Wireshark-users: Re: [Wireshark-users] pcap and cap difference

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 26 Apr 2007 09:17:36 -0700

Danilo Vilela Dantas wrote:

What is difference between pcap and cap files?

A "pcap file" is normally a capture file in libpcap format.

A "cap file" could be a file with the suffix ".cap", which could be any sort of file (nothing in any operating system enforces a particular file suffix being for a particular file format). Most ".cap" files are probably capture files in various other formats, including Microsoft Network Monitor format, Windows Sniffer format, etc. - but some people might use ".cap" for libpcap-format capture files.