PCAPNG
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
pcap-ng Preview.
At a glance
| Purpose | A pcap-ng packet capture (.pcapng): blocks of section headers, interfaces and packets with options. |
| Extensions | .pcapng |
| Poka parser | poka-pcapng |
| Viewer | poka-table-viewer |
| Depth tier | Parser with a shared viewer (see Depth tiers) |
| Breadth tier | B3 Core (see Breadth tiers) |
How much Poka reads
B3 Core. Only the main content type or types are decoded (for example geometry but not materials, layers or annotations, or only one version family). The list of gaps is substantial.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-pcapng/src/main.rs (635 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has secret-control-udp.pcapng, read by no test. Covers .pcapng and .ntar. The table lists enhanced and simple packet blocks Wireshark-style with the same link and transport dissection as the .pcap module, using each interface's link type and timestamp resolution. Judgement: B3: the packet list and transport headers are decoded, but not application protocols or payloads.
What Poka does not read
- Application protocols are not dissected and packet bytes are not shown
- Block options (comments, interface names, statistics) are not shown (judgement from the code)
- Name resolution and decryption-secrets blocks are not read
- Only the first 1,000 packets are listed
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- pcapng (candidate; MIT; Rust; https://github.com/richo/pcapng-rs)
- etherparse (candidate; MIT OR Apache-2.0; Rust; https://github.com/JulianSchmid/etherparse) — packet decode
Sources
- parsers/poka-pcapng/src/main.rs
- parsers/poka-pcapng/plugin.json