PCAP.

A binary packet-capture file format produced by libpcap, tcpdump, and Wireshark that stores network packets exactly as they were seen on the wire. It belongs to the Defense & Operations category of cybersecurity.

A binary packet-capture file format produced by libpcap, tcpdump, and Wireshark that stores network packets exactly as they were seen on the wire.

PCAP (packet capture) files record raw frames with per-packet timestamps and link-layer headers and are the lingua franca of network forensics. The classic libpcap format and its successor PCAPNG are written by tcpdump, Wireshark, Zeek, Suricata, and many appliances, and can be replayed or analyzed by hundreds of tools. Defenders use PCAP for deep incident investigation, malware C2 reconstruction, protocol troubleshooting, and forensic preservation of evidence. Operational concerns include capture loss at high rates, disk cost, lawful-interception controls, encryption (TLS often requires key logging or middlebox decryption) and how long to retain full packets versus metadata such as NetFlow.

Defences for PCAP typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: libpcap file, PCAPNG, Packet capture file.