# Pcap

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Pcap
> Markdown URL: https://mediated.wiki/source/Pcap.md
> Source: https://en.wikipedia.org/wiki/Pcap
> Source revision: 1353545161
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

Application programming interface for capturing network traffic

This article is about the packet sniffing API. For the projected capacitance technology for touchscreens, see [Projected capacitance](/source/Projected_capacitance). For the chess league, see [Professional Chess Association of the Philippines](/source/Professional_Chess_Association_of_the_Philippines).

libpcap Developer The Tcpdump team Stable release 1.10.4 / April 7, 2023; 3 years ago (2023-04-07)[1] Written in C Operating system Linux, Solaris, FreeBSD, NetBSD, OpenBSD, macOS, other Unix-like Type Library for packet capture License BSD[2] Website www.tcpdump.org Repository libpcap on GitHub

WinPcap Developer Riverbed Technology Final release 4.1.3 / March 8, 2013; 13 years ago (2013-03-08)[3] Operating system Windows Type Library for packet capture License Freeware Website www.winpcap.org

Npcap Developer the Nmap project Stable release 1.79 / January 19, 2024; 2 years ago (2024-01-19)[4] Operating system Windows Type Library for packet capture License Proprietary (source available) Website npcap.com

In the field of [computer](/source/Computer) [network administration](/source/Network_administration), **pcap** is an [application programming interface](/source/Application_programming_interface) (API) for [capturing network traffic](/source/Packet_sniffer). While the name is an abbreviation of *[packet capture](/source/Packet_capture)*, that is not the API's proper name. [Unix-like](/source/Unix-like) systems implement pcap in the *libpcap* library; for [Windows](/source/Microsoft_Windows), there is a [port](/source/Porting) of libpcap named *WinPcap* that is no longer supported or developed, and a port named *Npcap* for [Windows 7](/source/Windows_7) and later that is still supported.

Monitoring software may use libpcap, WinPcap, or Npcap to capture [network packets](/source/Network_packet) traveling over a [computer network](/source/Computer_network) and, in newer versions, to transmit packets on a network at the [link layer](/source/Link_layer), and to get a list of network interfaces for possible use with libpcap, WinPcap, or Npcap.

The pcap API is written in [C](/source/C_(programming_language)), so other languages such as [Java](/source/Java_(programming_language)), [.NET](/source/.NET_Framework) languages, and [scripting languages](/source/Scripting_language) generally use a [wrapper](/source/Wrapper_library); no such wrappers are provided by libpcap or WinPcap itself. [C++](/source/C%2B%2B) programs may link directly to the C API or make use of an [object-oriented](/source/Object-oriented_programming) wrapper.

## Features

libpcap, WinPcap, and Npcap provide the packet-capture and filtering engines of many [open-source](/source/Open-source_software) and commercial network tools, including protocol analyzers ([packet sniffers](/source/Packet_sniffer)), [network monitors](/source/Network_monitor), [network intrusion detection systems](/source/Network_intrusion_detection_system), traffic-generators and network-testers.

Most current [Unix-like](/source/Unix-like) systems provide a mechanism by which a program can capture network traffic to and from the machine running the program and, in some cases, other traffic to which that machine is attached. However, these mechanisms are significantly different from one another; the libpcap library provides a common API to access these mechanisms, allowing programs to be written to capture network traffic without having to worry about the details of all those mechanisms.

libpcap, WinPcap, and Npcap also support saving captured [packets](/source/Network_packet) to a file, and reading files containing saved packets; [applications](/source/Application_software) can be written, using libpcap, WinPcap, or Npcap, to be able to capture network traffic and analyze it, or to read a saved capture and analyze it, using the same analysis code. A capture file saved in the format that libpcap, WinPcap, and Npcap use can be read by applications that understand that format, such as [tcpdump](/source/Tcpdump), [Wireshark](/source/Wireshark), CA NetMaster, or [Microsoft Network Monitor](/source/Microsoft_Network_Monitor) 3.x. The file format is described by [Internet-Draft](/source/Internet-Draft) draft-ietf-opsawg-pcap;[5] the current editors' version of the draft is also available.[6]

