The pcapng file format stores a ton of crazy metadata in your files. What exactly gets stored depends on what is used to create the pcapng file, but Wireshark and mergecap do reveal a bit about the computer used to create the pcap.
nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpqzh27h4thddp5lls0sykyly7t3fnxwc9u0f3fzf8lr7lcrl5wfx6snl389m (nprofile…389m) wrote a nice blog post about this a few weeks ago, including how to make regular pcap the default setting in wireshark (and Erik reached out to me to warn me about some pcaps I had shared publicly, I still need to update my git repo to remove said pcapng files...how annoying of a process it is to do this! So don't be a dummy like me, make pcap your default, and be cautious where you share pcapng files).
https://www.netresec.com/?page=Blog&month=2025-02&post=How-to-set-PCAP-as-default-save-file-format-in-Wireshark
K. Reid Wightman :verified: 🌻 /
npub106…4mqj7
2025-03-25 15:56:48
Author Public Key
npub106eat5hjz3zhehyeq6klt5vah8lssugjkjpzwsv5del6nhs0dh9sd4mqj7Published at
2025-03-25 15:56:48Event JSON
{
"id": "03bd3509b4254881ffd817caf89200ad47c351cc461c62058ac996469efd821b",
"pubkey": "7eb3d5d2f214457cdc9906adf5d19db9ff087112b4822741946e7fa9de0f6dcb",
"created_at": 1742918208,
"kind": 1,
"tags": [
[
"p",
"15d5ebd5776b434ffe0f812c4f93cb8a666760bc7a629124ff1fbf81fe8e49b5",
"wss://relay.mostr.pub"
],
[
"p",
"33e9ffffa72f2cfd55ca5fe145c4206f6ecf3997b9270e6545401a8a08257942",
"wss://relay.mostr.pub"
],
[
"proxy",
"https://infosec.exchange/users/reverseics/statuses/114223887724600081",
"activitypub"
]
],
"content": "The pcapng file format stores a ton of crazy metadata in your files. What exactly gets stored depends on what is used to create the pcapng file, but Wireshark and mergecap do reveal a bit about the computer used to create the pcap. \n\nnostr:nprofile1qy2hwumn8ghj7un9d3shjtnddaehgu3wwp6kyqpqzh27h4thddp5lls0sykyly7t3fnxwc9u0f3fzf8lr7lcrl5wfx6snl389m wrote a nice blog post about this a few weeks ago, including how to make regular pcap the default setting in wireshark (and Erik reached out to me to warn me about some pcaps I had shared publicly, I still need to update my git repo to remove said pcapng files...how annoying of a process it is to do this! So don't be a dummy like me, make pcap your default, and be cautious where you share pcapng files). \n\nhttps://www.netresec.com/?page=Blog\u0026month=2025-02\u0026post=How-to-set-PCAP-as-default-save-file-format-in-Wireshark",
"sig": "32e6e44b82214aeb42fd3b7d308afc8578d3f1a0a37f3d568ae47087ca0b2182ee1c706f40a262c9e05b46f89b727d1381c023809bf532dd370f7b6bcff9cc15"
}