Which file format is considered modern and provides richer metadata for captures?

• A. PCAP
• B. PCAP-NG
• C. PCAP-Classic
• D. PCAP-Plus

Answer: (B)

PCAP-NG is the modern format designed to carry richer metadata about captures. Its block-based structure lets you store not only the packet data but also extensive context: multiple interfaces, per-packet options, descriptive metadata, and comments. This means you can capture details such as which interface a packet came from, higher-resolution timestamps, and various optional fields that help with analysis and troubleshooting, all within a single file. The classic PCAP format focuses on basic packet data and simple timestamps, offering far less room for per-packet or per-capture metadata. The other options aren’t standard modern formats for rich capture metadata. PCAP-NG’s design makes it the best choice for capturing and analyzing with tools like Wireshark.