How to open a .CAP file online
Three steps, a few seconds.
Open your .CAP file
Drop it on the box or click to choose it. It opens.
Filter the packets
Type dns, http, tls, an IP address or port 443 - or click a quick filter. Click any packet to see its layers and raw bytes.
Read the summary
The Insights tab lists name lookups, web requests and secure-connection server names; Statistics shows protocols, top conversations and a timeline.
What is a .CAP file?
The universal format for recorded network traffic.
A CAP file is almost always a network packet capture - a recorded snapshot of network traffic from a sniffer such as Wireshark, tcpdump, or a router. Open it with free Wireshark on Windows, macOS, or Linux. Note that CAP files can contain passwords and other sensitive traffic, and a handful of unrelated programs also use the .cap extension.
Programs that open .CAP files
| Full name | Packet Capture file (network trace) — primary meaning |
|---|---|
| Developer | Various (libpcap/tcpdump; Microsoft Network Monitor; NAI Sniffer) |
| First released | libpcap/tcpdump format early 1990s; .cap used by many sniffers |
| Category | Data & Other |
| MIME type | application/vnd.tcpdump.pcap |
| Signature | D4 C3 B2 A1 (libpcap magic (little-endian); also A1 B2 C3 D4 big-endian) |
Related viewers
Other free tools to open and preview your files.
Frequently asked questions
Is my .CAP file uploaded?
No. Your .CAP file is decoded by JavaScript in the page. Captures often contain private traffic.
Can it decrypt HTTPS / TLS traffic?
No - encrypted traffic stays encrypted. You can still see the server name each connection asked for (SNI), the TLS version and how much data was exchanged.
Which filters can I use?
Protocol names (dns, http, tls, tcp, udp, arp, icmp, ipv6), an IP address, port 53, or any text from the Info column. Combine words to narrow down - all of them must match.
How big can the file be?
Up to about 150 MB in the online version. For bigger captures, split them with editcap -c 100000 or use Wireshark.
My .cap file doesn't open. Why?
Several tools use .cap for their own formats (Microsoft Network Monitor, NetScout Sniffer). The viewer reads libpcap and pcapng; it tells you if the file is something else.
Was this tool helpful?
Your rating helps us decide which tools to improve next.