How to differentiate between three different flavours of pcap files?

Question

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng.

Is there an easy way to differentiate between them that is scriptable? Either cmd, powershell, or bash is acceptable.

score 1 · Accepted Answer · answered Dec 10 '13 at 14:53

1

You can verify the file type of pcap files with capinfos (e.g., simply enter capinfos your_capture.pcap in the command line).

capinfos is available with the WireShark distribution.

answered Dec 10 '13 at 14:53

vincent

126

How to differentiate between three different flavours of pcap files?

1 Answers1