.CAP file extension
To open .CAP files on Windows, install Wireshark, then open it and use File → Open to select the .CAP file.
To open a .CAP file, use a packet-capture analyzer such as Wireshark that can read pcap capture files. If it won’t open, the file may be a different capture format or corrupted—try identifying it with Wireshark’s captype utility.
Last updated: April 29, 2026 · Reviewed by Julian Stricker
Open on your device
Choose your operating system for a dedicated step-by-step opening guide.
How to open .CAP files
Use these platform-specific instructions to open .CAP files safely.
Windows
- Install Wireshark, then open it and use File → Open to select the .CAP file.
- If Wireshark refuses to open it, run Wireshark’s captype utility on the file to identify the actual capture type (files do not need a specific extension).
- If it is a pcap capture but still fails, re-copy/re-download the file to rule out truncation or corruption.
Mac
- Open the .CAP file in Wireshark (File → Open) to analyze the captured packets.
- If it does not open, use Wireshark’s captype utility to identify what capture format it actually is.
- If the file is identified as pcap/pcapng but errors persist, obtain a fresh copy; incomplete transfers commonly break capture parsing.
Linux
- Open the .CAP file with Wireshark from your desktop (File → Open) or by launching Wireshark and selecting the file.
- If your file manager does not recognize it, use Wireshark’s captype to detect the capture format regardless of extension.
- If desktop file association is incorrect, check your system’s MIME mapping behavior (many desktops use the shared MIME-info database) and open the file directly from Wireshark.
iOS
- iOS does not commonly provide native packet-capture analysis for pcap/.cap; transfer the file to a desktop system and open it in Wireshark.
Android
- Android does not commonly provide full pcap/.cap analysis tooling; transfer the file to a desktop system and open it in Wireshark.
Security notes
- A .CAP/pcap file can contain sensitive data from network traffic (such as credentials or session tokens in unencrypted protocols). Treat it like confidential data and share/store it carefully.
- Opening untrusted capture files can expose you to parser vulnerabilities in analysis tools; use up-to-date Wireshark versions and avoid opening captures from unknown sources when possible.
- Packet captures may include malicious payloads as captured bytes; while they are data (not executables), they can still be used for social engineering or to reconstruct sensitive content—handle with least-privilege and avoid unnecessary distribution.
Recommended antivirus software
Scan files before opening them. These antivirus tools help protect against malware and viruses.
Avast offers free and premium antivirus software that protects against viruses, malware, ransomware, and phishing. Scan files before opening them to ensure safety.
NortonNorton 360 delivers comprehensive antivirus protection, VPN, and identity theft monitoring. Scan files for threats before opening to keep your device secure.
We may earn a commission when you use affiliate links. This supports our free file extension guides.
Can't open this file?
These are the most common causes and fixes when .CAP files fail to open.
Common reasons
- The .CAP file won’t open or shows “unknown format”
- Wireshark opens it but reports errors or only shows part of the capture
- The file opens, but it’s not the traffic you expected
Fix steps
- Use Wireshark’s captype utility to identify the capture format based on file contents (extensions are not required).
- If captype identifies it as pcap/pcapng, try opening it in Wireshark via File → Open instead of double-clicking (to avoid incorrect app associations).
OS-specific troubleshooting
What is a .CAP file?
.CAP is commonly used as an extension for the pcap capture format, which stores captured network packets in a structured “savefile” with headers and per-packet records. The registered media type for this kind of capture is application/vnd.tcpdump.pcap, and IANA lists .cap as a valid extension alongside .pcap and .dmp. Many tools can read/write pcap (and related formats like pcapng), and files do not strictly require a specific extension to be recognized by capable tools.
Background
In practice, “.cap” most often refers to a pcap packet capture created by network troubleshooting and security tools. These files preserve packet-level data so you can inspect protocols, timing, endpoints, and payloads after the capture is complete.
Wireshark is a common choice for opening and analyzing captures, and its documentation notes support for pcap and pcapng capture files used by other tools such as tcpdump. If you are unsure what kind of capture you have, Wireshark provides a utility (captype) that can identify capture file types based on content rather than the file extension.
On many desktop systems, file identification may rely on shared MIME-type mappings (for example, the freedesktop.org shared MIME-info database on Linux desktops). This means a file might still be recognized as a packet capture even if the extension is missing or unusual, but that depends on your environment and installed MIME mappings.
Common MIME types: application/vnd.tcpdump.pcap
Further reading
Authoritative resources for more details on the .CAP format.
Common .CAP issues
The .CAP file won’t open or shows “unknown format”
Not every “.cap” file is necessarily a pcap capture, and even for captures, the extension alone is not definitive. The file may be a different capture format, mislabeled, or not a capture file at all.
- Use Wireshark’s captype utility to identify the capture format based on file contents (extensions are not required).
- If captype identifies it as pcap/pcapng, try opening it in Wireshark via File → Open instead of double-clicking (to avoid incorrect app associations).
Wireshark opens it but reports errors or only shows part of the capture
Capture files are often large and can be truncated by interrupted downloads/copies or by storage limitations. A truncated pcap may parse partially and then fail.
- Re-transfer the file using a reliable method and verify the file size matches the sender’s original.
- Ask the source system to re-export/re-save the capture, if possible, to ensure the savefile is complete.
The file opens, but it’s not the traffic you expected
A capture contains exactly what was captured at the time—wrong interface selection, capture filters, or timing can produce “missing” packets or unexpected traffic.
- Confirm with the capture source which interface and capture settings were used when producing the file.
- If you can re-capture, adjust capture settings (interface/filter/time window) and generate a new pcap for analysis.
FAQ
Is .CAP the same as .PCAP?
Often, yes. IANA lists .cap as a file extension used for application/vnd.tcpdump.pcap, and .cap is commonly used for pcap packet captures alongside .pcap.
Can I rename .cap to .pcap to open it?
Renaming may help some apps choose the right association, but it does not change the file’s real format. If it still won’t open, use Wireshark’s captype to identify what the file actually contains.
What program should I use to analyze a .CAP packet capture?
Wireshark is a common tool for reading and analyzing pcap captures, and it supports pcap and pcapng capture files used by other tools such as tcpdump.
Do capture files require a particular extension like .cap?
No. Wireshark’s captype documentation notes that capture files do not need a specific extension to be recognized by tools that inspect the file contents.
Similar file extensions
Compare related formats in the same category to find the right tool faster.