Convert pcap <-> pcap-ng, pcap-ng tools/libraries
I'm looking for some information about pcap-ng.
What is the difference between pcap-ng and pcap?
Is there any tool/library for pcap-ng?
How to convert pcap to pcap-ng and pcap-ng to pcap?
Answer
What is the difference between pcap-ng and pcap?
pcap is older and less capable than pcap-ng, but is simpler. Here's a description of pcap file format; here's a description of pcap-ng file format.
Is there any tool/library for pcap-ng?
Newer versions of libpcap can read some pcap-ng files (all interfaces need to have the same link-layer header type and snapshot length, as the libpcap API can supply only one link-layer header type and only one snapshot length for a file). Wireshark includes a library that can read and write a number of capture file formats, including pcap and pcap-ng, but it doesn't have a stable or well-documented API (it'll be changed quite significantly in the next Wireshark major release to better support pcap-ng and other formats).
How to convert pcap to pcap-ng and pcap-ng to pcap?
Use the "editcap" tool that comes with Wireshark. Note that not all pcap-ng files can be converted to pcap files - only the files that could be read by libpcap can be converted (and those can also be converted from pcap-ng to pcap by tcpdump, if tcpdump is using a newer version of libpcap capable of reading pcap-ng files).