Skip to main content

PCAP Capture File Format

The information below is for an old version of the document.
Document Type This is an older version of an Internet-Draft whose latest revision is Active
Authors Guy Harris , Michael Richardson
Last updated 2022-04-28 (Latest revision 2021-10-25)
Stream Internet Engineering Task Force (IETF)
Expired & archived
Stream WG state WG Document
Document shepherd (None)
IESG IESG state Expired
Consensus boilerplate Unknown
Telechat date (None)
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:


This document describes the format used by the libpcap library to record captured packets to a file. Programs using the libpcap library to read and write those files, and thus reading and writing files in that format, include tcpdump.


Guy Harris
Michael Richardson

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)