In more detail
A capture records each Packet with a timestamp, letting analysts replay a conversation, see which hosts talked and extract files or credentials sent in clear text. The newer PCAPNG format adds extra metadata. Encrypted traffic (TLS) shows only addresses, sizes and timing, not content. A classic PCAP file is a 24-byte global header followed by records, each with a 16-byte header (timestamp, captured length, original length) and then the packet bytes. A snapshot length (snaplen) can cut each packet short to save space, so check that the capture is not truncated.
Why it matters
A capture is a record of what really crossed the wire, which makes it strong evidence in an incident, a performance problem or a protocol bug. It is also sensitive: it can hold passwords, session cookies and private messages, so store and share captures like any other confidential data. Keep the original file untouched and work on copies, and note where the capture was taken, since a capture on one side of a firewall or NAT does not show what happened on the other.
Example
Capture and then read back only the traffic of one host:
tcpdump -i eth0 -w capture.pcap
tcpdump -nr capture.pcap 'host 203.0.113.5'
The first bytes identify the format. A classic little-endian, microsecond-resolution file starts d4 c3 b2 a1, then version 2.4 (02 00 04 00); the same file written big-endian starts a1 b2 c3 d4. A PCAPNG file starts 0a 0d 0d 0a. Open a capture in the PCAP Forensics to list conversations, DNS lookups and transferred files.
Common confusion
PCAP is the capture file, not the capture program. tcpdump and Wireshark are tools that write and read it, and spotting a suspicious address in one can feed an Indicator of compromise (IOC).