How to open .CAP files on Linux
To open .CAP files on Linux, open the .CAP file with Wireshark from your desktop (File → Open) or by launching Wireshark and selecting the file.
Step-by-step instructions
- Open the .CAP file with Wireshark from your desktop (File → Open) or by launching Wireshark and selecting the file.
- If your file manager does not recognize it, use Wireshark’s captype to detect the capture format regardless of extension.
- If desktop file association is incorrect, check your system’s MIME mapping behavior (many desktops use the shared MIME-info database) and open the file directly from Wireshark.
Recommended software
- VS Code
- Notepad++/TextEdit
- jq (CLI)
Alternative methods
- Open .CAP in a browser-based viewer if desktop apps fail.
- Try opening .CAP on Linux with a secondary app to rule out app-specific issues.
- Convert .CAP only with trusted tools when direct opening is not possible.
Common issues
The .CAP file won’t open or shows “unknown format”
Not every “.cap” file is necessarily a pcap capture, and even for captures, the extension alone is not definitive. The file may be a different capture format, mislabeled, or not a capture file at all.
- Use Wireshark’s captype utility to identify the capture format based on file contents (extensions are not required).
- If captype identifies it as pcap/pcapng, try opening it in Wireshark via File → Open instead of double-clicking (to avoid incorrect app associations).
Wireshark opens it but reports errors or only shows part of the capture
Capture files are often large and can be truncated by interrupted downloads/copies or by storage limitations. A truncated pcap may parse partially and then fail.
- Re-transfer the file using a reliable method and verify the file size matches the sender’s original.
- Ask the source system to re-export/re-save the capture, if possible, to ensure the savefile is complete.
The file opens, but it’s not the traffic you expected
A capture contains exactly what was captured at the time—wrong interface selection, capture filters, or timing can produce “missing” packets or unexpected traffic.
- Confirm with the capture source which interface and capture settings were used when producing the file.
- If you can re-capture, adjust capture settings (interface/filter/time window) and generate a new pcap for analysis.
Security note
A .CAP/pcap file can contain sensitive data from network traffic (such as credentials or session tokens in unencrypted protocols). Treat it like confidential data and share/store it carefully.