ngconvert is a command line tool that can be used to convert capture files to the PCAPng file format. It can read the same formats as TraceWrangler, which are


  • libpcap (old Wireshark/dumpcap versions, tcpdump, etc.)
  • Sniffer DOS format (.enc)
  • Sniffer CAP format (.cap)


If no output file name is specified, or if multiple files are converted, ngconvert will use the original file name and just replace the file extension with "pcapng".



It has two main features that are unique at the moment, which are:


  • it allows the use of wildcards and is able to convert all files found in subdirectories
  • when converting Sniffer CAP files it is able to preserve multiple capture interfaces