PCAP
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
Packet Capture Preview.
At a glance
| Purpose | A libpcap packet capture (.pcap): a file header and timestamped packet records. |
| Extensions | .pcap |
| Poka parser | poka-pcap |
| Viewer | poka-table-viewer |
| Depth tier | Parser with a shared viewer (see Depth tiers) |
| Breadth tier | B3 Core (see Breadth tiers) |
How much Poka reads
B3 Core. Only the main content type or types are decoded (for example geometry but not materials, layers or annotations, or only one version family). The list of gaps is substantial.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-pcap/src/main.rs (524 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has no .pcap and .cap sample. Covers .pcap and .cap. The table lists packets Wireshark-style (number, time, source, destination, protocol, length, info), dissecting Ethernet (with VLAN), raw IP, BSD loopback and Linux cooked links, and IPv4, IPv6, ARP, TCP, UDP and ICMP. Judgement: B3: the packet list and transport headers are decoded, but not application protocols or payloads.
What Poka does not read
- Application protocols (DNS, HTTP, TLS and the rest) are not dissected
- Packet bytes are not shown
- TCP streams are not reassembled
- Link types other than the four listed are named only
- Only the first 1,000 packets are listed
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- pcap (candidate; MIT OR Apache-2.0; Rust; https://github.com/rust-pcap/pcap) — binds the C libpcap/wpcap
- pcapng (candidate; MIT; Rust; https://github.com/richo/pcapng-rs) — pcapng successor
- etherparse (candidate; MIT OR Apache-2.0; Rust; https://github.com/JulianSchmid/etherparse) — packet decode
Sources
- parsers/poka-pcap/src/main.rs
- parsers/poka-pcap/plugin.json