The [MIME type](/source/MIME_type) for the file format created and read by libpcap, WinPcap, and Npcap is application/vnd.tcpdump.pcap. The typical file extension is .pcap, although .cap and .dmp are also in common use.[7]

## History

libpcap was originally developed by the [tcpdump](/source/Tcpdump) developers in the Network Research Group at [Lawrence Berkeley Laboratory](/source/Lawrence_Berkeley_Laboratory). The low-level packet capture, capture file reading, and capture file writing code of tcpdump was extracted and made into a library, with which tcpdump was linked.[8] It is now developed by the same tcpdump.org group that develops tcpdump.[9]

## pcap libraries for Windows

While libpcap was originally developed for Unix-like operating systems, a successful [port](/source/Porting) for Windows was made, called WinPcap. It has been unmaintained since 2013,[10] and several competing [forks](/source/Fork_(software_development)) have been released with new features and support for newer versions of Windows.

### WinPcap

WinPcap consists of:[11]

- [x86](/source/X86) and [x86-64](/source/X86-64) drivers for the [Windows NT](/source/Windows_NT) family ([Windows NT 4.0](/source/Windows_NT_4.0), [2000](/source/Windows_2000), [XP](/source/Windows_XP), [Server 2003](/source/Windows_Server_2003), [Vista](/source/Windows_Vista), [7](/source/Windows_7), [8](/source/Windows_8), and [10](/source/Windows_10)), which use [Network Driver Interface Specification](/source/Network_Driver_Interface_Specification) (NDIS) 5.x to read packets directly from a [network adapter](/source/Network_adapter);

- implementations of a lower-level library for the listed operating systems, to communicate with those drivers;

- a port of libpcap that uses the API offered by the low-level library implementations.

Programmers at the [Politecnico di Torino](/source/Politecnico_di_Torino) wrote the original code. As of 2008, CACE Technologies, a company set up by some of the WinPcap developers, developed and maintained the product. CACE was acquired by [Riverbed Technology](/source/Riverbed_Technology) on October 21, 2010.[12]

Because WinPcap uses the older NDIS 5.x APIs, it does not work on some builds of Windows 10, which have deprecated or removed those APIs in favor of the newer NDIS 6.x APIs. It also forces some limitations such as being unable to capture [802.1Q VLAN tags](/source/IEEE_802.1Q) in [Ethernet](/source/Ethernet) headers.

The WinPcap project has ceased development and WinPcap and WinDump are no longer maintained. The last official WinPcap release was 4.1.3 released March 8, 2013.[13]

### Npcap

Npcap is the [Nmap](/source/Nmap) Project's packet sniffing library for Windows.[14] It is based on WinPcap, but written to make use of Windows networking improvements in [NDIS](/source/Network_Driver_Interface_Specification) version 6. Its authors rewrote the WinPcap NDIS 5 Protocol Driver as a Light-Weight Filter (LWF) driver, a change that reduces processing overhead.[15] Npcap maintenance releases updated the version of the included libpcap library to the latest available, allowing software authors to use the newer API features that Linux software had already supported.[16] Most software that used WinPcap can be easily [ported](/source/Porting) to use Npcap with minimal changes.[17]

Npcap introduced several innovations that were not available in WinPcap:

- Npcap can be restricted so that only [Administrators](/source/Superuser#Microsoft_Windows) can sniff packets.[18]

- Npcap is able to sniff and inject [loopback](/source/Localhost#Loopback) packets (transmissions between services on the same machine) by using the [Windows Filtering Platform](/source/Windows_Filtering_Platform).[19]

- Npcap can capture [802.11](/source/IEEE_802.11) WiFi frames on a variety of commonly-available network adapters.[20]

Unlike [Nmap](/source/Nmap), Npcap is proprietary software and requires a special license for use and redistribution except for some limited internal uses.[21]

### Win10Pcap

Win10Pcap implementation is also based on the NDIS 6 driver model and works stably with [Windows 10](/source/Windows_10).[22] The project, however, has been inactive since 2016.[23]

## Programs that use or used libpcap

- [Bit-Twist](/source/Bit-Twist), a libpcap-based Ethernet packet generator and editor for [BSD](/source/Berkeley_Software_Distribution), Linux, and Windows.

