ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] pcap and cap difference

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 26 Apr 2007 09:17:36 -0700
Danilo Vilela Dantas wrote:

What is difference between pcap and cap files?

A "pcap file" is normally a capture file in libpcap format.

A "cap file" could be a file with the suffix ".cap", which could be any sort of file (nothing in any operating system enforces a particular file suffix being for a particular file format). Most ".cap" files are probably capture files in various other formats, including Microsoft Network Monitor format, Windows Sniffer format, etc. - but some people might use ".cap" for libpcap-format capture files.