5.3.áSaving captured packets

You can save captured packets simply by using the Save As... menu item from the File menu under Wireshark. You can choose which packets to save and which file format to be used.

	Saving may reduce the available information!
	Saving the captured packets will slightly reduce the amount of information, e.g. the number of dropped packets will be lost, see SectionáA.1, “Capture Files” for details.

5.3.1.áThe "Save Capture File As" dialog box

The "Save Capture File As" dialog box allows you to save the current capture to a file. Tableá5.2, “The system specific "Save Capture File As" dialog box” shows some examples of this dialog box.

	The dialog appearance depends on your system!
	The appearance of this dialog depends on the system and GTK+ toolkit version used. However, the functionality remains basically the same on either system.

Tableá5.2.áThe system specific "Save Capture File As" dialog box

Figureá5.4.á"Save" on native Windows

Microsoft Windows (GTK2 installed)

This is the common Windows file save dialog - plus some Wireshark extensions.

Specific for this dialog:

If available, the "Help" button will lead you to this section of this "User's Guide".
If you don't provide a file extension to the filename - e.g. .pcap, Wireshark will append the standard file extension for that file format.

Figureá5.5.á"Save" - new GTK version

Unix/Linux: GTK version >= 2.4

This is the common Gimp/GNOME file save dialog - plus some Wireshark extensions.

Specific for this dialog:

Clicking on the + at "Browse for other folders" will allow you to browse files and folders in your file system.

Figureá5.6.á"Save" - old GTK version

Unix/Linux: GTK version < 2.4 / Microsoft Windows (GTK1 installed)

This is the file save dialog of former Gimp/GNOME versions - plus some Wireshark extensions.

With this dialog box, you can perform the following actions:

Type in the name of the file you wish to save the captured packets in, as a standard file name in your file system.
Select the directory to save the file into.
Select the range of the packets to be saved, see Sectioná5.8, “The Packet Range frame”
Specify the format of the saved capture file by clicking on the File type drop down box. You can choose from the types, described in Sectioná5.3.2, “Output File Formats”.
The selection of capture formats may be reduced!
Some capture formats may not be available, depending on the packet types captured.
File formats can be converted!
You can convert capture files from one format to another by reading in a capture file and writing it out using a different format.
Click on the Save/Ok button to accept your selected file and save to it. If Wireshark has a problem saving the captured packets to the file you specified, it will display an error dialog box. After clicking OK on that error dialog box, you can try again.
Click on the Cancel button to go back to Wireshark and not save the captured packets.

	The selection of capture formats may be reduced!
Some capture formats may not be available, depending on the packet types captured.

	File formats can be converted!
You can convert capture files from one format to another by reading in a capture file and writing it out using a different format.

5.3.2.áOutput File Formats

Wireshark can save the packet data in it's "native" file format (libpcap) and in the file formats of some other protocol analyzers, so other tools can read the capture data.

	File formats have different time stamp accuracies!
	Saving from the currently used to a different file format may reduce the time stamp accuracy, see the Sectioná7.3, “Time Stamps” for details.

The following file formats can be saved by Wireshark (with the known file extensions):

libpcap, tcpdump and various other tools using tcpdump's capture format (*.pcap,*.cap,*.dmp)
Accellent 5Views (*.5vw)
HP-UX's nettl (*.TRC0,*.TRC1)
Microsoft Network Monitor - NetMon (*.cap)
Network Associates Sniffer - DOS (*.cap,*.enc,*.trc,*fdc,*.syc)
Network Associates Sniffer - Windows (*.cap)
Network Instruments Observer version 9 (*.bfr)
Novell LANalyzer (*.tr1)
Sun snoop (*.snoop,*.cap)
Visual Networks Visual UpTime traffic (*.*)

If the above tools will be more helpful than Wireshark is a different question ;-)

	Third party protocol analyzers may require specific file extensions!
Other protocol analyzers than Wireshark may require that the file has a certain file extension in order to read the files you generate with Wireshark, e.g.: ".cap" for Network Associates Sniffer - Windows

Third party protocol analyzers may require specific file extensions!

Other protocol analyzers than Wireshark may require that the file has a certain file extension in order to read the files you generate with Wireshark, e.g.:

".cap" for Network Associates Sniffer - Windows