How to Read a PCAP File — Wireshark Concepts & Browser-Based Analysis
Understand the PCAP format, TCP stream reassembly, and how to extract HTTP sessions, DNS queries, and credentials from packet captures without installing Wireshark.
A PCAP (Packet Capture) file is a recording of raw network traffic. Every packet that crossed a network interface — TCP handshakes, HTTP requests, DNS lookups, TLS negotiations — is stored in sequence with precise timestamps. PCAP files are the primary artifact in network forensics investigations.
Wireshark is the standard desktop tool for PCAP analysis, but its full feature set has a steep learning curve. This guide covers the core concepts you need to extract meaningful information from a capture file — applicable whether you're using Wireshark, tshark, or a browser-based tool.
The PCAP file format
A PCAP file starts with a global header (24 bytes) that records the magic number (0xa1b2c3d4 for microsecond precision, 0xa1b23c4d for nanosecond), link-layer type (1 = Ethernet, 105 = IEEE 802.11 WiFi), and the maximum capture length (snaplen).
Each packet is stored as a record header (16 bytes: timestamp seconds, timestamp microseconds, captured length, original length) followed by the raw packet bytes. The captured length may be less than the original length if the capture was truncated at the snaplen limit.
PCAPNG (Next Generation) is the modern successor. It supports multiple interfaces in one file, interface descriptions, comments on packets, and name resolution blocks. Most modern tools produce PCAPNG by default. The magic number is 0x0A0D0D0A.
Reading the protocol stack
Each packet starts with an Ethernet frame: 6-byte destination MAC, 6-byte source MAC, 2-byte EtherType (0x0800 = IPv4, 0x0806 = ARP, 0x86DD = IPv6). MAC addresses identify physical network interfaces and can reveal device manufacturers via OUI lookup.
The IP header contains source and destination IP addresses, TTL (Time to Live — decremented at each hop, useful for traceroute analysis), protocol number (6 = TCP, 17 = UDP, 1 = ICMP), and fragmentation flags. TTL values can hint at the originating OS (Windows defaults to 128, Linux to 64).
TCP headers include source/destination ports, sequence numbers, acknowledgment numbers, and flags (SYN, ACK, FIN, RST, PSH). Sequence numbers are essential for stream reassembly — TCP is a stream protocol, and application data may be split across many packets.
HTTP, DNS, FTP, SMTP, and other application protocols sit above TCP/UDP. Unencrypted HTTP traffic is fully readable in a PCAP. DNS queries reveal every domain the host resolved. FTP and basic HTTP authentication transmit credentials in plaintext.
TCP stream reassembly
A TCP connection is identified by a 4-tuple: source IP, source port, destination IP, destination port. All packets sharing this 4-tuple belong to the same stream. To read an HTTP conversation, you need to reassemble the stream — sort packets by sequence number and concatenate the payloads.
In Wireshark, right-click any TCP packet and select 'Follow > TCP Stream' to see the reassembled conversation. The client data is shown in one color, server data in another. This is how you extract HTTP request/response bodies, FTP file transfers, and SMTP email content from a capture.
The three-way handshake (SYN → SYN-ACK → ACK) establishes a TCP connection. A RST (reset) packet terminates it abruptly — often a sign of a port scan, firewall block, or application crash. FIN packets indicate a graceful close.
What to look for in a forensics investigation
Filter for HTTP POST requests (http.request.method == "POST") and look for form data containing 'password', 'passwd', or 'pwd'. FTP authentication (USER and PASS commands) is always cleartext. Basic HTTP auth decodes from base64.
Attackers can exfiltrate data by encoding it in DNS query subdomains (e.g., base64data.evil.com). Look for unusually long DNS query names, high query frequency to a single domain, or queries to domains with high entropy names.
Malware often 'beacons' to a C2 server at regular intervals. Filter by destination IP and sort by time — regular intervals (every 60s, 300s) in TCP connections to an unusual IP are a strong indicator of C2 communication.
A SYN scan appears as many SYN packets to sequential ports on a single host, with RST responses from closed ports and SYN-ACK from open ones. The source sends SYN but never completes the handshake (no final ACK).
Analyze PCAP files in your browser
The Packet Inspector in the Forensics module supports PCAP and PCAPNG files up to 1MB (free) or 50MB (Pro). It reassembles TCP streams, decodes HTTP, and exports findings as JSON or CSV — no Wireshark installation required.
Open Packet Inspector