.
When to use it
- Checking a capture's link type and snaplen before analysing it properly.
- Confirming whether a file is PCAP or PCAPNG when a tool refuses to open it.
- Reading capture timestamps to align an incident timeline.
PCAP / PCAPNG Parser at a glance
| PCAP magic | 0xA1B2C3D4 (µs) or 0xA1B23C4D (ns) |
| Global header | 24 bytes: version, snaplen, link type |
| Link type 1 | Ethernet — the most common value |
| PCAPNG | Block-based, multi-interface, Wireshark default |
Frequently asked questions
What is the difference between PCAP and PCAPNG?
PCAP is a flat file with one global header and a stream of packet records. PCAPNG is block-structured and can carry several interfaces, comments and metadata in one file. Modern Wireshark writes PCAPNG by default.
What does snaplen mean?
The maximum bytes captured per packet. If it is smaller than the packet, the record is truncated — the original length field tells you how much was lost, and nothing can recover it after the fact.
Is my capture file uploaded?
No. The file is read in your browser's memory. Captures frequently contain credentials and personal data, which is exactly why this runs locally.
Last reviewed · found a mistake? contact@decoder.tools · view as markdown