- [Cain and Abel](/source/Cain_and_Abel_(software)), a discontinued password recovery tool for Microsoft Windows

- [EtherApe](/source/EtherApe), a graphical tool for monitoring network traffic and bandwidth usage in real time.

- [Firesheep](/source/Firesheep), a discontinued extension for the [Firefox](/source/Firefox) web browser that captured packets and performed [session hijacking](/source/Session_hijacking)

- [iftop](/source/Iftop), a tool for displaying bandwidth usage (like [top](/source/Top_(software)) for network traffic)

- [Kismet](/source/Kismet_(software)), for 802.11 wireless [LANs](/source/Local_area_network)

- [L0phtCrack](/source/L0phtCrack), a [password](/source/Password) [auditing](/source/Audit) and [recovery](/source/Password_cracking) application.

- [McAfee](/source/McAfee) ePolicy Orchestrator, Rogue System Detection feature

- [ngrep](/source/Ngrep), aka "network [grep](/source/Grep)", isolate strings in packets, show packet data in human-friendly output.

- [Nmap](/source/Nmap), a [port-scanning](/source/Port_scan) and [fingerprinting](/source/TCP%2FIP_stack_fingerprinting) network utility

- Pirni, a discontinued network security tool for [jailbroken](/source/IOS_jailbreaking) [iOS](/source/IOS_(Apple)) devices.

- [Scapy](/source/Scapy), a packet manipulation tool for computer networks, written in [Python](/source/Python_(programming_language)) by Philippe Biondi.

- [Snort](/source/Snort_(software)), a network-intrusion-detection system.

- [Suricata](/source/Suricata_(software)), a network intrusion prevention and analysis platform.

- [Symantec](/source/NortonLifeLock) Data Loss Prevention, Used to monitor and identify sensitive data, track its use, and location. Data loss policies allow sensitive data to be blocked from leaving the network or copied to another device.

- [tcpdump](/source/Tcpdump), a tool for capturing and dumping packets for further analysis, and WinDump, the Windows port of tcpdump.

- [Zeek](/source/Zeek), an [intrusion detection system](/source/Intrusion_detection_system) and [network monitoring](/source/Network_monitoring) platform.

- [URL Snooper](https://www.techopedia.com/definition/26915/url-snooping), locate the URLs of audio and video files in order to allow recording them.

- [WhatPulse](/source/WhatPulse), a statistical (input, network, uptime) measuring application.

- [Wireshark](/source/Wireshark) (formerly Ethereal), a graphical packet-capture and protocol-analysis tool.

- [XLink Kai](/source/XLink_Kai), software that allows various LAN [console games](/source/Console_game) to be played online

- [Xplico](/source/Xplico), a network forensics analysis tool (NFAT).

- [PCAP Analyzer](https://comoe-networks.com) designed to process captured network traffic and provide protocol-level decoding and metadata extraction.

## Wrapper libraries for libpcap

- [C++](/source/C%2B%2B): [Libtins](https://libtins.github.io/), [Libcrafter](https://github.com/pellegre/libcrafter), [PcapPlusPlus](https://pcapplusplus.github.io/)

- [Perl](/source/Perl): [Net::Pcap](https://search.cpan.org/~saper/Net-Pcap/Pcap.pm)

- [Python](/source/Python_(programming_language)): [python-libpcap](https://sourceforge.net/projects/pylibpcap/), [Pcapy](https://www.coresecurity.com/corelabs-research/open-source-tools/pcapy), [WinPcapy](https://github.com/orweis/winpcapy)

- [Ruby](/source/Ruby_(programming_language)): [PacketFu](https://github.com/packetfu/packetfu)

- [Rust](/source/Rust_(programming_language)): [pcap](https://github.com/ebfull/pcap)

- [Tcl](/source/Tcl_(programming_language)): [tclpcap](https://tclpcap.sourceforge.net/), [tcap](https://monkey.org/~jose/software/tcap/), [pktsrc](http://home.roadrunner.com/~maccody/pktsrc.html)

- [Java](/source/Java_(programming_language)): [jpcap](https://jpcap.sourceforge.net/), [jNetPcap](https://web.archive.org/web/20121104024808/http://jnetpcap.com/), [Jpcap](https://archive.today/20101017042631/http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html), [Pcap4j](https://github.com/kaitoy/pcap4j), [Jxnet](https://github.com/jxnet/Jxnet)

