Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng.

Is there an easy way to differentiate between them that is scriptable? Either cmd, powershell, or bash is acceptable.

share|improve this question
    
Which flavor of OS? Windows or Linux/Unix? –  mdpc Jan 3 '13 at 22:26
    
Preferably Windows, but if it works in cygwin that's good as well. –  Chuu Jan 3 '13 at 22:28

1 Answer 1

up vote 1 down vote accepted

You can verify the file type of pcap files with capinfos (e.g., simply enter capinfos your_capture.pcap in the command line).

capinfos is available with the WireShark distribution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.