PCAP
A family of packet-capture file formats storing network frames with timestamps and link-layer metadata, widely used in network forensics and protocol analysis.
PCAP is a family of file formats used to store captured network frames with timestamps and link-layer information. pcapng can preserve richer metadata such as multiple interfaces.
Forensic Context
A capture file is more than packet payloads. Interpretation can depend on:
- capture point,
- timestamp resolution,
- packet loss,
- file integrity,
- capture tool behavior.
A packet missing from one capture does not prove that it was never transmitted elsewhere in the network.
Protocol Analysis
Standard protocols can be checked against their specifications. For undocumented protocols, repeated constants, lengths, sequence values and request-response pairs can reveal message structure.
Boundary
PCAP is not a network protocol; it is a capture-file format. Flow/session reconstruction may still be required for meaningful analysis.
Related: Packet Capture, Network Forensics, Chain of Custody.