This is our old Q&A Site. Please post any new questions and answers at

Is it possible to view pcap files outside of Wireshark? We have a need to analyse captured packets on our main network, the problem is that we are not allowed to have Wireshark insalled within our network.

asked 15 Sep '11, 07:47

MrBeaker's gravatar image

accept rate: 0%

The pcap files generated by Wireshark (or dumpcap, etc) do not contain any dissection (analysis) data. If you want to review these files with the traffic dissected, you will need to use Wireshark.

(15 Sep '11, 08:22) multipleinte...

...or some other program that can read pcap files and that can dissect the traffic in which you're interested; see my answer.

(17 Sep '11, 23:55) Guy Harris ♦♦

You might be able to get around this by using the PortableApps and/or U3 versions of Wireshark, neither of which require you to install Wireshark on the host machine. To get them, visit the Wireshark Download page.

permanent link

answered 15 Sep '11, 10:55

cmaynard's gravatar image

cmaynard ♦♦
accept rate: 20%

edited 15 Sep '11, 10:57

pcap format was originally created for tcpdump, not Wireshark, so it's older than Wireshark. There are other programs, such as tcpdump and other programs that use libpcap to read files, and recent versions of Microsoft Network Monitor, that can read pcap files.

Whether you will be allowed to have any of those other programs installed on your network is another matter.

permanent link

answered 15 Sep '11, 11:31

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

You could also try using CloudShark, but chances are if security is restricting installation of Wireshark then uploading pcap files to the web may not be allowed either.

permanent link

answered 15 Sep '11, 08:30

rickg421's gravatar image

accept rate: 0%

edited 15 Sep '11, 10:50

cmaynard's gravatar image

cmaynard ♦♦

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 15 Sep '11, 07:47

question was seen: 68,095 times

last updated: 17 Sep '11, 23:55

p​o​w​e​r​e​d by O​S​Q​A