Skip to content


Switch branches/tags

Latest commit


We just use SHOULD and MAY in most cases, to allow programs to read bad
pcap or pcapng files with original length < captured length and write
out a new file with the same lengths, but we say that if the packet
*isn't* coming from a bad file (e.g., if it's coming from a capture
process), the original length must be >= the captured length, even if
that means fixing the original length.

Git stats


Failed to load latest commit information.


This is the working area for individual Internet-Drafts.

PCAP Capture File Format

PCAP Next Generation (pcapng) Capture File Format

Building the Draft

Formatted text and HTML versions of the draft can be built using make.

$ make

This requires that you have the necessary software installed. See the instructions.


See the guidelines for contributions.

The pcap and pcapng specifications are written using the kramdown superset of Markdown and the kramdown-rfc2629 extensions to kramdown. This allows xml2rfc-format RFCs and I-Ds to be written in extended Markdown and converted to xml2rfc. Xml2rfc was originally defined in RFC 2629; version 2 is documented in RFC 7749, and version 3 is documented in RFC 7991.