capinfos

capinfos cap.pcap

Displays the metadata of a pcap (duration, size, packets, format) with capinfos, the technical sheet of the capture before analyzing it.

Run it when you receive a pcap: capinfos gives you the basic capture info — format (pcap/pcapng), packet count, duration, size, interfaces, and time range. It's the first step in any analysis: knowing what you're working with (what window it covers, whether it's a full capture or a fragment, how much traffic there is) determines the approach. In IR, the pcap sheet is attached to the case as evidence metadata, and the time range is cross-referenced with the incident timeline.

Don't use it for traffic analysis: capinfos gives metadata, not content — for connections and protocols, use tshark and Zeek. On truncated or corrupted captures, values (duration, counts) can be misleading: capinfos reads what the file declares. And watch out: the pcap time range is the capture's, not the incident's — a 24h pcap may cover only part of the relevant window. For evidence, the pcap hash and chain of custody are recorded separately; capinfos is the description, not the authentication.