python-pcapng

What it is and what it does

Python-pcapng is a pure-Python library for reading and writing pcap-ng packet capture files—the modern format used by Wireshark, dumpcap, and similar network analysis tools. It fills a gap where tcpdump and other tools struggle with pcap-ng files, and where few Python bindings existed for the format. The library parses binary pcap-ng data into block objects that represent packets, interfaces, and metadata, and can also generate valid pcap-ng files from scratch.

The library includes a strictness mode (FORBID, FIX, WARN, NONE) to control how strictly it validates pcap-ng structure during writing, allowing both strict compliance and deliberate generation of edge-case files for testing. It has no external runtime dependencies and runs on modern Python versions (3.5+), making it straightforward to integrate into network analysis pipelines, packet inspection tools, or test suites.

Use it for:

• Extract packet data and metadata from pcap-ng files captured by Wireshark or dumpcap for offline analysis.
• Generate synthetic pcap-ng files for testing network analysis tools or packet processing code.
• Convert or migrate packet capture data between formats or tools that require pcap-ng input.
• Build custom packet inspection or filtering tools that need to read modern packet capture formats.
• Validate pcap-ng file structure or repair marginal/broken capture files by re-writing with adjusted strictness.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses and writes pcap-ng packet capture files, the format used by modern packet sniffers like Wireshark and dumpcap.

Yes, if you need to work with pcap-ng files in Python and have no better alternative. The library is stable (Production/Stable status), has no known vulnerabilities, and installs with zero friction. However, maintenance is aging (last release 2022-08-23, no active development), so expect no new features or bug fixes—suitable for stable, read-heavy workloads but risky for projects requiring ongoing support.

Install

python-pcapng on PyPI

pip install python-pcapng

uv add python-pcapng

poetry add python-pcapng

Installing python-pcapng

Before you install

Low friction: pure Python wheel with no runtime dependencies. Maintenance is aging—last release was 2022-08-23 and the repository shows no recent activity, though it remains archived=false and the last commit is recent (2026-01-25), suggesting minimal ongoing development.

License in practice

Apache-2.0 is permissive; you can use, modify, and distribute this library freely in commercial and open-source projects, provided you include the license notice.

Quickstart

from pcapng import FileScanner

with open('/tmp/mycapture.pcap', 'rb') as fp:
    scanner = FileScanner(fp)
    for block in scanner:
        pass  # do something with the block

Verify before relying

• Performance characteristics compared to C-based alternatives or Cython ports mentioned in the description.
• Completeness of pcap-ng format support relative to the full specification.
• Whether the library handles all edge cases in real-world captures from different packet sniffers.

Package facts

Evidence: python_pcapng-2.1.1-py3-none-any.whl

Tags

More Networking packages