Network capture file formats
Recordings of network traffic. A capture tool copies each packet as it crosses a network interface and writes it to a file with the time it was seen, so the traffic can be examined later, packet by packet. Some tools record at a higher level, such as the requests a web browser made, or a trace of events inside the operating system.
Formats
.ETL
Windows event trace logA trace of Windows events, from performance data to network packets.
.HAR
HTTP ArchiveA browser’s requests and responses with timings, saved as JSON.
.PCAP
libpcap packet captureRecorded network packets, each with a timestamp, after a 24-byte header.
.PCAPNG
PCAP Next Generation captureWireshark’s capture format: packets, interfaces and comments in typed blocks.
.SNOOP
Solaris snoop captureSolaris packet captures: a 16-byte header, then timestamped packet records.