# PCAP / PCAPNG Parser

> Inspect capture-file structure, packet records and metadata.

- Page: https://decoder.tools/pcap-parser
- Category: Network, System & Packets
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A PCAP parser reads the container structure of a packet capture file — the global header, link-layer type and per-packet records with their timestamps and lengths — so you can inspect a capture without a full protocol analyser.

## What is the PCAP / PCAPNG Parser?

The classic PCAP format is deliberately simple: a 24-byte global header with a magic number, version, timezone, snaplen and link type, then a sequence of records, each with a timestamp, a captured length, an original length and the packet bytes. The magic number also encodes endianness and whether timestamps are microsecond or nanosecond resolution.

PCAPNG replaced it with a block-based format that can hold multiple interfaces, per-packet comments, name resolution and capture metadata in one file. It is the default for modern Wireshark, which is why a file that older tools reject is usually PCAPNG rather than corrupt.

The field worth checking first in any capture is snaplen against the original length: if packets were captured with a small snaplen, the payload is truncated and no amount of analysis will recover it — a mistake that only reveals itself when you go looking for the data that isn't there.

## How to use the PCAP / PCAPNG Parser

1. Load the capture file — it is parsed locally in your browser.
2. Read the global header: link type, snaplen and timestamp resolution.
3. Scan the packet records for timestamps and any length truncation.

## When to use it

- Checking a capture's link type and snaplen before analysing it properly.
- Confirming whether a file is PCAP or PCAPNG when a tool refuses to open it.
- Reading capture timestamps to align an incident timeline.

## PCAP / PCAPNG Parser at a glance

| | |
|---|---|
| PCAP magic | 0xA1B2C3D4 (µs) or 0xA1B23C4D (ns) |
| Global header | 24 bytes: version, snaplen, link type |
| Link type 1 | Ethernet — the most common value |
| PCAPNG | Block-based, multi-interface, Wireshark default |

## FAQ

### What is the difference between PCAP and PCAPNG?

PCAP is a flat file with one global header and a stream of packet records. PCAPNG is block-structured and can carry several interfaces, comments and metadata in one file. Modern Wireshark writes PCAPNG by default.

### What does snaplen mean?

The maximum bytes captured per packet. If it is smaller than the packet, the record is truncated — the original length field tells you how much was lost, and nothing can recover it after the fact.

### Is my capture file uploaded?

No. The file is read in your browser's memory. Captures frequently contain credentials and personal data, which is exactly why this runs locally.