Free online PCAP to TXT converter

A support team may need a searchable packet report for a ticket, email, script, or text-only archive, while the recipient may not have packet-analysis software. Exporting a capture to TXT produces readable text, but it does not preserve the original traffic for complete reanalysis.

What the PCAP format is

PCAP is a binary format associated with the libpcap capture library. It stores packet timestamps, captured and original lengths, a link-layer type, and captured bytes. .pcapng is a related, newer format that can also store multiple interfaces, interface names, comments, and other metadata.

Wireshark, TShark, tcpdump, dumpcap, monitoring appliances, and intrusion-detection tools can create or read these files. Network administrators, developers, support engineers, incident responders, and malware analysts use captures to troubleshoot connections, inspect protocols, investigate suspicious traffic, and reproduce application problems. A snap-length limit may leave only the beginning of each packet in the file.

What the TXT format is

TXT is a plain-text container with no required schema. A network export can contain packet summaries, timestamps, addresses, ports, protocol fields, decoded payload text, or hexadecimal bytes, depending on the tool and its options.

Plain text is searchable, editable, easy to attach, and suitable for scripts or systems that accept only text. It is not a lossless equivalent of a capture: the export may omit raw bytes, packet metadata, protocol structure, interface information, and details needed to reopen the traffic in Wireshark. A verbose or hexadecimal export can be larger than the source capture, while a selected-field report is often much smaller.

Using TShark

TShark is Wireshark's command-line analyzer and is suitable for repeatable exports. Install Wireshark or its command-line package, open a shell in the directory containing the capture, and run:

tshark -r input.pcap -n > output.txt

-r reads an existing capture and -n disables hostname and service-name resolution. Use the same command with a .pcapng filename when required. For a detailed protocol tree, run:

tshark -r input.pcap -n -V > output.txt

For a compact, script-friendly export of selected fields, run:

tshark -r input.pcap -n -T fields -E header=y -E separator=, -E quote=d -e frame.number -e frame.time -e ip.src -e ip.dst -e _ws.col.Protocol -e frame.len > output.txt

This is comma-separated data stored in a file named .txt; use a CSV-aware program if the receiving workflow expects columns. Add a display filter with -Y to export matching packets only:

tshark -r input.pcap -n -Y "http or dns" -V > output.txt

To include captured bytes as hexadecimal and ASCII output, use:

tshark -r input.pcap -n -x > output.txt

The > operator creates or overwrites the output file; use >> to append. A capture filter cannot be applied retroactively to a file; use -Y for a display filter when reading an existing capture.

Using Wireshark

1. Open the .pcap or .pcapng file in Wireshark.
2. Apply a display filter such as http, ip.addr == 192.0.2.10, or tcp.port == 443 if the report should contain selected traffic.
3. Choose File → Export Packet Dissections → As Plain Text.
4. Choose all packets or displayed packets, select the required packet-summary, protocol-detail, and packet-byte options, then save with a .txt extension.

Wireshark is useful when you need to inspect the dissection before exporting or select output options visually. Menu names and available options can vary between Wireshark versions.

Using tcpdump

For a quick summary and raw-byte view, run:

tcpdump -nn -X -r input.pcap > output.txt

-nn prevents hostname and service-name lookups, -X prints hexadecimal bytes with an ASCII view, and -r reads the existing capture. tcpdump generally provides less protocol detail than Wireshark or TShark.

Using 101convert.com

You can convert the file on 101convert.com for free without installing software. 

Quality and compatibility limits

• There is no standard PCAP-to-TXT representation. Packet summaries, verbose dissections, selected-field tables, and hexadecimal dumps contain different information.
• Output depends on the analyzer version, enabled protocol dissectors, link-layer type, packet truncation, malformed or fragmented packets, and available protocol context.
• Encrypted traffic remains encrypted unless the analyzer has the required keys and decryption settings, such as TLS key logs or IPsec secrets.
• Binary or non-printable payloads may appear as escaped data, hexadecimal values, or unreadable characters. Use hexadecimal output when captured bytes matter.
• Text encoding is not defined by TXT. Set or verify UTF-8 when non-ASCII protocol fields must work in another system; terminal and operating-system locale settings can affect output.
• A TXT export normally cannot be imported into Wireshark as a usable capture and cannot reliably recreate packet boundaries, timestamps, metadata, checksums, or raw bytes. Retain the original file for reanalysis or forensic verification.
• Apply the same access controls to the text export as to the original capture, because decoded payloads may contain sensitive information.