---
id: python-pcapng
version: "2.1.1"
license: Apache-2.0
license_treatment: permissive
maintenance: aging
---

# python-pcapng — Library to read/write the pcap-ng format used by various packet sniffers.

License: permissive · Maintenance: aging · Downloads: 483.5K/mo

## What it is and what it does

Python-pcapng is a pure-Python library for reading and writing pcap-ng packet capture files—the modern format used by Wireshark, dumpcap, and similar network analysis tools. It fills a gap where tcpdump and other tools struggle with pcap-ng files, and where few Python bindings existed for the format. The library parses binary pcap-ng data into block objects that represent packets, interfaces, and metadata, and can also generate valid pcap-ng files from scratch.

The library includes a strictness mode (FORBID, FIX, WARN, NONE) to control how strictly it validates pcap-ng structure during writing, allowing both strict compliance and deliberate generation of edge-case files for testing. It has no external runtime dependencies and runs on modern Python versions (3.5+), making it straightforward to integrate into network analysis pipelines, packet inspection tools, or test suites.

Use it for:

- Extract packet data and metadata from pcap-ng files captured by Wireshark or dumpcap for offline analysis.
- Generate synthetic pcap-ng files for testing network analysis tools or packet processing code.
- Convert or migrate packet capture data between formats or tools that require pcap-ng input.
- Build custom packet inspection or filtering tools that need to read modern packet capture formats.
- Validate pcap-ng file structure or repair marginal/broken capture files by re-writing with adjusted strictness.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses and writes pcap-ng packet capture files, the format used by modern packet sniffers like Wireshark and dumpcap.

Yes, if you need to work with pcap-ng files in Python and have no better alternative. The library is stable (Production/Stable status), has no known vulnerabilities, and installs with zero friction. However, maintenance is aging (last release 2022-08-23, no active development), so expect no new features or bug fixes—suitable for stable, read-heavy workloads but risky for projects requiring ongoing support.

## Install

pip install python-pcapng
uv add python-pcapng
poetry add python-pcapng

## Installing python-pcapng

Before you install: Low friction: pure Python wheel with no runtime dependencies. Maintenance is aging—last release was 2022-08-23 and the repository shows no recent activity, though it remains archived=false and the last commit is recent (2026-01-25), suggesting minimal ongoing development.

License in practice: Apache-2.0 is permissive; you can use, modify, and distribute this library freely in commercial and open-source projects, provided you include the license notice.

Quickstart:

from pcapng import FileScanner

with open('/tmp/mycapture.pcap', 'rb') as fp:
    scanner = FileScanner(fp)
    for block in scanner:
        pass  # do something with the block

Verify before relying:

- Performance characteristics compared to C-based alternatives or Cython ports mentioned in the description.
- Completeness of pcap-ng format support relative to the full specification.
- Whether the library handles all edge cases in real-world captures from different packet sniffers.

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 483.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

pcap-ng file parser, packet capture format reader, wireshark pcapng library, network packet file parsing, pcapng write support, dumpcap file handling, packet sniffer output parser, packet-capture, network-analysis, file-format

[View on SkillFed](https://skillfed.io/packages/python-pcapng) · [View on PyPI](https://pypi.org/project/python-pcapng/)