- [.NET](/source/.NET_Framework): WinPcapNET, [SharpPcap](https://github.com/chmorgan/sharppcap), [Pcap.Net](http://pcapdot.net)

- [Haskell](/source/Haskell_(programming_language)): [pcap](https://hackage.haskell.org/package/pcap)

- [OCaml](/source/OCaml): [mlpcap](https://web.archive.org/web/20110830000918/http://www.drugphish.ch/~jonny/mlpcap.html)

- [Chicken](/source/Chicken_(Scheme_implementation)) Scheme: [pcap](https://wiki.call-cc.org/eggref/3/pcap)

- [Common Lisp](/source/Common_Lisp): [PLOKAMI](https://github.com/atomontage/plokami)

- [Racket](/source/Racket_(programming_language)): [SPeaCAP](http://planet.racket-lang.org/display.ss?package=SPeaCAP.plt&owner=evanfarrer)

- [Go](/source/Go_(programming_language)): [pcap](https://github.com/akrennmair/gopcap) by Andreas Krennmair, [pcap](https://godoc.org/github.com/miekg/pcap) fork of the previous by Miek Gieben, [pcap](http://godoc.org/code.google.com/p/gopacket/pcap) developed as part of the [gopacket](https://pkg.go.dev/github.com/google/gopacket) package

- [Erlang](/source/Erlang_(programming_language)): [epcap](https://github.com/msantos/epcap)

- [Node.js](/source/Node.js): [node_pcap](https://github.com/node-pcap/node_pcap)

## Non-pcap libraries that read pcap files

- [Python](/source/Python_(programming_language)): [pycapfile](https://pypi.python.org/pypi/pypcapfile)

- [Python](/source/Python_(programming_language)): [PyPCAPKit](https://pypi.python.org/pypi/pypcapkit)

## Other applications or devices that read or write pcap or pcapng files

- [Apache Drill](/source/Apache_Drill), an open source SQL engine for interactive analysis of large scale datasets.[24][25]

- [Endace](/source/Endace)'s EndaceProbe, a high scale packet capture system that continuously records weeks or months of network traffic.[26]

## References

1. **[^](#cite_ref-1)** ["tcpdump and libpcap latest release"](https://www.tcpdump.org/#latest-release). tcpdump.org. Retrieved 2023-02-08.

1. **[^](#cite_ref-2)** ["tcpdump and libpcap license"](https://www.tcpdump.org/license.html). tcpdump.org. Retrieved 2020-05-02.

1. **[^](#cite_ref-3)** ["WinPcap Changelog"](https://www.winpcap.org/misc/changelog.htm).

1. **[^](#cite_ref-4)** ["npcap/CHANGELOG.md"](https://github.com/nmap/npcap/blob/master/CHANGELOG.md). *[GitHub](/source/GitHub)*.

1. **[^](#cite_ref-5)** [*PCAP Capture File Format*](https://datatracker.ietf.org/doc/html/draft-ietf-opsawg-pcap). [IETF](/source/Internet_Engineering_Task_Force). 23 July 2023. I-D draft-ietf-opsawg-pcap.

1. **[^](#cite_ref-6)** ["PCAP Capture File Format"](https://ietf-opsawg-wg.github.io/draft-ietf-opsawg-pcap/draft-ietf-opsawg-pcap.html). 1 March 2024.

1. **[^](#cite_ref-7)** Turner, Glen (2011-03-30). ["IANA record of application for MIME type application/vnd.tcpdump.pcap"](https://www.iana.org/assignments/media-types/application/vnd.tcpdump.pcap). *IANA*. Retrieved 2023-02-25.

1. **[^](#cite_ref-8)** McCanne, Steve. ["libpcap: An Architecture and Optimization Methodology for Packet Capture"](https://sharkfest.wireshark.org/retrospective/sfus/presentations11/McCanne-Sharkfest'11_Keynote_Address.pdf) (PDF). Retrieved December 27, 2013.

1. **[^](#cite_ref-9)** ["TCPDUMP/LIBPCAP public repository"](https://www.tcpdump.org/). Retrieved December 27, 2013.

