What is PCAP-NG and why might you choose it?

• A. It is a deprecated format with less metadata
• B. It stores only DNS records
• C. PCAP-NG is the modern capture file format with richer metadata; choose it for better context and compatibility
• D. It compresses data by default

Answer: (C)

PCAP-NG is the Next Generation PCAP format, the modern file structure used for network captures. It’s designed to replace the older PCAP by adding a structured layout that carries much more context along with the packet data.

Choosing it gives you richer metadata and better compatibility with current analysis tools. You get per‑packet details like high‑resolution timestamps, interface descriptions, comments or annotations, and capture options. It also supports storing multiple interfaces and different link-layer types in a single file, which is useful for complex captures and sharing data across tools. This added context makes analysis easier and more reliable across modern workflows. It isn’t a deprecated format, it doesn’t store only DNS records, and it doesn’t compress data by default.