{"success":true,"data":{"ext":"pcap","name":"PCAP","description":"PCAP is a packet capture file format created for libpcap and tcpdump, and maintained through the tcpdump.org project. It is used to store network traffic captures for analysis, troubleshooting, protocol development, and forensic review in tools such as Wireshark, tcpdump, and related analyzers. The format is long established and generally safe, though capture files may contain sensitive network data and can be large or truncated if recordings are incomplete.","mime":["application/vnd.tcpdump.pcap"],"risk_level":"Safe","signatures":[{"hex":"D4 C3 B2 A1","offset":0,"sources":[{"name":"Apache Tika","url":"https://raw.githubusercontent.com/apache/tika/main/tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml"},{"name":"Wikipedia","url":"https://en.wikipedia.org/wiki/List_of_file_signatures"}],"endianness":"little"},{"hex":"A1 B2 C3 D4","offset":0,"sources":[{"name":"Apache Tika","url":"https://raw.githubusercontent.com/apache/tika/main/tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml"}],"endianness":"big"},{"hex":"4D 3C B2 A1","offset":0,"sources":[{"name":"Wikipedia","url":"https://en.wikipedia.org/wiki/List_of_file_signatures"}]}],"related":["cap","dmp"],"usage":{"python":"def is_pcap(file_path: str) -> bool:\n    \"\"\"Check if file is a valid PCAP by magic bytes.\"\"\"\n    signature = bytes([0xD4, 0xC3, 0xB2, 0xA1])\n    with open(file_path, \"rb\") as f:\n        return f.read(4) == signature","node":"function isPCAP(buffer: Buffer): boolean {\n  const signature = Buffer.from([0xD4, 0xC3, 0xB2, 0xA1]);\n  return buffer.subarray(0, 4).equals(signature);\n}","go":"func IsPCAP(data []byte) bool {\n    signature := []byte{0xD4, 0xC3, 0xB2, 0xA1}\n    if len(data) < 4 {\n        return false\n    }\n    return bytes.Equal(data[:4], signature)\n}"}}}