PCAP NG

PCAPng provides some benefits over the legacy PCAP format

  • Metadata: per packet and per trace file comments, information about the interfaces used for capturing
  • Nanosecond timestamps
  • Name resolution data
  • Possibility to save dropped frames counter
  • Possibility to bundle TLS sessions keys within the file
  • Saving packets from multiple NICs