5.3. Saving captured packets

5.3. Saving captured packets
Prev	Chapter 5. File Input / Output and Printing	Next

You can save captured packets simply by using the Save As... menu item from the File menu under Wireshark. You can choose which packets to save and which file format to be used.

	Saving may reduce the available information!
	Saving the captured packets will slightly reduce the amount of information, e.g. the number of dropped packets will be lost, see Section A.1, “Capture Files” for details.

5.3.1. The "Save Capture File As" dialog box

The "Save Capture File As" dialog box allows you to save the current capture to a file. Table 5.2, “The system specific "Save Capture File As" dialog box” shows some examples of this dialog box.

	The dialog appearance depends on your system!
	The appearance of this dialog depends on the system and GTK+ toolkit version used. However, the functionality remains basically the same on any particular system.

Table 5.2. The system specific "Save Capture File As" dialog box

Figure 5.4. "Save" on native Windows

Microsoft Windows

This is the common Windows file save dialog - plus some Wireshark extensions.

Specific for this dialog:

If available, the "Help" button will lead you to this section of this "User's Guide".
If you don't provide a file extension to the filename - e.g. .pcap, Wireshark will append the standard file extension for that file format.

Figure 5.5. "Save" - new GTK version

Unix/Linux: GTK version >= 2.4

This is the common Gimp/GNOME file save dialog - plus some Wireshark extensions.

Specific for this dialog:

Clicking on the + at "Browse for other folders" will allow you to browse files and folders in your file system.

Figure 5.6. "Save" - old GTK version

Unix/Linux: GTK version < 2.4

This is the file save dialog of former Gimp/GNOME versions - plus some Wireshark extensions.

With this dialog box, you can perform the following actions:

Type in the name of the file you wish to save the captured packets in, as a standard file name in your file system.
Select the directory to save the file into.
Select the range of the packets to be saved, see Section 5.8, “The Packet Range frame”
Specify the format of the saved capture file by clicking on the File type drop down box. You can choose from the types, described in Section 5.3.2, “Output File Formats”.
The selection of capture formats may be reduced!
Some capture formats may not be available, depending on the packet types captured.
File formats can be converted!
You can convert capture files from one format to another by reading in a capture file and writing it out using a different format.
Click on the Save/Ok button to accept your selected file and save to it. If Wireshark has a problem saving the captured packets to the file you specified, it will display an error dialog box. After clicking OK on that error dialog box, you can try again.
Click on the Cancel button to go back to Wireshark and not save the captured packets.

	The selection of capture formats may be reduced!
Some capture formats may not be available, depending on the packet types captured.

	File formats can be converted!
You can convert capture files from one format to another by reading in a capture file and writing it out using a different format.

5.3.2. Output File Formats

Wireshark can save the packet data in its "native" file format (libpcap) and in the file formats of some other protocol analyzers, so other tools can read the capture data.

	File formats have different time stamp accuracies!
	Saving from the currently used file format to a different format may reduce the time stamp accuracy, see the Section 7.4, “Time Stamps” for details.

The following file formats can be saved by Wireshark (with the known file extensions):

libpcap, tcpdump and various other tools using tcpdump's capture format (*.pcap,*.cap,*.dmp)
Accellent 5Views (*.5vw)
HP-UX's nettl (*.TRC0,*.TRC1)
Microsoft Network Monitor - NetMon (*.cap)
Network Associates Sniffer - DOS (*.cap,*.enc,*.trc,*fdc,*.syc)
Network Associates Sniffer - Windows (*.cap)
Network Instruments Observer version 9 (*.bfr)
Novell LANalyzer (*.tr1)
Sun snoop (*.snoop,*.cap)
Visual Networks Visual UpTime traffic (*.*)
... new file formats are added from time to time

If the above tools will be more helpful than Wireshark is a different question ;-)

	Third party protocol analyzers may require specific file extensions!
Other protocol analyzers than Wireshark may require that the file has a certain file extension in order to read the files you generate with Wireshark, e.g.: ".cap" for Network Associates Sniffer - Windows

Third party protocol analyzers may require specific file extensions!

Other protocol analyzers than Wireshark may require that the file has a certain file extension in order to read the files you generate with Wireshark, e.g.:

".cap" for Network Associates Sniffer - Windows

Prev	Up	Next
5.2. Open capture files	Home	5.4. Merging capture files