What is the difference between PCAP and PCAPNG?

PCAP is a flat file with one global header and a stream of packet records. PCAPNG is block-structured and can carry several interfaces, comments and metadata in one file. Modern Wireshark writes PCAPNG by default.

What does snaplen mean?

The maximum bytes captured per packet. If it is smaller than the packet, the record is truncated — the original length field tells you how much was lost, and nothing can recover it after the fact.

Is my capture file uploaded?

No. The file is read in your browser's memory. Captures frequently contain credentials and personal data, which is exactly why this runs locally.

PCAP / PCAPNG Parser

Inspect capture-file structure, packet records and metadata.

on the roadmapNetwork, System & Packetsfree · no sign-up

This bench is being wired up

The pcap-parser decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the PCAP / PCAPNG Parser?

A PCAP parser reads the container structure of a packet capture file — the global header, link-layer type and per-packet records with their timestamps and lengths — so you can inspect a capture without a full protocol analyser.

The classic PCAP format is deliberately simple: a 24-byte global header with a magic number, version, timezone, snaplen and link type, then a sequence of records, each with a timestamp, a captured length, an original length and the packet bytes. The magic number also encodes endianness and whether timestamps are microsecond or nanosecond resolution.

PCAPNG replaced it with a block-based format that can hold multiple interfaces, per-packet comments, name resolution and capture metadata in one file. It is the default for modern Wireshark, which is why a file that older tools reject is usually PCAPNG rather than corrupt.

The field worth checking first in any capture is snaplen against the original length: if packets were captured with a small snaplen, the payload is truncated and no amount of analysis will recover it — a mistake that only reveals itself when you go looking for the data that isn't there.

PCAP / PCAPNG Parser at a glance

PCAP magic: 0xA1B2C3D4 (µs) or 0xA1B23C4D (ns)
Global header: 24 bytes: version, snaplen, link type
Link type 1: Ethernet — the most common value
PCAPNG: Block-based, multi-interface, Wireshark default

How to use the PCAP / PCAPNG Parser

1Load the capture file — it is parsed locally in your browser.
2Read the global header: link type, snaplen and timestamp resolution.
3Scan the packet records for timestamps and any length truncation.

When you would reach for it

Checking a capture's link type and snaplen before analysing it properly.
Confirming whether a file is PCAP or PCAPNG when a tool refuses to open it.
Reading capture timestamps to align an incident timeline.

PCAP / PCAPNG Parser — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools