I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
To answer your question: The IDS knows different protocols so it can see what runs over them. It can also interpret pcaps. A pcap is just a fileformat. The IDS understands this fileformat and can see all these different protocols. From here it just starts reading them. If it sees a protocol it understands, it will analyse it.
It's no different in concept than with logs, just different type of fileformat.