There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng.

Is there an easy way to differentiate between them that is scriptable? Either cmd, powershell, or bash is acceptable.

  • Which flavor of OS? Windows or Linux/Unix?
    – mdpc
    Jan 3, 2013 at 22:26
  • Preferably Windows, but if it works in cygwin that's good as well.
    – Chuu
    Jan 3, 2013 at 22:28

1 Answer 1


You can verify the file type of pcap files with capinfos (e.g., simply enter capinfos your_capture.pcap in the command line).

capinfos is available with the WireShark distribution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.