Which Packet Capture Format is better?

Question

I am writing an application to save the captured IP packets to file. Which of the following packet capture format is better suited for use as the file format? Click on the link for more information on each.

• Snoop (rfc1761)

• PCAP

In addition, is there a C# library for any of the above format?

Answer 1

I'd go for PCAP, as most tools I usually work with support it (Wireshark, tcpdump, etc.)

WinPCAP wrapper for .NET: http://www.tamirgal.com/blog/page/SharpPcap.aspx

Answer 2

I use pcap (because it is supported by a lot of tools and libraries for every language) but do note there is another format, ncap.

Answer 3

I would also recommend pcap.

I recommend a great WinPcap wrapper to use in C# or VB.NET (.NET wrapper) called Pcap.Net: http://pcapdotnet.codeplex.com