CAPTYPE(1)

📦
version 4.7.4 · 17 versions
, in arch rolling

💅 CAPTYPE(1) — like, the manual page, bestie ✨

okay so this is captype from section 1 of the manual (that's the "user commands" girlies, iykyk), and honestly? she's a little icon. let's get into it 🎀

✨ NAME ✨

captype — prints the types of capture files. that's it. that's her whole job. and she ATE 💅

🦋 SYNOPSIS 🦋

captype <infile> ...
captype -h|--help
captype -v|--version

🌸 DESCRIPTION 🌸

so captype is this program that opens one or more capture files and prints the capture file type of each <infile>. literally just vibes and file type detection, no cap 💖

here's the tea: captype is able to detect and read the same capture files that are supported by Wireshark. and the input files don't need a specific filename extension — bestie, the file format and an optional gzip, zstd or lz4 compression will be automatically detected. she just knows 🔥

near the beginning of the DESCRIPTION section of wireshark(1) or at https://www.wireshark.org/docs/man-pages/wireshark.html there's a detailed description of the way Wireshark handles this — and captype handles it the exact same way. same energy, different program 🫶

👑 OPTIONS 👑

  • -h|--help — print the version number and options and exit. a little "hi bestie, here's what I do" moment 💫
  • -v|--version — print the full version information and exit. the full ✨lore✨ drop.

🧚 DIAGNOSTIC OPTIONS 🧚

this is the nerdy section and honestly it's giving main character energy 💜

  • --log-level <level> — set the active log level. supported levels, in lowest to highest order, are "noisy", "debug", "info", "message", "warning", "critical", and "error". messages at each level and higher will be printed — for example, "warning" prints "warning", "critical", and "error" messages, and "noisy" prints all messages. levels are case insensitive 🌈
  • --log-fatal <level> — abort the program if any messages are logged at the specified level or higher. for example, "warning" aborts on any "warning", "critical", or "error" messages. she said "I'm not doing this today" 💀
  • --log-fatal-count <count> — the amount of fatal log messages which may pass before the program is aborted. like a little patience meter 🍓
  • --log-domains <list> — only print messages for the specified log domains, e.g. "GUI,Epan,sshdump". list of domains must be comma-separated. can be negated with "!" as the first character (inverts the match) 🙈
  • --log-debug <list> — force the specified domains to log at the "debug" level. list of domains must be comma-separated. can be negated with "!" as the first character (inverts the match) 🔍
  • --log-noisy <list> — force the specified domains to log at the "noisy" level. list of domains must be comma-separated. can be negated with "!" as the first character (inverts the match) 📣
  • --log-fatal-domains <list> — abort the program if any messages are logged for the specified log domains. list of domains must be comma-separated. no negotiation, periodt 💅
  • --log-file <path> — write log messages and stderr output to the specified file. everything goes in the group chat (the file) 🫶

🔗 SEE ALSO 🔗

pcap(3), wireshark(1), mergecap(1), editcap(1), tshark(1), dumpcap(1), capinfos(1), pcap-filter(7) or tcpdump(8)

the whole friend group honestly 💖

📝 NOTES 📝

captype is part of the Wireshark distribution. the latest version of Wireshark can be found at https://www.wireshark.org 🌐

HTML versions of the Wireshark project man pages are available at https://www.wireshark.org/docs/man-pages ✨

⭐ AUTHORS ⭐

Original Author

Ian Schorr <ian[AT]ianschorr.com>

Contributors

Gerald Combs <gerald[AT]wireshark.org> Jim Young <jyoung[AT]gsu.edu>

and that's the whole page, bestie 🎀 this version is from the Wireshark distribution, dated 2026-10-08 — so go forth, run captype, and slay your file type detection journey 💜🦋✨

📦 where this page comes from