Saving PCAPNG in Wireshark
You learn to handle capture files like evidence: the difference between pcap and pcapng and converting formats, adding comments to a packet and to the file, exporting only the requested packets, splitting and merging big files, continuous capture with a ring buffer and taking the evidence’s SHA-256 digest. The incident capture differs in every lab.
Level 101 · 50 min
Last night there was a suspicious download on a workstation and its traffic record came to the SOC: ~/captures/olay.pcapng. This file is now evidence: it will be handed to others and perhaps kept for years. Your team lead says: "We don’t change evidence; we take a copy, keep notes on it and record its digest."
pcap is the old, simple format: packets only. pcapng (next generation) is today’s default: it carries several interfaces, packet and file comments, name resolutions and capture information. The figure shows the difference between the two formats.
The Wireshark family’s file tools: capinfos (summary), editcap (convert, split, add comments), mergecap (merge).
What you will do in this lesson
- The file’s format
- Convert to the old format: editcap -F pcap
- Put a note on a packet
- A note on the file: whose, when?
- Only the requested packets: Export Specified Packets
- Split a big file: editcap -c
- Put it back together: mergecap
- Ring buffer: continuous capture without filling the disk
- The evidence digest
- Short quiz
Skills you will earn
- Telling pcap and pcapng apart and converting
- Converting, splitting and annotating with editcap
- Adding packet and file comments
- Exporting only the requested packets
- Merging capture files (mergecap)
- Capturing continuously with a ring buffer
- Taking the SHA-256 digest of capture evidence
← Live capture with Wireshark · Wireshark fundamentals · Wireshark display filters →
Start for free