1. **[^](#cite_ref-10)** ["WinPcap News"](https://www.winpcap.org/news.htm). Retrieved November 6, 2017.

1. **[^](#cite_ref-11)** ["WinPcap internals"](https://www.winpcap.org/docs/docs_412/html/group__internals.html). Retrieved December 27, 2013.

1. **[^](#cite_ref-12)** ["Riverbed Expands Further Into The Application-Aware Network Performance Management Market with the Acquisition of CACE Technologies"](https://web.archive.org/web/20130308100122/http://www.riverbed.com/us/company/news/press_releases/2010/press_102110.php) (Press release). [Riverbed Technology](/source/Riverbed_Technology). 2010-10-21. Archived from [the original](http://www.riverbed.com/us/company/news/press_releases/2010/press_102110.php) on 2013-03-08. Retrieved 2010-10-21.

1. **[^](#cite_ref-13)** ["WinPcap · News"](https://www.winpcap.org/news.htm). *WinPcap*. 2013-03-08.

1. **[^](#cite_ref-14)** ["Npcap"](https://npcap.com).

1. **[^](#cite_ref-15)** ["Filter drivers"](https://docs.microsoft.com/en-us/windows-hardware/drivers/network/ndis-filter-drivers). 15 December 2021.

1. **[^](#cite_ref-16)** ["Release Npcap 1.20"](https://github.com/nmap/npcap/releases/tag/v1.20). *[GitHub](/source/GitHub)*.

1. **[^](#cite_ref-17)** ["Updating WinPcap software to Npcap"](https://npcap.com/guide/npcap-devguide.html#npcap-devguide-updating). *Developing software with Npcap*. Retrieved 2023-02-25.

1. **[^](#cite_ref-18)** ["Graphical installer options"](https://npcap.com/guide/npcap-users-guide.html#npcap-installer-options-gui). *Npcap Users' Guide*. Retrieved 2023-02-25.

1. **[^](#cite_ref-19)** ["For software that uses Npcap loopback feature"](https://npcap.com/guide/npcap-devguide.html#npcap-feature-loopback). *Npcap User's Guide*. Retrieved 2023-02-25.

1. **[^](#cite_ref-20)** ["For software that uses Npcap raw 802.11 feature"](https://npcap.com/guide/npcap-devguide.html#npcap-feature-dot11). *Npcap User's Guide*. Retrieved 2023-02-25.

1. **[^](#cite_ref-21)** ["Npcap License"](https://github.com/nmap/npcap/blob/master/LICENSE). *[GitHub](/source/GitHub)*.

1. **[^](#cite_ref-22)** ["Win10Pcap: WinPcap for Windows 10"](https://www.win10pcap.org).

1. **[^](#cite_ref-23)** [*Win10Pcap: WinPcap for Windows 10 (NDIS 6.x driver model): SoftEtherVPN/Win10Pcap*](https://github.com/SoftEtherVPN/Win10Pcap), SoftEther VPN Project, 2019-12-31, retrieved 2020-01-09

1. **[^](#cite_ref-24)** Bevens, Bridget (July 31, 2017). ["Drill 1.11 Released"](https://drill.apache.org/blog/2017/07/31/drill-1.11-released/).

1. **[^](#cite_ref-25)** [Packet.java](https://github.com/apache/drill/blob/master/contrib/format-pcapng/src/main/java/org/apache/drill/exec/store/pcap/decoder/Packet.java) on [GitHub](/source/GitHub)

1. **[^](#cite_ref-26)** ["What Can Read or Save a PCAP?"](https://www.endace.com/learn/what-is-a-pcap-file). *What is a PCAP file?*. [Endace](/source/Endace).

## External links

- [Free and open-source software portal](https://en.wikipedia.org/wiki/Portal:Free_and_open-source_software)

- [Official website](https://tcpdump.org), libpcap, tcpdump

- [Official website](https://npcap.com), Npcap

- [Official website](https://www.winpcap.org/), WinPcap, WinDump

- [List of publicly available PCAP files](https://www.netresec.com/?page=PcapFiles)

---
Adapted from the Wikipedia article [Pcap](https://en.wikipedia.org/wiki/Pcap) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Pcap?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.