Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng.

Is there an easy way to differentiate between them that is scriptable? Either cmd, powershell, or bash is acceptable.

share|improve this question
Which flavor of OS? Windows or Linux/Unix? – mdpc Jan 3 '13 at 22:26
Preferably Windows, but if it works in cygwin that's good as well. – Chuu Jan 3 '13 at 22:28
up vote 1 down vote accepted

You can verify the file type of pcap files with capinfos (e.g., simply enter capinfos your_capture.pcap in the command line).

capinfos is available with the WireShark distribution.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .