) has a link to Augmented PCAP Next Generation Dump File Format page that you might also want to take a look at. You can also have a look at the Wireshark source code, such as the epan/dissectors/file-pcapng.c and wiretap/pcapng.c files.īy the way, if you're looking to support all extensions, the Wireshark (. For example: Frame 1: 184 bytes on wire (1472 bits), 184 bytes captured (1472 bits) This should cause you to be able to see the various pcapng blocks and be able to drill down into them. If you've loaded a pcapng file into Wireshark, you can use 'View -> Reload as File Format/Capture' ( Ctrl+Shift+F) to cause Wireshark to load and display the raw file contents itself rather than to load and display the packets from the file. If you're looking for a pcapng parser to help you decipher the file, then look no further than Wireshark itself.

, or and probably others, but they're all obsolete.

The current PCAP Next Generation (pcapng) Capture File Formatdraft document is 52 pages, so perhaps you're not looking at the most recent version? Other versions do exist, such as those at. It seems that, after reading the 40 page whitepaper on Pcapng.

Wireshark pcap s7