PCAPNG viewer
To open a PCAPNG file, drop it in the box below. It opens straight away, even with no extension or the wrong one. Your browser opens it on your device: nothing is uploaded.
What you see
| PCAPNG in the viewer | |
|---|---|
| Blocks read | Sections, interfaces, enhanced, simple and old packet blocks, name resolution; others skipped |
| Read in | A worker in your browser, a piece at a time, with Stop |
| Packets listed | The first 1,000,000; the rest are counted |
| Decoded | Ethernet, VLAN, SLL, IPv4, IPv6, ARP, ICMP, TCP, UDP, DNS, DHCP, HTTP, TLS, QUIC |
| Not done | Decrypting TLS, following streams, reassembling fragments |
| Extensions | .pcapng, .ntar |
| Upload | None: opened on your device |
What is a PCAPNG file?
PCAPNG is Wireshark’s capture format: packets from one or more interfaces, each with its own link type and time resolution, plus names and comments.
Every packet as a row in the table viewer: number, time from the first packet and the absolute time, source, destination, protocol, length and a summary line. Ethernet, VLAN tags, Linux cooked captures, raw IP and loopback are read; IPv4 and IPv6 with their extension headers, ARP, ICMP, TCP flags and sequence numbers, UDP, DNS questions and answers, DHCP, HTTP request and status lines with the Host, the server name in a TLS Client Hello, and QUIC. Details lists the packet count, duration, link types, protocols and the busiest conversations. Sort, filter and search like any table. Details adds the interfaces, names stored in the file and the app that made the capture.
How to open a PCAPNG file
- Add your PCAPNG. Drop the file in the box, choose it or paste it.
- Look at it. Every packet as a row in the table viewer: number, time from the first packet and the absolute time, source, destination, protocol, length and a summary line. Ethernet, VLAN tags, Linux cooked captures, raw IP and loopback are read; IPv4 and IPv6 with their extension headers, ARP, ICMP, TCP flags and sequence numbers, UDP, DNS questions and answers, DHCP, HTTP request and status lines with the Host, the server name in a TLS Client Hello, and QUIC. Details lists the packet count, duration, link types, protocols and the busiest conversations. Sort, filter and search like any table. Details adds the interfaces, names stored in the file and the app that made the capture.
- Take it further. Open in hands it, in a new tab, to File converter.
Questions
When a capture holds several interfaces, each row starts with the interface’s name.
No. It is read in your browser, on your device.
No. The viewer runs in your browser and opens the file on your device. Nothing is sent anywhere.